Source-linked AI summary
A Trustworthy Watermarking Framework for LLM-Generated Food Safety Content
Zhongli Fang, Yiran Chen, Lingyun Zhang, Yu Liu, Ping Chen, Xiaoyan Sun, Jun Dai
TL;DR
LLM-generated food-safety content can be tampered with, creating a need for authentication that preserves traceability and text quality. ToSS uses adaptive dual watermarking with dynamic token-list partitioning and entropy-aware embedding. It embeds and extracts up to 64-bit watermarks in short texts while reporting strong decoding accuracy and acceptable text quality.
Problem
Tampering with LLM-generated food-safety reports and related content creates public-health and market-order risks, while existing watermarking methods struggle with reliable long-bit embedding in short texts.
Method
ToSS combines zero-bit existence verification with multi-bit traceability encoding through dynamic black–white token-list selection and entropy-adaptive embedding.
Results
At a threshold of 1.0, 64-bit watermarks achieve a 95.63% match rate and 99.12% bit accuracy with perplexity 7.14.
Takeaways & Limitations
ToSS provides a unified authentication approach for embedding traceability information in short, high-risk content while maintaining practical text quality.
Abstract
from arXiv · showhide
Large language models are transforming many industries with their text generation abilities. However, their outputs can be easily tampered with, creating serious risks in critical areas such as food safety reporting. To protect the integrity and traceability of AI-generated content, this paper introduces ToSS (Token Oriented Repartitioning and Strategic Selection), a reliable authentication method using adaptive dual watermarking. The key innovation of ToSS is its dual watermark encoding approach that divides vocabulary tokens into black and white sublists, enabling precise bit-level embedding of traceability information. Additionally, an entropy adaptive mechanism dynamically selects text regions with high prediction uncertainty for watermark insertion, maintaining text fluency and factual accuracy while ensuring reliable traceability. Experiments on multiple datasets, including food domain texts, demonstrate that ToSS achieves leading performance in both watermark capacity and decoding accuracy.
I. INTRODUCTION
ToSS addresses the risk of tampered AI-generated food-safety content with adaptive dual watermarking that supports both existence verification and multi-bit traceability. It combines dynamic token-list partitioning with entropy-adaptive embedding to protect text quality while embedding up to 64 bits in short texts.
- Motivation: Food-sector misuse of LLMs can forge safety reports, nutritional information, traceability data, and health certifications, motivating content authentication.The paper identifies these risks as threats to public health and market order.
- Verification: Verification first detects the zero-bit watermark, then reconstructs the multi-bit sequence and compares it with a stored reference to identify tampering.The reported experiments also show strong fluency and factual-consistency performance relative to existing methods.
- Framework: ToSS combines zero-bit existence verification with multi-bit information tracing in a unified adaptive dual-watermarking framework.The first stage uses green/red lists, while the second divides the green list into white/black lists for traceability encoding.
- Embedding design: Dynamic pseudo-random partitioning and hard selection map message bits to vocabulary choices, creating a deterministic and stealth-oriented embedding channel.The mechanism partitions token lists and selects vocabulary tokens according to the target bit sequence.
- Adaptive embedding: Entropy-adaptive embedding strengthens watermarking in high-entropy regions while reducing intervention in low-entropy regions to preserve fluency and factual accuracy.High-entropy regions provide embedding opportunities, whereas low-entropy regions receive lighter treatment.
- Capacity: ToSS enables stable embedding and extraction of up to 64 bits in paragraph-level short texts, supporting traceability in food reports and related applications.The contribution targets constrained paragraphs where existing methods have insufficient capacity.
A. Zero-bit Watermarking
Prior zero-bit and multi-bit watermarking methods established existence verification and information embedding, but existing approaches face capacity and extraction constraints in short texts.
- Zero-bit watermarking: Zero-bit watermarking research has evolved from rewriting and substitution methods toward less perceptible language-model-based approaches.Examples include paraphrasing, synonym substitution, and reverse-trained text-to-text insertion and extraction.
- Multi-bit watermarking: Multi-bit watermarking supports source attribution and content tracking through bit sequences embedded in generated text.Prior methods use statistical tests or pseudo-random mappings to assign information to tokens.
- Limitations: Existing multi-bit schemes commonly require many tokens, limiting high-density watermark embedding in short texts.This constraint motivates methods designed for reliable information embedding under limited text lengths.
III. METHODOLOGY
ToSS uses a synergistic dual-layer watermarking architecture combining zero-bit existence verification with multi-bit traceability. Entropy-adaptive embedding balances reliable information transmission with text fluency and accuracy.
- ToSS combines zero-bit watermark detection with an encodable multi-bit layer for fine-grained authentication in short texts.The design targets high-density traceability scenarios such as food safety reports.
- The existence-verification layer biases generation toward green-list vocabulary and detects watermark presence through a Z-score.The Z-score is compared with a preset threshold using green-list token counts, text length, and green-list ratio.
- The tracing layer converts traceability information into bits and dynamically partitions the green list into white and black lists for encoding.The partitioning and sampling pattern are determined at each generation step from the current message bit.
- Entropy-adaptive embedding adjusts watermark strength according to predictive entropy, strengthening insertion in uncertain contexts while prioritizing fluency and accuracy in certain contexts.The mechanism is expressed as δ′ = α(Ht)·δ.
