PaperlayerView exact revision on arXiv

Source-linked AI summary

TANGO: Watermarking Masked Diffusion Language Models in Token Pairs

Kasra Arabi, Nir Weinberger, Micah Goldblum, Niv Cohen

arXiv:2609.35224v1cs.LGcs.CLcs.CR

TL;DR

Masked-diffusion models generate in no fixed order, limiting watermarks that depend on preceding tokens; fixed green lists instead expose their favored tokens to frequency attacks. TANGO biases each new token according to a keyed relation with an already-unmasked neighbor, embedding its signal in token pairs. Across two masked-diffusion models it detects nearly all unedited texts and most edited ones, while tested frequency attacks fail to forge it.

  • Problem

    Masked-diffusion models unmask positions out of order, so preceding tokens required by common watermarks may still be masked, while fixed green lists expose favored tokens to frequency-based recovery and forgery.

    Source: §1 · p. 1

  • Method

    TANGO uses a secret key to color vocabulary tokens and biases each new token toward the color satisfying a checksum with an already-unmasked neighbor.

    Source: §1 · pp. 1–2

  • Results

    On two masked-diffusion models, TANGO detects nearly all unedited watermarked texts and most edited ones, and frequency attacks that forge the red–green list fail against it.

    Source: §1 · p. 2

  • Takeaways & Limitations

    In experiments, token-frequency key recovery stays at chance against TANGO, and detection requires only the candidate text and key.

    Source: §6 · p. 9

    The unchanged expected token-frequency result holds only under idealized assumptions; real-text correlations and finite-sample attacks require empirical evaluation.

    Source: §3.3 · p. 5, §3.4 · p. 6

Abstract

from arXiv · show

Masked-diffusion language models fill in masked positions in parallel and in no fixed order. Most practical text watermarks assume left-to-right generation. They key each token to the tokens before it, and in a diffusion model those tokens may still be masked. A fixed green list needs no such context, but it favors the same tokens at every position, so these tokens appear more often in watermarked text. An attacker who compares token frequencies in watermarked and unwatermarked text can recover the list and forge text that the provider's own detector accepts. We present TANGO, a watermark for masked-diffusion language models that keys each new token to a nearby token that is already unmasked. A secret key splits the vocabulary into color classes, and TANGO biases the new token toward a color determined by the key and the nearby token's color. The watermark is therefore embedded in pairs of tokens. Because the favored color changes from position to position, token frequencies stay much closer to those of unwatermarked text than under a fixed green list. Detection needs only the text and the key, and it does not assume any unmasking order. On two masked-diffusion models, TANGO detects nearly all unedited watermarked texts and most edited ones, and frequency attacks that forge the fixed green list fail against it.

1 Introduction

Masked-diffusion generation makes prior-token watermarks unreliable, while fixed green lists expose their favored tokens to frequency attacks. TANGO embeds a keyed signal in token pairs and detects it without relying on generation order.

1 Introduction

  • Context-hashed green lists cannot be computed when prior tokens remain masked, while fixed red–green lists expose favored tokens to frequency-based recovery and forgery.The preceding-token Gumbel rule also embeds little signal in the authors’ experiments under confidence-ordered unmasking.Source: §1 · p. 1
  • TANGO colors the vocabulary with a secret key and biases each newly unmasked token toward the class satisfying a checksum with an already-unmasked neighbor.The detector recolors the candidate text and counts checksum matches; it needs only the text and key, not the prompt or model.Source: §1 · pp. 1–2
  • Because its second-order signal comes from token-color pairs, TANGO has no expected token-frequency shift under stated idealized conditions, and tested frequency-based forgeries fail against it.Pair-count forgeries also succeed less often against TANGO than red–green forgeries across tested biases and numbers of texts.Source: §1 · p. 2
  • Meaning-based color classes help synonym substitutions preserve pair checksums, while deletion is more damaging because it breaks every pair spanning the deleted word.Under synonym substitution and word insertion, TANGO detects nearly as many texts as the red–green list; it favors a whole class, leaving the model free to choose within it.Source: §1 · p. 2
  • The analysis gives a detection score growing as √T, unchanged expected token frequencies under idealized assumptions, and an edit-score reduction of (1 − ρ)^r for random replacement.Here T is the number of scored pairs, ρ the replacement rate, and r the number of tokens read by a checksum; fewer-token checksums are more robust to edits.Source: §1 · p. 2
  • On two masked-diffusion models, TANGO detects nearly all unedited watermarked texts and most edited ones, while frequency attacks that forge the red–green list fail against it.Its unedited-text detection and perplexity are comparable to the red–green list; at similar perplexity near default settings, it detects far more texts than the Gumbel rule.Source: §1 · p. 2

