PaperlayerView exact revision on arXiv

Source-linked AI summary

SAC-Copula: Quality-Preserving Watermarking for Diffusion Language Models via Smooth Correlated Gumbel Fields

Baixin Li, Haiyun He

arXiv:2608.20839v1cs.CLcs.CRcs.LG

TL;DR

Diffusion language models revise multiple token positions in parallel, unlike sequential watermarking designs. SAC-Copula uses smooth, locally correlated Gumbel fields and a SAC-aware detector; against matched i.i.d. Gumbel, its P99 fell from 4256.634 to 99.653 while retaining strong low-FPR detectability.

  • Problem

    Watermarking helps distinguish model-generated from human text, but prefix-synchronized sequential schemes do not match DLMs’ parallel updates and token revisions.

    Source: §1 · p. 1

  • Method

    SAC-Copula watermarks DLMs with smooth, locally correlated Gumbel perturbations constructed via a Gaussian copula, paired with a SAC-aware detector that aggregates low-lag evidence.

    Source: §1.1 · p. 3, §1.2 · p. 3, §2.3 · p. 4

  • Results

    Against matched i.i.d. Gumbel, P99 fell from 4256.634 to 99.653, while SAC-Copula retained strong low-FPR detectability and a competitive broader quality profile.

    Source: §4.2 · p. 7, §5 · p. 8

  • Takeaways & Limitations

    Reported benefits also generalize across Dream-7B/ELI5 and LLaDA/C4-en, spanning another DLM backbone and task/source setting.

    Source: §4.3 · p. 8

    Deployment requires private-tape access and representative calibration data, and LLaDA–ELI5 remains the primary evaluation setting.

    Source: §5 · p. 8

Abstract

from arXiv · show

Watermarking diffusion language models (DLMs) requires mechanisms compatible with iterative parallel unmasking rather than autoregressive decoding. Existing sampling-based watermarking methods typically inject position-wise i.i.d. perturbations, which can be poorly aligned with DLM decoding dynamics and degrade generation quality. We propose SAC-Copula, a quality-preserving watermarking method for DLMs based on smooth, locally correlated Gumbel perturbation fields constructed via a Gaussian copula. We further develop a SAC-aware detector using covariance-aware filtering and native-sample calibration. Mechanism-level analysis shows that local correlation reduces latent perturbation roughness and better matches iterative refinement dynamics. Experiments on LLaDA show that SAC-Copula achieves a favorable quality-detectability trade-off compared with existing baselines. In particular, further evaluations on Dream-7B and additional datasets show that SAC-Copula substantially improves PPL tail stability over the i.i.d. Gumbel baseline, while maintaining strong low-FPR detectability and competitive overall generation quality. Additional token-edit stress tests further assess watermark robustness under controlled synchronization drift.

1 Introduction

SAC-Copula adapts sampling-based watermarking to diffusion language models by replacing independent perturbations with locally correlated Gumbel fields, aiming to better fit iterative refinement while preserving Gumbel marginals. The paper analyzes the mechanism, develops a detector, and reports quality–detectability results on LLaDA.

1 Introduction

  • Watermarking embeds a private statistical signal during generation so a detector with the shared secret key can distinguish model-generated text from human-created text.Existing language-model watermarking methods largely target autoregressive decoding, unlike DLMs’ iterative masked denoising.Source: §1 · p. 1

1.1 Related Works

  • Unlike sequence-position-indexed i.i.d. Gumbel watermarking [Bagchi et al., 2026], SAC-Copula designs structured perturbation fields to better match DLM refinement and local consistency.DLMs iteratively update multiple masked positions in parallel, so independent neighboring perturbations can disrupt local refinement consistency and generation quality.Source: §1 · p. 1, Figure 1 · p. 1, §1.1 · p. 2

