Cross-Attention Watermarking of Large Language Models
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
A new approach to linguistic watermarking of language models is presented in which information is imperceptibly inserted into the output text while preserving its readability and original meaning. A cross-attention mechanism is used to embed watermarks in the text during inference. Two methods using cross-attention are presented that minimize the effect of watermarking on the performance of a pretrained model. Exploration of different training strategies for optimizing the watermarking and of the challenges and implications of applying this approach in real-world scenarios clarified the tradeoff between watermark robustness and text quality. Watermark selection substantially affects the generated output for high entropy sentences. This proactive watermarking approach has potential application in future model development.
Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 18 of its 29 references that are in the map. First posted on arXiv 12 Jan 2024.
Builds on
18 of 29 references.
Closest ancestors · 4
Same direction, newest first
- 2023Undetectable Watermarks for Language Models25 May
- 2023Can AI-Generated Text be Reliably Detected?17 Mar
- 2023A Watermark for Large Language Models24 Jan
- 2021Tracing Text Provenance via Context-Aware Lexical Substitution15 Dec
Other references · 14
- 2017Attention Is All You Needcited by 60,361
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
- 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
- 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,386
- 2013Efficient Estimation of Word Representations in Vector Spacecited by 4,375
- 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,739
- 2018SentencePiece: A simple and language independent subword tokenizer and detokenizer for Neural Text Processingcited by 1,989
- 2023The Curse of Recursion: Training on Generated Data Makes Models Forgetcited by 356
- 2021VisualGPT: Data-efficient Adaptation of Pretrained Language Models for Image Captioningcited by 191
- 2023Generative Language Models and Automated Influence Operations: Emerging Threats and Potential Mitigationscited by 158
- 2020Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hidingcited by 130
2 more
- 2017Generating Steganographic Text with LSTMscited by 44
- 2022Deepfake Text Detection: Limitations and Opportunitiescited by 37
Built on by
Citing papers per year: 2024: 1; 2025: 2; 2026: 3.
6 papers.
- 2024SoK: On the Role and Future of AIGC Watermarking in the Era of Gen-AIcited by 14
- 2025CATMark: A Context-Aware Thresholding Framework for Robust Cross-Task Watermarking in Large Language Modelscited by 3
- 2026Distilling the Thought, Watermarking the Answer: A Principle Semantic Guided Watermark for Large Reasoning Modelscited by 3
- 2025SoK: Are Watermarks in LLMs Ready for Deployment?cited by 2
- 2026Robust LLM Watermarking with Minimal Semantic Distortion for IP Protectioncited by 1
- 2026LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematizationcited by 1
- 2026LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematization11 Jul 2026
- 2026Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection22 May 2026
- 2026Distilling the Thought, Watermarking the Answer: A Principle Semantic Guided Watermark for Large Reasoning Models8 Jan 2026
- 2025CATMark: A Context-Aware Thresholding Framework for Robust Cross-Task Watermarking in Large Language Models27 Sep 2025
- 2025SoK: Are Watermarks in LLMs Ready for Deployment?5 Jun 2025
- 2024SoK: On the Role and Future of AIGC Watermarking in the Era of Gen-AI18 Nov 2024
Similar, not cited
Close in wording, no citation either way
- 2023Three Bricks to Consolidate Watermarks for Large Language Models
- 2024Learnable Linguistic Watermarks for Tracing Model Extraction Attacks on Large Language Models
- 2025Learning to Watermark: A Selective Watermarking Framework for Large Language Models via Multi-Objective Optimization
- 2023Necessary and Sufficient Watermark for Large Language Models
- 2025Can you Finetune your Binoculars? Embedding Text Watermarks into the Weights of Large Language Models
- 2023On the Learnability of Watermarks for Language Models
- 2024WaterJudge: Quality-Detection Trade-off when Watermarking Large Language Models
- 2026Auditing Cross-Lingual Fairness in Language Model Watermarking