2 Preliminaries

Masked-diffusion models iteratively fill a block of masked positions, with the unmasking order depending on the data. The section sets detection and attacker requirements and outlines TANGO’s tap-conditioned checksum test.

2 Preliminaries

  • A denoising step makes one bidirectional model pass, samples candidates for masked positions, and keeps the K most confident positions; irreversible unmasking yields a data-dependent permutation.For LLaDA and Dream with the stated ordering, confidence is the model probability assigned to the sampled token.Source: §2 · pp. 2–3
  • Figure 1 shows the keyed color classes, tap-conditioned logit bias, and checksum-match detector, which compares the count with a Binom(T, 1/q) null.A position or its right neighbor at i + 2 can supply an already-unmasked tap; the detector flags counts exceeding the null by a threshold.Source: Figure 1 · p. 3
  • The setting requires prompt-free, order-agnostic detection and a key hidden from token frequencies in watermarked text.The detector should use only the candidate text and secret key, without the unmasking order.Source: §2 · p. 3
  • The attacker knows the watermark method and design parameters but not the key, and may collect texts, edit watermarked text, or generate text to forge or remove a watermark.Its goal is either provider-detector acceptance or watermark removal by editing.Source: §2 · p. 3

3 TANGO

TANGO embeds a keyed checksum relation between a token and an already-unmasked tap, then detects it from the text and key without assuming an unmasking order. Its design uses balanced colorings and analyzes detection, frequency leakage, and edit robustness under stated assumptions.

3 TANGO

  • A secret key assigns tokens colors; at eligible positions, TANGO biases tokens toward the class that satisfies a checksum with an already-unmasked tap, and detection needs only text and key.The default uses one tap at lag 2; positions do not wait for their taps.Source: §3 · p. 3

3.1 Balanced colorings

  • Semantic-quantile coloring sorts keyed embedding projections into balanced buckets, helping synonyms retain their colors while avoiding semantic-cluster coloring’s inflated false-positive rates.Hash coloring ignores meaning, while semantic-cluster coloring can raise false positives to 60% at q = 2 and 30.5% at q = 3.Source: §3.1 · pp. 3–4
  • Balanced token counts do not ensure balanced probability mass in natural text, so class frequencies can leak the key; whitening reduces but does not remove this drift.Defaults do not whiten embeddings and calibrate detection thresholds per model on unwatermarked text.Source: §3.1 · pp. 3–4

3.2 Generation: enforcing the checksum inside the denoising loop

  • When a tap remains masked, either-side enforcement can bias the endpoint committed second, enforcing most pairs without changing detection or the stated guarantees.With left-only enforcement, about 40% of scored pairs on LLaDA are unenforced.Source: §3.2 · p. 4

3.3 Detection

  • The text-and-key detector counts checksum matches against a binomial null; under stated approximations, thresholding is likelihood-ratio optimal for equal-count texts, though natural-text correlations violate the null assumptions.Source: §3.3 · pp. 4–5

3.4 Theoretical guarantees

  • Expected score grows with the square root of scored positions; the coupling margin rises with enforcement and bias but shrinks when the model distribution is peaked.Under independence, the false-negative rate decays exponentially with text length.Source: §3.4 · pp. 5–6
  • Under its assumptions, TANGO leaves the generated-text distribution unchanged, giving every token zero expected frequency shift and making frequency-based color ranking no better than chance.This is a result about expected shifts, not finite-sample rankings; imbalance makes cancellation inexact.Source: §3.4 · p. 6
  • Under independent random substitutions, aligned positions, and the stated gcd condition, expected detection score falls with the probability that a whole checksum remains untouched; each added tap further weakens edit robustness.Source: §3.4 · p. 6

4 Experiments

Experiments compare TANGO with diffusion watermark baselines, test detection, quality, and forgery resistance, and examine design choices. TANGO’s key-frequency attacks fail in the tested settings, while deletion and additional taps expose robustness trade-offs.

