SemField: A Simple, Linear, Continuous, yet Robust Semantic Watermark

1 INTRODUCTION

• The work targets reliable attribution as AI-generated text spreads, addressing token-watermark vulnerability to paraphrasing and the need for robust detection without degraded text quality.Semantic watermarks instead tie evidence to sentence meaning rather than exact wording.Source: §1 · pp. 1–2
• SEMFIELD uses a secret-key Gaussian direction to select candidate sentences that best improve a continuous signal over the prospective document aggregate.The method is described as simple, linear, and training-free.Source: §1 · p. 2
• Across three models, both variants achieve mean TPR@1% of 88.2–90.4% versus 77.6–81.7% for each model’s strongest baseline.SEMFIELD-PL reaches mean TPR@5% of 96.4–96.6% versus 91.9–94.2% for each model’s strongest baseline; both variants rank in the top two for MAUVE, with perplexity within the compared methods’ range.Source: §1 · p. 2
• SEMFIELD-PL locks the alignment orientation using the first sentence, while document-level aggregation provides exact reordering invariance and bounded score changes under sentence insertion or deletion.At detection, the normalized sum of sentence embeddings is projected onto the keyed direction and evaluated against a standard normal distribution.Source: §1 · p. 2

Token-based watermarks

• Token-based methods alter token sampling or probabilities using a secret key and detect whether selected tokens occur unusually often.Examples include green-list sampling, keyed exponential or tournament sampling, and distortion-free sampling with alignment-based detection.Source: §2 · p. 3

Semantic watermarks

• Semantic methods encode evidence through choices among semantically related realizations, using partitions, clusters, geometric constraints, or relations between representations.Other variants use richer semantic codes, smaller semantic units, order-robust aggregation, or post-hoc lexical changes.Source: §2 · p. 3

Learning-based watermarks

• Learning-based methods train part of the watermarking mechanism, such as a context-to-token transformation, a joint generator-detector, or an encoder–decoder.Some work also jointly optimizes watermark policies for open-source models and targets robustness to later model modifications.Source: §2 · p. 3

3.1 SETUP

• A detector uses the document and secret key to test whether the document was generated independently of the keyed watermarking procedure.It declares a watermark when the resulting p-value falls below a threshold chosen for the desired FPR.Source: §3.1 · p. 4

3.2 KEYED SEMANTIC FIELD

• The key defines a Gaussian direction whose projection scores normalized sentence embeddings; similar embeddings receive correlated, continuous field values.For a fixed normalized embedding, the field score is standard normal.Source: §3.2 · p. 4

3.3 DOCUMENT-LEVEL SEMANTIC STATISTIC

• The document statistic projects the normalized sum of sentence embeddings onto the keyed direction, preventing repeated identical sentences from artificially inflating the score.The linearity of the field makes the sum of sentence-level values equal the projection of the aggregate.Source: §3.3 · p. 4

3.4 SEMFIELD GENERATION

• At each step, SEMFIELD samples candidate sentences and selects the one whose prospective document aggregate has the highest detection statistic.This greedy rule favors alignment with the keyed direction and optimizes the statistic used at detection.Source: §3.4 · p. 5

3.5 SEMFIELD DETECTION

• Detection recomputes the document aggregate and evaluates its alignment with the keyed direction; a small upper-tail p-value indicates evidence against the null.Under the null, the document is independent of the tested key.Source: §3.5 · p. 5

3.6 POLARITY LOCKING (PL)

• SEMFIELD-PL chooses the stronger orientation from the first candidate set and reinforces that fixed direction, avoiding orientation switches that can cancel contributions.The rule reduces to regular SEMFIELD for the positive orientation and can reinforce the negative direction.Source: §3.6 · pp. 5–6

3.7 STRUCTURAL ROBUSTNESS

• Detection is exactly invariant to reordering intact sentences, while insertion or deletion changes the score by a bounded amount that cannot flip a decision beyond that margin.The reordering guarantee assumes unchanged sentence boundaries and embeddings; the edit bound applies when both aggregates are nonzero.Source: §3.7 · p. 6

4.1 SETUP AND BASELINES

• The evaluation uses 500 documents from C4-REALNEWSLIKE and runs independently on LLAMA-3.2-1B, QWEN3-1.7B, and OPT-1.3B.Each document's first sentence is the generation prompt, with the remainder as the human-written reference continuation.Source: §4.1 · pp. 6–7
• SEMFIELD and SEMFIELD-PL are compared with 12 recent baselines, using original baseline parameters and shared generation settings.Best-of-Q methods use Q = 64; semantic methods use ALL-MPNET-BASE-V2 embeddings, and generation uses temperature 0.7, top p 0.95, and repetition penalty 1.05.Source: §4.1 · p. 7

