PaperlayerView exact revision on arXiv

Source-linked AI summary

Constitution-Guided Watermarking

Toluwani Aremu, Samuele Poppi, Nils Lukas

arXiv:2610.09552v1cs.CRcs.CLcs.LG

TL;DR

Watermark objectives can conflict, and one shared configuration may not fit requests with different requirements. Constitution-Guided Watermarking maps provider-written rules to request-specific policies through offline refinement and deployment routing. In a KGW proof of concept, it improves paraphrase detection on robustness-prioritized requests by up to 14 percentage points over fixed configurations while matching the best clean detection and quality.

  • Problem

    Watermark objectives can conflict, while a shared operating point may sacrifice quality on wording-sensitive requests or robustness where attribution matters.

    Source: §1 · pp. 1–2

  • Method

    The framework uses provider-written natural-language rules to guide offline refinement of rule-specific configurations and deployment routing to the applicable policy.

    Source: §1 · p. 3

  • Results

    Up to 14 percentage points of post-paraphrase detection improvement on robustness-prioritized requests is reported over fixed configurations, while matching the best clean detection and quality.

    Source: §1 · p. 3, §6 · p. 12

  • Takeaways & Limitations

    The KGW demonstration supports the feasibility of request-dependent policies that improve paraphrase robustness on prioritized requests and exempt editing requests as specified.

    Source: §6 · p. 12

    The evaluation uses one watermark family, serving model, key pair, search seed, and five-rule constitution, so its results are finite-sample evidence rather than guarantees.

    Source: §6 · p. 12

Abstract

from arXiv · show

Watermarking enables language model providers to identify text generated by their models. However, its desired properties can conflict (\ie~stronger watermark signals can degrade text quality), while designs that resist editing may also facilitate forgery. Providers address these trade-offs by choosing configurations that balance competing objectives or prioritize particular properties. Either approach imposes a shared operating point on requests with different requirements, potentially sacrificing quality where wording preservation matters or robustness where reliable attribution is essential. To allow flexible and adaptable designs, we introduce \emph{Constitution-Guided Watermarking}, a framework that selects request-appropriate trade-offs from provider requirements, listed as natural-language principles. \emph{Offline}, a pretrained reasoning agent examines constitutional rules alongside watermark implementations and iteratively refines rule-specific configurations using empirical feedback. \emph{At deployment}, a separate monitor identifies applicable rules and retrieves the corresponding policy, including watermarking exemptions, without modifying the serving model. Furthermore, our framework supports offline parallel optimization and refinement of rule-specific configurations based on evolving provider requirements without affecting deployment, and binds each deployed configuration to its evaluation evidence, making deployment decisions auditable. In a proof-of-concept evaluation using KGW and a five-rule constitution, our framework selects configurations responsive to provider priorities and improves post-paraphrase detection on robustness-prioritized requests by up to $14$ percentage points over fixed configurations, while matching or exceeding all baselines in aggregate quality and clean detection at a nominal $0.1\%$ false-positive rate.

1 Introduction

Watermark properties can conflict, and a single operating point may not suit requests with different priorities. Constitution-Guided Watermarking uses natural-language rules to select request-specific policies through offline refinement and deployment routing.

1 Introduction

  • A shared compromise can add distortion to quality-sensitive requests while providing insufficient robustness where attribution matters most.Providers may need distinct priorities for proofreading, deterministic answers, and paraphrase-sensitive generations.Source: §1 · p. 2
  • The framework translates provider-written natural-language rules into request-dependent watermark policies, including when watermarking applies and which properties take priority.Rules are paired with quantitative acceptance criteria so the resulting policies can be tested.Source: §1 · pp. 2–3
  • Offline, a verification agent examines watermark implementations and iteratively refines rule-specific configurations using empirical feedback; at deployment, a monitor routes prompts to policies.The serving model remains frozen, and evaluated configurations are stored with their evidence and gate status.Source: §1 · p. 3
  • Up to 14 percentage points of post-paraphrase detection improvement on robustness-prioritized requests is reported over fixed configurations, while matching the best clean detection and quality.The proof of concept uses KGW and a five-rule constitution.Source: §1 · p. 3

2 Problem Formalization

The formalization represents provider requirements as rules, precedence, and quantitative gates, then evaluates configurations against rule-specific requirements. When no configuration passes within the search budget, it returns a best-effort option and records unmet gates.

