Paper deep dive

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

Xiaoyan Feng, Yanjun Zhang, He Zhang, Leo Yu Zhang, Shirui Pan

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 65

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%

Last extracted: 8/14/2026, 5:00:27 AM

Summary

The paper introduces 'Cocktail', a novel LLM watermarking method that co-embeds robust and fragile signals to simultaneously provide provenance tracing and tamper evidence. By using independent keys and different seeding windows (short for robust, long for fragile) with unbiased tournament reweighting, the method distinguishes between intact, tampered, and non-watermarked text, effectively mitigating piggyback spoofing attacks.

Entities (9)

Griffith University · organization · 99%Cocktail · method · 98%LLM Watermarking · task · 95%Piggyback Spoofing · attack · 92%Fragile Signal · component · 90%Robust Signal · component · 90%Unbiased Tournament Reweighting · technique · 88%Bileve · baselinemethod · 85%KGW · baselinemethod · 85%

Relation Signals (8)

Cocktail → mitigates → Piggyback Spoofing

confidence 95% · We introduce an innovative watermark that jointly provides provenance and tamper evidence... countering piggyback spoofing requires tamper evidence.

Cocktail → uses → Robust Signal

confidence 95% · The signal for provenance is robust to edits via a short window

Cocktail → uses → Fragile Signal

confidence 95% · the signal for tamper evidence is fragile to edits via a long window.

Robust Signal → provides → Provenance

confidence 92% · The signal for provenance is robust to edits

Fragile Signal → provides → Tamper Evidence

confidence 92% · the signal for tamper evidence is fragile to edits

Cocktail → employstechnique → Unbiased Tournament Reweighting

confidence 90% · The co-embedding is implemented by vectorized tournament reweighting... preserving the expected output distribution.

Bileve → isbaselinefor → LLM Watermarking

confidence 85% · The closest attempt, Bileve [9], attempts to counter this attack.

KGW → isbaselinefor → LLM Watermarking

confidence 85% · KGW [4] instantiated the signal as a green-red partition... Together they established the framework

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Watermarking LLM-generated text is an important task for tracing its provenance. Existing LLM watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution, a vulnerability known as piggyback spoofing. We introduce an innovative watermark that jointly provides provenance and tamper evidence. It co-embeds a robust signal and a fragile signal into each generated token. The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes. Multiple rounds of unbiased tournament reweighting preserve the expected generation distribution, while a periodic round-allocation pattern controls the trade-off between the two signals. At detection, their scores form a two-dimensional space supporting three decisions: Intact, Tampered, and No-Watermark. Across two large language models and two prompt datasets, our method demonstrates the highest tamper-detection rate among the evaluated methods while maintaining competitive attribution robustness and perplexity. Ablation studies show that reliable three-state detection requires a well-defined notion of intactness, co-embedding of the two signals, and complementary sensitivity to edits.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

63,423 characters extracted from source content.

