Text watermarking

Overview

A text watermark biases which tokens a model picks, following a secret rule, so that a detector can later decide whether a text came from the model 2509.24368 §1. The red-green family assigns each token to a "green" list derived from its context hash and favours green tokens. Detection counts green tokens and runs a binomial test 2509.24368 §3.2.

The shared problem is that the green list needs the context of each token. In a left-to-right model that context is fixed. In a diffusion language model, tokens are filled in any order, so a token is often sampled before some of its context is decoded 2509.24368 §3.1. The shared invariant is the detector: a binomial test on the green count, which needs the hash and the key, not the model 2509.24368 §3.2.

Variants

Expected-gradient tilt for diffusion models

At each denoising step, the method computes the distribution of each position's context hash from the current token distributions. It then evaluates the expected green count on the top-k tokens and hashes and adds a scaled gradient of that count to the logits 2509.24368 §3.2 2509.24368 alg. 2. The tilt has two parts: a booster that raises green tokens in the current position, and a greenify term that favours tokens making the next position's hash more likely to be green 2509.24368 §3.3 2509.24368 eq. 9. Using both beats either part alone in the authors' ablation 2509.24368 §4.3. Card: Watermarking Diffusion Language Models.

Hash choice: SumHash or MinHash

SumHash sums token ids at the context offsets; MinHash takes the minimum of permuted token ids 2509.24368 §3.2. The main experiments use SumHash 2509.24368 §4.1. The authors report no significant effect of the hash choice 2509.24368 §4.3.

Strength by delta or by KL budget epsilon

The strength can be a constant delta, or it can be set by bisection so that the KL divergence from the model stays within a budget epsilon 2509.24368 app. G.2. The paper recommends the delta form for the main experiments 2509.24368 §4.3. The authors report that the epsilon form gives much weaker detection 2509.24368 §4.3.

Naive adaptation (baseline)

The baseline applies a red-green watermark only at positions whose context is already fixed 2509.24368 §4.1. The paper uses it as the comparison point for the tilt method above.

When to use which

Implementation sketch

The core of one watermarked step, in the paper's own terms. Strength normalisation differs between the appendix and the released code; see Contradictions before choosing a value.

# Booster added to the logits at one denoising step  [arxiv:2509.24368 alg. 2]
# Input:  logits (B, L, V); delta (strength); k (top-k size)
# Output: booster (B, L, V), added to the logits before sampling

def watermark_booster(logits, delta, k):
    # Token distributions at each position  [arxiv:2509.24368 §3.2]
    probs = softmax(logits / T)                              # (B, L, V)
    # Distribution over the hash of each position's context  [arxiv:2509.24368 eq. 6]
    hash_probs = convolve_context_probs(probs, context_offsets)
    # Expected green count over the top-k tokens and hashes  [arxiv:2509.24368 eq. 2]
    energy = expected_green_count(probs, hash_probs, k)      # (B,)
    # Gradient of the energy with respect to each position's distribution  [arxiv:2509.24368 §3.1]
    alpha = gradient(energy, probs)                          # (B, L, V)
    # Logit tilt  [arxiv:2509.24368 eq. 4]
    return delta * alpha

Detection uses the same green matrix and does not run the model:

# Detection  [arxiv:2509.24368 §3.2]
# Input:  tokens (L,); context offsets C; green matrix G; green rate gamma

def detect(tokens, C, G, gamma):
    # Keep one copy of each (context hash, token) pair
    pairs = unique(zip(context_hash(tokens, C), tokens))
    # Count the pairs that are green under G
    greens = sum(G[h, t] for h, t in pairs)
    # One-sided binomial test of the green count against gamma
    return binomial_p_value(greens, len(pairs), gamma)

Contradictions

• Strength scale. The paper gives delta = 4 for context {-1} and 5 for larger contexts 2509.24368 §4.1. Its appendix divides delta by the context size 2509.24368 app. A.1. The released configs set delta to 2.0. The paper does not say which value produced its table, and the released configs do not reproduce the stated delta.
• Remasking for Dream. The paper says random remasking for both models 2509.24368 app. A.1. The released Dream config uses a different strategy. The paper does not say which one produced the Dream results.
• Remasking changes the setting. With entropy remasking, the appendix chooses delta = 3 for context {-1} to reach about 1.0 TPR@1 at 300 tokens 2509.24368 app. C.5. The detection figures depend on the remasking strategy, so they do not transfer across strategies without recalibration.

Author-reported figures come from a single paper and have not been reproduced here.

Papers

• Watermarking Diffusion Language Models: adapts red-green watermarks to diffusion language models by tilting each denoising step with the expected green-count gradient; detection stays the binomial test.