mlsanityData to 14 Oct 2026

Mark My Words: Analyzing and Evaluating Language Model Watermarks

arXiv 2312.00273 ↗First posted 1 Dec 2023cs.CR cs.AI cs.CLcited by 71

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

The capabilities of large language models have grown significantly in recent years and so too have concerns about their misuse. It is important to be able to distinguish machine-generated text from human-authored content. Prior works have proposed numerous schemes to watermark text, which would benefit from a systematic evaluation framework. This work focuses on LLM output watermarking techniques - as opposed to image or model watermarks - and proposes Mark My Words, a comprehensive benchmark for them under different natural language tasks. We focus on three main metrics: quality, size (i.e., the number of tokens needed to detect a watermark), and tamper resistance (i.e., the ability to detect a watermark after perturbing marked text). Current watermarking techniques are nearly practical enough for real-world use: Kirchenbauer et al. [33]'s scheme can watermark models like Llama 2 7B-chat or Mistral-7B-Instruct with no perceivable loss in quality on natural language tasks, the watermark can be detected with fewer than 100 tokens, and their scheme offers good tamper resistance to simple perturbations. However, they struggle to efficiently watermark code generations. We publicly release our benchmark (https://github.com/wagner-group/MarkMyWords).

Key facts. Cited by 71 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 56 of its 105 references that are in the map. First posted on arXiv 1 Dec 2023.

Builds on

56 of 105 references.

Closest ancestors · 20

Same direction, newest first

  1. 2023WaterBench: Towards Holistic Evaluation of Watermarks for Large Language Models13 Nov
  2. 2023Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models7 Nov
  3. 2023Publicly-Detectable Watermarking for Language Models27 Oct
  4. 2023A Resilient and Accessible Distribution-Preserving Watermark for Large Language Models11 Oct
  5. 2023A Semantic Invariant Robust Watermark for Large Language Models10 Oct
  6. 2023Necessary and Sufficient Watermark for Large Language Models2 Oct
  7. 2023Unbiased Watermark for Large Language Models22 Sep
  8. 2023An Unforgeable Publicly Verifiable Watermark for Large Language Models30 Jul
  9. 2023Robust Distortion-free Watermarks for Language Models28 Jul
  10. 2023Three Bricks to Consolidate Watermarks for Large Language Models26 Jul
  11. 2023Provable Robust Watermarking for AI-Generated Text30 Jun
  12. 2023Undetectable Watermarks for Language Models25 May
8 more
  1. 2023Who Wrote this Code? Watermarking for Code Generation24 May
  2. 2023Evading Watermark based Detection of AI-Generated Content5 May
  3. 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense23 Mar
  4. 2023Can AI-Generated Text be Reliably Detected?17 Mar
  5. 2023Protecting Language Generation Models via Invisible Watermarking6 Feb
  6. 2023A Watermark for Large Language Models24 Jan
  7. 2022CATER: Intellectual Property Protection on Text Generation APIs via Conditional Watermarks19 Sep
  8. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermark5 Dec

Other references · 36

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  2. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  3. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  4. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  5. 2021Program Synthesis with Large Language Modelscited by 3,637
  6. 2023Mistral 7Bcited by 3,164
  7. 2019The Curious Case of Neural Text Degenerationcited by 2,916
  8. 2023G-Eval: NLG Evaluation using GPT-4 with Better Human Alignmentcited by 2,276
  9. 2017Get To The Point: Summarization with Pointer-Generator Networkscited by 1,292
  10. 2023Large Language Models are not Fair Evaluatorscited by 1,085
  11. 2015Teaching Machines to Read and Comprehendcited by 1,049
  12. 2021Measuring Coding Challenge Competence With APPScited by 902
24 more
  1. 2023Can Large Language Models Be an Alternative to Human Evaluations?cited by 734
  2. 2023DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvaturecited by 726
  3. 2019Defending Against Neural Fake Newscited by 559
  4. 2019Neural Text Generation with Unlikelihood Trainingcited by 503
  5. 2019GLTR: Statistical Detection and Visualization of Generated Textcited by 496
  6. 2021MAUVE: Measuring the Gap Between Neural Text and Human Text using Divergence Frontierscited by 470
  7. 2023Is ChatGPT a Good NLG Evaluator? A Preliminary Studycited by 422
  8. 2023Large Language Models Are State-of-the-Art Evaluators of Translation Qualitycited by 420
  9. 2019Automatic Detection of Generated Text is Easiest when Humans are Fooledcited by 261
  10. 2017OpenNMT: Open-source Toolkit for Neural Machine Translationcited by 251
  11. 2023Can LLM-Generated Misinformation Be Detected?cited by 177
  12. 2023Generative Language Models and Automated Influence Operations: Emerging Threats and Potential Mitigationscited by 158
  13. 2023In-Context Impersonation Reveals Large Language Models' Strengths and Biasescited by 155
  14. 2023The Science of Detecting LLM-Generated Textscited by 128
  15. 2020TweepFake: about Detecting Deepfake Tweetscited by 117
  16. 2019Real or Fake? Learning to Discriminate Machine from Human Generated Textcited by 99
  17. 2023On the Possibilities of AI-Generated Text Detectioncited by 88
  18. 2023Exploring the Use of Large Language Models for Reference-Free Text Quality Evaluation: An Empirical Studycited by 85
  19. 2019Neural Linguistic Steganographycited by 78
  20. 2023Fake News in Sheep's Clothing: Robust Fake News Detection Against LLM-Empowered Style Attackscited by 70
  21. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 45
  22. 2023Is GPT-4 a reliable rater? Evaluating Consistency in GPT-4 Text Ratingscited by 34
  23. 2023HowkGPT: Investigating the Detection of ChatGPT-generated University Student Homework through Context-Aware Perplexity Analysiscited by 30
  24. 2021Toward quantifying trust dynamics: How people adjust their trust after moment-to-moment interaction with automationcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 4; 2024: 22; 2025: 20; 2026: 25.