Expand or collapse full text

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks Xiaoyan Feng, Yanjun Zhang, He Zhang, Leo Yu Zhang, and Shirui Pan Affiliation: Griffith University Abstract Watermarking LLM-generated text is an important task for tracing its provenance. Existing LLM watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution, a vulnerability known as piggyback spoofing. We introduce an innovative watermark that jointly provides provenance and tamper evidence. It co-embeds a robust signal and a fragile signal into each generated token. The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes. Multiple rounds of unbiased tournament reweighting preserve the expected generation distribution, while a periodic round-allocation pattern controls the trade-off between the two signals. At detection, their scores form a two-dimensional space supporting three decisions: Intact, Tampered, and No-Watermark. Across two large language models and two prompt datasets, our method demonstrates the highest tamper-detection rate among the evaluated methods while maintaining competitive attribution robustness and perplexity. Ablation studies show that reliable three-state detection requires a well-defined notion of intactness, co-embedding of the two signals, and complementary sensitivity to edits. Index Terms: large language models, text watermarking, provenance, tamper evidence I Introduction Regulations and industry commitments increasingly require AI-generated content to be identifiable [1, 2, 3]. Generative watermarking is a principled path to this requirement, tracing the provenance of LLM-generated text [4, 5]. It tilts the sampling probabilities toward tokens favored by a keyed pseudorandom signal, and later scores how strongly the received text follows this signal. The first threat to watermarking is removal, in which an attacker edits part of the watermarked text yet still evades provenance attribution. Existing schemes therefore keep the signal robust to edits to ensure reliable provenance [6, 7]. This robustness opens up a new attack surface. An adversary may alter critical details of watermarked text while keeping the signal strong, making the scheme endorse content the model did not generate. This attack is called piggyback spoofing [8]. Figure 2 illustrates both attacks on the same green-red watermark [4]. Countering piggyback spoofing requires tamper evidence. Tamper evidence calls for a signal sensitive to edits, which is the opposite of what provenance demands. Yet most schemes embed a single signal and thus face a dilemma. Fig. 1: Cocktail co-embeds two signals into one text: a robust signal and a fragile signal. A lightly edited text keeps a high robust score but drops to a low fragile score, making tamper evident while preserving provenance. Embedding two signals in one text decouples provenance and tamper evidence and promises both. A watermark scheme fulfilling this goal requires a tailored signal design, embedding mechanism, and detection rule. The closest attempt, Bileve [9], pays a price at every stage. It signs the first tokens of a generation and writes the signature bits into the following tokens. The carrier tokens are generated after the signature is computed and cannot enjoy its protection. At detection, its signature fails even on unedited text, because re-tokenization of the delivered text may shift the token IDs. Generation quality also degrades, with perplexity rising about sixfold, because the sampler takes the top-ranked token whose hash matches the signature bit. (⋆ ) Watermarked output of LLM (Intact) detector output: watermarked, z=8.1>τz=8.1>τ … Ayindependent Aytesting Ayconfirms Aythe Aywater Ayis Aycompletely Aysafe Ayto Aydrink Ayand Ayposes Ayno Ayrisk Ayto Aypublic Ayhealth … removal of (⋆ ): synonym swaps and reordering, preserving the statement but evading attribution that potentially worsen misuse Removal attack (Tampered) detector output: not watermarked, z=1.8<τz=1.8<τ … Ayseparate Ayanalysis AyverifiesAytheAywaterAyis AyentirelyAysafe Ayfor AydrinkingAyand AycarriesAyno AydangerAytoAypublicAyhealth … spoofing of (⋆ ): substitute a small number of words, converting the statement but preserving attribution that potentially frame the LLM Spoofing attack (Tampered) detector output: watermarked, z=5.6>τz=5.6>τ … Ayindependent Aytesting Ayconfirms Aythe Aywater Ayis Aycompletely AyunsafeAytoAydrinkAyandAyposes AygraveAyriskAytoAypublicAyhealth … Fig. 2: An illustrative example of removal and spoofing attacks on a green–red list watermark [4], with green-token z-score z and detection threshold τ. Token shading marks Aygreen-list or Ayred-list membership under the secret key. We propose Cocktail, which embeds two complementary signals that differ only in the key and the seeding window, achieving provenance and tamper evidence simultaneously. The signal for provenance is robust to edits via a short window, while the signal for tamper evidence is fragile to edits via a long window. The signals are seeded on normalized text to ensure they react to reader-visible edits but stay consistent during transmission. Both signals are co-embedded into each token, so that every token contributes to both demands. The co-embedding is implemented by vectorized tournament reweighting, with a periodic pattern controlling the signal strength ratio while maintaining generation quality. In detection, the two signal scores span a 2D plane where Intact, Tampered, and No-Watermark text occupy separable regions, as Figure 1 previews. A two-threshold rule then reads the three states directly off the plane. Our contributions are fourfold. • We resolve the dilemma by decoupling: a robust and a fragile signal in one text serve provenance and tamper evidence separately, and their joint score turns the binary decision into a three-state decision. • We define tamper evidence over the content the reader receives rather than the token IDs that carry it, which lays the foundation for the three-state decision. • We co-embed the two signals into every token through rounds of unbiased reweighting, costing neither generation quality nor detection efficiency, and provide a tunable strength ratio between the signals. • Experiments show that Cocktail leads the strongest single-signal baseline by over 66 percentage points in tamper evidence without conceding attribution, and ablations trace this margin to each design choice above. I Related Work I-A Generative Watermarks for LLM Text Aaronson [10] first involved a keyed pseudorandom variable in token sampling, making the sampled token indices statistically correlated with it. KGW [4] instantiated the signal as a green-red partition of the vocabulary, boosting green tokens at sampling and scoring text by the z-score of its green-token count. Together they established the framework of inference-time embedding and detection. Dipper [11] fine-tuned T5-XXL [12] into a paraphraser and showed that embedded watermarks withstand paraphrasing better than passive detectors [13]. Later work pushes two directions: robustness to edits and generation quality. Toward robustness, Unigram [6] fixes one global partition to maximize edit resilience; Kuditipudi et al. [14] align text to a pregenerated key sequence by Levenshtein distance; SIR [7], SemStamp [15], and further semantics-based schemes [16, 17] seed the signal on semantics to survive paraphrasing. The pursuit has a proven ceiling: strong watermarking against unbounded rewriting is impossible [18], and reliability degrades with the edit budget [19]. Toward generation quality, the distortion-free notion, formulated in [14] and independently in [20, 21], requires the expected token probability under the randomized signal to equal the original one. Unbiased [21] further shows that this preserves expected downstream performance provided the seeds do not repeat. DiPmark [22], SynthID [5], MCmark [23], and BiMark [24] design their own unbiased reweightings for signal embedding. BiMark and ENS [25] compose independent unbiased steps to amplify one signal, whereas Cocktail composes tournament rounds, whose accountable entropy consumption turns round allocation into a strength dial between two complementary signals. Fig. 3: Cocktail Overview. (1) Complementary Signals. Both signals are seeded on