BiMark: Unbiased Multilayer Watermarking for Large Language Models
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
Recent advances in Large Language Models (LLMs) have raised urgent concerns about LLM-generated text authenticity, prompting regulatory demands for reliable identification mechanisms. Although watermarking offers a promising solution, existing approaches struggle to simultaneously achieve three critical requirements: text quality preservation, model-agnostic detection, and message embedding capacity, which are crucial for practical implementation. To achieve these goals, the key challenge lies in balancing the trade-off between text quality preservation and message embedding capacity. To address this challenge, we propose BiMark, a novel watermarking framework that achieves these requirements through three key innovations: (1) a bit-flip unbiased reweighting mechanism enabling model-agnostic detection, (2) a multilayer architecture enhancing detectability without compromising generation quality, and (3) an information encoding approach supporting multi-bit watermarking. Through theoretical analysis and extensive experiments, we validate that, compared to state-of-the-art multi-bit watermarking methods, BiMark achieves up to 30% higher extraction rates for short texts while maintaining text quality indicated by lower perplexity, and performs comparably to non-watermarked text on downstream tasks such as summarization and translation.
Key facts. Cited by 21 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 40 of its 70 references that are in the map. First posted on arXiv 19 Jun 2025.
Builds on
40 of 70 references.
Closest ancestors · 22
Same direction, newest first
- 2024Large Language Model Watermark Stealing With Mixed Integer Programming30 May
- 2024Watermarking Language Models for Many Adaptive Users17 May
- 2024Watermark Stealing in Large Language Models29 Feb
- 2024No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choices25 Feb
- 2024Permute-and-Flip: An optimally stable and watermarkable decoder for LLMs8 Feb
- 2023A Survey of Text Watermarking in the Era of Large Language Models13 Dec
- 2023A Robust Semantics-based Watermark for Large Language Model against Paraphrasing15 Nov
- 2023Publicly-Detectable Watermarking for Language Models27 Oct
- 2023REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Models18 Oct
- 2023A Resilient and Accessible Distribution-Preserving Watermark for Large Language Models11 Oct
- 2023Unbiased Watermark for Large Language Models22 Sep
- 2023Advancing Beyond Identification: Multi-bit Watermark for Large Language Models1 Aug
10 more
- 2023Towards Codable Watermarking for Injecting Multi-bits Information to LLMs29 Jul
- 2023Robust Distortion-free Watermarks for Language Models28 Jul
- 2023Three Bricks to Consolidate Watermarks for Large Language Models26 Jul
- 2023Robust Multi-bit Natural Language Watermarking through Invariant Features3 May
- 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense23 Mar
- 2023Protecting Language Generation Models via Invisible Watermarking6 Feb
- 2023A Watermark for Large Language Models24 Jan
- 2022CATER: Intellectual Property Protection on Text Generation APIs via Conditional Watermarks19 Sep
- 2021Tracing Text Provenance via Context-Aware Lexical Substitution15 Dec
- 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermark5 Dec
Other references · 18
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
- 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,893
- 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
- 2017Get To The Point: Summarization with Pointer-Generator Networkscited by 1,292
- 2020Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hidingcited by 130
- 2023The Science of Detecting LLM-Generated Textscited by 128
- 2022Trustworthy Graph Neural Networks: Aspects, Methods and Trendscited by 89
- 2019Neural Linguistic Steganographycited by 78
- 2017Generating Steganographic Text with LSTMscited by 44
- 2024Large Language Models in Drug Discovery and Development: From Disease Mechanisms to Clinical Trialscited by 24
- 2025A Label-Free Heterophily-Guided Approach for Unsupervised Graph Fraud Detectioncited by 24
- 2023GNNEvaluator: Evaluating GNN Performance On Unseen Graphs Without Labelscited by 17
6 more
- 2023Unraveling Privacy Risks of Individual Fairness in Graph Neural Networkscited by 16
- 2024Dynamic Graph Unlearning: A General and Efficient Post-Processing Method via Gradient Transformationcited by 15
- 2024Online GNN Evaluation Under Test-time Graph Distribution Shiftscited by 12
- 2023Masked Language Model Based Textual Adversarial Example Detectioncited by 5
- 2025Not All Edges are Equally Robust: Evaluating the Robustness of Ranking-Based Federated Learningcited by 4
- 2025Exploring Gradient-Guided Masked Language Model to Detect Textual Adversarial Attackscited by 4
Built on by
Citing papers per year: 2025: 4; 2026: 17.