1.2 Main Contributions

  • SAC-Copula uses a Gaussian copula to create smooth, auto-correlated Gumbel perturbations that preserve one-coordinate Gumbel marginals under mild assumptions.The method treats the joint geometry of the perturbation field as a key design dimension for DLM decoding.Source: §1.2 · p. 3, §1.1 · p. 3
  • Positive low-lag dependence reduces latent perturbation roughness, lowering local-difference energy from 2 to 2(1 −ρ2r1).This mechanism-level analysis motivates compatibility with DLM refinement.Source: §1.2 · p. 3
  • The SAC-aware detector uses covariance-aware filtering and native-sample calibration; a global-offset scan supports coarse synchronization recovery in controlled edit diagnostics.The offset scan addresses token–signal misalignment.Source: §1.2 · p. 3
  • On LLaDA, SAC-Copula achieves strong clean detectability and a balanced quality profile, with substantially improved upper-tail stability over the matched i.i.d. Gumbel baseline.Mild token-edit stress tests diagnose residual watermark evidence.Source: §1.2 · p. 3

2 Watermark Injection and Detection

SAC-Copula replaces position-wise independent perturbations with a smooth, locally correlated Gumbel field for diffusion decoding, then uses a detector designed to read its structured evidence. The method preserves single-position sampling marginals while accounting for local evidence geometry and possible alignment drift.

2.1 SAC-Copula Perturbation Field

  • A Gaussian copula maps a mixed, locally correlated Gaussian field into Gumbel perturbations while preserving standard one-coordinate marginals and fixed-context, single-position sampling marginals.The field mixes key-seeded white Gaussian noise with a normalized spatial stream controlled by ρ; this does not imply invariance of the full generated-text joint distribution.Source: §2.1 · pp. 3–4

2.2 Injection into LLaDA Decoding

  • The keyed perturbation tape is added only to masked generated-position logits, reused across denoising steps, and kept independent of model logits.Prompt tokens are not perturbed, and remasking confidence uses unperturbed logits.Source: §2.2 · p. 4

2.3 SAC-Aware Detector

  • FFR replaces an i.i.d. equal-weight readout with native-sample-centered evidence, SAC-aware local filtering, and ridge-regularized covariance calibration.Its lag template aggregates low-lag evidence structure induced by the correlated field.Source: §2.3 · p. 4
  • FFR scores sequences along a development-estimated filtered mean direction and can flag them using a threshold calibrated on held-out native samples.Detection reconstructs the private keyed tape without another language-model forward pass.Source: §2.3 · pp. 4–5
  • GO-FFR extends FFR for controlled insertions and deletions by scanning global offsets to partially recover token-signal alignment, with native-sample threshold calibration.It reuses the FFR scoring direction and calibrates under the same offset-scan rule.Source: §2.3 · p. 5

3 Why Correlated Perturbations Help DLMs

DLM refinement revises neighboring token decisions together, making the perturbation field’s local geometry relevant. SAC-Copula introduces positive low-lag dependence to reduce latent roughness while retaining standard Gumbel marginals, motivating a quality-stability hypothesis.

3.1 DLM Decoding Couples Neighboring Decisions

  • LLaDA-style decoding predicts multiple masked positions in parallel, retains or remasks tokens by confidence, and revises sequences over denoising steps (Ghazvininejad et al., 2019).Related masked-diffusion and non-Markovian discrete-diffusion work also emphasizes iterative denoising and refinement-sensitive dynamics (Zhang et al., 2025).Source: §3.1 · p. 5
  • Independent Gumbel perturbations may create inconsistent neighboring preferences during joint refinement, while smoother correlated perturbations make nearby preferences more coherent.This proposed alignment with iterative masked refinement motivates the quality-stability hypothesis evaluated in Section 4.Source: §3.1 · p. 5, §3.3 · p. 6

3.2 Independent Latent Fields Create Local Roughness

  • The lag-one local-difference proxy measures adjacent latent variation; the i.i.d. Gaussian field has unit variance and zero adjacent covariance, whereas SAC-Copula induces low-lag dependence.A larger proxy value indicates sharper adjacent changes; the proxy concerns latent dependence before the nonlinear copula transform.Source: §3.2 · p. 5, §3.3 · p. 6

