Paper deep dive
SSG: Logit-Balanced Vocabulary Partitioning for LLM Watermarking
Chenxi Gu, Xiaoning Du, John Grundy
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 96%
Last extracted: 4/27/2026, 3:27:11 AM
Summary
The paper introduces SSG (Sort-then-Split by Groups), a novel logit-balanced vocabulary partitioning method designed to improve LLM watermarking effectiveness, particularly in low-entropy scenarios like code generation and mathematical reasoning. While the standard KGW scheme suffers from degraded watermark strength in low-entropy settings due to random vocabulary partitioning, SSG sorts tokens by logits and splits them into logit-balanced green and red subsets. This approach raises the lower bound of 'watermark strength,' ensuring better detectability without compromising text quality. Experimental results on models like Qwen2.5-Coder-7B and LLaMA-3-8B across datasets like HumanEval and MBPP demonstrate that SSG significantly outperforms KGW in low-entropy tasks.
Entities (8)
Relation Signals (4)
KGW → haslimitationin → low-entropy settings
confidence 100% · However, KGW's effectiveness degrades significantly under low-entropy settings such as code generation and mathematical reasoning.
SSG → uses → logit-balanced partitioning
confidence 100% · SSG (Sort-then-Split by Groups), a method that partitions the vocabulary into two logit-balanced subsets.
SSG → improves → watermark strength
confidence 95% · This design lifts the lower bound of watermark strength for each token prediction, thereby improving watermark detectability.
SSG → outperforms → KGW
confidence 90% · Experiments on multiple datasets demonstrate that SSG achieves superior detectability over baselines without degrading text quality.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Watermarking has emerged as a promising technique for tracing the authorship of content generated by large language models (LLMs). Among existing approaches, the KGW scheme is particularly attractive due to its versatility, efficiency, and effectiveness in natural language generation. However, KGW's effectiveness degrades significantly under low-entropy settings such as code generation and mathematical reasoning. A crucial step in the KGW method is random vocabulary partitioning, which enables adjustments to token selection based on specific preferences. Our study revealed that the next-token probability distribution plays an critical role in determining how much, or even whether, we can modify token selection and, consequently, the effectiveness of watermarking. We refer to this characteristic, associated with the probability distribution of each token prediction, as \emph{watermark strength.} In cases of random vocabulary partitioning, the lower bound of watermark strength is dictated by the next-token probability distribution. However, we found that, by redesigning the vocabulary partitioning algorithm, we can potentially raise this lower bound. In this paper, we propose SSG (\textbf{S}ort-then-\textbf{S}plit by \textbf{G}roups), a method that partitions the vocabulary into two logit-balanced subsets. This design lifts the lower bound of watermark strength for each token prediction, thereby improving watermark detectability. Experiments on code generation and mathematical reasoning datasets demonstrate the effectiveness of SSG.
Tags
Links
- Source: https://arxiv.org/abs/2604.22438v1
- Canonical: https://arxiv.org/abs/2604.22438v1
Trouble viewing inline? Open PDF directly →
Full Text
47,920 characters extracted from source content.
Expand or collapse full text
SSG: Logit-Balanced Vocabulary Partitioning for LLM Watermarking Chenxi Gu Xiaoning Du Corresponding author. John Grundy Abstract Watermarking has emerged as a promising technique for tracing the authorship of content generated by large language models (LLMs). Among existing approaches, the KGW scheme is particularly attractive due to its versatility, efficiency, and effectiveness in natural language generation. However, KGW’s effectiveness degrades significantly under low-entropy settings such as code generation and mathematical reasoning. A crucial step in the KGW method is random vocabulary partitioning, which enables adjustments to token selection based on specific preferences. Our study revealed that the next-token probability distribution plays an critical role in determining how much, or even whether, we can modify token selection and, consequently, the effectiveness of watermarking. We refer to this characteristic, associated with the probability distribution of each token prediction, as watermark strength. In cases of random vocabulary partitioning, the lower bound of watermark strength is dictated by the next-token probability distribution. However, we found that, by redesigning the vocabulary partitioning algorithm, we can potentially raise this lower bound. In this paper, we propose SSG (Sort-then-Split by Groups), a method that partitions the vocabulary into two logit-balanced subsets. This design lifts the lower bound of watermark strength for each token prediction, thereby improving watermark detectability. Experiments on code generation and mathematical reasoning datasets demonstrate the effectiveness of SSG. The source code is available at https://github.com/AllenG-L/SSG. SSG: Logit-Balanced Vocabulary Partitioning for LLM Watermarking 1 Introduction Large language models (LLMs) can generate high-quality, human-like content, making them powerful tools for diverse generative tasks. Yet these capabilities also pose risks: LLM outputs may be misused to infringe on proprietary interests, circumvent usage policies, or spread harmful misinformation. For example, most proprietary providers such as OpenAI, Anthropic, and Google Gemini prohibit the use of their