2 Problem Formalization

  • A constitution comprises a rule set, precedence, and quantitative gates; each rule specifies a natural-language instruction, watermarking decision, ordered objectives, and active gates.The rule set is denoted S, while R is reserved for responses.Source: §2 · p. 4
  • Compatible watermarked rules can combine objective priorities, with more frequently requested objectives ordered first while applicable gates remain active.For example, two quality requests can outweigh one robustness request in the objective order without removing the robustness requirement.Source: §2 · p. 4
  • The PPL gate alone establishes neither task correctness nor distribution preservation, so low-distortion or exactness requirements need task-specific measurements.Examples include a task-specific loss or an appropriate task reference.Source: §2 · p. 5
  • If no tested configuration passes within the search budget, the system returns the best measured incumbent under the provider’s objective order and reports unmet requirements.Failure to find a passing configuration does not prove the constitution is infeasible.Source: §2 · p. 5

3 Methodology

The methodology separates offline construction of rule-specific policies from online execution, using constitution-labeled data, iterative empirical search, and constrained deployment routing. The serving model remains frozen.

3 Methodology

  • Constitution-guided watermarking separates offline policy construction from online execution: a verification agent proposes rule-specific policies, and a monitor selects the applicable policy for each request.The proof of concept uses pretrained agents without weight updates, and the serving model remains frozen.Source: §3 · pp. 5–6

3.1 Dataset Generation

  • A generate–critique–revise loop creates realistic prompts labeled with applicable rules, resolved actions, and active gates; paraphrases and overlapping-rule prompts test rule recognition.A fixed reference set enters configuration search, while a disjoint test set is reserved for results; prompt paraphrases stay in the same split as their source.Source: §3.1 · p. 6

3.2 Constitution-Guided Search

  • For each unresolved profile, the verification agent proposes a policy with rationale and expected gate effects; deterministic checks reject invalid proposals before reference-set evaluation.Measurements and failures return to the agent for revision; passing profiles can be frozen, while unresolved profiles retain a best-effort configuration when the budget ends.Source: §3.2 · pp. 6–7

3.3 Constitution-Guided Deployment

  • Search returns a versioned certificate containing constitution rules, watermark information, evaluation records, and per-rule policies, with reference-passed or best-effort status.At deployment, the monitor predicts applicable rules, retrieves and validates the corresponding record, and enforces its action and bound configuration.Source: §3.3 · p. 7

4 Experimental Setup

The proof-of-concept evaluates Constitutional-KGW against two fixed KGW settings and a budget-matched random-search verifier. The setup uses five rules, held-out prompts, explicit gates, and separate attack and clean-detection measurements.

4 Experimental Setup

  • The study evaluates five provider rules using 10 reference prompts per rule over at most five search rounds, then tests on 100 disjoint prompts per rule.The 500 test prompts per method are never used as feedback.Source: §4 · p. 8
  • The five rules cover misuse-prone requests, low-risk editing, high-stakes advice, deterministic answers, and general generation, with distinct watermarking actions and priorities.Low-risk editing is unwatermarked; the other listed request types use watermarking with different priorities.Source: §4 · p. 8
  • The main experiment uses KGW with integer δ ≥1, 0 < γ < 1, integer context length h ≥1, and four available configuration choices for f.The available f values are time, additive, skip, and min.Source: §4 · p. 8
  • Comparisons include two prespecified fixed KGW operating points and a budget-matched random-search verifier sharing the deployment monitor.The fixed settings are (γ, δ, h) = (0.25, 4, 3) and (0.5, 2, 1), both with f = time.Source: §4 · p. 8
  • Watermarked-rule gates require detection ≥0.95, quality pass rate ≥0.90, robustness ≥0.50, and empirical FPR ≤0.01.The setup uses adaptive DIAA and non-adaptive DIPPER paraphrasers, with five attacks per answer and attack channels reported separately.Source: §4 · p. 9
  • Metrics include clean detection, perplexity-based quality, post-attack detection at nominal 0.1% FPR, editing compliance, routing failures, and observed false positives.Generation and routing failures remain in attempted-prompt denominators, and attack execution failures count as non-detections; passing the empirical FPR gate does not establish operation at 0.1% FPR.Source: §4 · p. 9

5 Experimental Evaluation

The evaluation finds targeted paraphrase-detection gains on robustness-prioritized requests while maintaining strong clean detection and quality. Refinement, priority sensitivity, and deployment-monitor comparisons show both the promise and limits of the workflow.