3.3 SAC-Copula Reduces Local Perturbation Variation

  • SAC-Copula changes the field’s joint structure, not its one-coordinate marginal: each coordinate retains a standard Gumbel marginal under the stated assumptions.Positive low-lag dependence reduces abrupt changes across positions, rather than reducing the single-coordinate probability of large Gumbel values.Source: §3.3 · p. 6
  • Figure 3 shows SAC-Copula’s positive low-lag dependence and reduced latent roughness, motivating the hypothesis that smoother fields improve quality stability while preserving detectability.The paper presents these as a mechanism and empirical prediction, not as proof of invariance in the full generated-text distribution.Source: §3.3 · p. 6

4 Experiments

Experiments find that SAC-Copula reduces severe PPL-tail failures versus matched i.i.d. Gumbel while retaining strong low-FPR detectability and competitive overall quality. Additional evaluations test transfer, correlation strength, detector calibration, and controlled token edits.

4.1 Experimental Setup

  • The primary benchmark compares LLaDA-8B-Instruct on ELI5 with native decoding, i.i.d. Gumbel, adapted KGW and Unigram, and PatternMark across δ ∈ {1, 2, 3}.SAC-Copula generally uses W = 39, σK = 15.0, and ρ = 0.6; evaluated outcomes include text-quality metrics and AUC and TPR at nominal 1%/5% FPR.Source: §4.1 · pp. 6–7
  • With W = 39, σK = 15, and α = 1, FFR AUC/TPR@1%FPR rises from 0.9683/0.820 at ρ = 0 to 0.9900/0.980 at ρ = 0.6, then falls to 0.9631/0.830 at ρ = 1.P99 decreases from 4256.63 to 99.65 and 27.55, respectively, but ρ = 1 worsens semantic, repetition, and diversity metrics relative to 0.6; ρ = 0.6 is the balanced interior point.Source: §4.1 · p. 7, Figure 4 · p. 7

4.2 Text Quality and Stability

  • P99 falls from 4256.634 to 99.653 and PPL>100 from 3.5% (7/200) to 1.0% (2/200) versus matched i.i.d. Gumbel, while median PPL remains close (8.446 vs. 8.260).The reported improvement is concentrated in severe upper-tail failures, not uniform per-prompt gains; SAC also retains strong low-FPR detectability and a competitive broader quality profile.Source: §4.2 · p. 7, Figure 5 · p. 7, Table 1 · p. 8

4.3 Clean Detection

  • Under legacy readout, i.i.d. versus SAC AUC/TPR@5%FPR is 0.966/0.855 versus 0.987/0.950; FFR raises SAC TPR@1%FPR/TPR@5%FPR to 0.980/0.985.The SAC signal difference is visible with the common legacy readout, while FFR adds a covariance-aware readout gain.Source: §4.3 · p. 7
  • With model-native H0, AUC/TPR@1%FPR/TPR@5%FPR rises from 0.9867/0.9078/0.9667 at N = 100 to 0.9900/0.980/0.985 at N = 500, with N = 200 intermediate.At N = 500, human-answer, C4, and Wikipedia H0 yield AUC 0.9861–0.9878 and TPR@1%FPR 0.950–0.955; added calibration benefits the strict 1% point most.Source: §4.3 · p. 7
  • Frozen LLaDA–ELI5 model-native-H0 thresholds applied without C4 refitting to 2,000 held-out non-watermarked C4 realnewslike records yield 0.95%/5.50% realized FPR at nominal 1%/5%.This is detector-only threshold transfer, not C4 generation.Source: §4.3 · p. 7
  • On Dream-7B/ELI5, SAC-Copula maintains near-perfect detection while reducing P99 and Composite-collapse; on LLaDA/C4-en, it improves detection and reduces P99 and PPL-tail failures.On LLaDA/C4-en, median PPL is nearly unchanged (13.71 vs. 13.73).Source: §4.3 · p. 8, Table 2 · p. 8

4.4 Residual Evidence under Controlled Token Edits

  • At 20% edits, GO-FFR raises TPR@1%FPR from 0.150 to 0.460 under deletion and 0.195 to 0.505 under insertion; substitution yields 0.890 for SAC+FFR versus 0.755 for i.i.d.+Old.These results show partial coarse synchronization under deletion and insertion, where low-FPR detection remains degraded; cumulative token–tape drift is unresolved, and semantic/document paraphrasing is outside scope.Source: §4.4 · p. 8

5 Discussion and Limitations … A.2 Marginal Gaussian and Gumbel Exactness

SAC-Copula’s discussion emphasizes improved upper-tail stability against matched i.i.d. Gumbel while qualifying that latent-field analysis does not establish output-text invariance or downstream quality. The appendix’s marginal exactness claims are limited to specified valid positions and ideal transforms.