outputs for training other models Houman (2025); Google (2025); Anthropic (2024), but proving such violations is difficult when generated text cannot be reliably distinguished from human-written or non-watermarked model outputs. Similarly, malicious actors may employ LLMs to generate convincing fake news Liu et al. (2024), urging regulatory bodies in the US, EU, China, and G7 countries to seek robust mechanisms for content authentication and provenance Union (2024). These challenges highlight the urgent need for reliable watermarking techniques. Among existing approaches, the KGW watermarking scheme has attracted attention for its simplicity, efficiency, and effectiveness in natural language generation Kirchenbauer et al. (2024); Liu et al. (2024). KGW partitions the vocabulary into two subsets (green and red) based on a context-dependent hash and biases the green subset’s logits to embed a hidden statistical signal. A standard statistical test, such as a z-score test, can then detect this signal by measuring the overrepresentation of green tokens. However, KGW watermarking degrades in low-entropy settings such as code generation Lee et al. (2024); Lu et al. (2024); Huang et al. (2025), where the next-token probability distribution is sharply peaked at a few tokens. While investigating this limitation, we found that next token probability distribution inherently affect how much, or even whether, we can effectively bias the green set of tokens, and consequently, the watermarking effectiveness. We refer to this characteristic associated with the probability distribution of next token prediction as watermark strength. Formally, it quantifies the normalized probability shift toward the green set at next token prediction. Under random vocabulary partitioning - the strategy hired by KGW, the lower bound of watermark strength is dictated by the next-token probability distribution (detailed analysis provided in Section 4.1). Low watermark strength is usually observed when most high-logit tokens are in the same subset—a situation that arises non-negligibly in low-entropy tasks where the number of high-logit tokens is quite limited. To mitigate this problem, we propose SSG (Sort-then-Split by Groups), a novel algorithm for improving the lower bound of watermark strength, thereby enhancing watermark detectability. SSG sorts tokens by their logits, groups them, and then applies a hash-based split such that the green and red sets are approximately logit-balanced. By doing so, SSG guarantees a higher lower bound on watermark strength than KGW, and the proof is presented in Section 4.4. Moreover, this proof extends to high-entropy tasks, demonstrating SSG’s generalizability across all generation scenarios. Experiments on multiple datasets demonstrate that SSG can enhance watermark detectability on different tasks without compromising text quality. Our main contributions are as follows: • We analyze the limitations of KGW watermarking in low-entropy settings and show why random vocabulary partitioning leads to weak watermark injection. • We introduce watermark strength, a token-level metric that provides fine-grained insight into watermark injection. • We propose SSG, a logit-balanced partitioning scheme that improves watermark detectability. • We conduct comprehensive evaluations on low-entropy and high-entropy tasks, demonstrating that SSG achieves superior detectability over baselines without degrading text quality. 2 Related Works Large language models (LLMs) such as GPT Radford and Narasimhan (2018), LLaMA Touvron et al. (2023), and GPT-4 OpenAI et al. (2024) have advanced rapidly in recent years, achieving state-of-the-art performance across diverse tasks, including machine translation OpenAI et al. (2024), code generation Li et al. (2023), and many others Touvron et al. (2023). Alongside these successes, however, their widespread adoption raises concerns over potential misuse and intellectual property protection, like unauthorized dataset usageSun et al. (2023). To address these challenges, watermarking has emerged as a promising approach for attributing and detecting LLM-generated content. Watermarking methods can broadly be categorized into three classes: logit-based Kirchenbauer et al. (2024); Lee et al. (2024); Lu et al. (2024); Chen et al. (2024), sampling-based Christ et al. (2023); Kuditipudi et al. (2024); Hou et al. (2024), and training-based Sun et al. (2022, 2023); Gu et al. (2024). Among these, logit-based approaches are particularly attractive due to their simplicity, versatility, and low computational cost Liu et al. (2024). A representative example is KGW Kirchenbauer et al. (2024), which partitions the vocabulary into “green” and “red” sets using a hash of the preceding context, and then adds a bias to the logits of green tokens. This encourages the model to generate more green tokens, enabling detection through a z-score statistical test. While effective for high-entropy text, KGW performance degrades substantially in low-entropy settings such as code generation, where the next-token distribution is concentrated on a small set of candidates Lee et al. (2024); Lu et al. (2024). In such cases, perturbing logits produces only a negligible distributional shift, weakening the watermark signal and reducing detection accuracy. To mitigate this, Lee et al. (2024) propose restricting watermark injection to high-entropy tokens, while Lu et al. (2024) introduce entropy-weighted scoring to prioritize high-entropy tokens during detection. Overall, these studies Lee et al. (2024); Lu et al. (2024); Huang et al. (2025)focus on improving the watermarking for low-entropy tasks via modifying the detection algorithm, while SSG aims to improve the injection algorithm. A recent concurrent work Park et al. (2026) also proposes a design of logit-balanced vocabulary partitioning for effective LLM watermarking. Similarly, it sorts and groups all tokens by logits. Unlike our strategy of assigning green and red colors independently for each group, Park et al. (2026) assigns colors uniformly across all groups. Both approaches offer similar enhancements, but we also provide a thorough theoretical analysis of the performance improvements. 