21 papers.
Sort:
By area:
- 2025TimeOmni-1: Incentivizing Complex Reasoning with Time Series in Large Language Modelscited by 27
- 2025Character-Level Perturbations Disrupt LLM Watermarkscited by 9
- 2026SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarkingcited by 7
- 2026TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectoriescited by 5
- 2025Majority Bit-Aware Watermarking For Large Language Modelscited by 4
- 2026MC2Mark: Distortion-Free Multi-Bit Watermarking for Long Messagescited by 4
- 2026ArcMark: Distortion-Free Multi-Byte LLM Watermark via Optimal Transportcited by 3
- 2026More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensemblescited by 2
- 2026Every Bit, Everywhere, All at Once: A Binomial Multibit LLM Watermarkcited by 1
- 2026Geometric Reciprocity: Unlocking Self-Supervision for Stereoscopic Video Generationcited by 1
- 2026LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematizationcited by 1
- 2026Watermark Forensics for Generative Models: An Information-Theoretic Perspectivecited by 1
9 more
- 2026Tracing Provenance and Detecting Tampering with Complementary LLM Watermarkscited by 1
- 2025The Anti-Ouroboros Effect: Emergent Resilience in Large Language Models from Recursive Selective Feedbackcited by 0
- 2026WorldCup Sampling for Multi-bit LLM Watermarkingcited by 0
- 2026Preserving Structure, Strengthening Signals: A Grammar-Driven Approach to Optimize the Trade-off Between Quality and Detectability in Code Watermarkingcited by 0
- 2026DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Samplingcited by 0
- 2026Stability-Aware Feature Design for Robust Watermark Detection in Machine-Generated Textcited by 0
- 2026WeaveMark: Robust and Scalable Multi-bit LLM Watermarking via Coded Payload Spreadingcited by 0
- 2026TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectoriescited by 0
- 2026ByteMark: A Unified Byte-Level Watermark for Detection Across Language Modelscited by 0
- 2026ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models10 Oct 2026
- 2026TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectories9 Sep 2026
- 2026WeaveMark: Robust and Scalable Multi-bit LLM Watermarking via Coded Payload Spreading2 Sep 2026
- 2026Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks13 Aug 2026
- 2026DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling4 Aug 2026
- 2026Watermark Forensics for Generative Models: An Information-Theoretic Perspective14 Jul 2026
- 2026Preserving Structure, Strengthening Signals: A Grammar-Driven Approach to Optimize the Trade-off Between Quality and Detectability in Code Watermarking11 Jul 2026
- 2026LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematization11 Jul 2026
- 2026TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories9 Jul 2026
- 2026Geometric Reciprocity: Unlocking Self-Supervision for Stereoscopic Video Generation6 Jul 2026
- 2026Stability-Aware Feature Design for Robust Watermark Detection in Machine-Generated Text9 Jun 2026
- 2026Every Bit, Everywhere, All at Once: A Binomial Multibit LLM Watermark12 May 2026
9 more
- 2026SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarking13 Mar 2026
- 2026MC2Mark: Distortion-Free Multi-Bit Watermarking for Long Messages15 Feb 2026
- 2026More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensembles12 Feb 2026
- 2026ArcMark: Distortion-Free Multi-Byte LLM Watermark via Optimal Transport6 Feb 2026
- 2026WorldCup Sampling for Multi-bit LLM Watermarking2 Feb 2026
- 2025TimeOmni-1: Incentivizing Complex Reasoning with Time Series in Large Language Models29 Sep 2025
- 2025Character-Level Perturbations Disrupt LLM Watermarks11 Sep 2025
- 2025The Anti-Ouroboros Effect: Emergent Resilience in Large Language Models from Recursive Selective Feedback2 Sep 2025
- 2025Majority Bit-Aware Watermarking For Large Language Models5 Aug 2025