Main Results

  • On 100 robustness-targeted prompts, post-paraphrase detection reached 13.8% (DIAA) and 17.0% (DIPPER), gains of +11.0 and +14.0 percentage points over Fixed KGW A.Both attack results remained below the provider’s 50% requirement, so the policy was reported as best-effort rather than validated.Source: §5 · p. 9, Table 2 · p. 10
  • Across 400 watermark-required rules, quality pass rate (PPL ≤18.25) was 98.6%; the method correctly exempted all 100 editing requests, while fixed baselines watermark every request.Its clean detection exceeded Fixed KGW A (92.5%) and Fixed KGW B (61.8%).Source: §5 · p. 10, Table 2 · p. 10

Impact of Iterative Refinement

  • On the 10-prompt reference set, refinement raised clean detection at nominal 0.1% FPR from 90% to 100% and worst-channel robustness from 0% to 10%, with no quality-pass-rate loss.The robustness requirement remained unmet, and these small-reference-set results illustrate refinement rather than establish generalization.Source: §5 · p. 10, Table 3 · p. 10

Sensitivity to Constitutional Priorities

  • On 100 held-out prompts, quality-first achieved 98.0% quality, while robustness-first achieved 15.6% DIAA and 18.6% DIPPER robustness with 91.0% quality.The balanced variant fell between them, but intervals overlapped with robustness-first; no variant exceeded 19% paraphrase robustness.Source: §5 · pp. 10–11, Table 4 · p. 11

Impact of Deployment Monitor

  • The stronger monitor routed 100.0% of requests correctly versus 70.6% for the lightweight monitor, with clean detection and quality pass rates also higher under the stronger monitor.Robustness was similar between monitors; the comparison used regenerated outputs, so it is a deployment-level diagnostic rather than a counterfactual audit of identical generations.Source: §5 · p. 11, Table 5 · p. 11

6 Discussion and Conclusion

The conclusion presents constitution-guided watermarking as a feasible workflow for request-dependent policies, while emphasizing that tested policies fall short of stringent robustness requirements. Its evidence remains bounded by the proof-of-concept evaluation.

Discussion and Conclusion

  • Rule-specific operating points deliver targeted robustness gains while preserving quality-oriented configurations and editing exemptions, but no evaluated method meets the 50% robustness requirement.The unmet gate is a limitation of tested policies and search budget, not evidence of a KGW robustness ceiling.Source: §6 · p. 12

Limitations

  • The evaluation uses one watermark family, serving model, key pair, search seed, and five-rule constitution, with small reused reference sets that provide finite-sample evidence rather than guarantees.Detection assumes access to the generation configuration; task correctness, semantic preservation under attack, and forgery resistance were not measured.Source: §6 · p. 12

Conclusion

  • Future work includes task-specific quality measurements, independent calibration audits, and evaluation across watermark families and constitutions.The paper also identifies Bayesian-optimization and simpler hand-designed policy comparisons as further ways to isolate the reasoning verifier’s contribution.Source: §6 · p. 12

Ethics Statement

The ethics statement distinguishes statistical watermark evidence from proof and highlights risks that deployment must address.

Ethics Statement

  • Watermark detection is statistical evidence, not conclusive proof of authorship or misconduct.Source: Ethics Statement · p. 12
  • Deployment must account for mixed human–AI authorship, false attribution, prompt privacy, and key security.Source: Ethics Statement · p. 12
  • Evaluating misuse-prone requests does not justify bypassing serving-model safety constraints; provenance control is not a substitute for content safety.Source: Ethics Statement · p. 12

AI Use Statement

The authors disclose generative-AI use for dataset creation, code, and manuscript editing, alongside review and verification practices.

AI Use Statement

  • Generative AI tools generated synthetic, constitution-labeled prompt datasets using GPT-OSS-120B and Qwen3-32B.Source: AI Use Statement · p. 12
  • Generative AI tools also implemented parts of the experimental code and drafted and edited parts of the manuscript.Source: AI Use Statement · pp. 12–13
  • The authors report no AI use for mathematical claims or proofs and say they reviewed AI-assisted work, including filtering prompts and testing code.Source: AI Use Statement · p. 13

Reproducibility Statement

This block documents the study’s implementation, comparison procedures, and evaluated constitution, then reports selected configurations, false-positive measurements, and sensitivity results. It distinguishes provider-policy selection from prior adaptive watermarking and describes limitations in the evaluation evidence.