3 Preliminaries Language Model: A language model ℳM is fundamentally a function for prediction the next token in a sequence. ℳM takes an input sequence =[x0,…,xn−1] x=[x_0,...,x_n-1] and produces the logit LnL_n, which will be transformed into a probability distribution PnP_n over a vocabulary set V. Formally, we have Pn=softmax(Ln)=softmax(ℳ(:−))P_n=softmax(L_n)=softmax(M( x_0:n-1)). The next token yny_n is selected based on PnP_n by sampling. This generation process is auto-regressive until a whole sequence y is finished. Watermarking Algorithm aims to embed hidden pattern into LLMs’ output to help people identify its authorship. It comprises two stages: Watermark Injection and Watermark Detection. During Watermark Injection, the probability distribution output will be altered from PnP_n to P~n P_n, which is determined by a secret key s. As a result, the output sequence is changed to ~ y instead of y. At Watermark Detection stage, the detection algorithm takes a suspected sequence ∗ x^* as input, and determines if it is generated by ℳM. KGW scheme Watermarking Algorithm: To embed watermark when predict yny_n, KGW scheme watermarking methods first divide vocabulary V into green token set gV^g with size of γ∗||γ*|V| where γ is green set ratio, and red token set rV^r, via a hash function determined by secret key s and context −h: x_-h: Then, the logits of token viv_i in gV^g, denoted as Ln,igL^g_n,i, will be increased by logit bias term δ, to get watermarked logit L~n=[Lng+δ,Lnr] L_n=[L^g_n+δ,L^r_n]. At last, next token y~n y_n will be sampled according to P~n P_n. During watermark detection stage, for a suspected text x, a statistical test is performed. The null hypothesis ℋ0H_0 is :The text is not watermarked. If the z-score of statistical test is above a predefined threshold τ, ℋ0H_0 could be rejected and one can conclude that x is watermarked. Low-entropy Generation Tasks: Low-entropy generation tasks refer to scenarios in which the language model’s next-token distribution is highly concentrated on only a few candidates. Formally, if the next-token distribution is denoted as P=piP=\p_i\, the entropy is given by H(P)=−∑ipilogpiH(P)=- _ip_i p_i. A low-entropy setting arises when H(P)H(P) is small, meaning that most of the probability is assigned to a small subset of tokens, while the rest receive negligible likelihood. Typical examples include code generation, mathematical reasoning, structured formats generation(e.g., JSON, SQL, or HTML). 4 Method This section provides a detailed description of SSG. In Section 4.1, we first explain why random vocabulary partition, which is adopted in prior KGW-scheme, induces the ineffectiveness in low-entropy settings. Then the whole pipeline of SSG watermark injection stage is described in Section 4.2. Section 4.3 details the process of watermark detection. Finally, we analyze SSG in Section 4.4 to show why it could achieve more reliable watermark injection. 4.1 Motivation We begin by formalizing the Watermarking Strength, which is a token-level metric that highly-related to watermark detectability of KGW-scheme and then explain why KGW-scheme could have poor Watermarking Strength on low-entropy tasks. Let LiL_i be the model logit for token vi∈v_i . The corresponding unnormalized weight after softmax is wi=eLi.w_i=e^L_i. (1) Given a partition of V into a green set gV^g and a red set rV^r, the total probability assigned to the green set before watermarking is pg=∑vi∈gwi∑vj∈wj.p_g= _v_i ^g w_i _v_j w_j. (2) In the KGW scheme, a fixed bias δ>0δ>0 is added to the logits of all green tokens, yielding modified logits L~i=Li+δ,vi∈g,Li,vi∈r. L_i= casesL_i+δ,&v_i ^g,\\ L_i,&v_i ^r. cases (3) The total probability assigned to the green set after watermarking becomes p~g=eδpgeδpg+(1−pg). p_g= e^δp_ge^δp_g+(1-p_g). (4) We define the Watermarking Strength as the normalized increase in the green total probability due to watermarking: fws(δ,pg)=p~g−pgpg(1−pg).f_ws(δ,p_g)= p_g-p_g p_g(1-p_g). (5) which could be simplified as: fws(δ,pg)=(eδ−1)pg(1−pg)1+(eδ−1)pg.f_ws(δ,p_g)= (e^δ-1)\, p_g(1-p_g)1+(e^δ-1)p_g. (6) Intuitively, fwsf_ws measures how much the bias δ alters the model’s next-token distribution toward the green set. Thus, fwsf_ws, which is a concave function about δ and pgp_g depicted in Appendix B , serves as a quantitative measure of the effectiveness of watermark injection at each next-token generation step. The lower bound of it implies that the green set contains either the top or bottom 50% of logit tokens. In low-entropy settings, suppose the top m tokens have logits L1≥⋯≥Lm≫∑i>mLiL_1≥·s≥ L_m _i>mL_i. With probability 21−m2^1-m, random vocabulary split places all m top tokens into the same subset, which happens non-negligibly when m is small in low-entropy settings, and hence pgp_g is close to 0 or 11 as ∑i>mpi→0 _i>mp_i→ 0. As a result, fwsf_ws could be nearly 0 in Equation 6, causing a ineffective watermark injection. To improve on fwsf_ws, one option is increase the bias term δ, however, this could induce a significant text quality drop Kirchenbauer et al. (2024). Instead, SSG aims to avoid such phenomenon by guaranteeing the tokens can be divided into two logit-balanced sets. By doing so, SSG enhances watermark detectability without comprising text quality. 