Source-linked AI summary
SemTrace: Source-Grounded Semantic Signatures for Tracing LLM Exposure to Protected Documents
Junyan Zhang, Yudong Zeng, Yongwei Huang, Zuhao Ouyang, Hong Chen, Xuming Hu
TL;DR
Document owners may need to detect whether downstream text reflects a protected document even when the generating LLM is a black box. SemTrace embeds a source-grounded binary signature in a protected copy and decodes semantic evidence with an NLI model; clean detection is near-perfect, while black-box paraphrase robustness varies by rewriting strategy.
Problem
Document owners need to detect exposure of protected documents from generated text without controlling the LLM or accessing its internal generation infrastructure.
Method
SemTrace selects manuscript-supported factual alternatives, instructs a reviewer to express selected facts, and uses an erasure-aware NLI detector to compare recovered bits with an assigned codeword.
Results
SemTrace achieves ROC-AUC 1.000 on ICML 2023 and 0.990 on ICLR 2024 for assigned-copy exposure detection, while neutral paraphrasing reduces ROC-AUC to 0.880 and 0.960.
Takeaways & Limitations
The method provides model-agnostic assigned-copy exposure detection using semantic evidence tied to facts in the protected manuscript.
Takeaways & Limitations
The paraphrase evaluation covers black-box attackers without the source, fact pairs, codeword, detector scores, or key, so it does not characterize knowledgeable white-box adversaries.
Abstract
from arXiv · showhide
Large language models are increasingly used to read documents and produce downstream text, creating a provenance problem when the document owner cannot control or inspect the model that performs the generation. We introduce SemTrace, a source-grounded semantic watermark for detecting whether a generated review was influenced by a known protected manuscript copy. Rather than biasing token probabilities or imposing surface-form patterns, SemTrace constructs a document-specific binary signature from factual propositions that are directly supported by the manuscript itself. A protected PDF invisibly carries a content contract that selects one fact from each binary pair and asks an instruction-following reviewer to express those facts in fixed review slots without changing its independent evaluation. A frozen natural language inference model then decodes the resulting semantic evidence with explicit erasures and scores the recovered bits against the codeword assigned to that copy. This design targets model-agnostic, assigned-copy exposure detection while keeping the watermark semantically tied to the source document.
1 INTRODUCTION
SemTrace addresses exposure detection when document owners lack control over the LLM by encoding document-supported facts into semantic signatures. It combines auditable source-grounded construction with erasure-aware semantic decoding against an assigned codeword.
- SemTrace constructs document-specific binary signatures from factual propositions directly supported by the source manuscript.It filters propositions for factuality, neutrality, and redundancy before arranging them into binary alternatives.
- The protected copy instructs the review model to express one selected fact from each pair in predetermined content slots without fabricating claims.Both alternatives are true statements supported by the paper, so the signature changes which true details are expressed.
- An erasure-aware NLI detector determines whether local review spans entail either fact in each pair and compares decoded positions with the protected copy’s codeword.Each position can decode as 0, 1, or an explicit erasure when evidence is absent, conflicting, or ambiguous.
- The construction pipeline estimates natural fact mentions, removes redundant carriers, and penalizes semantic implication between selected and unselected facts.These steps address false evidence, wasted signature capacity, and positions where both alternatives may be observed.
- The evaluation protocol combines source quotations, NLI validation, neutrality constraints, semantic deduplication, code-aware pairing, slot assignment, and paired protected/unprotected testing.It also includes clustered uncertainty analysis, matched in-context baselines, and black-box paraphrase stress tests.
2 RELATED WORK
Prior watermarking methods use decoding control, post-generation rewriting, or surface-form and representation-level signals. SemTrace instead operates through an instruction embedded in the input document, using source-grounded semantic content for provenance detection.
- Token-level watermarks bias next-token sampling toward keyed vocabulary subsets and require control over generation or decoding.This access requirement is restrictive when watermarking is initiated by a document owner rather than the generator.