A Related Work

  • The framework’s policy-level adaptation selects among algorithms and configurations using rule-specific empirical evidence, unlike prior methods that adapt within an output to a fixed objective.The reproducibility statement says code, prompts, and run artifacts—including source hashes, proposals, rejections, and retained incumbents—will be released upon publication.Source: Reproducibility Statement · p. 13, A Related Work · p. 16

B.1 Implementation

  • The main run uses answer-only KGW with fixed key, context-window policy, and detector operating points; artifacts retain exact requests, rejections, incumbents, and decoding settings.Reasoning uses temperature 0.6, top-p 0.95, and top-k 20; the verification and monitor completion budgets are 32,768 and 4,096 tokens.Source: §B.1 · pp. 16–17

B.2 Attack Settings

  • Attack evaluation uses adaptive paraphrasing and DIPPER with five repetitions per attacked answer, measuring raw signal survival rather than whether meaning is preserved.Generation caps can truncate paraphrases, and the study does not audit semantic preservation.Source: §B.2 · p. 17

B.3 Baselines

  • Random search receives the same empirical budget as the reasoning verifier but ranks candidates by gate passage and weighted shortfall, while the agent uses rule priorities; both arms share a deployment monitor.Test results do not select the random-search prior, weights, candidates, or incumbent.Source: §B.3 · p. 17

B.4 Provider Constitution

  • The evaluated constitution uses first-applicable precedence, so only the earliest matching rule’s action and priorities govern each prompt.The experiments do not test the objective recurrence for combining compatible rules.Source: §B.4 · pp. 17–18

C.1 Selected Per-Rule Configurations

  • The agent assigns its strongest bias and longer context to misuse, but uses one shared configuration for the three quality-prioritized rules; misuse remains Best-Effort.Its aggregate clean detection matches random search, while its advantage lies mainly in misuse-rule paraphrase robustness.Source: §C.1 · p. 18, Table 6 · p. 18

C.2 Null-Reference False-Positive Rates

  • Observed null-reference FPRs range from 0.88% to 1.14% at nominal 1% and 0.08% to 0.18% at nominal 0.1%, with every 95% interval including its nominal rate.The texts also informed configuration selection, so the intervals are descriptive; an independent assessment requires a fresh unwatermarked set.Source: §C.2 · pp. 18–19, Table 7 · p. 19

C.3 Constitution-Sensitivity Setup

  • Across priority variants, γ remains 0.5 and configurations differ mainly in bias strength; the study cautions that parameter changes alone do not establish constitutional control without the intended outcome shift.The sensitivity study reuses one general-generation slice and varies only the natural-language priority instruction.Source: §C.3 · p. 19

C.4 Robustness at Nominal 1% FPR and Paired Comparison

At nominal 1% FPR, Constitutional-KGW leads the reported paraphrase-detection comparison, while paired evidence at nominal 0.1% is narrower. Qualitative traces and routing tests also expose best-effort robustness, routing errors, and scope limits in the pilot evaluations.

C.4 Robustness at Nominal 1% FPR and Paired Comparison

  • 27.8% DIAA and 30.8% DIPPER post-paraphrase detection make Constitutional-KGW the highest-ranked method at nominal 1% FPR, with gains up to 19.2 percentage points over Fixed KGW A.Robustness remains below the provider’s 50% requirement even at this looser operating point.Source: Table 8 · p. 20, §C.4 · p. 20
  • At nominal 0.1% FPR, only the paired DIPPER gain of +5.4 percentage points over random search excludes zero; the other paired differences remain within sampling uncertainty.The paired comparison uses the same 100 robustness-required prompts, with attack repetitions kept together in the bootstrap.Source: Table 9 · p. 20, §C.4 · p. 20

C.5 Qualitative Examples

  • The misuse-rule refinement raises bias after detection and robustness fail, but its exported configuration passes detection and quality while reaching only 10% robustness, so it remains Best-Effort.No measured candidate satisfied the robustness gate.Source: §C.5 · p. 21, Figure 3 · p. 21
  • The monitor distinguished medical editing from medical advice, but omitted an applicable editing rule in a grammar-correction case and consequently applied the wrong policy.The examples show requested operation, rather than subject area, determining the intended route.Source: §C.5 · p. 21, Figure 4 · p. 22