4.2 Watermark Injection Algorithm 1 describes how SSG generate watermarked text with a language model ℳM. First, the model computes the logits L=ℳ()L=M( x) for all vocabulary tokens. The tokens are then sorted in descending order of their logits, and the resulting sequence is partitioned into consecutive groups of size two. Each group is processed independently: using a pseudorandom generator seeded by the secret key s combined with the token ids in every group ℬB, one token from the group is assigned to the green set gV^g, and the other to the red set rV^r. After partitioning, the logits of all tokens in the green set are increased by δ, while the red tokens remain unchanged. The modified logits L~ L are then passed through the softmax function to produce the biased probability distribution P~ P, from which the next token y is sampled. Despite the strong effectiveness of SSG demonstrated in our experiments, the procedure of SSG on the whole vocabulary can be computationally expensive, as it requires sorting the logits at every token prediction step. To strike a balance between effectiveness and efficiency, we propose to conduct SSG only on top-k logits tokens. The key observation is that in low-entropy settings, only a few tokens dominate the probability. Thus, ensuring that these high-logit tokens are evenly distributed between the green and red sets is sufficient to achieve a balanced vocabulary split. Based on this insight, SSG applies only on the top-k highest-probability tokens, while randomly splitting the remaining tokens. Our experiments show that this approach substantially reduces computational cost while maintaining watermarking effectiveness. Algorithm 1 Single Step Watermark Injection of SSG 0: LLM ℳM, context x, vocabulary V, secret key s, watermark window size h, logit bias δ, Green list ratio γ, Top-k hyperparameter k 0: Next token y, Green set gV^g, Red Set rV^r 1: L←ℳ()L ( x) 2: π←π← indices of V sorted by LiL_i in descending order 3: Partition π0:k−1 _0:k-1 into consecutive groups ℬ1,ℬ2,…,ℬk/2B_1,B_2,…,B_k/2 of size 2 4: g←∅V^g← , r←∅V^r← 5: for each group ℬB do 6: (v1,v2)←(v_1,v_2)← tokens in ℬB 7: Seed RNG with hash(s,v1,v2,−h:)hash(s,v_1,v_2, x_-h:) 8: r←r← RNG output from (0,1)(0,1) 9: if r<=0.5r<=0.5 then 10: g←g∪v1V^g ^g∪\v_1\, r←r∪v2V^r ^r∪\v_2\ 11: else 12: g←g∪v2V^g ^g∪\v_2\, r←r∪v1V^r ^r∪\v_1\ 13: end if 14: end for 15: T←γ∗||−k/2T←γ*|V|-k/2 16: Seed RNG with hash(s,−k:)hash(s, x_-k:) 17: ∗←V^*← Permutate k:V_k: seed by RNG 18: g←g∪∗0:T−1V^g ^g∪\V^*_0:T-1\, 19: r←r∪∗T:V^r ^r∪\V^*_T:\ 20: for each vi∈gv_i ^g do 21: L~i←Li+δ L_i← L_i+δ 22: end for 23: P~←softmax(L~) P ( L) 24: Sample next token y∼P~y P 25: return y,g,ry,V^g,V^r 4.3 Watermark Detection As an algorithm for logit-balanced vocabulary partition, SSG can incorporate any KGW-scheme detection algorithm like Kirchenbauer et al. (2024); Lee et al. (2024); Lu et al. (2024); Huang et al. (2025). In Algorithm 2, we adopt the design from Lu et al. (2024) as an example for detection due to its reported high performance, which uses the entropy value of every token to determine its weight on final detection result. 4.4 Analysis of SSG In this section, we present an analysis of SSG to demonstrate why it can guarantee the lower bound of watermark strength even in low-entropy settings. Let all pip_i be sorted descendingly: p1≥p2≥p3≥⋯≥pm≫∑i>mpi≈0p_1≥ p_2≥ p_3≥·s≥ p_m _i>mp_i≈ 0 and p1:mp_1:m are high-probability tokens. SSG forms consecutive pairs (p1,p2),(p3,p4),…(p_1,p_2),(p_3,p_4),… and assigns one token from each pair to gV^g. Define α=∑jp2j,β=∑jp2j−1.α\;=\; _jp_2j,β\;=\; _jp_2j-1. (7) Then we have: α≥1−p12,β≤1+p12.α\;≥\; 1-p_12,β\;≤\; 1+p_12. (8) Based on this, the lower bound pglbp_g^lb and upper bound pgubp_g^ub of pgp_g are: pglb=1−p12≤pg≤1+p12=pgub.p_g^lb= 1-p_12≤ p_g≤ 1+p_12=p_g^ub. (9) Because fwsf_ws is a concave function about pgp_g, we then have: fws(pg)≥minfws(pglb),fws(pgub)> 0.f_ws(p_g)\;≥ \f_ws(p_g^lb),f_ws(p_g^ub)\>\;0. (10) which means fwsf_ws has a lower bound and it is determined by p1p_1. In this formulation, the value of p1p_1 directly controls the tightness of the lower bound. When p1p_1 is very large, the distribution is dominated by a single high-probability token. In this extreme case, the residual probability becomes small, resulting in a looser lower bound. Intuitively, if the model is already overwhelmingly confident in predicting one token, no watermarking scheme can substantially alter the distribution without comprising text quality, and thus the strength of the watermark signal is inherently limited. Conversely, when p1p_1 is moderate, the probability is more evenly distributed among the top tokens. In this case, SSG ensures that both α and β are bounded away from 0 and 1, leading to a tighter bound on fwsf_ws. Taken together, this analysis demonstrates that SSG provides a provable guarantee of watermark strength that scales with the concentration of the next-token distribution. While extremely peaked distributions (large p1p_1) inherently limit the effectiveness of watermarking, SSG ensures that as long as probability is shared among multiple candidate tokens, the watermark signal remains detectable. It is worth noting that, although SSG is designed to improve watermark detectability on low-entropy tasks, such analysis can still hold on high-entropy tasks. In the following, we validate its performance on both task types. Model Method Humaneval MBPP P@1 T@1 F1@1 T@5 F1@5 P@1 T@1 F1@1 T@5 F1@5 Qwen2.5-coder-7B !25UW !2531.8 !250.6 !251.2 !253.7 !256.7 !2542.3 !251.9 !253.6 !255.8 !2510.5 KGW 26.2 22.0 35.8 36.0 51.3 38.4 37.8 54.6 64.0 75.9 +SSG+SSG 25.6 39.0 55.9 45.7 60.7 37.0 58.7 73.6 71.7 81.3 SWEET 26.2 29.3 45.1 36.1 66.1 40.2 53.7 69.5 72.8 82.0 +SSG+SSG 29.9 50.0 66.4 78.0 84.2 37.6 62.2 83.5 76.2 84.2 EWD 26.5 32.9 49.3 52.4 66.7 37.6 