5 Discussion and Limitations

  • Against matched i.i.d. Gumbel, SAC-Copula’s clearest quality gain is improved upper-tail stability with a competitive broader profile.The latent-field analysis provides a mechanism-level rationale, not proof of invariance of the complete generated-text distribution or downstream text quality.Source: §5 · p. 8
  • FFR uses covariance-matched readout, while GO-FFR adds coarse offset recovery; cumulative drift degrades low-FPR detection, and paraphrasing breaks fixed-tape readout (Krishna et al., 2023; Hou et al., 2024).GO-FFR partially recovers coarse insertion/deletion offsets under edit stress, but cumulative local drift remains unresolved.Source: §5 · p. 8
  • Detection depends on calibrated H0 samples and development data; evaluations extend from primary LLaDA–ELI5 to Dream-7B–ELI5 and LLaDA–C4-en, with an interior sweep region around ρ = 0.6.Size/source controls and a frozen-threshold C4 test quantify calibration sensitivity and threshold transfer; deployment requires private-tape access and representative calibration data.Source: §5 · p. 8
  • Broader security work examines strong-watermark impossibility and watermark stealing (Zhang et al., 2024; Jovanovi´c et al., 2024), while proposed extensions include wider architecture coverage, systematic W/σK studies, runtime, and deployment robustness (Zhao et al., 2025).The paper identifies broader architectural coverage, more systematic W/σK studies, runtime characterization, and deployment-oriented robustness evaluation as natural extensions.Source: §5 · p. 8

A Watermark Properties

A.1 Boundary Convention

  • With zero padding and global full-window energy normalization, exact unit variance holds at full-window interior positions, while boundary positions may have lower variance.Strict marginal claims use the full-window or boundary-normalized convention; zero-padding boundary deviations are treated as implementation checks.Source: §A.1 · p. 10

A.2 Marginal Gaussian and Gumbel Exactness

  • At valid coordinates, the combined field is N(0, 1), and the ideal probability-integral transform followed by the inverse standard Gumbel CDF yields Gumbel(0, 1).Numerical evaluation clamps U to avoid floating-point extremes, so exact unbounded Gumbel claims refer to the ideal transform.Source: §A.2 · pp. 10–11

A.3 Finite-Window Latent Autocorrelation … B.5 Global Offset Extension

The appendices characterize SAC’s finite-window latent correlations and clarify how the detector filters and calibrates correlated evidence. They also specify diagnostic checks and a global-offset scan for coarse synchronization recovery, with limits on what that scan covers.

A.3 Finite-Window Latent Autocorrelation

  • The final latent field has symmetric autocorrelation, r0 = 1, and zero autocorrelation for |τ| > W −1; the detector uses this structure to motivate Hω, while estimating detector covariance from Native evidence.The lag-one local-difference proxy follows from the finite-window autocorrelation and preserved one-coordinate latent variance.Source: §A.3 · p. 11

A.4 Latent Tape KL Proxy

  • The latent-tape KL proxy is not semantic or output-text KL, and its leading term is O(ρ^4) because marginal variances are preserved and the trace term cancels.This is an explanatory approximation from a log-determinant expansion around identity covariance.Source: §A.4 · p. 11

A.5 Implementation Checks

  • Implementation checks cover marginal Gaussian and Gumbel QQ plots, theoretical versus empirical autocorrelation, low-frequency noise energy, effective sample size, and boundary variance; they validate the noise tape, not generated-text invariance.The appendix defines a low-frequency energy fraction for diagnostic sequences.Source: §A.5 · p. 11

B.1 From i.i.d. Evidence to Covariance-Aware Calibration

  • Covariance-aware calibration corrects the larger null variance and reduced effective sample size caused by positive local dependence, but rescaling alone cannot help when the watermark shift is misaligned with the equal-weight direction.Within a fixed detector group and calibration setting, positive rescaling preserves ROC ordering and AUC.Source: §B.1 · p. 12

