The DOI matches its DataCite record; 54 of the 64 references it cites were found in a registry or an index.
A Watermark for Large Language Models
Open accessAbstract
Potential harms of large language models can be mitigated by watermarking model output, i.e., embedding signals into generated text that are invisible to humans but algorithmically detectable from a short span of tokens. We propose a watermarking framework for proprietary language models. The watermark can be embedded with negligible impact on text quality, and can be detected using an efficient open-source algorithm without access to the language model API or parameters. The watermark works by selecting a randomized set of "green" tokens before a word is generated, and then softly promoting use of green tokens during sampling. We propose a statistical test for detecting the watermark with interpretable p-values, and derive an information-theoretic framework for analyzing the sensitivity of the watermark. We test the watermark using a multi-billion parameter model from the Open Pretrained Transformer (OPT) family, and discuss robustness and security.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“more robust detectors [8, 14, 36, 1] require recursive paraphrasing to be effectively bypassed.”
From Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text (2025) · cites this paper as [14]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Additionally, watermarking presents challenges for proprietary LLMs and third-party applications due to the necessity of accessing the language model logits [Kirchenbauer et al., 2023].”
From Authorship Attribution in the Era of LLMs: Problems, Methodologies, and Challenges (2025) · cites this paper as Kirchenbauer et al., 2023
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Preliminary evidence points to the possibility of model collapse, with the models losing diversity and converging to a state with low variance 162 .”
From Machine culture (2023) · cites this paper as [162]
Experimental — accuracy not yet measuredIn the citing paper
“Despite efforts to watermark machine-created content 161 , machine-made and human-made content will increasingly intertwine 162 .”
From Machine culture (2023) · cites this paper as [162]
In the citing paper
“The human element in this cycle may prove crucial-for instance, in preventing 'model collapse', a dynamic where repeated training on machine-generated data narrows its outputs to very few traits 162 .”
From Machine culture (2023) · cites this paper as [162]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., & Polosukhin, I. (2017) · arXiv · doi:10.48550/arxiv.1706.03762 · Cited by 120,404 · cited 1×
“…via hierarchical language models in Wilson et al. (2014) still required human interactions, the emergence of modern neural language models (Vaswani et al., 2017; Devlin et al., 2019) also allowed for improved watermarking/steganography (Fang et al., 2017; Ziegler et al., 2019; Dai & Cai,…”
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2018) · arXiv · doi:10.48550/arxiv.1810.04805 · Cited by 73,173
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 54,325 · cited 2×
“(2014) still required human interactions, the emergence of modern neural language models (Vaswani et al., 2017; Devlin et al., 2019) also allowed for improved watermarking/steganography (Fang et al.”
RoBERTa: A Robustly Optimized BERT Pretraining Approach
Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., & Stoyanov, V. (2019) · arXiv · doi:10.48550/arxiv.1907.11692 · Cited by 16,515 · cited 2×
“Typical vocabularies contain |V| = 50 , 000 tokens or more (Radford et al., 2019; Liu et al., 2019).”
Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer
Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., & Liu, P. J. (2019) · arXiv · doi:10.48550/arxiv.1910.10683 · Cited by 10,929 · cited 2×
“3B (Zhang et al., 2022) using prompts from the C4 dataset’s RealNewsLike subset (Raffel et al., 2019).”
On the Dangers of Stochastic Parrots: Can Language Models Be Too Big? 🦜
Bender, E. M., Gebru, T., McMillan-Major, A., & Shmitchell, S. (2021) · Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency · doi:10.1145/3442188.3445922 · Cited by 6,988 · cited 1×
“A watermark is a hidden pattern in text that is imperceptible to humans, while making the text algorithmically identifiable as synthetic.”