57.4 75.7 74.6 83.2 +SSG+SSG 27.8 50.6 66.9 70.7 80.6 38.1 74.3 84.9 84.1 89.1 LLaMA-3-8B !25UW !2534.1 !258.5 !2515.6 !2515.2 !2525.4 !2556.3 !2513.6 !2518.3 !2529.7 !2510.5 KGW 27.4 13.4 23.5 22.6 35.4 51.9 21.1 27.6 28.3 42.5 +SSG+SSG 32.3 14.0 24.5 49.4 64.0 51.6 85.5 89.9 89.9 92.4 SWEET 29.3 7.9 14.6 26.2 40.0 51.9 74.1 78.5 81.0 87.2 +SSG+SSG 29.3 24.4 39.0 37.8 53.0 53.2 93.0 96.0 96.8 96.1 EWD 34.1 26.8 42.1 54.9 68.7 51.6 87.7 91.3 94.2 94.7 +SSG+SSG 29.9 59.1 74.0 73.2 82.2 51.6 97.1 98.1 98.9 97.1 Table 1: Evaluation of watermarking methods on Humaneval and MBPP. For every setting, we run 55 times and report the average result. Numbers are percentages (i.e., original scores ×100× 100). UW denotes the unwatermarked baseline. UW denotes the unwatermarked baseline. Metrics are reported as percentages (original scores ×100× 100): P@1 = Pass@1, T@1 = True Positive Rate (TPR) at 1% False Positive Rate (FPR), F1@1 = F1-score at 1% FPR, T@5 = TPR at 5% FPR, F1@5 = F1-score at 5% FPR. Best results in each column are bolded. 5 Experiments We conduct experiments across multiple datasets, models, and watermarking methods using the open-source toolkit MarkLLM Pan et al. (2024). Tasks and Datasets. We evaluate SSG on both low-entropy and high-entropy tasks. The two representative low-entropy tasks selected are code generation and mathematical problem solving. For code generation, we use HumanEval Austin et al. (2021) and MBPP Chen et al. (2021), both consisting of Python programming problems with reference solutions. For mathematical reasoning, we sample 10% problems from GSM8K Cobbe et al. (2021), which contains grade-school level math questions in English. For the high entropy tasks, we use C4 Raffel et al. (2023) and CNN/DailyMail Hermann et al. (2015). Following prior work Lee et al. (2024); Lu et al. (2024); Huang et al. (2025), we only consider generations longer than 15 tokens for watermark detection. Models. For code generation, we employ Qwen2.5-Coder-7BHui et al. (2024), a model specialized in programming tasks. For mathematical reasoning, we use DeepSeekMath-7BShao et al. (2024), which is trained specifically for math problem solving. To assess the generalizability of SSG, we also evaluate the versatile LLaMA-3-8B Grattafiori et al. (2024) on both code and math tasks. The max generation lengyh is set to 512512 in all experiments. Watermarking Methods. We compare three representative watermarking methods: KGW, SWEET, and EWD. KGW is the classical baseline in this line of research, while SWEET and EWD are methods designed to better handle low-entropy scenarios. Without lossing generality, we set watermark context window h as 11, δ as 2.02.0, green set ratio γ as 0.50.5 for all methods. Baselines and Metrics. Since SSG can be incorporated into any KGW-scheme watermarking method, we report results for each method both with and without SSG, thereby isolating the effect of our contribution. Following prior works Lu et al. (2024); Lee et al. (2024), we report true positive rates (TPR) at 1% and 5% false positive rates (FPR), along with the corresponding F1-score. For generation quality, we measure Pass@1 accuracy on HumanEval and MBPP for code generation, and answer accuracy on GSM8K for mathematical reasoning. Besides, we use perplexity to measure text quality on C4 and CNN/DailyMail. These metrics together reflect the trade-off between watermark detectability and text quality. 5.1 Main Results Model Method P@1 T@1 F1@1 T@5 F1@5 DSMath-7B !25UW !2527.3 !254.5 !258.6 !256.8 !2512.2 KGW 21.7 41.7 58.5 57.6 71.0 +SSG+SSG 25.8 90.9 94.9 91.7 93.4 SWEET 27.3 94.7 96.9 97.0 96.2 +SSG+SSG 25.0 94.7 96.9 97.0 96.2 EWD 21.2 93.2 96.1 95.5 95.5 +SSG+SSG 25.0 96.2 97.7 97.0 96.2 LLaMA-3-8B !25UW !2538.6 !255.3 !2510.0 !2512.9 !2521.9 KGW 37.1 63.6 77.4 65.2 76.8 +SSG+SSG 34.1 89.4 94.0 91.0 95.5 SWEET 38.6 79.5 88.2 94.7 95.1 +SSG+SSG 34.1 100 99.6 100 97.8 EWD 35.6 74.2 84.8 95.5 95.5 +SSG+SSG 35.6 99.2 99.2 99.2 97.4 Table 2: Evaluation of watermarking methods on GSM8K. Figure 1: Influence of top-k on SSG performance. Table 1 and Table 2 show the performance of multiple watermark algorithms on code generation and mathematical reasoning tasks, respectively, while Table 5 shows the results on high-entropy tasks. Across all models and datasets, the introduction of watermarking results in a drop in Pass@1 relative to the unwatermarked baseline. This indicates that watermarking inevitably perturbs the next-token distribution, and such perturbations come at a cost of text quality. In other words, watermarking strengthens attribution and traceability but reduces the probability of generating the correct solution. For all three watermarking methods (KGW, SWEET, and EWD), the corresponding SSG variants yield substantial improvements in detection performance. In particular, SSG consistently raises TPR and F1 under both the 1%1\% and 5%5\% FPR thresholds, in some cases by large margins. Importantly, these gains are achieved without further degrading Pass@1, demonstrating that SSG can significantly strengthen watermark detectability while preserving text quality. Figure 2: Examples of the watermark strength distributions on Qwen2.5-Coder-7B and LLaMA3-8B for code generation tasks. 