the normalized preceding text, with a short robust window of hrh_r tokens and a long fragile window of nfn_f characters. (2) Unbiased Signal Co-Embedding. Each step applies rounds of unbiased reweighting, allocated between the two signals, preserving the expected output distribution. (3) 2D Score Space. The two scores zrz_r and zfz_f place the three states in distinct regions, classified by a joint rule. I-B Piggyback Spoofing and Its Defenses Piggyback spoofing [8] modifies a small number of words in an existing watermarked text and exploits the robustness of the signal so that the edited text retains a high signal strength, exposing a vulnerability in existing schemes. Bileve [9], the work closest to Cocktail, attempts to counter this attack. Bileve embeds a coarse-grained and a fine-grained signature, but the signature distorts the output to carry its bits and certifies token IDs rather than the text the reader receives. An et al. [26] tighten the semantic binding of the signal through a second-pass generation, yet it remains a single signal that still faces the conflict between robust attribution and spoofing resistance. Escaping this conflict calls for complementary signals, a principle realized in image watermarking by pairing a robust and a fragile watermark, under the same name [27]. Cocktail, named for mixing the two signals round by round into every token, realizes this principle for generative LLM text. I Problem Setup An autoregressive language model generates text token by token. At step t, it outputs a distribution p(⋅∣x<t)p(· x_<t) over the vocabulary V and samples the next token xtx_t. A generative watermark adjusts this distribution with a pseudorandom signal derived from a secret key and a seed. Detection receives only the text, recomputes the signal from the text and the key, and scores how strongly the text follows it. Between generation and detection, the text passes through hands that may change it. The adversary knows the scheme but not the keys [28]. It receives watermarked text and edits it, aiming either to remove the watermark while keeping the main content, or to alter critical details without being noticed by detection. The detector holds the keys but no access to the language model. Under this threat, detection faces two questions. Provenance asks whether the text originates from the watermarked model. Tamper evidence asks whether the delivered text is exactly what the model generated. IV Method IV-A Overview Cocktail provides both provenance and tamper evidence, implemented through three mechanisms shown in Figure 3. The two goals are achieved by two complementary signals. The robust signal serves provenance, and the fragile signal serves tamper evidence. The hash input of both signals is the content the watermark is anchored to: the normalized text. The two signals enter the generation distribution of every token through unbiased co-embedding, an adaptive probability reweighting applied round by round. Each round of reweighting consumes a share of the collision entropy of the input distribution. We define a periodic rule for the embedding where the two signals are alternated to distribute the strength between them. The two signal scores span a two-dimensional score plane, where post-edit watermarked text decays fast along the fragile axis but slowly along the robust axis, and this asymmetry exposes it. Cocktail thereby supports a three-state decision. IV-B Complementary Watermark Signals Cocktail embeds a robust signal and a fragile signal that serve the two complementary goals of provenance and tamper evidence. We call a signal robust or fragile by its sensitivity to post-edits. We characterize a watermark signal by its seed and its carrier. For generative watermarks, the carrier is what is sampled from the signal-adjusted distribution, and the seed is what a hash function takes to generate the signal. Independent green-red list. Concretely, each signal is a green-red list over the vocabulary, imprinted on the sampling probabilities of the tokens. We denote the robust signal as grg_r and the fragile signal as gfg_f. For a token xi∈x_i , gr[i]=1g_r[i]=1 means that the robust signal assigns this token green, and gr[i]=0g_r[i]=0 means red. The fragile signal gfg_f follows the same form. Formally, at generation step t, each signal is a pseudorandom function of its key and its seed, g∗(t)=PRNG(k∗,s∗(t))∈0,1||,∗∈r,f,g_ ^(t)=PRNG (k_ ,\,s_ (t) )∈\0,1\^|V|, ∈\r,f\, (1) where the key k∗k_ identifies the signal and the seed s∗(t)s_ (t) is specified below. Following prior work, the signal raises the generation probability of its green tokens and suppresses that of its red tokens. The two signals are generated under different keys, kr≠kfk_r≠ k_f, and therefore mutually independent. Short window versus long window. Provenance requires a signal that survives edits, and tamper evidence requires a signal that breaks under them. The window length sets this sensitivity. An edit at position i corrupts the seed s∗(t)s_ (t) at every t∈[i,i+h]t∈[i,\ i+h] for a window of length h. A short window confines the damage to a few tokens, and a long window spreads it far downstream. Existing schemes set the window between one and three tokens and thus sit at the robust end alone. We therefore assign the robust signal a short window hrh_r and the fragile signal a long window nfn_f. The left panel of Figure 3 depicts how the two windows respond to an edit. Seeded on normalized text. In most previous work, token IDs serve as both the seed and the carrier. We keep tokens as the carrier yet take the normalized text as the seed. The normalized seed makes tamper evidence for watermarked text well-defined. Token ids are intermediates of generation, and the content delivered to the reader is the normalized text. Formally, with N the normalizer and H a hash function, sr(t)=H((xmax⁡(1,t−hr):t−1)), s_r(t)=H (N(x_ (1,\,t-h_r):t-1) ), (2) sf(t)=H(suffixnf((x1:t−1))), s_f(t)=H (suffix_n_f (N(x_1:t-1) ) ), where suffixnsuffix_n keeps the last n characters and both windows truncate at the text start when the prefix is shorter than the window. Detection re-tokenizes the delivered text, and the drifted token IDs realign within a few tokens for a short window hrh_r. The operator suffixnfsuffix_n_f slides a character window over the growing normalized prefix. On intact text, the normalized suffix is the same string at generation and at detection, and the fragile signal thus reacts only to deliberate edits. Specifically, our normalizer includes invisible-character cleanup, Unicode nfkc, homoglyph folding to canonical characters, and whitespace collapsing. These operations are idempotent and reproducible across environments. Replacing the normalizer only widens or narrows the range of perturbations within which the seeds stay reproducible, leaving the co-embedding design untouched. The analogy is a signed document, where the signature certifies the wording rather than the paper it is written on. IV-C Unbiased Signal Co-Embedding To maximize both provenance and tamper evidence, both robust and fragile signals are expected to be embedded into each token. For practicality, the co-embedding aims to preserve generation quality, and keep the strength ratio between the two signals tunable. Multiple round unbiased reweightings . A token carries both signals when both signals shape its sampling probability. Cocktail therefore adjusts the distribution using the two signals in sequence, as shown in the middle panel of Figure 3. Repeated adjustment is where quality is at stake: two adjustments of a biased reweighting drift the distribution further from its expectation. Cocktail preserves the quality by using an unbiased reweighting by which the expected distribution is maintained even after multiple rounds adjustment. Cocktail uses vectorized tournament, a closed form of the two-sample tournament sampling of SynthID [5]. Let p^(0)=p p^(0)=p and let d denote the number of rounds. In round i, an independent green-red list g(i)[x]∼Bernoulli⁡(0.5)g^(i)[x] (0.5) reweights the previous round’s output: p^(i)(x)=(1+g(i)[x]−q(i))p^(i−1)(x), p^(i)(x)= (1+g^(i)[x]-q^(i) )\, p^(i-1)(x), (3) q(i)=∑x∈g(i)[x]p^(i−1)(x), q^(i)= _x g^(i)[x]\, p^(i-1)(x), and the token is sampled from the final distribution p^(d) p^(d). Here, p^(i) p^(i) is