4.2 ATTACKS AND EVALUATION

• Robustness evaluation includes clean outputs, sentence-level rewriting, and document-level rewriting, with paraphrasers given neither the secret key nor detector.PEGASUS and PARROT rewrite sentences; DIPPER and LLM-REWRITE paraphrase documents end-to-end while aiming to preserve meaning.Source: §4.2 · p. 7
• Detection is reported with AUROC and TPR at 1% and 5% FPR, with 1% FPR designated the stricter main operating point.Mean TPR across clean text and four rewrite attacks summarizes detection across unattacked and rewritten text.Source: §4.2 · pp. 7–8
• Clean-text quality is assessed using corpus-level perplexity and PPLRatio against the human reference, with ratios near 1.0 indicating similar predictability.The study also uses MAUVE to assess naturalness, as stated in the evaluation setup.Source: §4.2 · p. 8
• Structural stress tests measure TPR@1% FPR across insertion, dilution, deletion, and reordering strengths without paraphrasing the text.The attacks respectively add empty markers, mix in null-text sentences, remove original sentences, or permute sentence positions.Source: §4.2 · p. 8

5.1 OVERALL DETECTION, PARAPHRASE ROBUSTNESS, AND TEXTUAL QUALITY

• 88.2%–90.4% mean TPR@1% FPR places SEMFIELD and SEMFIELD-PL in the top two positions across three models; SEMFIELD-PL also leads mean TPR@5% FPR at 96.6%, 96.4%, and 96.4%.The strongest baselines score 78.0%, 78.2%, and 81.7% mean TPR@1% FPR.Source: §5.1 · p. 9, Table 1 · p. 9, Table 2 · p. 9
• Under LLM-REWRITE, SEMFIELD-PL beats SAMARK in TPR@1% FPR on all three models, while both variants keep Corpus PPL near baseline medians or below.SEMFIELD-PL scores 66.4%, 76.0%, and 69.2%, versus SAMARK’s 64.6%, 60.2%, and 67.2%.Source: §5.1 · pp. 9–10, Table 4 · p. 10
• Polarity locking raises mean TPR@5% FPR by 3.0, 2.8, and 2.6 points across the three models, but does not improve TPR@1% in every condition.Under LLM-REWRITE, the stricter two-sided cutoff explains lower PL TPR@1% on two models despite similar score drops.Source: §5.1 · p. 10

5.2 STRUCTURAL ROBUSTNESS

• Figure 1 shows that at 80% insertion, SEMFIELD-PL achieves 70.4–75.2% TPR@1% across three models versus SEMFIELD’s 47.8–62.2%; at the same deletion strength, their ranges are 79.2–84.2% and 71.8–80.6%, respectively.For intact-sentence reordering, SEMFIELD and SEMFIELD-PL remain at clean detection levels of 96.8–98.0% and 99.6–100.0%, respectively.Source: §5.2 · p. 11
• At 80% dilution, SEMFIELD retains 37.4–52.8% TPR@1%, exceeding SEMFIELD-PL’s 21.4–28.6%; the one-sided variant is more resistant to dilution, while polarity locking generally helps insertion and deletion.Both methods show good robustness through 40% dilution, after which SEMFIELD-PL drops sharply.Source: §5.2 · pp. 11–12

5.3 EFFECT OF CANDIDATE DIVERSITY.

• On LLAMA-3.2-1B, temperature 1.0 raises mean TPR@1% from 88.2% to 97.4%, but Corpus PPL rises from 6.90 to 34.66 and selected candidates can be awkwardly phrased.The temperature comparison holds the other generation parameters unchanged.Source: §5.3 · pp. 12–13, Table 7 · p. 13
• Mean TPR@1% rises from 4.0% at Q = 2 to 90.2% at Q = 64 and 95.2% at Q = 128, while higher candidate budgets mainly add computation rather than improving PPLRatio.Clean detection begins to level off at larger budgets (≥32).Source: §5.3 · p. 13, Figure 2 · p. 13

5.4 PRACTICAL DEPLOYMENT SCENARIOS

• With frozen thresholds, both variants remain the top two in mean TPR across models; in 100-key testing, own-key detection is 99.518% and unrelated-key detection is 1.065%.SEMFIELD-PL’s mean TPR@1% FPR is 89.3%, 91.2%, and 89.5%, versus 72.5%, 73.4%, and 76.8% for SWORDSTAMP.Source: §5.4 · pp. 13–14