C.6 Routing Robustness

  • The monitor routed all 50 misuse-framed editing probes to misuse and exempted 49 of 50 editing-only controls, but generated probes may contain clearer misuse cues than real evasion attempts.The authors characterize this as a pilot and leave adaptive evasion for future work.Source: §C.6 · pp. 22–23, Table 10 · p. 23
  • On overlapping prompts, accuracy was close to single-rule accuracy, while a separate gpt-5.4-nano routing rerun assigned 97.0% of rules correctly versus 100.0% end-to-end, indicating run-to-run variation.The framework’s randomized-key defense, specialist agent training, and prompt-free detection extensions are not evaluated here.Source: §C.6 · p. 23, Table 11 · p. 23, D Framework Extensions · p. 23

D.1 Conditional Forgery Resistance

The appendix presents a conditional multi-key forgery bound and describes specialist-training objectives and prompt-free detector selection. It also identifies assumptions, calibration requirements, and evaluation gaps that constrain those claims.

D.1 Conditional Forgery Resistance

  • Under key blindness and equal-marginal independent forged-text detections, the per-attempt forgery bound is independent of N and tends to 1/e as K grows.The bound is conditional, not negligible, and does not bound success over unlimited attempts.Source: §D.1 · p. 24
  • The multi-key defense is conditional theoretical support: the experiments do not evaluate its wrapper, assumptions, or forgery attacks.Randomization must occur within a profile; stricter thresholds and rejecting multiple detections can reduce genuine acceptance, while testing K keys increases detection cost.Source: §D.1 · p. 25

D.2 Specialist Training Objectives

  • Proposed specialist training would supervise verifier proposals with implementations, checked derivations, and failure cases, while monitor targets preserve multiple applicable rules.Unchecked model explanations are not proof certificates, and preference learning can rank legal proposals using measured constitutional attainment.Source: §D.2 · pp. 25–26

D.3 Prompt-Free Detector Selection

  • Prompt-free routing selects a detector-equivalent configuration from the visible response, but the applied rule may not be identifiable from that response.The monitor uses the response, rules, and frozen policy; each complete monitor-and-policy procedure must be calibrated on its own null scores.Source: §D.3 · p. 26
  • That calibration provides marginal null control under exchangeability, not conditional FPR for every calibration set or shifted domain; evaluation remains future work.Rule recovery, detector equivalence, and paraphrase detection power are distinct outcomes.Source: §D.3 · p. 26

E.1 Hypotheses for Improvement

  • Improvement hypotheses include clearer rule priorities, richer theoretical and empirical context, better starting configurations, legal parameter bounds, broader watermark families, and specialist training.The initial refinement proposal failed every robustness check before feedback corrected it.Source: §E.1 · p. 27

E.2 Limitations

The evaluation is limited in scope and relies on finite, partly reused data; several measurement and security claims remain untested or conditional.

E.2 Limitations

  • The evaluation covers one watermark family, serving model, key pair, search seed, and five-rule constitution; generalization and search stability remain untested.Source: §E.2 · p. 27
  • Both agents are pretrained without specialist training; compute cost is unmatched, and deterministic-heuristic and Bayesian-optimization baselines were not evaluated.Source: §E.2 · p. 27
  • Configurations use 10 reference prompts per rule, and null texts inform both selection and reported FPRs, so adaptive reuse may overfit and deployment performance is not guaranteed.Reported intervals are descriptive, not guarantees; failure to find a passing configuration within budget does not prove infeasibility.Source: §E.2 · p. 27
  • Perplexity measures fluency rather than task correctness or distribution preservation, and the paraphrasers do not exhaust attacks or audit meaning preservation.Prompts and rule labels are synthetic and need independent validation, especially for overlapping or adversarial requests.Source: §E.2 · p. 27
  • Forgery resistance is not empirically evaluated, and rule-specific configurations under one key do not by themselves satisfy the multi-key defense assumptions.Users can target a rule and collect its configuration’s samples; shared keys can produce correlated detection outcomes.Source: §E.2 · pp. 27–28

Related papers

Loading 2610.09552v1…