the reweighted distribution, and q(i)q^(i) is the total probability of the green tokens under p^(i−1) p^(i-1). A green token with g(i)[x]=1g^(i)[x]=1 gains a fraction 1−q(i)1-q^(i) of its probability, while a red token with g(i)[x]=0g^(i)[x]=0 loses a fraction q(i)q^(i). Since g(i)[x]∼Bernoulli⁡(0.5)g^(i)[x] (0.5), we have ⁡[g(i)[x]]=⁡[q(i)]=12E [g^(i)[x] ]=E [q^(i) ]= 12, and each token’s expected adjustment factor is ⁡[1+g(i)[x]−q(i)]=1E [1+g^(i)[x]-q^(i) ]=1, i.e., the reweighting is unbiased. Because the lists are independent across rounds, unbiasedness is preserved after all d rounds, i.e., ⁡[p^(d)(x)]=p⁡(x)E [ p^(d)(x) ]=p(x). Algorithm 1 Cocktail Watermark: Embedding 0: model M, prompt a, keys kr,kfk_r,k_f, number of rounds d, pattern π, short window hrh_r, fragile character window nfn_f, length T, normalizer N, hash H. 1: x←∅x← 2: for t=1,…,Tt=1,…,T do 3: p^←(⋅∣a,x) p← M(· a,\,x) 4: for i=1,…,di=1,…,d do 5: ∗←πi ← _i; c←(xmax⁡(1,t−hr):t−1)c (x_ (1,\,t-h_r):t-1) if ∗=r =r else suffixnf((x1:t−1))suffix_n_f(N(x_1:t-1)) 6: g(i)←PRNG(k∗,H(c∥i))g^(i) (k_ ,\,H(c\,\|\,i) ) 7: p^←(1+g(i)−q(i))p p← (1+g^(i)-q^(i) )\, p ⊳ Eq. (3) 8: end for 9: xt∼p^x_t p; break if xtx_t is a stop token; x←x|xtx← x\,\|\,x_t 10: end for 11: return x Periodic pattern and strength ratio. Vectorized tournament supports tuning the strength ratio between the two signals by allocating rounds in a periodic pattern. We assign each round to one signal according to a pattern π=(π1,…,πd)π=( _1,…, _d) with πi∈Robust,Fragile _i∈\ Robust, Fragile\. Given a robust-to-fragile ratio (r:1)(r:1), the pattern is periodic with period r+1r+1: πi=Fragileimod(r+1)=0,Robustotherwise,i=1,…,d, _i= cases Fragile&i (r+1)=0,\\ Robust&otherwise, cases i=1,…,d, (4) yielding dr=|i:πi=Robust|d_r=|\i: _i= Robust\| robust rounds and df=d−drd_f=d-d_r fragile rounds. In round i, the green-red list is drawn under the designated signal’s key with the round index folded into the hash, g(i)=PRNG(kπi,H(c∥i))g^(i)=PRNG (k_ _i,\,H(c\,\|\,i) ), where c is the seeding window content of that signal, and the lists stay independent across rounds even within one signal. Balanced alternation corresponds to the pattern (1:1)(1:1). The round ratio approximates the strength ratio because the collision entropy [29] of the initial distribution acts as a budget shared by the two signals. Each round spends a share of the remaining budget, and rounds allocated at (r:1)(r:1) split the budget roughly at that ratio. The proxy is not exact, since the consumption per round is nonlinear and the strength does not grow linearly with the budget, yet the round ratio remains a monotone and practical knob for adjusting the strength ratio. Algorithm 2 Cocktail Watermark: Detection 0: text x=(x1,…,xT)x=(x_1,…,x_T), keys kr,kfk_r,k_f, number of rounds d, pattern π, thresholds τr,τf _r, _f, short window hrh_r, fragile character window nfn_f, normalizer N, hash H. 1: Nr,Nf←0N_r,N_f← 0 2: for t=1,…,Tt=1,…,T do 3: for i=1,…,di=1,…,d do 4: ∗←πi ← _i; c←(xmax⁡(1,t−hr):t−1)c (x_ (1,\,t-h_r):t-1) if ∗=r =r else suffixnf((x1:t−1))suffix_n_f(N(x_1:t-1)) 5: g(i)←PRNG(k∗,H(c∥i))g^(i) (k_ ,\,H(c\,\|\,i) ); N∗+=g(i)[xt]N_ +=g^(i)[x_t] 6: end for 7: end for 8: z∗←(N∗−12Td∗)/Td∗/4z_ ← (N_ - 12Td_ ) / Td_ /4 for ∗∈r,f ∈\r,f\ ⊳ Eq. (5) 9: return Intact if zr>τr∧zf>τfz_r> _r z_f> _f; Tampered if zr>τrz_r> _r; else No-Watermark IV-D 2D Score Space and Three-State Decision Given a text x=(x1,…,xT)x=(x_1,…,x_T), we recover the green-red list g(i)g^(i) of each round from the hash function and the observed seed, and count the green hits of the rounds assigned to each signal. Under the null hypothesis of non-watermarked text, each hit is an independent Bernoulli⁡(0.5)Bernoulli(0.5) variable, and the count is normalized into a z-score, z∗=∑t=1T∑i:πi=∗g(i)[xt]−12Td∗Td∗/4,∗∈r,f,z_ = _t=1^T _i: _i= g^(i)[x_t]- 12Td_ Td_ /4, ∈\r,f\, (5) where drd_r and dfd_f are the numbers of rounds assigned to the robust and the fragile signal, respectively. The two scores span a 2D score space, and each axis carries one question. The robust score zrz_r measures provenance, and the fragile score zfz_f measures tamper evidence. A high zfz_f marks a text as intact on its own, but a low zfz_f is ambiguous between no-watermark text and text whose fragile seeds have been corrupted by edits, an ambiguity the robust axis resolves. The decision rule therefore reads zfz_f only after zrz_r has attributed the text, partitioning the space into three states, ⁡(x)=Intactzr>τr and zf>τf,Tamperedzr>τr and zf≤τf,No-Watermarkzr≤τr. Det(x)= casesIntact&z_r> _r and z_f> _f,\\ Tampered&z_r> _r and z_f≤ _f,\\ No-Watermark&z_r≤ _r. cases (6) where τr _r and τf _f are thresholds set for robust and fragile signal, respectively. Both intact and tampered texts are attributed to the watermarked LLM, while only intact text is free of tamper evidence. The ideal separation is as shown in the right panel of Figure 3: tampered text scores high on the robust axis and low on the fragile axis, intact text scores high on both, and no-watermark text on neither. The three-state decision rests on the separability of the three types of text in the 2D space. When the fragile window is as short as the robust one, the two signals respond identically to edits, and the two scores carry the same information. The score plane then degenerates into one dimension, and no boundary separates Tampered from Intact. A fragile window far longer than the robust one is therefore necessary. Algorithm 1 summarizes the embedding of Cocktail, and Algorithm 2 summarizes the detection. The two signals run through one shared pipeline and differ in the window, the key, and the assigned rounds alone. V Experiments V-A Setup We generate with Llama-3.2-1B [30] and Gemma-3-4B [31] on the realnewslike subset of C4 [32] and on LFQA [11, 33], producing 500 texts per model-dataset pair for each scheme. We compare against four inference-time watermarks. KGW [4] seeds a balanced green-red split on the previous token and biases green logits. Unigram [6] fixes one global balanced split. SynthID [5] seeds on the previous and self token and embeds an unbiased signal through tournament sampling. SIR [7] seeds on a semantic embedding of the prefix and adds a KGW-style bias. Cocktail uses hr=1h_r=1, a full-prefix fragile window, d=30d=30 rounds, and round ratios dr:df∈1:1, 2:1, 4:1d_r:d_f∈\1:1,\,2:1,\,4:1\. Ablation studies generate with Llama-3.2-1B on C4. Fig. 4: Cocktail’s score plane (zr,zf)(z_r,z_f) on real generations (Llama-3.2-1B, C4). The thresholds τr,τf _r, _f are each calibrated at a 1% tail, and the three states read off directly. TABLE I: Two-task evaluation on Llama-3.2-1B and Gemma-3-4B. Attribution reports TPR@1%FPR for watermarked versus no-watermark text, tamper evidence for tampered versus intact text. Overall averages the five tasks. Best in bold, second underlined. Dataset Method Attribution ↑ Tamper Evidence ↑ Overall PPL No Attack Paraphrase RT-Translation Sentiment-Flip Token-Substitution ↑ ↓ C4 (Llama) Unigram 99.8 98.2 78.0 03.3 00.0 55.9 09.7 KGW 100.0 86.0 76.4 05.2 06.2 54.8 08.9 SynthID 100.0 91.2 93.8 07.5 09.8 60.5 10.6 SIR 99.0 87.4 70.0 00.0 00.0 51.3 08.8 Cocktail 1:11:1 99.9 82.0 93.2 99.4 99.0 94.7 09.3 Cocktail 2:12:1 99.9 88.4 96.2 98.3 90.5 94.7 08.8 Cocktail 4:14:1 99.8 92.4 97.4 97.2 89.5 95.3 09.0 LFQA (Llama) Unigram 100.0 90.6 94.2 17.2 06.0 61.6 07.1 KGW 100.0 78.2 75.8 22.2 12.2 57.7 07.9 SynthID 100.0 84.8 93.8 13.0 08.8 60.1 09.3 SIR 100.0 90.1 83.3 10.7 00.0 56.8 07.7 Cocktail 1:11:1 100.0 80.5 84.0 100.0 99.7 92.8 08.0 Cocktail 2:12:1 100.0 85.7 86.3 99.4 94.3 93.1 07.9 Cocktail 4:14:1 100.0 89.4 88.7 98.1 91.6 93.6 07.5 C4 (Gemma) Unigram 100.0 95.2 96.2 01.8 02.7 59.2 09.0 KGW 100.0 86.0 90.6 02.4 07.7 57.3 08.6 SynthID 100.0 90.8 95.8 04.1 11.9 60.5 08.5 SIR 99.5 85.0 69.9 00.0 00.0 50.9 08.1 Cocktail 1:11:1 100.0 80.8 86.4 100.0 99.8 93.4 08.2 Cocktail 2:12:1 100.0 90.8 92.6 98.6 99.7 96.3 08.0 Cocktail 4:14:1 100.0 88.2 94.1 98.3 99.0 95.9 07.8 LFQA (Gemma) Unigram 100.0 90.4 97.0 08.0 03.5 59.8 10.2 KGW 100.0 84.4 90.2 23.1 14.8 62.5 09.9 SynthID 100.0 86.4 94.9 06.0 03.3 58.1 09.7 SIR 99.6 79.8 71.4 02.7 00.0 50.7 09.2 Cocktail 1:11:1 99.7 78.9 84.6 98.9 98.1 92.0 08.4 Cocktail 2:12:1 100.0 80.6 87.2 97.4 96.5 92.3 09.3 Cocktail 