B. Key Ideas of Our Watermark Design
ToSS creates a deterministic multi-bit encoding channel by repartitioning the green list into equal black and white sublists. Entropy adaptation addresses the quality degradation caused by forcing embedding at every position.
- At each timestep, ToSS generates a green list and divides it into equal black and white sublists.The partition satisfies |b list| = |w list| = |Gt|/2.
- The message is represented as a binary sequence m ∈{0, 1}L for vocabulary-selection encoding.The formulation supports multi-bit traceability information.
- Hard encoding samples from the black list for bit 0 and the white list for bit 1, producing an unambiguous bit-to-token mapping.This deterministic binding reduces uncertainty during extraction.
- During extraction, the detector reconstructs the partition with the same key and recovers bits using maximum-likelihood decoding.The shared key is required to reproduce the timestep-specific list assignments.
- Embedding at every generation position degrades text quality, motivating restriction of forced embedding to suitable high-entropy regions.The entropy-adaptive strategy jointly targets information reliability and text quality.
C. Adaptive Entropy Embedding Algorithm
The entropy-adaptive algorithm uses predictive uncertainty to decide when to embed watermark bits. It skips low-entropy positions and applies forced black/white-list sampling only when entropy reaches the threshold.
- Predictive entropy controls watermark strength: low-entropy regions prioritize text quality, while high-entropy regions receive stronger embedding.The strategy uses model uncertainty as the signal for dynamic adjustment.
- When Ht < Hth, ToSS skips watermark embedding, samples from the original distribution, and does not advance the message-bit index.This preserves fluency in low-entropy regions such as key terminology and fixed expressions.
- When Ht ≥ Hth, ToSS forcibly samples from the black or white list for the current bit and advances the index only after successful embedding.This improves completion of long messages under limited text length.
- After all bits are embedded, ToSS falls back to green-list biasing to retain watermark existence detection without unnecessary overhead.A bias δ is applied to green-list logits before sampling.
A. Experiment Setup
Experiments evaluate ToSS across several text datasets, language models, watermark lengths, and watermark-quality metrics. OpenGen with LLaMA-2-7B is the default benchmark configuration.
- The evaluation uses OpenGen, C4-News, Essays, and a food-related dataset containing recipes, ingredient lists, and cooking instructions.OpenGen is the primary benchmark unless otherwise specified.
- Figures 3 and 4 report ToSS match rate and Z-score performance across language models and datasets.
- Tables II and III evaluate LLaMA-2-7B on OpenGen under different entropy thresholds and report their effects on performance and perplexity.
- Experiments primarily use LLaMA-2-7B, Guanaco-7B, and Falcon-7B, with LLaMA-2-7B as the default baseline model.
- Match rate measures complete watermark extraction, bit accuracy measures retrieval precision, and perplexity plus Z-score assess text quality and watermark effectiveness.
- Watermark lengths range from 12 to 64 bits, with an entropy threshold of 1.0 by default.Other parameters retain their default settings.
B. Comparison with Other Methods
ToSS maintains strong decoding accuracy and extraction efficiency as watermark length increases, including on food-domain text. Compared with existing schemes, it balances reliable long-sequence embedding with practical verification speed.
- ToSS achieved leading decoding accuracy across all tested bit lengths from 12 to 32 bits.The comparison measured match rate, bit accuracy, and extraction time under identical settings.
- 32-bit match rates for comparative methods fell to 8.4% and 27.2%, whereas ToSS retained reliable long-bit embedding.The authors attribute this stability to dynamic list partitioning and entropy adaptation.
- ToSS extraction time remained stable across bit lengths and was on the same order of magnitude as Qu et al..The reported sub-second detection speed supports on-the-fly authenticity verification in food supply chains.
- ToSS extraction accuracy remained high through 64-bit tests and performed stably on the Food dataset.These results indicate adaptability to food-domain textual characteristics.
- ToSS improved decoding accuracy over Qu et al. while surpassing earlier high-accuracy schemes and [13] in computational efficiency.The authors report an overall balance among decoding accuracy, extraction efficiency, and long-sequence embedding capability.
C. Ablation Study
The ablation study shows that entropy-threshold selection controls the trade-off between watermark reliability and text quality. A threshold of 1.0 prioritizes high-risk traceability, while 2.0 favors fluency with reduced but still sufficient watermark performance.
- A threshold of 0.0 produced perfect watermark detection but reduced 64-bit text quality to a perplexity of 9.99.Always embedding watermarks, including in critical factual statements, harmed readability.
- At the default threshold of 1.0, 64-bit watermarks achieved a 95.63% match rate and 99.12% bit accuracy with perplexity 7.14.This setting is used for high-risk food safety and nutrition applications.
- At threshold 2.0, perplexity improved to 5.31 while 64-bit performance remained 89.38% match rate and 99.10% bit accuracy.Thresholds above 2.0 are not recommended for high-risk fields because decoding performance drops sharply.
V. CONCLUSION
ToSS secures AI-generated content for high-risk applications by embedding watermark information that is highly sensitive to unauthorized text modification. The framework achieves content-integrity verification while retaining high decoding accuracy and practical usability.
- ToSS is highly sensitive to tampering because unauthorized text modification disrupts its densely embedded watermark information.The authors present this zero-tolerance behavior as a mechanism for verifying content integrity and originality.
- Experimental results confirm ToSS achieves its integrity-verification goal while maintaining high decoding accuracy and practical usability.The conclusion identifies adaptive frameworks balancing integrity sensitivity and editing robustness as a future direction.