4.1 Setup

  • The evaluation uses LLaDA-8B-Instruct and Dream-v0-Instruct-7B, with C4 prompts; Dream’s sampler is incompatible with the Gumbel rule, which is therefore tested only on LLaDA.The default uses semantic-quantile coloring, three colors, one tap at lag 2, residue 0, bias 5, and either-side enforcement.Source: §4.1 · p. 6

4.2 Detection and quality

  • 97% on LLaDA and 100% on Dream of unedited watermarked texts; after edits, TANGO detects 68–92% and 73–98%, respectively.Perplexity is 7.2 on LLaDA and 7.8 on Dream, against 7.6 and 9.1 for the red–green list; on Dream, repetition occurs in 31% of TANGO texts versus 62% for the red–green list and 20% unwatermarked.Source: Table 1 · p. 7, §4.2 · p. 7
  • The distortion-free-in-expectation Gumbel rule detects poorly, with AUROC 0.815 and clean TPR@1%FPR 0.15; raising temperature improves detection at a quality cost, reaching 83% deleted-text detection at temperature 1.5 and perplexity 20.6.Source: §4.2 · p. 7

4.3 Key recovery and forgery

  • Frequency ranking recovers the red–green list but stays at chance for TANGO: AUC rises from 0.738 at 25 texts to 0.806 at 100 for the former, while TANGO reaches 0.504 at 200 LLaDA texts and 0.501 at 100 Dream texts.The token-frequency total-variation distance is 0.217 for TANGO, close to 0.210 from finite samples alone and below 0.340 for the red–green list; frequency-based forgeries pass the red–green detector but not TANGO’s.Source: §4.3 · pp. 7–8
  • At the bias level where 51% of pair-frequency forgeries pass the red–green detector, 4% pass TANGO’s; at twice that bias, the rates are 98% and 55%, respectively.The pair attack estimates O(V^2) pair frequencies rather than O(V) token frequencies; the more frequent pairs are used to bias attacker-generated text.Source: §4.3 · p. 8

4.4 Ablations

  • Edited-text detection rises from 0.62 at q = 2 to 0.92 at q = 3, with no further improvement; deletion TPR falls from 0.92 with one tap to 0.12 with four.GPT-2-large perplexity rises from 22.2 at q = 3 to 29.9 at q = 8, motivating q = 3 and a single tap.Source: §4.4 · p. 8
  • At β = 8 on LLaDA, either-side enforcement raises the enforced fraction κ from 0.61 to 0.74; at the default β = 5 it reaches 0.76.At fixed margin per enforced pair, raising κ from 0.61 to 0.74 raises the expected score by about 1.2 times.Source: §4.4 · pp. 8–9

5 Related work

Related watermarks for diffusion models adapt context hashing, sampling randomness, or sequence-level signatures. TANGO also uses an already-unmasked neighbor, but bases its favored set on the neighbor’s color.

Biased and distortion-free watermarks

  • Biased green-list watermarks shift token frequencies, enabling attackers to approximate the favored list and forge or remove the watermark.Reweighting watermarks change the next-token distribution under a fixed key but preserve it in expectation over keys; distortion-free methods seed sampling randomness with the key.Source: §5 · p. 9

Watermarks for diffusion language models

  • Diffusion watermark designs include context-hashed biases, unmasking-order steering, Gumbel perturbations, and control of a global sequence sketch.DLM, dgMARK, and other approaches are described as adapting these strategies to diffusion generation.Source: §5 · p. 9
  • LR-DWM hashes left and right unmasked neighbor token IDs into green lists, whereas TANGO uses a neighbor’s color to select one of q balanced classes.A substitution that preserves the neighbor’s color therefore preserves TANGO’s favored class.Source: §5 · p. 9

6 Discussion

The discussion presents TANGO as a frequency-hidden watermark for masked diffusion, while acknowledging weaker deletion and paraphrase robustness and a pair-frequency forgery route. The accompanying appendices state the proof assumptions and examine the unwatermarked detection null.