Training language models to follow instructions with human feedback
Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C. L., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., et al. (2022) · arXiv · doi:10.48550/arxiv.2203.02155 · Cited by 4,208
HuggingFace's Transformers: State-of-the-art Natural Language Processing
Wolf, T., Debut, L., Sanh, V., Chaumond, J., Delangue, C., Moi, A., Cistac, P., Rault, T., Louf, R., Funtowicz, M., et al. (2019) · arXiv · doi:10.48550/arxiv.1910.03771 · Cited by 3,347
Training Language Models to Follow Instructions with Human Feedback
Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., et al. (2022) · Advances in Neural Information Processing Systems 35 · doi:10.52202/068431-2011 · Cited by 3,117 · cited 1×
“Note that instruction finetuning is already common (for example in ChatGPT) for other categories of malicious prompts, using reinforcement learning protocols (RLHF) (Christiano et al., 2017; Ouyang et al., 2022; Bai et al., 2022).”
Petitcolas, F., Anderson, R. J., & Kuhn, M. (1999) · Proceedings of the IEEE · doi:10.1109/5.771065 · Cited by 2,996 · cited 1×
“Watermarking is considered easier for continuous-valued data, where watermarks can be encoded with a variety of well-studied strategies (Petitcolas et al., 1999; Zhu et al., 2018; Lu et al., 2021; Boenisch, 2021).”
Research works printed but not linked: 7
- Foltýnek, T., Meuschke, N., and Gipp, B. Academic Plagiarism Detection: A Systematic Literature Review. ACM Computing Surveys, 52(6):112:1-112:42, October 2019. ISSN 0360-0300. doi: 10.1145/3345317. URL https://doi.org/10.1145/3345317. · DOI · Paper page
- Katzenbeisser, S. and Petitcolas, F. A. Information Hiding Techniques for Steganography and Digital Watermarking. Artech House, Inc., USA, 1st edition, 2000. ISBN 978-1- 58053-035-4.
- Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., and Sutskever, I. Language Models are Unsupervised Multi- task Learners. OpenAI, pp. 24, 2019.
- Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., and Liu, P. J. Exploring the limits of transfer learning with a unified text-to-text transformer. arXiv e-prints, 2019.
- Tian, E. Gptzero update v1, January 2023. URL https: //gptzero.substack.com/p/gptzero- update-v1. · DOI
- Venugopal, A., Uszkoreit, J., Talbot, D., Och, F., and Ganitkevitch, J. Watermarking the Outputs of Struc- tured Prediction with an application in Statistical Ma- chine Translation. In Proceedings of the 2011 Confer- ence on Empirical Methods in Natural Language Pro- cessing, pp. 1363-1372, Edinburgh, Scotland, UK., July 2011. Association for Computational Linguistics. URL https://aclanthology.org/D11-1126.
- Curran Associates, Inc., 2019. URL https://proceedings. neurips.cc/paper/2019/hash/ 3e9f0fc9b2f89e043bc6233994dfcf76- Abstract.html.
Cited by
Sorted by citations
Items 101–148 of 148
Emotion Classification using Generative Pre-trained Embedding and Machine Learning
Pattun, G., & Kumar, P. (2023) · IEEE International Conference on Machine Learning and Applied Network Technologies (ICMLANT) · doi:10.1109/icmlant59547.2023.10372980 · Cited by 6
“LLMs play crucial roles in medical diagnosis, education, creative writing, and legal research, offering versatile solutions[8], [11], [13], [14].”
BackgroundCooman, J. D. (2023) · Law Technology and Humans · doi:10.5204/lthj.2787 · Cited by 5
Detecting Artificial Intelligence: A New Cyberarms Race Begins
Campbell, M., & Jovanovic, M. (2023) · Computer · doi:10.1109/mc.2023.3279446 · Cited by 4
Rothenhäusler, A. (2024) · De Gruyter eBooks · doi:10.1515/9783111351490-013 · Cited by 4
Cross-Attention watermarking of Large Language Models
Baldassini, F. B., Nguyen, H. H., Chang, C.-C., & Echizen, I. (2024) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp48485.2024.10446397 · Cited by 5
“Kirchenbauer et al. [23] presented a comprehensive strategy for watermarking text generated by LLMs.”