6 CONCLUSION

• Across 12 baselines and four paraphrasing attacks, both variants rank in the top two for mean TPR@1% and MAUVE across three models, with perplexity near the baseline median.The conclusion also reports exact reordering invariance and provable score stability under small content perturbations.Source: §6 · p. 14
• SEMFIELD selects sentences to improve the normalized document projection onto a continuous Gaussian-keyed field; SEMFIELD-PL first chooses an orientation and reinforces it.Source: §6 · p. 14
• The authors present the approach as a proof of concept and hope it motivates robust watermarks that remain detectable under rewriting while maintaining sufficient generation quality.Source: §6 · p. 14

7 LIMITATIONS AND SCOPE OF WORK

• The experiments target vanilla language modeling and base models, and test only English sentence-based text, which may not fit languages without clear sentence boundaries.Source: §7 · p. 14
• Evaluation covers three models and a 500-document cohort, with one embedding model and dataset held constant across runs.The cohort corresponds to four times as many evaluations when attacks are included.Source: §7 · p. 14
• The authors do not claim overall state-of-the-art performance across methods, models, and use cases; they frame the work as a proof of concept.Source: §7 · p. 14
• Future work could explore more efficient sampling and multidimensional candidate selection for safety, helpfulness, correctness, and low-entropy generations such as math or code.Source: §7 · p. 14

A PROPOSITIONS, THEOREMS AND PROOFS

• The keyed field responses for two fixed embeddings have covariance equal to their inner product.Source: A PROPOSITIONS, THEOREMS AND PROOFS · p. 18
• Under the stated null assumptions, the normalized document score has a conditional standard normal distribution.The document must be independent of the randomly drawn tested key, and its aggregate must be nonzero.Source: A PROPOSITIONS, THEOREMS AND PROOFS · p. 19
• For a fixed key, the field response is continuous over normalized embeddings.The proof bounds score changes using the distance between unit vectors.Source: A PROPOSITIONS, THEOREMS AND PROOFS · p. 19
• Permuting intact sentences leaves the aggregate and both detectors' scores exactly unchanged.This follows because reordering changes only the order of terms in the finite vector sum.Source: A PROPOSITIONS, THEOREMS AND PROOFS · p. 20
• For insertion or deletion perturbations, both variants' score changes are bounded by a quantity determined by the keyed direction and the aggregate change.If the original score's margin from the detection threshold exceeds the edit bound, the attack cannot change the detection decision.Source: A PROPOSITIONS, THEOREMS AND PROOFS · pp. 20–21

B HIGHER-ORDER POLYNOMIAL FIELDS: EXPRESSIVITY AND COST

• A degree-m field maps normalized sentence embeddings into tensor-product features and computes the document statistic from the transformed aggregate projected onto a keyed direction.The document-level construction is preserved as the polynomial degree changes.Source: B HIGHER-ORDER POLYNOMIAL FIELDS:… · pp. 21–22
• For nearby embeddings, increasing polynomial degree can enlarge response differences and may provide a larger candidate-selection margin when embeddings occupy a narrow region.Source: B HIGHER-ORDER POLYNOMIAL FIELDS:… · p. 22
• Higher degree also magnifies response changes from rewriting, creating an expressivity–stability trade-off rather than an unconditional robustness gain.Source: B HIGHER-ORDER POLYNOMIAL FIELDS:… · p. 22
• Explicit degree-m features require O(dm) space and operations per candidate, with the number of symmetric monomials still large for modern embedding dimensions.Source: B HIGHER-ORDER POLYNOMIAL FIELDS:… · p. 22
• Approximate feature maps reduce storage to O(p), but approximate the polynomial inner products with error dependent on p and must be fixed consistently for generation and detection.Source: B HIGHER-ORDER POLYNOMIAL FIELDS:… · p. 23
• The linear field studied in the paper avoids higher-order costs and retains direct linear dependence on the embedding representation.Source: B HIGHER-ORDER POLYNOMIAL FIELDS:… · p. 23

• Table 8 reports fixed-threshold detection results for LLAMA-3.2-1B.Source: Table 8 · p. 23
• Both tables use the same cutoff for clean and all rewriting conditions, and mark best and second-best column values.Source: Table 8 · p. 23, Table 9 · p. 23
• Table 9 reports fixed-threshold detection results for QWEN3-1.7B.Source: Table 9 · p. 23

• The algorithm fragment appends ct to D within a loop.Source: D SEMFIELD ALGORITHMS · p. 24
• The shown algorithm fragment ends by returning D.Source: D SEMFIELD ALGORITHMS · p. 24
• Figure 3 covers generation and detection for regular SEMFIELD and polarity-locked SEMFIELD-PL.Source: Figure 3 · p. 24