B.2 Why Filtering is Needed for SAC-Copula Evidence

  • The SAC-motivated filter Hω uses an autocorrelation-envelope weighting with boundary renormalization; FFR applies it as a detector-side transform, not as generation noise.Raw evidence is centered before filtering, and Native observed-evidence covariance is projected into filtered space for whitening.Source: §B.2 · p. 12
  • FFR combines a SAC-motivated filtered feature map with whitening by Native H0 observed-evidence covariance, rather than using the latent tape covariance as the detector’s null covariance.The detector rationale is to match the evidence geometry induced by SAC-Copula while accounting for correlations in Native text and decoding.Source: §B.2 · p. 12

B.3 Ridge-Regularized Matched Direction

  • FFR uses a ridge-regularized plug-in matched direction under a shared-covariance Gaussian mean-shift surrogate; its direction must be estimated without evaluation leakage.The stated optimality applies only to the linear detector class under that surrogate.Source: §B.3 · p. 13

B.4 Relation to the Original Detector

  • When evidence is i.i.d., FFR’s direction is proportional to 1 and its score becomes the original equal-weight Gumbel evidence sum.FFR is therefore a covariance-aware, direction-aware, SAC-aware generalization of the original detector.Source: §B.4 · p. 13

B.6 Scope and Limitations

The section describes detector adaptations and calibration for correlated SAC-Copula evidence, while identifying semantic rewriting and cumulative edit-path drift as outside the analyzed scope.

B.6 Scope and Limitations

  • FFR scores correlated SAC-Copula evidence, while GO-FFR adds coarse synchronization recovery for mild insertion/deletion.Low-FPR evaluation uses detector-specific Native H0 calibration, and b∆u is estimated without evaluation leakage.Source: §B.6 · p. 13
  • Semantic rewriting and cumulative edit-path drift remain outside the global-offset family analyzed here.Source: §B.6 · p. 13

C Additional Experiment Evidence · C.1 Clean Quality and Detection Details

The appendix identifies frozen clean-sweep summaries as support for the clean quality and detection claims, while treating attack summaries as separate evidence. C.1 documents the clean-sweep metrics and visualizations without adding experimental claims beyond the main-text trade-off.

C Additional Experiment Evidence

  • Clean quality and detection claims rely on frozen clean multi-baseline sweep summaries, not attack-summary evidence.The attack sources are summary-only artifacts derived from token-level edit outputs and semantic/paraphrase attack summaries.Source: C Additional Experiment Evidence · p. 13
  • Attack-detail and failure-analysis sections use no per-sample generated text, exact noise tapes, or full detector-score files.Their attack sources consist of summary-only artifacts derived from token-level edit outputs and semantic/paraphrase attack summaries.Source: C Additional Experiment Evidence · p. 13

C.1 Clean Quality and Detection Details

  • C.1’s frozen clean-text sweep tables support the main-text trade-off and its quality-score and visualization components, but add no experimental claims.Table 4 defines metric directions; Tables 7–8 give raw quality metrics; Tables 9–10 document radar normalization; Figures 6–7 show compact clean quality–detection and detection views.Source: §C.1 · p. 14

C.2 Full Experimental Configuration … C.7 Controlled Token-Level Edit Details

The appendix documents clean-evaluation configurations and trade-offs, SAC operating-point selection, detector readouts, and controlled token-edit diagnostics. It treats the edit tests as residual-evidence diagnostics, not evidence of broad robustness.

C.2 Full Experimental Configuration

  • The appendix records clean-evaluation implementation choices, including KGW context-greenlist, Unigram static-greenlist, and PatternMark ReferenceLite baselines and their detector configurations.Tables 5 and 6 collect generation, watermark, baseline, detector, calibration, and evaluator settings from scripts and run metadata.Source: §C.2 · p. 14, Table 5 · p. 15, Table 6 · p. 16

C.3 Unigram Strength Trade-off

  • Stronger Unigram settings improve clean detectability but also change semantic, distributional, token-drift, repetition, and diversity measures, making Unigram a trade-off baseline.Figure 8 presents the strength sweep as a contrast to SAC-Copula’s clean quality and detection profile.Source: §C.3 · p. 15, Figure 8 · p. 19