6 Discussion

  • TANGO embeds a pairwise signal during denoising; token-frequency recovery stays at chance in the experiments, and frequency-built forgeries fail against its detector.Detection requires only the candidate text and key, not the unmasking order.Source: §6 · p. 9
  • Pair-counting attackers can forge TANGO, though less often than the red–green list in every tested setting; key rotation limits texts collected under one key but requires testing against each active key.The authors recommend key rotation in practice.Source: §6 · p. 9
  • TANGO trades some deletion robustness for a frequency-hidden key; back-translation reorders clauses and lowers its detection more than the red–green list’s.Theorem 2 covers only edits that keep positions aligned, and Dream’s natural text scores above chance, so thresholds should be calibrated on unwatermarked text for each new model.Source: §6 · p. 9
  • For providers prioritizing resistance to forgery, the authors argue that a frequency-hidden key is worth some loss of deletion robustness.Under synonym substitution and word insertion, TANGO detects at most eight percentage points fewer watermarked texts than the red–green list on both models.Source: §6 · p. 9

Appendix Contents

  • The appendices map out formal proofs, decoding and evaluation settings, calibration checks, full experiment tables, ablations, related work, and generated samples.Appendix A proves the formal statements and supporting results, with a table listing each result and its assumptions.Source: Appendix Contents · p. 14, A Proofs · p. 14, Table 3 · p. 14

A.1 Setting, notation, and assumptions

  • The checksum uses a keyed balanced coloring, target residue, and tap lags; the main-text single tap is lag 2 with coefficient 1.The proofs idealize sampling, favored-class unpredictability, class balance, and independence; the real key only approximates the unpredictability assumptions.Source: §A.1 · pp. 14, 16, 17

A.2 The score of unwatermarked text

  • Under uniform independent scored-token colors and independent match indicators, the null match count is Binom(T, 1/q), and the standardized score converges to N(0, 1).For the default key, natural-text classes carry 32%, 29%, and 39% of tokens, motivating threshold calibration on unwatermarked text.Source: §A.2 · pp. 17–18

A.3 Expected score and the text length needed for detection

This section relates the expected detection score to the average match margin and the number of scored pairs. The margin depends on the fraction of pairs actually enforced and the extra match probability at those pairs.

A.3 Expected score and the text length needed for detection

  • The average match probability is 1/q + ε, and the expected score is determined by the scored-position count T and this margin.The expected-score statement holds conditionally on T when text lengths vary.Source: §A.3 · pp. 18–19
  • The expected score reaches a fixed detection threshold when the number of scored positions is proportional to 1/ε²; halving the margin quadruples the required count.The threshold relation assumes z⋆ > 0 and a positive margin ε that does not depend on T.Source: §A.3 · p. 19
  • Increasing β raises the enforced-pair margin with diminishing returns, which is bounded above by 1 − 1/q.The margin depends on how much probability the tilt moves into the favored class.Source: §A.3 · p. 19
  • Under the stated assumptions, ε = κ ¯ε_enf: the margin is the enforced fraction times the excess match probability at an enforced pair.Either-side enforcement raises κ from 0.62 to 0.75 at β = 6 without changing the per-enforced-pair margin.Source: §A.3 · pp. 19–20

A.4 Finite-sample error bounds

The appendix bounds finite-sample detection errors and shows when the checksum-match count is an optimal detector. The optimality result depends on approximations and one-sided enforcement.