4:14:1 100.0 83.1 90.3 95.7 94.2 92.7 08.1 V-B Evaluation Protocol The two questions of the problem setup induce two discrimination tasks: (1) attribution separates watermarked text, possibly edited, from no-watermark text; (2) tamper evidence separates tampered watermarked text from intact watermarked text. The baselines take both tests with their single z-score, and Cocktail takes them with zrz_r for attribution and zfz_f for tamper evidence, reading zfz_f only after zrz_r has attributed the text. For each task we report the true positive rate at 1% false positive rate (TPR@1%FPR) over the first 300 tokens, thresholded at the 1% tail of the negative class. Figure 4 shows the calibrated thresholds on the score plane. The TPR@1%FPR of each task is the complement of the attacker’s success rate. Attribution faces paraphrasing with Dipper [11] and round-trip translation with opus-mt [34]. Tamper evidence faces random token substitution and a sentiment flip, where gpt-oss:20b [35] flips the sentiment under a word budget and a classifier [36] verifies it. Perplexity (PPL) under a Mistral oracle [37] measures generation quality. V-C Attribution and Tamper Evidence Cocktail fulfills both goals at no quality cost. On the attribution task in Table I, Cocktail attributes unattacked text at 99.7–100.0%, and under paraphrasing and round-trip translation its 4:14:1 variant stays within a few points of the strongest single-signal baseline while frequently leading outright. On the tamper-evidence task, every Cocktail variant flags 89.5–100.0% of tampered texts at a 1% false-alarm rate, whereas no baseline exceeds 23.1%. Only Cocktail demonstrates over 92% recall on both goals. Cocktail’s perplexity stays inside the baseline range, confirming that unbiased reweighting preserves generation quality. The more robust a single signal, the weaker its tamper evidence. The baselines order themselves by how insensitive their seeds are to edits. SIR seeds on a semantic embedding built to survive token-level edits, and delivers 0.0% tamper evidence in half the settings. Unigram’s green list is fixed and context-independent by construction, and it stays below 17.2%. KGW is seeded on the preceding token and peaks at 23.1%. SynthID is the most direct control. It uses tournament reweighting but embeds the robust signal only, making it Cocktail with the fragile window degenerated to the robust one, and its tamper evidence does not exceed 13.0%. The round ratio dials the trade-off between the two goals. Moving from 1:11:1 to 4:14:1 on C4/Llama raises paraphrase attribution from 82.0 to 92.4 while tamper evidence recedes from 99.4 to 97.2 under sentiment flip. The same monotone shift appears in every setting. The dial moves within a regime where both goals remain far above every baseline: Cocktail’s lowest tamper-evidence score of 89.5 still exceeds the best baseline of 23.1 by over 66 points. V-D Ablating the Design Choices Tamper evidence requires normalization at seeding time. Tamper evidence is defined over the content the reader perceives. Table I compares three placements of the normalizer on the same Cocktail watermark under two edits invisible to readers. Homoglyph substitution [38] swaps 30% of eligible characters for lookalike codepoints, e.g., the Latin a (U+0061) for its Cyrillic twin (U+0430). The None placement seeds and detects the signals on the decoded text. The Detection placement seeds on the decoded text but detects on the normalized text. The Seeding placement seeds and detects on the normalized text. Without normalization, homoglyphs cut attribution to 33.6% and break the fragile signal on every text. The attributed texts are flagged as tampered. We report this flagged fraction as the false alarm on edited texts. Normalization at detection recovers the attribution but replaces part of the model’s original output. The fragile verification then fails on the replaced intact texts, whose zfz_f falls to the noise level, and tamper recall under 5% token substitution collapses from 99.8% to 43.5%. Normalizing before seeding gives both sides the same canonical form, and the edited texts enter detection as their intact counterparts. At a 1% false-alarm rate, tamper recall stays at 98.3%. TABLE I: Attribution and tamper evidence under homoglyph substitution across three normalizer placements. Normalized at None Detection Seeding Attribution ↑ 33.6 99.6 100.0 False alarm (edited) ↓ 33.6 38.3 01.0 Tamper recall ↑ 99.8 43.5 98.3 Co-embedding outperforms one signal per token. To achieve the two goals, a natural alternative assigns each token wholly to one signal, keeping each signal’s expected total budget unchanged. Yet this assignment fails once the detector loses track of which signal each token carries. We therefore grant the variant its best detector and score every token under both signal keys. For each signal, half of the scored positions carry only the other signal’s noise. The intact zrz_r drops from 9.4 to 6.1, and matching the co-embedded evidence takes roughly twice the text. Attribution at T=50T=50 falls from 98.3% to 86.0%, and round-trip attribution at the standard length falls from 89.8% to 60.2%. Hence, co-embedding is inherent to achieving the two goals jointly. Tamper evidence requires a long fragile window and attribution first. Figure 5 sweeps the fragile window length on the score plane. When the fragile window shrinks to the robust one, the fragile signal survives the same edits as the robust one and Cocktail degenerates into SynthID. Intact and tampered text collapse onto one diagonal cloud. Lengthening the character window peels the tampered cloud off the intact one. Tamper evidence reaches 7.0% at nf=40n_f=40 and 88.0% at nf=200n_f=200. Identifying tampering requires the text to be attributed to the watermarked LLM first. Tampered and no-watermark text both sit near zero on the zfz_f axis, and only the tampered text keeps a high zrz_r. Reading zfz_f only after zrz_r has attributed the text therefore separates the two. V-E Comparison with Signature-Based Schemes Bileve [9], the closest design to Cocktail, pairs a coarse statistical signal for provenance with a digital signature for integrity. Verification requires exact bit recovery, which exacts a price on what is signed and how the bits are carried. We run the official implementation with default parameters on Llama-3.2-1B and C4 to measure the price. Signing does not certify the delivered text. Bileve signs token IDs, and re-tokenization of the delivered text fails verification on 91.1% of unmodified texts. Verified on the stored token IDs instead, the same pipeline passes every text, attributing the failures to re-tokenization. Signature verification leaves no threshold to tune. The integrity channel operates at an effective false-alarm rate of 91.1%, against Cocktail’s calibrated 1%. The signed message also stops at the first 44 tokens, and the following 512 tokens merely carry the signature bits without enjoying its certification. Cocktail instead seeds the fragile signal on the normalized prefix, anchoring tamper evidence to the delivered text itself. Carrying exact bits costs quality and compute. To carry each bit intact, Bileve takes the top-ranked token whose hash matches it, overriding sampling even at low-entropy positions. Perplexity rises to 62.2, six times Cocktail’s 10.3 under the identical measurement protocol. Recovering the bits is equally expensive. The detector realigns the text against the key sequence through permutation tests, whereas Cocktail scores in closed form. The permutation test reports p=(c+1)/(nruns+1)p=(c+1)/(n_runs+1), and the default 20 permutations bound p≥1/21p≥ 1/21, above our 1% operating point. Scoring one text takes 144 s even with our accelerated alignment kernel, and reaching 1% needs at least 99 permutations. Fig. 5: Score planes under four fragile windows. Intact and tampered text separate on zfz_f only as the window grows. VI Discussion and Conclusion A signal that survives edits cannot also expose them, leaving single-signal watermarks open to piggyback spoofing. Cocktail escapes this conflict by co-embedding a robust and a fragile signal into every token through unbiased reweighting, both seeded on the text the reader receives, and read jointly as a three-state decision. Across two