C.4 Traceable Clean-Generation Example

  • Table 11 provides one traceable clean-generation example to illustrate automatic quality metrics, but it is not primary evidence for a general qualitative claim.The example is drawn from the frozen generated-text artifact.Source: §C.4 · p. 15, Table 11 · p. 19

C.5 SAC Parameter Sensitivity

  • The selected SAC setting, W = 39, σK = 15.0, ρ = 0.6, balances strong low-FPR detection with favorable MAUVE, repetition/diversity, and token-drift behavior.Alternatives at W = 35, ρ = 0.7 can improve some fluency or collapse indicators but shift other quality and detection dimensions; the parameter table should be read through raw metrics, not its unavailable composite Quality score.Source: §C.5 · p. 16, Figure 9 · p. 19, Table 12 · p. 20

C.6 Detector Comparison for SAC Evidence

  • The clean detector comparison separates generation-side evidence from readout effects: the old detector is the i.i.d. equal-weight readout, while FFR filters SAC’s local low-lag evidence.GO-FFR matches or closely tracks FFR under intact fixed alignment, where offset recovery is unnecessary.Source: §C.6 · p. 16, Table 13 · p. 20

C.7 Controlled Token-Level Edit Details

  • Across selected deletion, insertion, and substitution settings, SAC-aware detection retains partial residual evidence, while GO-FFR offers coarse realignment but does not establish broad edit robustness.Low-FPR TPR remains harder than AUC, particularly under accumulated deletion or insertion drift; substitution corrupts token identities without shifting subsequent positions.Source: §C.7 · pp. 16–17, Figure 10 · p. 20, Figure 11 · p. 21

C.8 Failure Analysis under Edit Drift · C.9 Tail Stability and Correlation-Strength Controls

Under token edits, coarse synchronization recovery leaves cumulative local drift unresolved, while semantic rewriting degrades detection. The correlation sweep identifies ρ = 0.6 as a balanced interior operating point, not a universal optimum.

C.8 Failure Analysis under Edit Drift

  • At 50% deletion/insertion, GO-FFR partially recovers coarse shifts, but cumulative local drift leaves edit-path alignment unresolved.Deletion and insertion accumulate synchronization drift.Source: Table 15 · p. 22
  • Semantic rewriting degrades detection, while offset-style diagnostics provide only partial recovery.The frozen semantic/paraphrase summaries also cover valid-only filtering, realized TER bins, relative gains, and detector-only comparisons.Source: Table 15 · p. 22

C.9 Tail Stability and Correlation-Strength Controls

  • The tail analysis re-evaluates 200 frozen LLaDA-8B-Instruct ELI5 outputs for SAC W = 39, σK = 15, ρ = 0.6, paired by Prompt_ID and Gen_Len.Conditional PPL uses Meta-Llama-3.1-8B-Instruct, collapse is Conditional_PPL > 100, and confidence intervals use 10,000 paired bootstrap resamples with seed 20260712.Source: §C.9 · p. 22
  • The canonical 8B sweep varies ρ across six values with prompts, seeds, decoding, and remasking fixed; ρ = 0 is the matched i.i.d. endpoint.This is a fixed-parameter sweep, not matched-detectability or watermark-strength optimization.Source: §C.9 · p. 22
  • Tables 17–18 report conditional-PPL summaries and paired collapse transitions for SAC relative to matched i.i.d. Gumbel.Q95 is the mean after trimming the highest 5%, and the collapse-rate difference is SAC minus i.i.d.Source: Table 17 · p. 22, Table 18 · p. 22
  • Detection improves toward moderate correlation then declines; ρ = 0.6 is a balanced interior point, not a universal optimum or causal theorem.At ρ = 0.6, Rep3 ≈.414 and Distinct3 ≈.586; at ρ = 1, Rep3 ≈.528 and Distinct3 ≈.472.Source: Table 19 · p. 22, §C.9 · pp. 22–23, Table 20 · p. 22

C.10 Calibration and Threshold-Transfer Controls

The controls show that strong ROC separation does not ensure portable low-FPR operating thresholds: Wikipedia H0 thresholds produced substantially elevated realized FPRs on ELI5 Native. Rebuilding H0 on C4 did not improve false-positive control in the evaluated sample, while the calibration-size and source controls assess sensitivity under fixed evaluation identities.

