# Robust Detection of Watermarks for Large Language Models Under Human Edits

arXiv: https://arxiv.org/abs/2411.13868 · HTML: https://mlsanity.com/paper/2411.13868/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- First posted on arXiv 21 Nov 2024.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Built on by (most cited first, 30 of 31)

- [AdaDetectGPT: Adaptive Detection of LLM-Generated Text with Statistical Guarantees](https://mlsanity.com/paper/2510.01268/) (2025)
- [Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs](https://mlsanity.com/paper/2502.10673/) (2025)
- [Recursive Learning Without Collapse: A Weighting-Based Stabilization Framework](https://mlsanity.com/paper/2502.18049/) (2025)
- [Defending LLM Watermarking Against Spoofing Attacks with Contrastive Representation Learning](https://mlsanity.com/paper/2504.06575/) (2025)
- [In-Context Watermarks for Large Language Models](https://mlsanity.com/paper/2505.16934/) (2025)
- [Detecting LLM-Generated Text with Performance Guarantees](https://mlsanity.com/paper/2601.06586/) (2026)
- [Learn-to-Distance: Distance Learning for Detecting LLM-Generated Text](https://mlsanity.com/paper/2601.21895/) (2026)
- [Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption](https://mlsanity.com/paper/2510.18333/) (2025)
- [A Training-free Method for LLM Text Attribution](https://mlsanity.com/paper/2501.02406/) (2025)
- [Do Large Language Models (Really) Need Statistical Foundations?](https://mlsanity.com/paper/2505.19145/) (2025)
- [On the Empirical Power of Goodness-of-Fit Tests in Watermark Detection](https://mlsanity.com/paper/2510.03944/) (2025)
- [Watermarking Discrete Diffusion Language Models](https://mlsanity.com/paper/2511.02083/) (2025)
- [Detecting Post-generation Edits to Watermarked LLM Outputs via Combinatorial Watermarking](https://mlsanity.com/paper/2510.01637/) (2025)
- [Online LLM watermark detection via e-processes](https://mlsanity.com/paper/2602.14286/) (2026)
- [Refined Detection for Gumbel Watermarking](https://mlsanity.com/paper/2603.30017/) (2026)
- [Perturbation is All You Need for Extrapolating Language Models](https://mlsanity.com/paper/2605.04344/) (2026)
- [HeavyWater and SimplexWater: Distortion-Free LLM Watermarks for Low-Entropy Next-Token Predictions](https://mlsanity.com/paper/2506.06409/) (2025)
- [Robust Spectral Watermark for Synthetic Tabular Data](https://mlsanity.com/paper/2511.21600/) (2025)
- [Improving the Trade-off Between Watermark Strength and Speculative Sampling Efficiency for Language Models](https://mlsanity.com/paper/2602.01428/) (2026)
- [Sample Complexities of Estimating Gumbel--Max Watermark Proportions with and without Reduction to Pivotal Statistics](https://mlsanity.com/paper/2607.00224/) (2026)
- [Geometric Reciprocity: Unlocking Self-Supervision for Stereoscopic Video Generation](https://mlsanity.com/paper/2607.05354/) (2026)
- [Watermark Forensics for Generative Models: An Information-Theoretic Perspective](https://mlsanity.com/paper/2607.13003/) (2026)
- [Adaptive Testing for Segmenting Watermarked Texts From Language Models](https://mlsanity.com/paper/2511.06645/) (2025)
- [ADD for Multi-Bit Image Watermarking](https://mlsanity.com/paper/2604.11491/) (2026)
- [Trustworthy AI: Ensuring Reliability and Accountability from Models to Agents](https://mlsanity.com/paper/2605.08964/) (2026)
- [Signature filtering: a lightweight enhancement for statistical watermark detection in large language models](https://mlsanity.com/paper/2606.18430/) (2026)
- [Efficient Online LLM Watermark Detection via Rao-Blackwellized E-Processes](https://mlsanity.com/paper/2607.21958/) (2026)
- [Learning to Follow In-Context Watermark Instructions via Self-Distillation](https://mlsanity.com/paper/2608.29030/) (2026)
- [Anchor-ECC: Local Integrity Checking for Watermarked LLM Outputs via Error-Correcting Codes](https://mlsanity.com/paper/2609.38722/) (2026)
- [Tokenization-Invariant Watermarking: A Byte-Local Method for LLM Text](https://mlsanity.com/paper/2610.14378/) (2026)

## Abstract (arXiv)

Watermarking has offered an effective approach to distinguishing text generated by large language models (LLMs) from human-written text. However, the pervasive presence of human edits on LLM-generated text dilutes watermark signals, thereby significantly degrading detection performance of existing methods. In this paper, by modeling human edits through mixture model detection, we introduce a new method in the form of a truncated goodness-of-fit test for detecting watermarked text under human edits, which we refer to as Tr-GoF. We prove that the Tr-GoF test achieves optimality in robust detection of the Gumbel-max watermark in a certain asymptotic regime of substantial text modifications and vanishing watermark signals. Importantly, Tr-GoF achieves this optimality textitadaptively as it does not require precise knowledge of human edit levels or probabilistic specifications of the LLMs, in contrast to the optimal but impractical (Neyman--Pearson) likelihood ratio test. Moreover, we establish that the Tr-GoF test attains the highest detection efficiency rate in a certain regime of moderate text modifications. In stark contrast, we show that sum-based detection rules, as employed by existing methods, fail to achieve optimal robustness in both regimes because the additive nature of their statistics is less resilient to edit-induced noise. Finally, we demonstrate the competitive and sometimes superior empirical performance of the Tr-GoF test on both synthetic data and open-source LLMs in the OPT and LLaMA families.