Source-linked AI summary
Watermarkability: Measuring and Improving Language-Model Compatibility with Logit-Based Watermarks
Zewei Deng, Mohamed Seif, Liyan Xie
TL;DR
Because the same logit bias can have different effects as native target-set mass varies, the paper measures model–watermark compatibility and proposes an adapter-plus-controller method. Across OPT-125M and Qwen3-8B, it maintains at least 99.80% adherence while reducing PPL relative to a near-hard fixed-bias baseline.
Problem
Native probability mass on requested sets varies across contexts, models, and watermark rules, so the same logit bias can yield different adherence rates and PPL changes.
Source: §1 · p. 2Method
The method trains a target-set-conditioned adapter on unions from a 16-way vocabulary partition, then uses a closed-form controller to apply the smallest remaining uniform bias needed to reach target mass.
Source: §1 · p. 2Results
At least 99.80% adherence accompanies mean per-schedule prompt-conditional PPL reductions of 46.3% on OPT-125M and 5.2% on Qwen3-8B versus near-hard δ = 20.
Source: §1 · p. 3Takeaways & Limitations
Across 12 model–rule pairs, pre-adaptation watermarkability cost generally tracks fixed-bias log-PPL increases (Pearson r = 0.929), providing a compatibility measure at prescribed target mass.
Source: §1 · p. 2Further evaluation across more models, prompt domains, and quality measures is needed, and improving gains on larger models remains future work.
Source: §6 · p. 10
Abstract
from arXiv · showhide
Language-model watermarks can help identify model-generated text, encode provenance information, and detect post-generation edits. A broad class of logit-based watermarks increases the logits of a designated token set at each decoding step. Because a base model's native probability mass on this set varies across contexts, models, and watermark rules, the same logit bias can yield different adherence rates and increases in perplexity (PPL). We introduce watermarkability to characterize the compatibility between a model and the token sets requested by a watermark. At a target mass $\tau$, we quantify this property through a watermarkability cost: the expected minimum KL divergence from the base-model distribution required to assign probability at least $\tau$ to the requested set. A lower cost means that the model is more watermarkable for that request distribution. To reduce this cost, we propose a two-stage method. In the first stage, we train a target-set-conditioned low-rank adapter on unions drawn from a 16-way vocabulary partition to increase the requested set's probability mass. In the second stage, a closed-form controller applies the smallest remaining uniform logit bias needed to reach the target mass. We evaluate the method on six watermark schedules using OPT-125M and Qwen3-8B. Across the 12 model-schedule pairs, the pre-adaptation watermarkability cost correlates with the log-PPL increase under a near-hard fixed-bias baseline (pooled Pearson $r=0.929$). For every schedule, at least 99.80% of sampled tokens fall in the target set requested at their decoding step. At this reliability, the adapter and controller reduce average per-schedule prompt-conditional PPL by 46.3% on OPT-125M and 5.2% on Qwen3-8B relative to the fixed-bias baseline.
1 Introduction
The paper measures model–watermark compatibility through watermarkability cost and proposes a two-stage method to reduce it without changing requested sets. Across two models and six schedules, the method maintains high adherence while reducing prompt-conditional PPL relative to a fixed-bias baseline.
1 Introduction
- The same logit bias can produce different adherence rates and PPL changes because native target-set probability varies across contexts, models, and watermark rules.Source: §1 · pp. 1–2
- Watermarkability cost measures the minimum distributional change needed to reach a prescribed target-set probability; lower cost means greater compatibility with the watermark rule.The cost is averaged over contexts and target sets induced by the rule.Source: §1 · p. 2
- Across 12 model–rule pairs, higher watermarkability cost generally accompanies larger fixed-bias log-PPL increases (Pearson r = 0.929).Source: §1 · p. 2
- A target-set-conditioned adapter raises requested-set mass, then a closed-form controller applies the smallest remaining uniform logit bias needed to reach τ = 0.99.The adapter is trained on generic unions from a 16-way vocabulary partition and evaluated on six held-out schedules.Source: §1 · p. 2, Figure 1 · p. 2
- At least 99.80% adherence accompanies mean per-schedule prompt-conditional PPL reductions of 46.3% on OPT-125M and 5.2% on Qwen3-8B versus near-hard δ = 20.PPL decreases on all six OPT schedules and four of six Qwen schedules.Source: §1 · pp. 2–3
2 Related Work
Prior watermark work varies how preferred token sets are selected, activated, or structured, while other approaches calibrate interventions, redesign partitions, or train watermarked generation. This paper distinguishes its approach by adapting at runtime to externally specified sets and controlling their probability mass.