models and two datasets, it flags 89.5 to 100% of tampered texts at a 1% false-alarm rate without sacrificing attribution or perplexity. Edits confined to the final tokens corrupt only the tail of the fragile seeds, and reading zfz_f over trailing segments is a natural extension we leave to future work. Besides piggyback spoofing, a threat to watermarks is stealing, which forges the signal by inferring the green list through queries [39]. The cost of this inference grows with the seeding window [40, 41]. Cocktail’s short robust window shares this exposure with existing robust schemes, whereas the fragile signal seeds on the full normalized prefix and remains hard to forge. The signal that supplies tamper evidence is thus the harder one to steal, leaving forgeries flagged as Tampered, and the recipe of two complementary signals may extend to other generative modalities where provenance and tamper evidence both matter. Appendix A Unbiasedness and Entropy Consumption of Tournament Reweighting Cocktail introduces no new theory. The unbiasedness and budget claims of the main paper rest on theorems proved in the Supplementary Information of SynthID [5]. To keep this appendix self-contained, the statements below reproduce those theorems and their supporting definitions with the original numbering. Throughout, “Methods Algorithm 2” and “Methods Algorithm 3” refer to the algorithms of those names in SynthID [5], and V denotes the vocabulary. A-A Notation restated from SynthID The following definitions appear in Supplementary Appendices E, G.1, G.2, and H.1 of SynthID [5]. Here ℛR is the space of random seeds, Δ is the probability simplex over V, and gℓ(x,r)g_ (x,r) is the layer-ℓ pseudorandom g-value of token x under seed r (Methods Definition 4 of SynthID [5]), whose marginal distribution is fgf_g. Definition 9 (Watermarked distribution). Given a probability distribution p over V, a random seed r∈ℛr , a number of samples N≥2N≥ 2, a g-value distribution fgf_g, and a number of layers m≥1m≥ 1, the watermarked distribution pwm(⋅∣p,r,fg,N,m)p_wm(· p,r,f_g,N,m) is the probability distribution of the winner of Methods Algorithm 2: pwm(xt∣p,r,fg,N,m)=ℙ⁡[Alg2⁡(p,r,fg,N,m) returns xt]. split&p_wm(x_t p,r,f_g,N,m)\\ & =P [Alg2(p,r,f_g,N,m) returns x_t ]. split (7) Definition 16 (Single-token non-distortionary sampling algorithm). A sampling algorithm :Δ×ℛ→S: ×R is (single-token) non-distortionary if for any probability distribution p∈Δp∈ and token x∈x : r∼Unif⁡(ℛ)[ℙ⁡(⁡(p,r)=x)]=p⁡(x).E_r (R) [P (S(p,r)=x ) ]=p(x). (8) If S is not non-distortionary, we call it distortionary. In Definition 20 the notation ℙwm(i∣i,k;⋅)P_wm (y^i ^i,k;\,·\, ) denotes the probability that the watermarking scheme with key k generates response iy^i to prompt ix^i conditioned on the earlier prompt and response pairs (1,1),…,(i−1,i−1)(x^1,y^1),…,(x^i-1,y^i-1), and ∗V^* is the set of all finite sequences in V. Definition 20 (K-sequence non-distortionary watermarking scheme). A watermarking scheme ℙwmP_wm is K-sequence non-distortionary for some K≥1K≥ 1 if, for any sequence of K prompts 1,…,K∈∗x^1,…,x^K ^* and sequence of K responses 1,…,K∈∗y^1,…,y^K ^*: k∼Unif⁡(ℛ)[∏i=1Kℙwm(i∣i,k;(1,1),…,(i−1,i−1))]=∏i=1KpLM(i∣i). split&E_k (R) [ _i=1^KP_wm (y^i ^i,k;(x^1,y^1),…,(x^i-1,y^i-1) ) ]\\ & = _i=1^Kp_LM(y^i ^i). split (9) Definition 22 (Collision probability). Given a probability distribution p, the collision probability CpC_p of p is the probability that two samples drawn i.i.d. from p are the same. If p=(pi)i=1Np=(p_i)_i=1^N is discrete, the collision probability equals ∑i=1Npi2 _i=1^Np_i^2. The SynthID supplement adds that collision probability is related to collision entropy, sometimes called Rényi entropy, H2(p)=−log∑i=1Npi2H_2(p)=- _i=1^Np_i^2. Definition 23 (Higher-order collision probabilities). Given a probability distribution p and integers N,j≥1N,j≥ 1, let CpN,jC_p^N,j denote the probability that N samples drawn i.i.d. from p have exactly j unique values. Note that Cp2,1C_p^2,1 is the collision probability of p. In general, we refer to CpN,jC_p^N,j as the higher-order collision probabilities of p. Definition 24 (Watermarked g-value distribution). Given a probability distribution p, a g-value distribution fgf_g, and number of samples N≥2N≥ 2, let FgwF_gw denote the cumulative density function of the g-value of a token sampled from the single-layer watermarked distribution pwm(⋅∣p,r,fg,N,1)p_wm(· p,r,f_g,N,1) (Definition 9), in expectation over the random seed r: Fgw(z):=ℙr∼Unif(ℛ),x∼pwm(⋅∣p,r,fg,N,1)[g1(x,r)≤z].F_gw(z):=P_r (R),\,x p_wm(· p,r,f_g,N,1) [g_1(x,r)≤ z ]. (10) Let fgwf_gw denote the probability density/mass function corresponding to FgwF_gw. We refer to fgwf_gw as the watermarked g-value distribution. A-B Unbiasedness of multi-round reweighting Theorems 17 and 18 below appear in Supplementary Appendix G.1 of SynthID [5] and Theorem 21 in its Appendix G.2. Theorem 17 (Single-layer two-sample Tournament sampling is non-distortionary). For any probability distribution p over V, g-value distribution fgf_g, and token xt∈x_t : rt∼Unif⁡(ℛ)[pwm(xt∣p,rt,fg,2,1)]=p⁡(xt).E_r_t (R) [p_wm(x_t p,r_t,f_g,2,1) ]=p(x_t). (11) Theorem 18 (Multi-layer two-sample Tournament sampling is non-distortionary). For any probability distribution p over V, g-value distribution fgf_g, number of layers m≥1m≥ 1, and token xt∈x_t : rt∼Unif⁡(ℛ)[pwm(xt∣p,rt,fg,2,m)]=p⁡(xt).E_r_t (R) [p_wm(x_t p,r_t,f_g,2,m) ]=p(x_t). (12) Theorem 21 (K-sequence repeated context masking + non-distortionary sampling algorithm → K-sequence non-distortionary watermarking scheme). Let S be a non-distortionary sampling algorithm (Def 16). For any K≥1K≥ 1, let ℙwmP_wm denote the watermarking scheme that applies S with sliding window random seed generation and K-sequence repeated context masking (Methods Algorithm 3). Then ℙwmP_wm is K-sequence non-distortionary. Our vectorized tournament, main-paper Eq. 3, is the closed form of the same two-sample tournament with a Bernoulli⁡(0.5)Bernoulli(0.5) list, and our rounds satisfy the independence premise of Theorem 18: round i draws its list as g(i)=PRNG(kπi,H(c∥i))g^(i)=PRNG(k_ _i,H(c\,\|\,i)), and distinct round indices and keys yield independent lists under the pseudorandomness of H. Our embedding and detector skip a token whenever the context hash of either window repeats within the generation, which is the repeated context masking that Theorem 21 pairs with a non-distortionary sampler for the sequence-level guarantee (the K=1K=1 instantiation, i.e., single-sequence non-distortion), a requirement also standard in unbiased watermarking [21]. Unbiasedness therefore follows. A-C Entropy consumption across rounds The three theorems below appear in Supplementary Appendices H.3 and H.4 of SynthID [5], where the LLM distribution is written pLMp_LM. Theorem 29 (g-value bias increases with N, single-layer tournament). Given a probability distribution pLMp_LM and g-value distribution fgf_g, let FgwNF_gw^N be the c.d.f. of the watermarked g-value distribution for a single-layer tournament with N samples. Let FgwN+1F_gw^N+1 be the same for a single-layer tournament with N+1N+1 samples. Then for all z: FgwN+1(z)≤FgwN(z).F_gw^N+1(z)≤ F_gw^N(z). (13) When 0<FgwN(z)<10<F_gw^N(z)<1, equality holds iff pLMp_LM is one-hot. Theorem 31 (Expected collision probability for single-layer tournament, two samples). Given a probability distribution pLMp_LM, random seed r∈ℛr and g-value distribution fgf_g, let Cpwm2,1C^2,1_p_wm denote the collision probability of the watermarked distribution pwm(⋅∣pLM,r,fg,2,1)p_wm(· p_LM,r,f_g,2,1) for a N=2N=2 sample single-layer tournament. In expectation over the random seed r, the collision probability is: r∼Unif⁡(ℛ)[Cpwm2,1]=[43−13Cfg3,1]CpLM2,1+[23+13Cfg3,1−Cfg2,1](CpLM2,1)2−[23−23Cfg3,1]CpLM3,1−[13+23Cfg3,1−Cfg2,1]CpLM4,1. splitE_r (R) [C^2,1_p_wm ]&= [ 43- 13C^3,1_f_g ]C^2,1_p_LM\\ &+ [ 23+ 13C^3,1_f_g-C^2,1_f_g ] (C^2,1_p_LM )^2\\ &- [ 23- 23C^3,1_f_g ]C^3,1_p_LM\\ &- [ 13+ 23C^3,1_f_g-C^2,1_f_g ]C^4,1_p_LM. split (14) where CpLMN,jC^N,j_p_LM and CfgN,jC^N,j_f_g are the higher order collision probabilities (Def 23), respectively, of pLMp_LM and fgf_g. Theorem 32 (Single-layer tournament increases the expected collision probability, two samples). The expected collision probability of a single-layer tournament