- 2025Character-Level Perturbations Disrupt LLM Watermarkscited by 9
- 2025Majority Bit-Aware Watermarking For Large Language Modelscited by 4
- 2026MC2Mark: Distortion-Free Multi-Bit Watermarking for Long Messagescited by 4
- 2026ArcMark: Distortion-Free Multi-Byte LLM Watermark via Optimal Transportcited by 3
- 2026More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensemblescited by 2
- 2026Every Bit, Everywhere, All at Once: A Binomial Multibit LLM Watermarkcited by 1
- 2026LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematizationcited by 1
- 2026Watermark Forensics for Generative Models: An Information-Theoretic Perspectivecited by 1
- 2026Tracing Provenance and Detecting Tampering with Complementary LLM Watermarkscited by 1
- 2026WorldCup Sampling for Multi-bit LLM Watermarkingcited by 0
- 2026DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Samplingcited by 0
- 2026Stability-Aware Feature Design for Robust Watermark Detection in Machine-Generated Textcited by 0
12 most cited of 14 All 14 (JSON)
- 2026ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models10 Oct 2026
- 2026WeaveMark: Robust and Scalable Multi-bit LLM Watermarking via Coded Payload Spreading2 Sep 2026
- 2026Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks13 Aug 2026
- 2026DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling4 Aug 2026
- 2026Watermark Forensics for Generative Models: An Information-Theoretic Perspective14 Jul 2026
- 2026LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematization11 Jul 2026
- 2026Stability-Aware Feature Design for Robust Watermark Detection in Machine-Generated Text9 Jun 2026
- 2026Every Bit, Everywhere, All at Once: A Binomial Multibit LLM Watermark12 May 2026
- 2026MC2Mark: Distortion-Free Multi-Bit Watermarking for Long Messages15 Feb 2026
- 2026More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensembles12 Feb 2026
- 2026ArcMark: Distortion-Free Multi-Byte LLM Watermark via Optimal Transport6 Feb 2026
- 2026WorldCup Sampling for Multi-bit LLM Watermarking2 Feb 2026
12 newest of 14 All 14 (JSON)
- 2025TimeOmni-1: Incentivizing Complex Reasoning with Time Series in Large Language Modelscited by 27
- 2026Geometric Reciprocity: Unlocking Self-Supervision for Stereoscopic Video Generationcited by 1
- 2025The Anti-Ouroboros Effect: Emergent Resilience in Large Language Models from Recursive Selective Feedbackcited by 0
- 2026Preserving Structure, Strengthening Signals: A Grammar-Driven Approach to Optimize the Trade-off Between Quality and Detectability in Code Watermarkingcited by 0
- 2026Preserving Structure, Strengthening Signals: A Grammar-Driven Approach to Optimize the Trade-off Between Quality and Detectability in Code Watermarking11 Jul 2026
- 2026Geometric Reciprocity: Unlocking Self-Supervision for Stereoscopic Video Generation6 Jul 2026
- 2025TimeOmni-1: Incentivizing Complex Reasoning with Time Series in Large Language Models29 Sep 2025
- 2025The Anti-Ouroboros Effect: Emergent Resilience in Large Language Models from Recursive Selective Feedback2 Sep 2025
Similar, not cited
Close in wording, no citation either way
- 2025DERMARK: A Dynamic, Efficient and Robust Multi-bit Watermark for Large Language Models
- 2025BiMarker: Enhancing Text Watermark Detection for Large Language Models with Bipolar Watermarks
- 2024A Statistical Framework of Watermarks for Large Language Models: Pivot, Detection Efficiency and Optimal Rules
- 2025PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs
- 2024PostMark: A Robust Blackbox Watermark for Large Language Models
- 2025GaussMark: A Practical Approach for Structural Watermarking of Language Models
- 2025Improved Unbiased Watermark for Large Language Models
- 2026CertMark: Distortion-Free Multi-Bit Watermarking with Certified Decoding