BackgroundMethodA Principled Approach to Natural Language Watermarking
Ji, Z., Hu, Q., Zheng, Y., et al. (2024) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3664647.3681544 · Cited by 4
GPT-4 Attempting to Attack AI-Text Detectors
Nojoud, A., & Yuhao, L. (2024) · Lecture notes in computer science · doi:10.1007/978-981-96-0348-0_12 · Cited by 7
Building UniGPT: A Customizable On-Premise LLM-Solution for Universities
Radas, J., Risse, B., & Vogl, R. (2025) · EPiC series in computing · doi:10.29007/jv1l · Cited by 6
Vora, V., Savla, J., Mehta, D., Gawade, A. U., & Mangrulkar, R. (2023) · Research Square · doi:10.21203/rs.3.rs-3500331/v1 · Cited by 4
AI Control: Improving Safety Despite Intentional Subversion
Greenblatt, R., Shlegeris, B., Sachan, K., & Roger, F. (2023) · arXiv · doi:10.48550/arxiv.2312.06942 · Cited by 3
“The problem of AIs including secret messages in innocuous-looking outputs is known as steganography (Ray, 2022; Roger and Greenblatt, 2023) or watermarking (Kirchenbauer et al., 2023a); in this particular case the policy just needs to send a one-bit message describing whether the monitor should lie.”
BackgroundSavage, N. J. (2023) · Communications of the ACM · doi:10.1145/3596206 · Cited by 3
Enhancing Creativity in Deep Learning Models with SAVE-Inspired Activation Functions
Brad, S. (2023) · IFIP advances in information and communication technology · doi:10.1007/978-3-031-42532-5_12 · Cited by 3
Classifying AI-generated summaries And Human Summaries Based on Statistical Features
Mathews, D., Varghese, J. P., & Samuel, L. C. (2024) · International Conference on Trends in Quantum Computing and Emerging Business Technologies (TQCEBT) · doi:10.1109/tqcebt59414.2024.10545131 · Cited by 4
“By training a linear layer, the model can classify whether the text was generated by a machine[7].”
BackgroundDeep Watermarking for Deep Intellectual Property Protection: A Comprehensive SurveyPreprint
Sun, Y., Liu, L., Yu, N., Liu, Y., Tian, Q. C., & Guo, D. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4697020 · Cited by 4
Cheng, Z., Zhou, L., Jiang, F., Wang, B., & Li, H. (2025) · Proceedings of the ACM on Web Conference 2025 · doi:10.1145/3696410.3714770 · Cited by 3
Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text
Cheng, Y., Sadasivan, V. S., Saberi, M., Saha, S., & Feizi, S. (2025) · Advances in Neural Information Processing Systems 38 · doi:10.52202/085713-1588 · Cited by 3
AI in Scholarly Communications and Academic Research
Tzanova, S. (2024) · Advances in library and information science (ALIS) book series · doi:10.4018/979-8-3693-3053-1.ch002 · Cited by 3
Guo, S., Ju, Y., Chen, X., & Gu, J. (2024) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1145/3649329.3656545 · Cited by 3
“[6].”
InfluentialWatermarking Fine-Tuning Datasets for Robust Provenance
Gergov, I., & Tsochev, G. (2025) · Applied Sciences · doi:10.3390/app151910457 · Cited by 2
College Students’ Perception and Concerns regarding Online Examination amid COVID-19
Lee, H.-J., Ling, M. H., & Yau, K. A. (2023) · International Journal on Advanced Science Engineering and Information Technology · doi:10.18517/ijaseit.13.4.18588 · Cited by 2
Beyond Binary Classification: Customizable Text Watermark on Large Language Models
Xu, Z., Xu, R., & Sheng, V. S. (2024) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn60899.2024.10650062 · Cited by 3
“Kirchenbauer et al. [7] represent a seminal work in this area, developing a method that creates a random seed based on the hash value of the previous token and divides the vocabulary into a ’green list’ and a ’red list’ for token sampling.”