A.4 Finite-sample error bounds

  • The finite-sample bounds use independent match indicators under (I); Hoeffding’s false-positive bound depends only on z⋆ and q.When the binomial null of Proposition 1 holds, the exact binomial tail is smaller than the Hoeffding bound.Source: §A.4 · p. 20
  • At q = 3 and z⋆= 4, the false-positive bound is 8.2 × 10−4; for T ≥T⋆, the false-negative bound decays exponentially in T.Rounding changes the false-positive bound by less than 10−6 at V ≈1.26 × 105 and T ≤128.Source: §A.4 · p. 20

A.5 The count test is the likelihood-ratio test

  • Under Approximations 1–3 and one-sided enforcement, thresholding the checksum-match count C is the likelihood-ratio test for texts with the same T scored positions.Its false-positive-rate threshold is the same for every β > 0 and κ ∈(0, 1].Source: §A.5 · pp. 21–22
  • The count-test optimality does not extend to either-side enforcement, where a token’s likelihood ratio depends on both pair-match indicators.The paper nevertheless uses the count test for both enforcement modes.Source: §A.5 · p. 22

A.6 Token frequencies and the key

The section analyzes when TANGO’s token-frequency shifts reveal its key: balanced random favored classes cancel in expectation, whereas imbalance can produce shifts. A fixed red–green list does not have this cancellation.

A.6 Token frequencies and the key

  • Under (S), (U), and (B), the idealized sampler gives generated text the same distribution with and without the watermark, so expected token-frequency shifts are zero.The result assumes favored classes are fresh uniform draws; it does not say that a fixed key produces unwatermarked text.Source: §A.6 · pp. 22–23
  • When a context’s class mass is imbalanced, token-frequency shifts no longer cancel exactly and are bounded by the imbalance.To first order, the shift is −p(v) γ2ηc/(q ¯Z2), with ¯Z = 1 + γ/q.Source: §A.6 · p. 23
  • A class imbalance of 0.06 shifts a token’s expected frequency in one context by about 17% of p(v) at the default β = 5.To first order, the shift depends on the token’s own class imbalance; over-represented classes become less frequent and under-represented classes more frequent.Source: §A.6 · pp. 23–24
  • Under the stated conditions, a fixed red–green list shifts frequencies upward for tokens in G and downward outside G, separating the sets by ranking.The analysis holds contexts fixed; real generation also changes later contexts, which this statement does not model.Source: §A.6 · pp. 24–25

A.7 Edit robustness

The edit analysis gives an expected-score result for random substitutions and states boundaries for other edit types and conditions. Its substitution model preserves positions and replaces corrupted-token colors uniformly.

A.7 Edit robustness

  • The substitution result assumes independent random corruption, uniform replacement colors, no insertions or deletions, and gcd(aδ, q) = 1 for every δ.If gcd(aδ, q) > 1, a corrupted tap need not yield a checksum match at rate 1/q.Source: §A.7 · pp. 25–26
  • Under the stated random-substitution model, E[zatt] = (1 −ρ)|D|+1 E[zclean].A checksum reads |D| + 1 tokens; its excess over chance survives when all those tokens are untouched.Source: §A.7 · p. 25
  • Insertions and deletions shift pair positions, so the theorem predicts only the direction—not the size—of their effect.For synonym substitutions, semantic-quantile coloring can preserve color more often than chance, so the theorem may underestimate score survival.Source: §A.7 · p. 26

B Experimental details

The appendix specifies shared generation, attack, and scoring protocols, then examines whether unwatermarked text is calibrated for TANGO detection. Calibration differs by model: natural Dream text scores above chance, while the LLaDA threshold flags none of 500 natural texts.

B Experimental details

  • Generation uses 128 tokens in 128 denoising steps at temperature 1.0; LLaDA uses CFG scale 2.0, while Dream uses a plain forward pass.Perplexities are comparable within a model except for published diffusion watermarks paired with their own controls.Source: B Experimental details · p. 26
  • A continuation is degenerate when more than 20% of its whitespace 4-grams repeat earlier 4-grams; Tables 1, 12, and 13 exclude these texts from perplexity scoring.The choice matters more on Dream: 31% of TANGO texts and 62% of red–green texts are degenerate, versus 20% of unwatermarked texts.Source: B Experimental details · p. 26
  • Attacks delete or replace 10%–50% of words or insert words amounting to 20%; TPR@1%FPR uses the 99th percentile of unwatermarked scores as its threshold.With fewer than 100 negative texts, that threshold cannot certify a 1% false-positive rate.Source: B Experimental details · p. 27
  • The selection experiment chose either-side enforcement at β = 5 using held-out prompts, eligibility thresholds, forgery checks, and lowest Qwen perplexity among eligible settings.Defaults also use q = 3, one tap, and b = 0; the selection rule requires every one of 48 texts to meet the clean-TPR condition.Source: B Experimental details · p. 27
  • Generation adds an O(V) logit update per biased position per denoising step, while detection scores a text in one O(L) pass.Coloring is built once per key at O(Vd + V log V) cost.Source: B Experimental details · p. 27