71 papers.

Sort:

By area:

  1. 2023A Survey of Text Watermarking in the Era of Large Language Modelscited by 112
  2. 2023Jatmo: Prompt Injection Defense by Task-Specific Finetuningcited by 106
  3. 2024MarkLLM: An Open-Source Toolkit for LLM Watermarkingcited by 95
  4. 2024Watermark Stealing in Large Language Modelscited by 92
  5. 2024Watermarking Makes Language Models Radioactivecited by 58
  6. 2024WaterMax: breaking the LLM watermark detectability-robustness-quality trade-offcited by 54
  7. 2024SoK: Watermarking for AI-Generated Contentcited by 51
  8. 2024No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choicescited by 50
  9. 2024Provably Robust Multi-bit Watermarking for AI-generated Textcited by 47
  10. 2024Pseudorandom Error-Correcting Codescited by 44
  11. 2024Token-Specific Watermarking with Enhanced Detectability and Semantic Coherence for Large Language Modelscited by 34
  12. 2025SynthID-Image: Image watermarking at internet scalecited by 31
38 more
  1. 2025Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Surveycited by 30
  2. 2023Towards Optimal Statistical Watermarkingcited by 26
  3. 2023Optimizing watermarks for large language modelscited by 25
  4. 2024Black-Box Detection of Language Model Watermarkscited by 23
  5. 2024Debiasing Watermarks for Large Language Models via Maximal Couplingcited by 19
  6. 2024Optimizing Adaptive Attacks against Watermarks for Language Modelscited by 16
  7. 2024Ward: Provable RAG Dataset Inference via LLM Watermarkscited by 16
  8. 2024De-mark: Watermark Removal in Large Language Modelscited by 14
  9. 2024Provably Robust Watermarks for Open-Source Language Modelscited by 13
  10. 2025StealthInk: A Multi-bit and Stealthy Watermark for Large Language Modelscited by 12
  11. 2024Watermarking Language Models with Error Correcting Codescited by 10
  12. 2025Optimized Couplings for Watermarking Large Language Modelscited by 9
  13. 2025Watermarking Without Standards Is Not AI Governancecited by 9
  14. 2025Enhancing LLM Watermark Resilience Against Both Scrubbing and Spoofing Attackscited by 9
  15. 2025Character-Level Perturbations Disrupt LLM Watermarkscited by 9
  16. 2024PersonaMark: Personalized LLM watermarking for model protection and user attributioncited by 7
  17. 2024Enhancing Training Data Attribution for Large Language Models with Fitting Error Considerationcited by 7
  18. 2025An Ensemble Framework for Unbiased Language Model Watermarkingcited by 6
  19. 2025DITTO: A Spoofing Attack Framework on Watermarked LLMs via Knowledge Distillationcited by 6
  20. 2026Antidistillation Fingerprintingcited by 6
  21. 2025Analyzing and Evaluating Unbiased Language Model Watermarkcited by 5
  22. 2025On the Empirical Power of Goodness-of-Fit Tests in Watermark Detectioncited by 5
  23. 2026TextSeal: A Localized LLM Watermark for Provenance & Distillation Protectioncited by 5
  24. 2026TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectoriescited by 5
  25. 2024On Evaluating The Performance of Watermarked Machine-Generated Texts Under Adversarial Attackscited by 4
  26. 2024Multi-Designated Detector Watermarking for Language Modelscited by 4
  27. 2025Mitigating Watermark Forgery in Generative Models via Randomized Key Selectioncited by 4
  28. 2025Majority Bit-Aware Watermarking For Large Language Modelscited by 4
  29. 2025Data Provenance Auditing of Fine-Tuned Large Language Models with a Text-Preserving Techniquecited by 4
  30. 2026MC2Mark: Distortion-Free Multi-Bit Watermarking for Long Messagescited by 4
  31. 2026XMark: Reliable Multi-Bit Watermarking for LLM-Generated Textscited by 3
  32. 2025A Statistical Hypothesis Testing Framework for Data Misappropriation Detection in Large Language Modelscited by 2
  33. 2025RLCracker: Evaluating the Worst-Case Vulnerability of LLM Watermarks with Adaptive RL Attackscited by 2
  34. 2025How Good is Post-Hoc Watermarking With Language Model Rephrasing?cited by 2
  35. 2026Online LLM watermark detection via e-processescited by 2
  36. 2026Refined Detection for Gumbel Watermarkingcited by 2
  37. 2026RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resiliencecited by 2
  38. 2026Who Gets Flagged? The Pluralistic Evaluation Gap in AI Content Watermarkingcited by 2

50 most cited of 71 All 71 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023Baselines for Identifying Watermarked Large Language Models
  2. 2025PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs
  3. 2023New Evaluation Metrics Capture Quality Degradation due to LLM Watermarking
  4. 2026Vaporizer: Breaking Watermarking Schemes for Large Language Model Outputs
  5. 2024PostMark: A Robust Blackbox Watermark for Large Language Models
  6. 2024From Intentions to Techniques: A Comprehensive Taxonomy and Challenges in Text Watermarking for Large Language Models
  7. 2025GaussMark: A Practical Approach for Structural Watermarking of Language Models
  8. 2025LexiMark: Robust Watermarking via Lexical Substitutions to Enhance Membership Verification of an LLM's Textual Training Data