MethodLLMs meet the AI Act: Who’s the sorcerer’s apprentice?
Pagallo, U. (2025) · Cambridge Forum on AI Law and Governance · doi:10.1017/cfl.2024.6 · Cited by 3
SEFD: Semantic-Enhanced Framework for Detecting LLM-Generated Text
He, W., Hou, B., Shang, T., Tarzanagh, D. A., Long, Q., & Shen, L. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825110 · Cited by 6
“Detection score distributions for four different detectors: Log-Likelihood [18], DetectGPT [16], Intrinsic Dimension [19], and Soft Wa-termarking [7].”
InfluentialA Robust Image Watermarking Approach for Application in AI Generated Images
Aditto, T. A., Shahariar, M. R., & Imtiaz, H. (2024) · International Conference on Electrical and Computer Engineering (ICECE) · doi:10.1109/icece64886.2024.11025115 · Cited by 2
ChatGPT: Vriend en vyand in die Geografie-vakdidaktiek-klaskamer? Implikasies vir die praktyk
Staden, C. V. (2023) · Litnet Akademies : 'n Joernaal vir die Geesteswetenskappe, Natuurwetenskappe, Regte en Godsdienswetenskappe · doi:10.56273/1995-5928/2023/j20n2d5 · Cited by 4
Yan, M., Su, Z., Wang, Y., Ran, X., Liu, Y., & Luan, T. H. (2023) · Globecom · doi:10.1109/globecom54140.2023.10437312 · Cited by 2
“The existing works in watermark-based IP protection upon centralized models basically follow two lines: i) model-based methods [5]–[7], and ii) data-based methods [8]–[12].”
MethodMeng, D., Wang, Z., Phuntsho, T., & Gonsalves, T. (2025) · Egyptian Informatics Journal · doi:10.1016/j.eij.2025.100752 · Cited by 1
Using AI to control AI-assisted plagiarism in L2 writing: a critical review of the literature
Ibrahim, K. H. S. (2026) · Language Testing in Asia · doi:10.1186/s40468-026-00433-9 · Cited by 1
Künstliche-Intelligenz-Quellen
Besenbäck, R., & Prager, L. (2024) · De Gruyter eBooks · doi:10.1515/9783111351490-032 · Cited by 1
Solving Tensor Low Cycle Rank Approximation
Deng, Y., Gao, Y., & Song, Z. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386872 · Cited by 6
“A novel algorithm for detecting watermarks in language models without requiring access to the model’s parameters or API is introduced by [56].”
MethodResearch on Detecting ChatGPT Rewritten Text
Wang, Z., Li, D., & Jin, X. (2024) · doi:10.1109/ictech63197.2024.00092 · Cited by 1
“John Kirchenbauer et al. [17] proposed a watermarking method that divides the vocabulary into two parts based on a certain proportion.”
Lucas, E. (2023) · Digital Commons - Michigan Tech (Michigan Technological University) · doi:10.37099/mtu.dc.etdr/1599
Inaugural Defense and Security Research Symposium of the Purdue Military Research Institute
Laux, C. M., Dietz, J. E., Rapp, R. R., & Robert, L. L. (2024) · Purdue University Press eBooks · doi:10.5703/1288284317732
A Sentence-Semantic-Based Watermark for Large Language Models Against Paraphrasing AttacksPreprint
Wang, H., Zhao, L., Lyu, X., Gao, L., Song, J., & Shen, H. T. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4774832
Road to AGI: The Importance of Clear Objectives and Reward FunctionsPreprint
Rasoolinejad, M. (2024) · Preprints.org · doi:10.20944/preprints202407.0687.v1
The Tremendous Influence of Large Language Models on Academia and Strategies for Coping with It
Yi, C., Li, S., & Ge, B. (2024) · International Conference on Educational Knowledge and Informatization (EKI) · doi:10.1145/3691720.3691749
On Text Granularity and Metric Frameworks for Large Language Model Content Detection
Le, L., & Tran, D. T. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825505
“The third approach, watermarking [8], [23], modifies a LLM to insert specific signatures into its outputs.”