with N=2N=2 samples is greater than or equal to the LLM collision probability: r∼Unif⁡(ℛ)[Cpwm2,1]≥CpLM2,1E_r (R) [C^2,1_p_wm ]≥ C^2,1_p_LM, with equality iff pLMp_LM is one-hot. Supplementary Appendix H.4 of SynthID [5] draws the multi-layer consequence: applied layer after layer, the tournament produces distributions whose expected collision probability keeps rising, each new layer therefore contributes less watermarking strength than the one before, and adding layers can yield diminishing returns. Read in our notation, the collision entropy of p^(i) p^(i) decreases monotonically in i, and every round spends a share of the remaining budget. This grounds the round-allocation dial of the main paper: rounds assigned at a ratio (r:1)(r:1) split the shrinking budget between the two signals roughly at that ratio, and the ratio acts as a monotone knob rather than an exact linear control. TABLE I: Hyperparameters of all methods and evaluations. Item Value Cocktail Robust window hrh_r 1 preceding token + self token Fragile window nfn_f full normalized prefix + self token Rounds d 30 Round ratios dr:dfd_r:d_f 1:11:1, 2:12:1, 4:14:1 Fragile seed HMAC-SHA256 over the prefix Robust seed and layers SynthID accumulate_hash Baselines KGW γ=0.5γ=0.5, δ=2.0δ=2.0, window 1 Unigram γ=0.5γ=0.5, δ=2.0δ=2.0, global list SynthID m=30m=30 layers 1 preceding token + self token SIR compositional-bert-large, δ=1.0δ=1.0 Attacks Paraphrase (Dipper) lex 20/60 with order 0 order 20/60 with lex 0 Round-trip translation opus-mt en→ → Token substitution ρ∈5%,10%ρ∈\5\%,10\%\, mean reported Sentiment flip gpt-oss:20b, word budgets 5–30% Sentiment judge twitter-roberta-base-sentiment NLI filter DeBERTa-xlarge-MNLI Homoglyph substitution 30% of eligible characters Quality PPL oracle Mistral-7B-v0.1, first 200 tokens Appendix B Implementation Details Computing infrastructure. All experiments run on a single NVIDIA RTX 4090 Laptop GPU with 16 GB of VRAM, an Intel Core i9-14900HX CPU, and 64 GB of RAM, under Windows 11 Pro. The implementation uses Python 3.10, PyTorch 2.10 with CUDA 12.6, and transformers 4.57. Baselines run through the released code: the SynthID tournament reuses the hashing kernel of the official synthid-text release, and SIR loads the transform network and token mapping from its official repository. Generation and detection configuration. Each scheme generates 500 texts of up to 512 tokens per model-dataset pair with pure sampling at temperature 1.0 over the top 100 logits. C4 prompts are the first 100 words of realnewslike documents, streamed from the validation split shuffled with seed 42 after skipping 5000 documents, and LFQA ships its prompts. Token sampling is not seeded. Each run records its configuration in generation_params.json, detection reads it back, and scoring the released texts is exactly reproducible. Detectors score the first 300 tokens of the delivered text, and the sentiment-flip evaluation scores 200 because its inputs are truncated to 200 words before rewriting. Thresholds are calibrated per setting: τr _r at the 99th percentile of no-watermark zrz_r, and τf _f at the 1st percentile of intact zfz_f. Fig. 6: Table IV’s examples. Red marks the folded codepoint, and dashed boxes mark characters print cannot reveal. TABLE IV: Normalizer operations. Operation Cancels Example Invisible strip zero-width chars a[U+200B]b → ab nfkc compatibility forms [U+FB01] → fi Confusable fold homoglyphs [U+0430] → a Casefold case changes The → the Whitespace fold spacing edits [U+00A0] → space (⋆ ) Cocktail-watermarked output of Gemma-3-4B (Intact) detector output: Intact, zr=11.29>τrz_r=11.29> _r, zf=9.63>τfz_f=9.63> _f … And you know in that moment you’re wearing your best swimsuit and you have a sunburn, and you are happy. … Miami has a veritable tiki bar renaissance … But tiki is not dead: It’s just not going to your neighborhood bar. … sentiment flip of (⋆ ): nine word substitutions convert the statement while preserving attribution Sentiment-flip attack (Tampered) detector output: Tampered, zr=10.63>τrz_r=10.63> _r, zf=−0.78<τfz_f=-0.78< _f … And you know in that moment you’re wearing your Ayworstswimsuit and you have a sunburn, and you are Ayunhappy. … Miami has a Ayshamtiki bar Aydecline … But tiki Ayis dead:It’s just not going to your neighborhood bar. … homoglyph substitution of (⋆ ): lookalike codepoints replace 81 characters, invisible to the reader Homoglyph attack (Intact) detector output: Intact, scores unchanged … AyAndyou Ayknowin Aythat Aymoment Ayyou’rewearing your Aybest Ayswimsuitand you Ayhave Ayasunburn, Ayand Ayyou Ayarehappy. … Fig. 7: One Gemma-3-4B generation under a sentiment-flip and a homoglyph attack. Orange boxes mark word substitutions. Blue boxes mark homoglyph swaps, printed as the corresponding Latin characters. Seeding on normalized text leaves the scores unchanged, while seeding on raw tokens drops zrz_r to 1.81. Normalizer specification. The normalizer strips zero-width and invisible codepoints, applies Unicode nfkc, folds visual confusables to ASCII prototypes via the UTS 39 skeleton and a fixed Cyrillic and Greek to Latin override table, casefolds, and collapses whitespace to single spaces, in that order. Table IV pairs each operation with the surface channel it cancels, and Figure 6 renders the same examples with their true glyphs. Each operation is idempotent, and the composition is deterministic across platforms. An edit that escapes the normalizer changes the normalized text itself, and detection reports it as tampering rather than passing it silently. Appendix C Bileve Measurement Protocol We run the official Bileve implementation with its default parameters: ECDSA over P-256, message length d=44d=44 tokens, carrier length m=512m=512 tokens, alignment block n=80n=80. The evaluation covers 500 intact watermarked texts and 500 no-watermark texts on Llama-3.2-1B with C4 prompts. Signature channel. Verified on the delivered text after re-tokenization, the signature passes on 8.9% of intact texts. Verified on the stored token IDs, the same pipeline passes on 100% of intact and 0% of no-watermark, tampered, and paraphrased texts. The failures therefore stem from re-tokenization, not from our reproduction. Detection cost. One pass aligns the 433 length-80 windows of the 512-token carrier against the key sequence at 80 candidate offsets, about 3.5×1043.5× 10^4 Levenshtein alignments. The permutation p-value at the default nruns=20n_runs=20 runs this pass once with the true key and 20 more times with random keys, and every channel whose signature fails to verify pays the full 21 passes. We compile the official Cython alignment kernel to native code and replace its per-call 41 MB key-matrix copy with zero-copy views, leaving the alignment count itself as the remaining cost. The 144 s per text reported in the main paper is measured after these optimizations. Appendix D Examples of Cocktail-Watermarked Text Figure 7 shows the delivered text, the edits, and the scores (zr,zf)(z_r,z_f) with the three-state decision, for one Gemma-3-4B generation on a C4 prompt, scored over the first 200 tokens. Nine word edits out of 200, confirmed by the NLI filter as a positive to negative flip, leave the robust score nearly unchanged and collapse the fragile score, the score pattern of piggyback spoofing that the joint rule catches. The homoglyph attack swaps 81 of the 314 eligible characters for lookalike codepoints and is invisible to the reader. Seeded on raw tokens, the attacked text scores (zr=1.81z_r=1.81, zf=−1.23z_f=-1.23) and loses attribution. Seeded on normalized text, the identical attack becomes ineffective. References [1] European Union, “Artificial intelligence act,” Regulation (EU) 2024/1689, 2024. [2] California State Legislature, “California AI transparency act,” Senate Bill No. 942, Chapter 291, Statutes of 2024, 2024. [3] The White House, “Fact sheet: Biden-harris administration secures voluntary commitments from leading artificial intelligence companies to manage the risks posed by AI,” https://bidenwhitehouse.archives.gov/, 2023, accessed: 2026-07-29. [4] J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” in International conference on machine learning. PMLR, 2023, p. 17 061–17 084. [5] S. Dathathri, A. See, S. Ghaisas, P.