Vocabulary-partition and structured watermarking
- Green-list variants alter how preferred subsets are formed or activated, while multi-bit and code-constrained methods encode payloads or impose local patterns [Kirchenbauer et al., 2023, 2024; Zhao et al., 2024; Lee et al., 2024; Liu and Bu, 2024; Guo et al., 2024; Yoo et al., 2024; Xu et al., 2026; Chao et al., 2024; Xie et al., 2025; Deng et al., 2026b,a].Source: §2 · p. 3
Adaptive intervention and probability-aware partitioning
- Adaptive-bias methods calibrate intervention and balanced-list methods redesign partitions, whereas this framework measures compatibility for externally specified sets and controls target mass across set compositions [Pang et al., 2024; Wang et al., 2025; Gu et al., 2026; Park et al., 2026; Liu and Bu, 2024].Source: §2 · p. 3
Learning watermarked generation
- Unlike watermark distillation, the adapter conditions at runtime on requested sets, supporting different keys, symbols, cardinalities, and prefix-dependent schedules over shared base buckets [Gu et al., 2024; Hu et al., 2022].It combines cross-schedule training with an analytic reliability controller.Source: §2 · p. 3
3 Watermarkability
Watermarkability describes how readily a model can meet a watermark rule’s target-set probability requirement at a fixed target mass. Its cost is the minimum KL change needed for each request, averaged over contexts and requested sets.
3 Watermarkability
- Watermarkability is compatibility between a model and watermark rule: at fixed τ, less adjustment to the next-token distribution means higher watermarkability.Source: §3 · p. 3
- When native target mass M_t already meets τ, the minimum cost is zero; otherwise, the cost measures the distributional change required to meet the request.Source: §3 · p. 4
- Cost depends on the specific target set, so two sets of equal size can have different costs when their native probability masses differ.Source: §3 · p. 4
- The watermarkability cost averages minimum single-step KL divergence over prefixes and requested sets sampled under the model and rule.The sampling distribution includes the context protocol and the rule’s key and payload randomness.Source: §3 · p. 4
- Low native target-set mass tends to require selecting lower-probability tokens and can increase perplexity; watermarkability cost measures compatibility at matched target mass before generation.Source: §3 · p. 4
4 A Two-Stage Method for Reducing Watermarking Cost
The method reduces the distortion needed to honor a watermark’s requested target sets while preserving the watermark rule’s schedule. A target-set-conditioned adapter raises requested-set mass, and a controller supplies the smallest remaining bias needed to reach the target mass.
4 A Two-Stage Method for Reducing Watermarking Cost
- A shared adapter is conditioned on each current target set to increase its probability mass, followed by a controller that supplies the remaining bias without changing the watermark schedule.The target set remains the one specified by the watermark rule.Source: §4 · p. 5
4.1 Vocabulary Partition and Training Requests
- The vocabulary is partitioned into 16 base buckets, whose unions form target sets for fixed, scheduled, or prefix-and-key-dependent requests.The 16-way granularity supports Anchor-ECC’s allocation of 2 boundary buckets and 7 buckets per payload symbol, as well as keyed unions for grouped KGW variants.Source: §4.1 · pp. 5–6
4.2 Target-Set Conditioning and LoRA
- The adapter uses a shared target-set condition derived from likely next tokens, combining requested-set membership signs with probability weighting before projecting the summary into the model’s hidden dimension.The condition is recomputed from the current target set, while the adapter parameters are shared across decoding steps and schedules.Source: §4.2 · pp. 6–7
4.3 Closed-Form Reliability Controller
- The controller applies the smallest nonnegative uniform shift to target-set logits that reaches mass τ, while preserving their pairwise logit differences.The adapter shapes which requested tokens fit the context; the controller supplies the remaining aggregate mass for reliability.Source: §4.3 · p. 7
4.4 Training Objective
- Training minimizes controlled-token negative log-likelihood, a penalty on squared residual bias, and KL divergence from the frozen model.The terms encourage natural choices within the target set, encourage the adapter to raise target-set mass before control, and limit drift from the frozen model.Source: §4.4 · p. 7
5 Experiments
Experiments test whether pre-adaptation watermarkability cost tracks fixed-bias generation cost, then compare the adapted method with fixed bias at high adherence. Across six schedules, LoRA+Controller lowers mean per-schedule PPL on both models, with larger gains on OPT-125M.