Lamb, C., Brown, D., & Grossman, M. R. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5045638
Removing Regional Steering Vectors to Achieve Knowledge Domain Forgetting in Large Language Models
Wu, W., Wang, C., Xu, Q., & Kong, W. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-4566-4_18
Evaluating the Accuracy of AI Content DetectorsPreprint
YILDIZ, F. E., Karaarslan, E., & Aydın, Ö. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5364392
German, E., Antebi, S., Habler, E., Shabtai, A., & Elovici, Y. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5385338
Statistical and Machine Learning Methods for Detecting AI-Generated Content in Gen AI Systems
Kumar, K. P., Soumya, E., & Mani, J. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-2600-0368-8.ch008
Combining probabilistic features and semantic features for AI-Generated text detection
Yu, Y., & Gao, W. (2026) · International Journal of Scientific Research and Management (IJSRM) · doi:10.18535/ijsrm/v14i09.ec01
HybridDetect: Detecting Partial AI Contamination in Student Essays via Multi-Class Classification
Dan, D., & Nakayama, M. (2026) · Annals of Computer Science and Information Systems · doi:10.15439/2026f3512
“Academic detection approaches include DetectGPT [2], which uses perturbation-based log-probability curvature analysis, and watermarking schemes [4] that embed statistical signals during generation.”
Phantom References: Hallucinated Citations That Survive Peer Review at Top-Tier Conferences
Russinovich, M., Kumar, R. S. S., & Salem, A. (2026) · arXiv · doi:10.48550/arxiv.2607.00738 · Cited by 4
“…whether a statement is supported by its source [25], evaluating verifiability in generative search engines [26], and training models to emit inline citations grounded in retrieved evidence [27], [28], on the foundation of automated fact verification [29] and alongside AI-text detection [30], [31].”
How to Steal Reasoning Without Reasoning Traces
Zhang, T., Morris, J. X., & Shmatikov, V. (2026) · arXiv · doi:10.48550/arxiv.2603.07267
“Performance gains from inverted traces are generally larger for Qwen than for Llama , and Llama exhibits weaker gains on Live-CodeBench across all fine-tuning methods.”
Protecting Language Models Against Unauthorized Distillation through Trace Rewriting
Ma, X., Yeoh, W., Zhang, N., & Vorobeychik, Y. (2026) · arXiv · doi:10.48550/arxiv.2602.15143
EditLens: Quantifying the Extent of AI Editing in Text
Thai, K., Emi, B., Masrour, E., & Iyyer, M. (2025) · arXiv · doi:10.48550/arxiv.2510.03154 · Cited by 3
“All of the above methods operate in the post-hoc setting, in contrast to work on watermarking (Kirchenbauer et al., 2024) in which the model’s decoding algorithm is modified to enable detection.”
Metadata
- Authors
- Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., & Goldstein, T.
- Affiliations
- University of Maryland, College Park (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2023
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2301.10226
- OpenAlex
- W4318149317
- Cited by
- 194
- References
- 64
- Citations by year
- 2026: 4 · 2025: 73 · 2024: 64 · 2023: 53
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Funders
- National Science Foundation (2212182, 2229885)
- Open Philanthropy Project
- Defense Advanced Research Projects Agency (HR00112020007)
- Multidisciplinary University Research Initiative
- Office of Naval Research (N000142112557)
- Air Force Office of Scientific Research
- Topics
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Steganography and Watermarking Techniques
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- watermarking, large language models, watermark detection, hypothesis testing, information-theoretic analysis, watermark robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