C.1 LLaDA

  • On LLaDA, z > 4 flags 0 of 500 unwatermarked texts, with a 0.74% upper bound on the false-positive rate.Natural C4 text has mean score −0.46 and standard deviation 1.08, compared with −0.07 and 0.99 for random-token text.Source: §C.1 · p. 28

C.2 Dream

  • On Dream, 1.00% of 300 natural texts score above 4, and whitening lowers that rate to 0.33% with little change to watermark detection.The natural-text mean score falls from 1.07 to 0.67; a new model’s threshold should be set using its own unwatermarked text.Source: §C.2 · p. 28

C.3 Correlated colors and the choice of residue

The results compare detection at matched perplexity and test how readily attackers can recover or forge TANGO’s signal. Token-frequency attacks leave TANGO’s key at chance, while pair-based attacks retain some signal; natural-text color correlations also affect detector calibration and tap choice.

C.3 Correlated colors and the choice of residue

  • At lag 1, natural-text color-pair frequencies differ from independence by up to 0.013 per cell and null means range from −0.93 to +0.98; at lag 2, differences are at most 0.005 and the null-mean range is less than half as wide.This supports the default tap skipping the adjacent token.Source: §C.3 · p. 29, Table 6 · p. 29
  • Across residues, null scores vary more than watermarked scores; a tap-keyed residue lowers the null mean and detects more deleted texts, but slightly fewer unedited texts than b = 0.Tap-keyed detection is 0.97 versus 1.00 on unedited texts and 0.91 versus 0.79 on deleted texts.Source: §C.3 · p. 29, Table 7 · p. 29

D.1 Key recovery and forgery from token frequencies

  • Figure 2 shows red–green key-recovery AUC rising from 0.738 at 25 texts to 0.806 at 100 as more texts are used, while recovery against TANGO stays at chance.The figure uses subsets of a pool of 100 texts per method; TANGO uses one-sided enforcement at β = 6 and whitened coloring, and the red–green list uses bias 5.Source: Figure 2 · p. 30

D.2 Key recovery and forgery from token pairs

  • At 200 texts, lag-pair ranking against TANGO reaches AUC 0.62, or 0.78 for pairs seen at least three times, and pair-built forgeries pass 74% of the time.The red–green-list pair-built forgeries pass 96% of the time.Source: §D.2 · p. 31, Table 9 · p. 31
  • At forging bias βforge = 4, a model-based attacker’s texts pass TANGO’s detector 4% of the time versus 51% for the red–green list, at GPT-2-large perplexities 13.5 and 15.2.Unwatermarked text has perplexity 13.1.Source: §D.2 · p. 31, Table 10 · p. 32

D.3 The published diffusion watermarks

  • Neither published diffusion watermark detects more than TANGO or the red–green list at similar perplexity cost; TANGO detects 97% of clean texts at 1.7 times control perplexity.The published methods were evaluated using their public code and their own default and matched decoding settings.Source: §D.3 · p. 32, Table 11 · p. 33

D.4 Detection against perplexity at every strength

  • At Qwen perplexity 7.6 against TANGO’s 7.2, the red–green list detects 96% versus 68% of deleted texts; at 9.9 against 8.4, it detects 98% versus 81%.The comparison varies watermark strength under identical decoding.Source: Table 12 · p. 33, §D.4 · p. 33

D.5 Results on Dream

On Dream, TANGO detects unedited text while avoiding much of the red–green list’s repetition collapse. The appendix also tests key-aware removal, paraphrase robustness, and variation across seeds and keys.