Calibration-size sensitivity

  • Calibration-size controls compare ROC discrimination and operational-threshold behavior at H0 calibration sizes 50, 100, 200, and 500; strong ROC discrimination need not imply insensitivity of fixed low-FPR thresholds.Repeated subsamples were used 20/20/20/1 times, respectively; development and evaluation identities were fixed, and evaluation examples were excluded from calibration.Source: Table 22 · p. 23, Table 21 · p. 23, §C.10 · p. 23

Calibration-source controls

  • The four-source H0 control holds N = 500, development identities, and 200 Native negatives plus 200 SAC positives fixed while changing only the H0 source.The table quantifies source sensitivity, with no pre-specified formal equivalence margin.Source: §C.10 · p. 23, Table 23 · p. 23

Threshold portability and prompt shift

  • At nominal 1% and 5%, Wikipedia H0 thresholds on ELI5 Native yielded realized FPRs of 6.5% (13/200) and 21.0% (42/200), despite TPRs of 97.5% and 98.5%.The passage concludes that strong ROC separation is not equivalent to threshold portability.Source: §C.10 · p. 23
  • The same-model prompt-shift control tests A→B content changes, B→C prompt-template changes with questions and seeds fixed, and their combined A→C shift, not general prompt invariance.The passage introduces the use of Wikipedia H0 thresholds on ELI5 Native evaluation; the reported realized FPRs are given in the first point.Source: Table 25 · p. 23, §C.10 · p. 23

Frozen-threshold C4 realnewslike FPR

  • The frozen-threshold C4 test applies original LLaDA–ELI5 model-native-H0 thresholds to 2,000 held-out non-watermarked C4 realnewslike records without refitting H0.This is detector-only transfer, not C4 watermark generation, and is distinct from the C4-en continuation experiments.Source: §C.10 · p. 23, Table 26 · p. 23
  • Rebuilding H0 on C4 realnewslike gave realized FPRs of 2.95% (95% CI [2.25%, 3.79%]) and 7.55% (95% CI [6.43%, 8.80%]) at nominal 1% and 5%, without improved control in this sample.This result does not establish that target-domain recalibration is generally harmful; frozen-threshold FPR and ROC-selected detection address different operational questions.Source: §C.10 · p. 23

C.11 Targeted Backbone and Task Transfer

Targeted evaluations provide evidence that SAC-Copula transfers to Dream-7B and to LLaDA on C4-en continuation, retaining strong detection while improving quality-tail behavior. The separate C4 common-detector audit reports additional quality metrics and remains distinct from the method-matched result.

Dream-v0-Instruct-7B on ELI5

  • On ELI5, both methods retain near-perfect detection, while SAC reduces the i.i.d. upper-tail and composite-collapse profile on Dream-7B.The protocol uses 500 held-out examples, human answers for calibration and negative evaluation, and method-specific Dream generations for positive evaluation; SAC uses FFR while i.i.d. uses its original exact-tape detector.Source: §C.11 · pp. 23–24, Table 27 · p. 24

LLaDA on C4-en continuation

  • On C4-en continuation, SAC+FFR has a substantially less severe quality tail and stronger detection than i.i.d.+Old, with nearly identical median PPL.This is a method-matched comparison of complete pipelines, so detection differences are not attributable solely to generation-side SAC; it provides targeted evidence of transfer to a second task/source setting.Source: Table 28 · p. 24, §C.11 · p. 24

Separate common-detector control

  • In the separate C4 common-detector audit, Rep3 changes 0.7298 →0.6954, Distinct3 changes 0.2702 → 0.3046, and Ent3 changes 1.7293 →1.9986 from i.i.d. to SAC.These audit values are distinct from the submitted method-matched C4 result, with separate detector, evaluation, denominator, and H0 identities.Source: §C.11 · p. 24, Table 29 · p. 24

Related papers

Loading 2608.20839v1…