5.1 Experimental Setup
- Evaluation uses OPT-125M and Qwen3-8B, six held-out watermark schedules, 256 prompts per schedule, 96 generated tokens, and target mass τ = 0.99.Fixed-δ adds bias 20 and achieves 99.94–100% adherence across the 12 model–schedule pairs; PPL comparisons are within each model.Source: §5.1 · pp. 7–8
5.2 Watermarkability and Generation Cost
- Across 12 model–rule pairs, watermarkability cost tracks fixed-bias log-PPL increase (pooled Pearson r = 0.929), and both measures are higher for Qwen than OPT.Fixed-bias PPL ranges from 3.58× to 13.18× the clean value on Qwen, versus 0.91× to 3.68× on OPT.Source: §5.2 · pp. 8–9
5.3 Reliability-Matched Composition-Pool Results
- At ≥99.80% adherence, LoRA+Controller reduces mean per-schedule PPL by 46.3% on OPT-125M and 5.2% on Qwen3-8B; all six OPT and four Qwen schedules improve.The 95% intervals for mean per-rule reduction are 43.6–48.6% on OPT and 0.6–9.3% on Qwen; Qwen outcomes vary more across schedules.Source: Table 3 · p. 9, §5.3 · p. 9
- LoRA alone reaches 46.4% macro adherence on OPT and 44.3% on Qwen; adding the controller raises these to 99.83% and 99.82%.The mean residual bias falls from 4.78 to 3.64 on OPT and from 5.09 to 4.11 on Qwen.Source: Table 4 · p. 9, §5.3 · p. 9
6 Discussion and Conclusion
The paper defines watermarkability cost as a compatibility measure and combines a target-set-conditioned adapter with a closed-form controller. Experiments report that this measure tracks fixed-bias PPL increases and that the method reduces PPL at high adherence.
6 Discussion and Conclusion
- The two-stage method reduces PPL relative to fixed bias by 46.3% on OPT-125M and 5.2% on Qwen3-8B, with adherence at or above 99.80%.The adapter trains on unions of sixteen vocabulary buckets; the controller adds only the remaining bias needed to reach τ.Source: §6 · p. 10
- The authors identify broader evaluation and stronger larger-model gains as future work, alongside extending watermarkability beyond target-set watermarks.They also propose using the cost before deployment to choose a watermark rule and target mass for a model.Source: §6 · p. 10
A Target Schedules and Composition Coverage
The appendix describes the held-out watermark schedules and the generic composition curriculum used for adapter training.
A Target Schedules and Composition Coverage
- Table 5 lists watermark schedules used only for held-out evaluation; “dynamic” denotes a base-bucket union that changes with the generated prefix.The caption defines the term but does not specify the individual schedule entries.Source: Table 5 · p. 12
- The generic cardinality curriculum excludes schedule labels from its training trajectories.Table 6 reports distinct base-bucket unions covered by that curriculum.Source: A Target Schedules and Composition… · p. 12, Table 6 · p. 12
- ECC continuations contain twelve blocks of seven payload requests and one boundary request; CW repeats its eight-symbol pattern twelve times.An exact block requires every position to realize its requested set.Source: A Target Schedules and Composition… · p. 13
B Complete Composition-Pool Results
The appendix tables provide complete composition-pool evaluation results separately for OPT-125M and Qwen3-8B.
B Complete Composition-Pool Results
- Table 7 covers the complete OPT-125M evaluation after generic composition-pool training, with adherence shown as a fraction.The supplied caption does not include the table’s values.Source: Table 7 · p. 13
- Table 8 covers the complete Qwen3-8B evaluation after generic composition-pool training, with adherence shown as a fraction.The supplied caption does not include the table’s values.Source: Table 8 · p. 13
C Illustrative Qwen Generations
Three matched Qwen examples compare fixed-bias and LoRA+Controller continuations at the same prompt and decoding settings; the examples pair lower sequence-level NLL with visibly cleaner text.