5.2 Analysis on Watermark Strength To further assess the effect of SSG on token-level watermark detectability, we analyze the distribution of Watermark Strength on code generation tasks with Qwen2.5-Coder-7B and LLaMA-3-8B. Figure 3 illustrates the comparison between KGW and SSG. The key difference is that KGW produces a substantially larger proportion of tokens with near-zero Watermark Strength. Such tokens contribute little to the statistical signal and ultimately lower the overall z-score of the sequence, impairing detection. By contrast, SSG reshapes the distribution by reducing the probability of near-zero values and enforcing a lower bound on Watermark Strength, thereby ensuring more consistent detectability across tokens. Model Method Humaneval MBPP P@1 T@1 F1@1 T@5 F1@5 P@1 T@1 F1@1 T@5 F1@5 Qwen2.5-coder-7B !25UW !2531.8 !250.6 !251.2 !253.7 !256.7 !2542.3 !251.9 !253.6 !255.8 !2510.5 KGW 26.2 22.0 35.8 36.0 51.3 38.4 37.8 54.6 64.0 75.9 +SSG+SSG 25.6 22.6 36.6 31.7 46.4 37.0 55.6 71.1 67.5 78.3 SWEET 26.2 32.3 48.6 53.0 67.2 40.2 57.1 72.4 72.2 81.6 +SSG+SSG 29.9 30.5 46.5 54.3 68.2 37.6 72.2 80.2 75.7 83.7 EWD 26.5 43.3 60.2 59.1 72.1 37.6 67.5 80.2 75.4 83.7 +SSG+SSG 27.8 28.0 43.6 42.1 57.3 38.1 68.3 71.7 68.3 78.9 LLaMA-3-8B !25UW !2532.9 !258.5 !2515.6 !2515.2 !2525.4 !2556.3 !2513.6 !2518.3 !2529.7 !2529.7 KGW 27.4 13.4 23.5 22.6 35.4 51.9 22.1 27.6 28.3 42.5 +SSG+SSG 32.3 6.7 12.5 23.2 36.2 51.6 60.8 80.0 82.5 88.1 SWEET 29.3 8.5 15.6 18.3 29.7 51.9 41.8 58.6 60.1 72.9 +SSG+SSG 29.3 10.4 18.7 14.6 24.5 53.2 94.5 94.5 91.3 93.1 EWD 34.1 18.9 31.6 42.7 57.9 51.6 82.9 82.9 83.1 88.5 +SSG+SSG 29.9 19.5 32.5 34.8 49.8 51.6 85.8 85.8 87.3 90.9 Table 3: Evaluation of watermarking methods on Humaneval and MBPP without original prompts. All numbers are percentages; bold indicates the best per column. Model Method P@1 T@1 F1@1 T@5 F1@5 DSMath-7B !25UW !2527.3 !254.5 !258.6 !256.8 !2512.2 KGW 21.7 41.7 58.5 57.6 71.0 +SSG+SSG 25.8 81.8 89.6 85.6 90.0 SWEET 27.3 94.7 96.9 96.2 95.8 +SSG+SSG 25.0 78.0 87.3 82.6 88.3 EWD 21.2 92.4 95.7 95.5 95.5 +SSG+SSG 25.0 86.4 92.3 88.6 91.8 LLaMA-3-8B !25UW !2535.6 !255.3 !2510.0 !2512.9 !2521.9 KGW 35.6 63.6 77.4 65.2 76.8 +SSG+SSG 34.1 71.2 82.8 78.8 86.0 SWEET 38.6 60.6 75.1 84.1 89.2 +SSG+SSG 34.1 97.7 98.5 97.7 96.6 EWD 35.6 70.5 82.3 92.4 93.8 +SSG+SSG 35.6 68.2 80.7 75.8 84.0 Table 4: Evaluation of watermarking methods on GSM8K. All numbers are percentages; bold indicates the best per column. 5.3 The choice of Top-k We further investigate how the choice of top-k in SSG influences watermarking performance, text quality, and decoding efficiency. Experiments are conducted across six settings: Qwen2.5-Coder-7B and LLaMA-3-8B on HumanEval and MBPP for code generation, and DSMath-7B and LLaMA-3-8B on GSM8K for mathematical reasoning. We compare the baseline EWD with its variants combined with SSG, varying k∈2,4,8,16k∈\2,4,8,16\ to control the number of top-logit tokens used for balanced vocabulary partitioning. For decoding efficiency, we normalize the speed of EWD to 100%. The results in Figure 1 show that even when SSG is applied only to the top-2 logits, it yields substantial improvements in detection performance (TPR@1, TPR@5, and F1) compared to the baseline. Increasing k beyond 2 brings only marginal gains in detection while leaving text quality (Pass@1) unchanged, but incurs additional overhead that slows down decoding. Thus, larger k values fail to provide further detectability benefits and instead reduce efficiency. Considering this trade-off, we recommend moderate settings of k=2k=2 or k=4k=4, which offer strong detection capability without significant efficiency loss. 5.4 Results without Original Prompts In realistic scenarios such as code authorship detection, the original prompts used during generation may be unavailable at the time of watermark detection. To evaluate this setting, we follow prior work Lu et al. (2024); Lee et al. (2024); Huang et al. (2025) and conduct experiments using a general prompt. Table 3 and Table 4 report the detection results under this condition for code generation and mathematical reasoning, respectively. Compared to the case where original prompts are accessible, detection performance generally decreases across all methods, except for KGW without SSG. This is expected since KGW is the only method that does not depend on the original prompt for detection. Moreover, the effect of incorporating SSG is mixed: it improves detection in some cases but degrades it in others, reflecting the inherent reliance of SSG on logit values conditioned by the original prompts. 5.5 Results on Robustness We also evaluate the robustness of SSG against paraphrase attack by using GPT-4o-mini to paraphrase watermarked sentences. The experiment results showed in Table 6 and 7 demonstrated that the robustness of SSG varies on different LLMs compared to other methods without SSG. Compared to the results in Table 1 and Table 2, we can find that TPR drops significantly in all settings, demonstrating that paraphrasing attack is an effective way to erase watermark. SSG exhibits strong robustness on LLaMA-3-8B across both code generation and mathematical reasoning tasks. Conversely, it shows poor robustness on DSMath-7B. As for Qwen2.5-Coder-7B, its robustness remains largely on par with the baseline. 6 Conclusion In this paper, we introduced a token-level metric, Watermark Strength, to evaluate watermark detectability at the granularity of individual tokens. Using this metric, we revealed why the KGW scheme suffers in low-entropy settings such as code generation and mathematical reasoning. To address this limitation, we proposed SSG (Sort-then-Split by Groups), a logit-balanced partitioning algorithm that improves the lower bound on Watermark Strength of watermark injection. Extensive experiments on multiple large language models across code and mathematic reasoning tasks demonstrate that SSG achieves consistently stronger detection performance while maintaining text quality. Limitations Although SSG proves effective in our evaluations, the experimental scope remains limited. Future work should expand to additional low-entropy domains and diverse datasets to further validate its performance. Moreover, while SSG improves watermark injection reliability, it