- Post-hoc watermarking transforms already generated text, whereas SemTrace controls only the input document before an unknown model produces downstream text.
- Semantic-generation watermarks define keyed states over sentence representations, including hashed embedding regions or clustered semantic regions.These methods use rejection sampling during generation and study robustness–efficiency trade-offs.
- Rewriting attacks can reduce learned- and watermark-based detection, although some watermark evidence survives moderate rewriting when enough text is observed.
- In-context watermarking embeds instructions in model context to induce detectable Unicode, lexical, acrostic, phrase, citation, or related surface signals in downstream reviews.Indirect prompt injection exploits the same data–instruction boundary that lets externally supplied content influence model behavior.
3 METHOD
SEMTRACE detects whether generated text carries the signature of a known protected document by encoding source-supported facts into binary choices and recovering them semantically. Its construction filters, selects, pairs, assigns, and slots facts while preserving independent evaluation, then decodes evidence with explicit erasures.
- 3.1 PROBLEM SETTING: SEMTRACE tests whether downstream text carries the semantic signature assigned to a known protected manuscript copy.The generation model is treated as a black box, while detection uses the generated text and precomputed fact pairs.
- 3.1 PROBLEM SETTING: The signature uses a balanced codeword to select one independently true, manuscript-supported fact from each binary pair.Selected facts are expressed in predetermined content slots by an instruction-following model.
- 3.2 SOURCE-GROUNDED ATOMIC FACT POOL: Candidate facts require exact source support, NLI entailment, limited evaluative impact, and deduplication before entering the approved pool.The pipeline uses fixed thresholds and fails explicitly if a valid pool cannot be formed.
- 3.3 ESTIMATING NATURAL MENTION PRIORS: Natural-mention priors identify facts that are less likely to appear spontaneously in unwatermarked control reviews.Selection-only controls estimate each candidate’s background mention rate and are not reused as final negative examples.
- 3.4 SELECTING RELIABLE AND NONREDUNDANT FACTS: Greedy maximal marginal relevance selects strong, diverse carriers, while code-aware optimization pairs, orients, and slots facts using implication risk and pair costs.The assignment accounts for semantic entailment between selected and unselected alternatives, co-occurrence, redundancy, and slot preferences.
4 EXPERIMENTS
SEMTRACE is evaluated on fixed ICML 2023 and ICLR 2024 corpora using paired protected/null reviews, assigned-code scoring, and frozen detection rules. It achieves near-perfect clean separation and retains detectable semantic signals under both evaluated black-box paraphrase attacks, with attack-dependent degradation.
- Evaluation setup: The evaluation uses ICML 2023 and ICLR 2024 papers with fixed construction, generation, detection, and paired evaluation protocols.Each paper receives five paired positive/null review draws, with matched sampling seeds and identical outer review constraints.
- Evaluation setup: The Exact-12 configuration uses 12 binary positions mapped to predictable locations in a structured conference-review format.Four positions occupy Summary sentences, while the remaining positions are assigned across Strengths and Weaknesses.
- Clean detection: SEMTRACE achieves near-perfect clean detection, with ROC-AUC 1.000 on ICML 2023 and 0.990 on ICLR 2024.At the descriptive empirical zero-FPR point, TPR is 1.00 on ICML and 0.98 on ICLR.
- Clean detection: Protected reviews produce more observed semantic bits than controls, averaging 10.76 versus 1.46 on ICML and 10.84 versus 1.26 on ICLR.Among non-erased positive bits, assigned-code agreement is 1.0000 and 0.9945, respectively.
- Paraphrase robustness: Neutral paraphrasing lowers ROC-AUC to 0.880 on ICML and 0.960 on ICLR, while the adaptive unknown-scheme attack yields 0.990 and 0.980.At the frozen clean threshold, neutral-paraphrase TPRs are 0.68 and 0.92; adaptive-attack TPRs are 0.98 and 0.94, with no observed false positives for neutral paraphrasing.