C Illustrative Qwen Generations
- In the double-slit example, LoRA+Controller lowers PPL from 14.93 to 7.03 while both continuations have 1.000 adherence.The fixed-bias text repeats and trails off, while the adapted continuation begins a direct explanation.Source: C Illustrative Qwen Generations · pp. 13–14
- For the scientific-law prompt, LoRA+Controller lowers PPL from 18.96 to 11.76 with 1.000 adherence in both cases.The fixed-bias continuation repeats its opening, while the adapted response proceeds to address the question.Source: C Illustrative Qwen Generations · pp. 13–14
- For the gamma-ray prompt, LoRA+Controller has PPL 11.87 versus 18.09 for fixed δ = 20, with adherence 0.990 versus 1.000.The paired continuations illustrate the same lower-NLL, cleaner-text pattern described for the selected cases.Source: C Illustrative Qwen Generations · pp. 13–14
D Schedule-Aware Training Ablation
The schedule-aware ablation compares training on evaluation-family target sets with generic composition training, while the controller derivation specifies the bias needed to reach target mass.
D Schedule-Aware Training Ablation
- Schedule-aware training yields mean per-rule PPL reductions of 48.5% on OPT and 8.2% on Qwen, versus 46.3% and 5.2% under generic composition training.Both settings improve four Qwen schedules in point estimate; schedule-aware training uses 35,000 trajectories versus 20,000 for generic composition.Source: D Schedule-Aware Training Ablation · p. 14
- All six schedule-aware OPT PPL-reduction intervals lie above zero, including ECC [21.3, 27.4]% and Binary [59.7, 67.3]%.The other intervals are CW-ABCD [43.5, 57.7]%, Unigram [53.6, 62.7]%, Grouped-KGW50 [46.4, 55.9]%, and Grouped-KGW25 [33.7, 49.2]%.Source: D Schedule-Aware Training Ablation · p. 15
- Qwen schedule-aware PPL changes vary: ECC is [+13.9, +25.0]% and Unigram [−45.2, −29.6]% versus fixed δ = 20; positive values mean higher PPL.The intervals for CW, Grouped-KGW50, and Grouped-KGW25 include zero.Source: D Schedule-Aware Training Ablation · p. 15
E Controller Derivation
- The controller derivation solves for a common target-set logit bias from current mass M and target mass τ, with no positive intervention when M ≥ τ.The target mass after adding bias α is e^αM/(1 − M + e^αM).Source: E Controller Derivation · p. 15
F Partition, Training, and Compute Details
The appendix specifies how vocabulary buckets, adapter training, and compute were configured, and notes that lower-cost watermark realization has deployment risks requiring safeguards.
F Partition, Training, and Compute Details
- The partition groups tokens by semantic LSH signature and native-probability stratum, balancing bucket sizes, semantic spread across L buckets, and discrete assignments.The partition optimizer's regularizers implement these count, semantic, and entropy objectives.Source: F Partition, Training, and Compute… · p. 16
- Each model-specific partition uses 5,000 calibration contexts and 500 validation contexts, with 256-context minibatches for estimating the mass-balancing objective.The setup also applies aggregation levels K ∈ {2, 4, 8, 16}, eight-bit semantic LSH, and 256 native-mass strata.Source: F Partition, Training, and Compute… · p. 16
- Composition-pool runs take 1.49 hours for OPT and approximately 8.6 hours for Qwen on one A100-SXM4-40GB GPU; schedule-aware runs take 2.63 and 15.3 hours.Both adapters use rank 16 and six epochs; Qwen selects its epoch-1 checkpoint by validation objective.Source: F Partition, Training, and Compute… · p. 16
G Broader Impact
- Deployment of lower-cost watermark realization requires defenses against spoofing, key theft, removal, and false attribution, as well as key management, calibration, and detector audits.The paper notes that the approach may aid provenance while also facilitating misuse.Source: G Broader Impact · p. 16