still depends on the availability of the original prompt for optimal detection, which restricts its applicability in realistic settings. An important research direction is to design prompt-free watermarking algorithms that retain effectiveness even in low-entropy tasks. References Anthropic (2024) Usage policy. Note: Blog post External Links: Link Cited by: §1. J. Austin, A. Odena, M. Nye, M. Bosma, H. Michalewski, D. Dohan, E. Jiang, C. Cai, M. Terry, Q. Le, and C. Sutton (2021) Program synthesis with large language models. External Links: 2108.07732, Link Cited by: §5. L. Chen, Y. Bian, Y. Deng, D. Cai, S. Li, P. Zhao, and K. Wong (2024) WatME: towards lossless watermarking through lexical redundancy. External Links: 2311.09832, Link Cited by: §2. M. Chen, J. Tworek, H. Jun, Q. Yuan, H. P. de Oliveira Pinto, J. Kaplan, H. Edwards, Y. Burda, N. Joseph, G. Brockman, A. Ray, R. Puri, G. Krueger, M. Petrov, H. Khlaaf, G. Sastry, P. Mishkin, B. Chan, S. Gray, N. Ryder, M. Pavlov, A. Power, L. Kaiser, M. Bavarian, C. Winter, P. Tillet, F. P. Such, D. Cummings, M. Plappert, F. Chantzis, E. Barnes, A. Herbert-Voss, W. H. Guss, A. Nichol, A. Paino, N. Tezak, J. Tang, I. Babuschkin, S. Balaji, S. Jain, W. Saunders, C. Hesse, A. N. Carr, J. Leike, J. Achiam, V. Misra, E. Morikawa, A. Radford, M. Knight, M. Brundage, M. Murati, K. Mayer, P. Welinder, B. McGrew, D. Amodei, S. McCandlish, I. Sutskever, and W. Zaremba (2021) Evaluating large language models trained on code. External Links: 2107.03374, Link Cited by: §5. M. Christ, S. Gunn, and O. Zamir (2023) Undetectable watermarks for language models. External Links: 2306.09194, Link Cited by: §2. K. Cobbe, V. Kosaraju, M. Bavarian, M. Chen, H. Jun, L. Kaiser, M. Plappert, J. Tworek, J. Hilton, R. Nakano, C. Hesse, and J. Schulman (2021) Training verifiers to solve math word problems. External Links: 2110.14168, Link Cited by: §5. Google (2025) Google apis terms of service. Note: Blog post External Links: Link Cited by: §1. A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, and et al. (2024) The llama 3 herd of models. External Links: 2407.21783, Link Cited by: §5. C. Gu, X. L. Li, P. Liang, and T. Hashimoto (2024) On the learnability of watermarks for language models. External Links: 2312.04469, Link Cited by: §2. K. M. Hermann, T. Kočiský, E. Grefenstette, L. Espeholt, W. Kay, M. Suleyman, and P. Blunsom (2015) Teaching machines to read and comprehend. In Advances in Neural Information Processing Systems, p. 1693–1701. Cited by: §5. A. B. Hou, J. Zhang, T. He, Y. Wang, Y. Chuang, H. Wang, L. Shen, B. V. Durme, D. Khashabi, and Y. Tsvetkov (2024) SemStamp: a semantic watermark with paraphrastic robustness for text generation. External Links: 2310.03991, Link Cited by: §2. Houman (2025) The openai vs deepseek knowledge distillation dispute: technical and legal implications. Note: Blog post External Links: Link Cited by: §1. B. Huang, D. Su, F. Sun, Q. Cao, H. Shen, and X. Cheng (2025) Low-entropy watermark detection via Bayes’ rule derived detector. In Findings of the Association for Computational Linguistics: ACL 2025, W. Che, J. Nabende, E. Shutova, and M. T. Pilehvar (Eds.), Vienna, Austria, p. 14330–14344. External Links: Link, Document, ISBN 979-8-89176-256-5 Cited by: §1, §2, §4.3, §5.4, §5. B. Hui, J. Yang, Z. Cui, J. Yang, D. Liu, L. Zhang, T. Liu, J. Zhang, B. Yu, K. Lu, K. Dang, Y. Fan, Y. Zhang, A. Yang, R. Men, F. Huang, B. Zheng, Y. Miao, S. Quan, Y. Feng, X. Ren, X. Ren, J. Zhou, and J. Lin (2024) Qwen2.5-coder technical report. External Links: 2409.12186, Link Cited by: §5. J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein (2024) A watermark for large language models. External Links: 2301.10226, Link Cited by: §1, §2, §2, §4.1, §4.3. R. Kuditipudi, J. Thickstun, T. Hashimoto, and P. Liang (2024) Robust distortion-free watermarks for language models. External Links: 2307.15593, Link Cited by: §2. T. Lee, S. Hong, J. Ahn, I. Hong, H. Lee, S. Yun, J. Shin, and G. Kim (2024) Who wrote this code? watermarking for code generation. External Links: 2305.15060, Link Cited by: §1, §2, §2, §2, §4.3, §5.4, §5, §5. R. Li, L. B. Allal, Y. Zi, N. Muennighoff, D. Kocetkov, C. Mou, M. Marone, C. Akiki, J. Li, J. Chim, Q. Liu, E. Zheltonozhskii, T. Y. Zhuo, T. Wang, O. Dehaene, M. Davaadorj, J. Lamy-Poirier, J. Monteiro, O. Shliazhko, N. Gontier, N. Meade, A. Zebaze, M. Yee, L. K. Umapathi, J. Zhu, B. Lipkin, M. Oblokulov, Z. Wang, R. Murthy, J. Stillerman, S. S. Patel, D. Abulkhanov, M. Zocca, M. Dey, Z. Zhang, N. Fahmy, U. Bhattacharyya, W. Yu, S. Singh, S. Luccioni, P. Villegas, M. Kunakov, F. Zhdanov, M. Romero, T. Lee, N. Timor, J. Ding, C. Schlesinger, H. Schoelkopf, J. Ebert, T. Dao, M. Mishra, A. Gu, J. Robinson, C. J. Anderson, B. Dolan-Gavitt, D. Contractor, S. Reddy, D. Fried, D. Bahdanau, Y. Jernite, C. M. Ferrandis, S. Hughes, T. Wolf, A. Guha, L. von Werra, and H. de Vries (2023) StarCoder: may the source be with you!. External Links: 2305.06161, Link Cited by: §2. A. Liu, L. Pan, Y. Lu, J. Li, X. Hu, X. Zhang, L. Wen, I. King, H. Xiong, and P. S. Yu (2024) A survey of text watermarking in the era of large language models. External Links: 2312.07913, Link Cited by: §1, §1, §2. Y. Lu, A. Liu, D. Yu, J. Li, and I. King (2024) An entropy-based text watermarking detection method. External Links: 2403.13485, Link Cited by: §1, §2, §2, §2, §4.3, §5.4, §5, §5. OpenAI, J. Achiam, S. Adler, S. Agarwal, L. Ahmad, and I. A. et al. (2024) GPT-4 technical report. External Links: 2303.08774, Link Cited by: §2. L. Pan, A. Liu, Z. He, Z. Gao, X. Zhao, Y. Lu, B. Zhou, S. Liu, X. Hu, L. Wen, I. King, and P. S. Yu (2024) MarkLLM: an open-source toolkit for llm watermarking. External Links: 2405.10051, Link Cited by: §5. S. Park, H. Park, H. Ahn, and