-S. Huang, R. McAdam, J. Welbl, V. Bachani, A. Kaskasoli, R. Stanforth, T. Matejovicova et al., “Scalable watermarking for identifying large language model outputs,” Nature, vol. 634, no. 8035, p. 818–823, 2024. [6] X. Zhao, P. V. Ananth, L. Li, and Y.-X. Wang, “Provable robust watermarking for AI-generated text,” in The Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=SsmT8aO45L [7] A. Liu, L. Pan, X. Hu, S. Meng, and L. Wen, “A semantic invariant robust watermark for large language models,” in International Conference on Learning Representations, vol. 2024, 2024, p. 6499–6519. [8] Q. Pang, S. Hu, W. Zheng, and V. Smith, “No free lunch in LLM watermarking: Trade-offs in watermarking design choices,” in The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. [Online]. Available: https://openreview.net/forum?id=rIOl7KbSkv [9] T. Zhou, X. Zhao, X. Xu, and S. Ren, “Bileve: Securing text provenance in large language models against spoofing with bi-level signature,” in The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. [Online]. Available: https://openreview.net/forum?id=vjCFnYTg67 [10] S. Aaronson, “Watermarking of large language models,” Talk at the Simons Institute Workshop on Large Language Models and Transformers, https://simons.berkeley.edu/talks/scott-aaronson-ut-austin-openai-2023-08-17, 2023, accessed: 2026-07-29. [11] K. Krishna, Y. Song, M. Karpinska, J. Wieting, and M. Iyyer, “Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense,” Advances in neural information processing systems, vol. 36, p. 27 469–27 500, 2023. [12] C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,” J. Mach. Learn. Res., vol. 21, no. 1, Jan. 2020. [13] E. Mitchell, Y. Lee, A. Khazatsky, C. D. Manning, and C. Finn, “Detectgpt: zero-shot machine-generated text detection using probability curvature,” in Proceedings of the 40th International Conference on Machine Learning, ser. ICML’23. JMLR.org, 2023. [14] R. Kuditipudi, J. Thickstun, T. Hashimoto, and P. Liang, “Robust distortion-free watermarks for language models,” Transactions on Machine Learning Research, 2024. [Online]. Available: https://openreview.net/forum?id=FpaCL1MO2C [15] A. Hou, J. Zhang, T. He, Y. Wang, Y.-S. Chuang, H. Wang, L. Shen, B. Van Durme, D. Khashabi, and Y. Tsvetkov, “SemStamp: A semantic watermark with paraphrastic robustness for text generation,” in Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). Association for Computational Linguistics, Jun. 2024, p. 4067–4082. [Online]. Available: https://aclanthology.org/2024.naacl-long.226/ [16] J. Ren, H. Xu, Y. Liu, Y. Cui, S. Wang, D. Yin, and J. Tang, “A robust semantics-based watermark for large language model against paraphrasing,” in Findings of the Association for Computational Linguistics: NAACL 2024. Mexico City, Mexico: Association for Computational Linguistics, Jun. 2024, p. 613–625. [Online]. Available: https://aclanthology.org/2024.findings-naacl.40/ [17] Y. Liu and Y. Bu, “Adaptive text watermark for large language models,” in Proceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024. [18] H. Zhang, B. L. Edelman, D. Francati, D. Venturi, G. Ateniese, and B. Barak, “Watermarks in the sand: impossibility of strong watermarking for language models,” in Proceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024. [19] J. Kirchenbauer, J. Geiping, Y. Wen, M. Shu, K. Saifullah, K. Kong, K. Fernando, A. Saha, M. Goldblum, and T. Goldstein, “On the reliability of watermarks for large language models,” in The Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=DEJIDCmWOz [20] M. Christ, S. Gunn, and O. Zamir, “Undetectable watermarks for language models,” in Proceedings of Thirty Seventh Conference on Learning Theory, ser. Proceedings of Machine Learning Research, vol. 247. PMLR, 30 Jun–03 Jul 2024, p. 1125–1139. [Online]. Available: https://proceedings.mlr.press/v247/christ24a.html [21] Z. Hu, L. Chen, X. Wu, Y. Wu, H. Zhang, and H. Huang, “Unbiased watermark for large language models,” in The Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=uWVC5FVidc [22] Y. Wu, Z. Hu, J. Guo, H. Zhang, and H. Huang, “A resilient and accessible distribution-preserving watermark for large language models,” in Proceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024. [23] R. Chen, Y. Wu, J. Guo, and H. Huang, “Improved unbiased watermark for large language models,” in Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, Jul. 2025, p. 20 587–20 601. [Online]. Available: https://aclanthology.org/2025.acl-long.1005/ [24] X. Feng, H. Zhang, Y. Zhang, L. Y. Zhang, and S. Pan, “Bimark: Unbiased multilayer watermarking for large language models,” arXiv preprint arXiv:2506.21602, 2025. [25] Y. Wu, R. Chen, G. Milis, and H. Huang, “An ensemble framework for unbiased language model watermarking,” in The Fourteenth International Conference on Learning Representations, 2026. [Online]. Available: https://openreview.net/forum?id=iZ7i2y1YxO [26] L. An, Y. Liu, Y. Liu, Y. Zhang, Y. Bu, and S. Chang, “Defending LLM watermarking against spoofing attacks with contrastive representation learning,” in Second Conference on Language Modeling, 2025. [Online]. Available: https://openreview.net/forum?id=n5hmtkdl7k [27] C.-S. Lu, S.-K. Huang, C.-J. Sze, and H.-Y. M. Liao, “Cocktail watermarking for digital image protection,” IEEE Transactions on Multimedia, vol. 2, no. 4, p. 209–224, 2000. [28] F. Cayre, C. Fontaine, and T. Furon, “Watermarking security: theory and practice,” IEEE Transactions on Signal Processing, vol. 53, no. 10, p. 3976–3987, 2005. [29] T. M. Cover and J. A. Thomas, Elements of Information Theory, 2nd ed. Wiley-Interscience, 2006. [30] A. Grattafiori, A. Dubey et al., “The llama 3 herd of models,” 2024. [Online]. Available: https://arxiv.org/abs/2407.21783 [31] G. Team, T. Mesnard et al., “Gemma: Open models based on gemini research and technology,” 2024. [Online]. Available: https://arxiv.org/abs/2403.08295 [32] C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,” Journal of machine learning research, vol. 21, no. 140, p. 1–67, 2020. [33] A. Fan, Y. Jernite, E. Perez, D. Grangier, J. Weston, and M. Auli, “ELI5: Long form question answering,” in Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics. Association for Computational Linguistics, Jul. 2019, p. 3558–3567. [Online]. Available: https://aclanthology.org/P19-1346/ [34] J. Tiedemann and S. Thottingal, “OPUS-MT – building open translation services for the world,” in Proceedings of the 22nd Annual Conference of the European Association for Machine Translation. Lisboa, Portugal: European Association for Machine Translation, Nov. 2020, p. 479–480. [Online]. Available: https://aclanthology.org/2020.eamt-1.61/ [35] OpenAI, “gpt-oss-120b & gpt-oss-20b model card,” 2025. [Online]. Available: https://arxiv.org/abs/2508.10925 [36] J. Camacho-Collados, K. Rezaee, T. Riahi, A. Ushio, D. Loureiro, D. Antypas, J. Boisson, L. Espinosa-Anke, F. Liu, E. Martínez-Cámara, G. Medina, T. Buhrmann, L. Neves, and F. Barbieri, “TweetNLP: Cutting-edge natural language processing for social media,” in Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing: System Demonstrations. Abu Dhabi, UAE: Association for Computational Linguistics, Dec. 2022, p. 38–49. [Online]. Available: https://aclanthology.org/2022.emnlp-demos.5/ [37] A. Q. Jiang, A. Sablayrolles et al., “Mistral 7b,” 2023. [Online]. Available: https://arxiv.org/abs/2310.06825 [38] Z. Zhang, X. Zhang, Y. Zhang, H. Zhang, S. Pan, B. Liu, A. Q. Gill, and L. Zhang, “Character-level perturbations disrupt llm watermarks,” in Proceedings 2026 Network and Distributed System Security Symposium. Internet Society, 2026. [Online]. Available: http://dx.doi.org/10.14722/ndss.2026.230138 [39] N. Jovanović, R. Staab, and M. Vechev, “Watermark stealing in large language models,” in Proceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024. [40] A. Liu, L. Pan, X. Hu, S. Li, L. Wen, I. King, and P. S. Yu, “An unforgeable publicly verifiable watermark for large language models,” in The Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=gMLQwKDY3N [41] H. Shen, B. Huang, and X. Wan, “Enhancing LLM watermark resilience against both scrubbing and spoofing attacks,” in The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. [Online]. Available: https://openreview.net/forum?id=RbdLnwEEjk

Instant research discovery