D.5 Results on Dream

  • 62% of red–green Dream texts collapse into repeated phrases, versus 20% of unwatermarked texts and 31% of TANGO texts; both watermarks detect every unedited text.The red–green list’s mean score is 12.2 on non-degenerate texts and 14.3 on degenerate ones.Source: Table 13 · p. 34, §D.5 · p. 34

D.6 Removal by an attacker who holds the key

  • At 10% regeneration, key-aware and random attacks lower mean z similarly (4.34 versus 4.42); at 25% and 50%, the key-aware attacker lowers it less.At 25% budget about a quarter of texts remain above z = 4; at 50%, almost none do.Source: §D.6 · p. 34, Table 14 · p. 34

D.7 Paraphrase

  • TPR@1%FPR falls from 1.00 to 0.34 for TANGO under back-translation, while the red–green list falls to 0.61; neither watermark is robust to paraphrase.Theorem 2 covers edits that keep positions aligned, whereas paraphrasing reorders clauses.Source: §D.7 · p. 35

D.8 Variance over seeds and keys

  • Clean AUROC is 0.998 ± 0.002 across four independent keys; per-seed TPR standard deviation reaches 0.19 under the heaviest edits.The per-seed standard deviation without edits is 0.04.Source: Table 16 · p. 35, Table 15 · p. 35, §D.8 · p. 35

E Full ablations

The ablations compare coloring, taps, enforcement choices, and detection as text length grows, with small cells limiting row-by-row conclusions. Additional related work distinguishes TANGO’s pair statistic and statistical guarantee from other semantic watermarks and cryptographic signatures.

E Full ablations

  • With 24 texts per cell, repeated configurations differ by up to 0.13 TPR, so row-level ablation differences are not significant.The authors draw conclusions only from trends across several rows.Source: E Full ablations · p. 35

E.1 Number of colors

  • 0.5% or lower null FPR holds for semantic-quantile coloring at every q, while cluster coloring flags 60% of natural texts at q = 2 and 30.5% at q = 3.For quantile coloring, q = 2 detects less under edits than q ≥ 3, while perplexity rises from 22.2 at q = 3 to about 30 at q ≥ 8.Source: Table 17 · p. 36, §E.1 · p. 36

E.2 Tap set

  • 0.92 to 0.12: del30 TPR falls when taps increase from one to four; lag 2 detects as well as or better than lag 1 in every tested column.Lag 2 is used because adjacent token colors are most correlated in natural text, while lag 1 leaks more to the pair-counting attacker.Source: Table 18 · p. 36, §E.2 · p. 36, Figure 3 · p. 37

E.3 Enforcement side, bias, lag, and unmasking order

  • 0.94 del30 TPR for lag 1 versus 0.77 for lag 2 at β = 6 and matched perplexity, but forgery success is 0.54 versus 0.38.Either-side enforcement raises the enforced fraction and del30 TPR; order steering raises the enforced fraction to about 0.9 but multiplies perplexity by 1.3 to 1.7 and lowers AUROC to 0.974 at β = 6.Source: §E.3 · p. 37

E.4 Detection grows with text length

  • At 94 scored pairs, the mean score matches the predicted 4.67; shorter prefixes score lower, and measured z = 4 detection takes about 78 pairs versus the predicted 69.The predicted line is calibrated using the margin measured on full texts, so agreement at full length is by construction.Source: Figure 4 · p. 38, §E.4 · p. 38

F Additional related work

  • Unlike single-token or sentence-level semantic watermarks, TANGO uses meaning to help a token-pair statistic survive synonym substitution; its guarantee is statistical, not cryptographic.Related semantic methods include SIR (Liu et al., 2024b), SemStamp (Hou et al., 2024), and SemaMark (Ren et al., 2024); TANGO’s expected-frequency guarantee assumes equal class masses and an evenly varying favored class (Theorem 1).Source: F Additional related work · pp. 38–39

G Qualitative samples

The qualitative samples compare verbatim continuation spans from four methods across three C4 prompts.

G Qualitative samples

  • Across these three C4 prompts, all four methods produce readable sample text, and TANGO shows no visible checksum trace.Each displayed entry is one sentence copied verbatim from the full continuation.Source: G Qualitative samples · p. 39, Figure 5 · p. 40
Loading 2609.35224v1…