Y. Han (2026) WaterMod: modular token-rank partitioning for probability-balanced llm watermarking. Proceedings of the AAAI Conference on Artificial Intelligence 40 (39), p. 32683–32691. External Links: Link, Document Cited by: §2. A. Radford and K. Narasimhan (2018) Improving language understanding by generative pre-training. External Links: Link Cited by: §2. C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P. J. Liu (2023) Exploring the limits of transfer learning with a unified text-to-text transformer. External Links: 1910.10683, Link Cited by: §5. Z. Shao, P. Wang, Q. Zhu, R. Xu, J. Song, X. Bi, H. Zhang, M. Zhang, Y. K. Li, Y. Wu, and D. Guo (2024) DeepSeekMath: pushing the limits of mathematical reasoning in open language models. External Links: 2402.03300, Link Cited by: §5. Z. Sun, X. Du, F. Song, and L. Li (2023) CodeMark: imperceptible watermarking for code datasets against neural code completion models. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ESEC/FSE ’23, p. 1561–1572. External Links: Link, Document Cited by: §2, §2. Z. Sun, X. Du, F. Song, M. Ni, and L. Li (2022) CoProtector: protect open-source code against unauthorized training usage with data poisoning. In Proceedings of the ACM Web Conference 2022, p. 652–660. Cited by: §2. H. Touvron, T. Lavril, G. Izacard, X. Martinet, M. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, and G. Lample (2023) LLaMA: open and efficient foundation language models. External Links: 2302.13971, Link Cited by: §2. E. Union (2024) Regulation (eu) 2024/1689: artificial intelligence act.. Note: Blog post External Links: Link Cited by: §1. Appendix A Watermark Detection Algorithm 2 explains how SSG works with another detection algorithm like EWD. Algorithm 2 SSG Watermark Detection 0: LLM ℳM, suspected text x, vocabulary V, secret key s, threshold τ, green-list ratio γ, context window size h, Top-k hyperparameter k 0: Decision on whether x is watermarked 1: Initialize ← E← 0, ← g← 0 2: for each token xix_i in k: x_k: do 3: L←ℳ(0:i−1)L ( x_0:i-1) 4: P←softmax(L)P (L) 5: Ei←Entropy(P)E_i (P) 6: (g,r)←SSG(ℳ,,s,,h,k)(V^g,V^r) (M,V,s, x,h,k) 7: if xi∈gx_i ^g then 8: i←1 g_i← 1 9: end if 10: end for 11: for each EiE_i in E do 12: Wi←Ei−min()W_i← E_i- ( E) 13: end for 14: |s|G←⋅|s|_G← W· g 15: z←|s|G−γ∑i=h||Wiγ(1−γ)∑i=h||Wi2z← |s|_G-γ _i=h^| x|W_i γ(1-γ) _i=h^| x|W_i^2 16: if z>τz>τ then 17: return x is watermarked 18: else 19: return x is not watermarked 20: end if Appendix B Curve of Watermark Strength Figure 3: Curve of Watermark Strength over pgp_g and δ. Appendix C Text Quality of SSG We show that SSG and KGW are equivalent in the expected logit shift across the parameter space γ∈(0,1)γ∈(0,1). Let [L~i(γ)]E[ L_i(γ)] be the expected logit of token viv_i for a given γ. In the KGW framework, the expectation is trivially: KGW[L~i(γ)]=Li+γδE_KGW[ L_i(γ)]=L_i+γδ (11) In SSG, the probability of green tokens P(vi∈g;γ)P(v_i ^g;γ) is piecewise-defined by the token’s rank ZiZ_i. The total bias injected into the vocabulary V is: SSG(γ) SSG(γ) =∑vj∈(SSG[L~j(γ)]−Lj) = _v_j (E_SSG[ L_j(γ)]-L_j ) (12) =∑vj∈top0.5δ+∑vj∈remγ||−k/2||−kδ = _v_j _top0.5δ+ _v_j _rem γ|V|-k/2|V|-kδ (13) =k2δ+(γ||−k/2)δ=γ||δ = k2δ+(γ|V|-k/2)δ=γ|V|δ (14) Dividing by the vocabulary size |||V|, the mean expected logit for SSG is: 1||∑vj∈SSG[L~j(γ)]=L¯+γδ 1|V| _v_j E_SSG[ L_j(γ)]= L+γδ (15) Thus, the global expectation of the logit shift in SSG is identical to KGW: SSG[L~(γ)]=KGW[L~(γ)]=L+γδE_SSG[ L(γ)]=E_KGW[ L(γ)]=L+γδ (16) This confirms that SSG preserves the quality quality of KGW. Appendix D General Prompts For Humaneval and MBPP, we use "Please write a Python function that solves a given task. Output only valid Python code without explanations. def solve_problem(input_data): " as our General Prompt for experiments without original prompts. While on GSM8k, the General Prompt is "Solve the following math word problem step by step, and in the last line output the final numeric answer in the format: #### <answer>. ". Appendix E Experiments Model Method C4 CNN/DM PPL T@1 F1@1 T@5 F1@5 PPL T@1 F1@1 T@5 F1@5 LLaMA-3-8B !25UW !252.65 !253.0 !255.8 !254.0 !257.3 !252.60 !250.0 !250.0 !252.0 !253.7 KGW 3.01 81.0 89.0 90.0 92.3 2.86 72.0 83.2 91.0 92.9 +SSG+SSG 2.80 93.0 95.9 95.0 95.0 2.84 98.0 98.5 99.0 97.1 SWEET 3.01 91.0 94.8 93.0 93.9 2.89 88.0 93.1 99.0 97.1 +SSG+SSG 2.80 94.0 96.8 95.2 95.8 2.84 95.0 95.0 99.0 97.1 EWD 3.01 95.0 96.9 97.0 96.0 2.86 92.0 95.3 95.0 95.0 +SSG+SSG 2.80 96.0 97.5 98.0 96.6 2.84 98.0 98.5 99.0 97.1 Table 5: Evaluation of watermarking methods on C4 and CNN/DailyMail . All numbers are percentages. Model Method Humaneval MBPP T@1 F1@1 T@5 F1@5 T@1 F1@1 T@5 F1@5 Qwen2.5-coder-7B !25UW !250.6 !251.2 !253.7 !256.7 !251.9 !253.6 !255.8 !2510.5 KGW 3.0 5.9 9.1 16.1 3.2 6.1 14.3 24.0 SWEET 1.2 2.4 8.5 15.1 2.6 5.1 9.3 16.2 EWD 5.5 10.3 11.0 18.9 4.8 9.0 8.7 15.4 +SSG+SSG 7.3 13.6 20.1 32.2 2.4 4.6 6.1 11.0 LLaMA-3-8B !25UW !256.1 !2511.4 !2511.6 !2519.9 !251.6 !253.1 !254.5 !258.2 KGW 0.6 1.2 1.2 2.3 1.1 2.1 5.0 9.2 SWEET 0.6 1.2 1.2 2.3 1.1 2.1 5.0 9.2 EWD 7.3 13.6 23.8 37.0 4.0 7.6 12.7 21.6 +SSG+SSG 28.0 43.6 53.0 67.2 5.6 10.4 19.6 31.5 Table 6: Evaluation of watermarking methods on Humaneval and MBPP when watermarked sentence has been paraphrased by GPT-4o-mini. All numbers are percentages. Model Method T@1 F1@1 T@5 F1@5 DSMath-7B !25UW !254.5 !258.6 !256.8 !2512.2 KGW 1.5 3.0 6.1 11.0 SWEET 25.0 39.8 44.7 59.9 EWD 22.7 36.8 28.8 43.2 +SSG+SSG 0.0 0.0 9.8 17.2 LLaMA-3-8B !25UW !252.3 !254.4 !253.8 !257.0 KGW 0.0 0.0 13.6 23.1 SWEET 0.0 0.0 13.6 23.1 EWD 1.5 3.0 12.1 20.8 +SSG+SSG 12.1 21.5 25.0 38.6 Table 7: Evaluation of watermarking methods on GSM8K when watermarked sentence has been paraphrased by GPT-4o-mini. All numbers are percentages.