- Paraphrase robustness: The adaptive results characterize scheme-agnostic black-box rewriting, not robustness to a knowledgeable white-box adversary.The attacker is not given the source paper, fact pairs, codeword, detector scores, or key.
A IMPLEMENTATION DETAILS
The appendix fixes implementation configurations across datasets and experimental conditions, providing details omitted from the main setup for readability.
- Implementation details: All appendix configurations are fixed across datasets and experimental conditions.The appendix supplies frozen implementation details omitted from the main experimental setup for readability.
A.1 EXACT-12 CONSTRUCTION DETAILS
Exact-12 construction selects and pairs manuscript-supported facts using fixed filtering, utility, redundancy, control-aware, and code-aware procedures.
- Exact-12 construction: Exact-12 selects 24 approved facts per paper for 12 binary positions with a balanced codeword containing six zeros and six ones.Eight seed-disjoint selection-only controls estimate candidate facts’ natural mention tendencies.
- Candidate generation and filtering: Candidate facts are generated from overlapping evidence chunks and must be 12–35 words long with an exact supporting quotation of at least five words.Candidate generation uses Qwen2.5-VL-32B-Instruct with initial and supplemental passes.
- Candidate generation and filtering: Candidates are filtered for source entailment, evaluative neutrality, and semantic redundancy before selection.The stated thresholds include entailment probability 0.68, sentiment and rating-impact magnitudes at most 0.35, and embedding cosine similarity 0.99 for near-duplicate removal.
- Selection and pairing: Fact selection uses a base utility and greedy MMR objective that balance evidence, informativeness, verification, natural mention, and redundancy.The base utility is B(f) = 1.2e_f + 0.8i_f + 0.5v_f + 0.5n_f + 1.0(1 − r_f), with MMR coefficient 1.2.
- Selection and pairing: Pairing minimizes differences in fact properties while incorporating co-occurrence, redundancy, category, and directed implication risks.Initialization uses control-aware minimum-weight perfect matching, followed by deterministic simulated annealing and greedy improving swaps.
A.2 CARRIER AND REVIEW GENERATION DETAILS
The carrier is invisibly embedded in protected PDFs, and reviews are generated under identical model, format, and parameter constraints for protected and unprotected documents.
- Carrier embedding: The document-triggered instruction is placed invisibly on the protected PDF’s final page and verified through a text round-trip check.A Unicode-capable font is used in invisible render mode.
- Review generation: Reviews are generated with Qwen2.5-VL-32B-Instruct under fixed decoding and structured review constraints shared by protected and unprotected generations.Generation uses bfloat16, temperature 0.35, top-p 0.9, and a maximum of 1,800 output tokens; reviews contain 400–1,200 words and five named sections.
A.3 DETECTION DETAILS
Detection decodes semantic evidence from generated reviews with a frozen NLI model, explicit thresholds, and an eligibility rule for assigned-code scoring. Evaluation uses paired positive/null draws, paper-clustered uncertainty, and frozen-detector paraphrase and adaptive-attack conditions.
- A frozen DeBERTa-v3-small NLI model decodes adjacent two-sentence review windows, retaining at most 128 windows per review.The minimum entailment threshold is 0.52, the ambiguity margin is 0.20, and the both-mentioned threshold is 0.90.
- At least 8 of 12 positions must be observed for assigned-code scoring; otherwise the review receives the fixed ineligible score −13.A position is observed only when the NLI decoding rule resolves sufficient evidence for one fact-pair member.
- Each paper contributes five paired positive/null review draws generated with the same sampling seed from protected and unwatermarked PDFs.Selection-only controls use a disjoint seed space and are excluded from final detector negatives.
- ROC-AUC over the assigned-code score is primary, while zero-false-positive and 5% false-positive points are descriptive operating summaries.Confidence intervals use cluster bootstrap over papers because review draws from the same paper are statistically dependent.
- Paraphrase evaluation freezes the detector and clean operating threshold while testing neutral and adaptive scheme-agnostic rewriting conditions.The adaptive attacker knows only that an unknown watermark may exist, not the source, fact pairs, codeword, scores, or key.