PMark: Towards Robust and Distortion-free Semantic-level Watermarking with Channel Constraints
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
Semantic-level watermarking (SWM) for large language models (LLMs) enhances watermarking robustness against text modifications and paraphrasing attacks by treating the sentence as the fundamental unit. However, existing methods still lack strong theoretical guarantees of robustness, and reject-sampling-based generation often introduces significant distribution distortions compared with unwatermarked outputs. In this work, we introduce a new theoretical framework on SWM through the concept of proxy functions (PFs) unicodex2013 functions that map sentences to scalar values. Building on this framework, we propose PMark, a simple yet powerful SWM method that estimates the PF median for the next sentence dynamically through sampling while enforcing multiple PF constraints (which we call channels) to strengthen watermark evidence. Equipped with solid theoretical guarantees, PMark achieves the desired distortion-free property and improves the robustness against paraphrasing-style attacks. We also provide an empirically optimized version that further removes the requirement for dynamical median estimation for better sampling efficiency. Experimental results show that PMark consistently outperforms existing SWM baselines in both text quality and robustness, offering a more effective paradigm for detecting machine-generated text. Our code will be released at [this URL](https://github.com/PMark-repo/PMark).
Key facts. Cited by 16 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 42 of its 56 references that are in the map. First posted on arXiv 25 Sep 2025.
Builds on
42 of 56 references.
Closest ancestors · 26
Same direction, newest first
- 2025Majority Bit-Aware Watermarking For Large Language Models5 Aug
- 2025MorphMark: Flexible Adaptive Watermarking for Large Language Models14 May
- 2025Optimized Couplings for Watermarking Large Language Models13 May
- 2025Defending LLM Watermarking Against Spoofing Attacks with Contrastive Representation Learning9 Apr
- 2025SimMark: A Robust Sentence-Level Similarity-Based Watermarking Algorithm for Large Language Models5 Feb
- 2024Robust Multi-bit Text Watermark with LLM-based Paraphrasers4 Dec
- 2024SoK: Watermarking for AI-Generated Content27 Nov
- 2024FreqMark: Frequency-Based Watermark for Sentence-Level Detection of LLM-Generated Text9 Oct
- 2024A Watermark for Black-Box Language Models2 Oct
- 2024PersonaMark: Personalized LLM watermarking for model protection and user attribution15 Sep
- 2024Waterfall: Framework for Robust and Scalable Text Watermarking and Provenance for LLMs5 Jul
- 2024MarkLLM: An Open-Source Toolkit for LLM Watermarking16 May
14 more
- 2024An Entropy-based Text Watermarking Detection Method20 Mar
- 2024WaterMax: breaking the LLM watermark detectability-robustness-quality trade-off6 Mar
- 2024k-SemStamp: A Clustering-Based Semantic Watermark for Detection of Machine-Generated Text17 Feb
- 2024Pseudorandom Error-Correcting Codes14 Feb
- 2024Provably Robust Multi-bit Watermarking for AI-generated Text30 Jan
- 2024Adaptive Text Watermark for Large Language Models25 Jan
- 2023Towards Optimal Statistical Watermarking13 Dec
- 2023A Semantic Invariant Robust Watermark for Large Language Models10 Oct
- 2023Towards Codable Watermarking for Injecting Multi-bits Information to LLMs29 Jul
- 2023Provable Robust Watermarking for AI-Generated Text30 Jun
- 2023Undetectable Watermarks for Language Models25 May
- 2023Can AI-Generated Text be Reliably Detected?17 Mar
- 2023Protecting Language Generation Models via Invisible Watermarking6 Feb
- 2023A Watermark for Large Language Models24 Jan
Other references · 16
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
- 2023GPT-4 Technical Reportcited by 18,396
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
- 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
- 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,512
- 2025Gemma 3 Technical Reportcited by 1,824
- 2024SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineeringcited by 1,737
- 2024WorldSimBench: Towards Video Generation Models as World Simulatorscited by 881
- 2022One Embedder, Any Task: Instruction-Finetuned Text Embeddingscited by 333
- 2021BookSum: A Collection of Datasets for Long-form Narrative Summarizationcited by 184
4 more
- 2023A Survey on LLM-Generated Text Detection: Necessity, Methods, and Future Directionscited by 105
- 2025AI4Research: A Survey of Artificial Intelligence for Scientific Researchcited by 60
- 2025CoheMark: A Novel Sentence-Level Watermark for Enhanced Text Qualitycited by 19
- 2023On the Zero-Shot Generalization of Machine-Generated Text Detectorscited by 11
Built on by
Citing papers per year: 2025: 1; 2026: 15.
16 papers.
Sort:
By area:
- 2026Vision-Language Introspection: Mitigating Overconfident Hallucinations in MLLMs via Interpretable Bi-Causal Steeringcited by 8
- 2026Distilling the Thought, Watermarking the Answer: A Principle Semantic Guided Watermark for Large Reasoning Modelscited by 3
- 2026A Visual Semantic Adaptive Watermark grounded by Prefix-Tuning for Large Vision-Language Modelcited by 3
- 2026Decoding by Perturbation: Mitigating MLLM Hallucinations via Dynamic Textual Perturbationcited by 3
- 2026KBF: Knowledge Boundary as Fingerprint for Language Model and Black-Box API Auditingcited by 3
- 2026RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resiliencecited by 2
- 2026SAMark: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustnesscited by 2
- 2025LLM Watermark Evasion via Bias Inversioncited by 1
- 2026AliMark: Enhancing Robustness of Sentence-Level Watermarking Against Text Paraphrasingcited by 1
- 2026Global Sketch-Based Watermarking for Diffusion Language Modelscited by 1
- 2026Semantic Watermarking with Order-Robust Detection over Sub-sentence Unitscited by 1
- 2026DenMark: Robust Semantic Watermarking for Diffusion Language Modelscited by 1
4 more
- 2026SemTrace: Source-Grounded Semantic Signatures for Tracing LLM Exposure to Protected Documentscited by 0
- 2026The average-farmer illusion in language-model simulations of agricultural decisionscited by 0
- 2026Beyond Semantic Narrowing: Robust and Efficient LLM Watermarking with Hamming Neighborhoodscited by 0
- 2026ByteMark: A Unified Byte-Level Watermark for Detection Across Language Modelscited by 0
- 2026ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models10 Oct 2026
- 2026Beyond Semantic Narrowing: Robust and Efficient LLM Watermarking with Hamming Neighborhoods29 Sep 2026
- 2026The average-farmer illusion in language-model simulations of agricultural decisions14 Sep 2026
- 2026DenMark: Robust Semantic Watermarking for Diffusion Language Models13 Sep 2026
- 2026SemTrace: Source-Grounded Semantic Signatures for Tracing LLM Exposure to Protected Documents30 Aug 2026
- 2026Semantic Watermarking with Order-Robust Detection over Sub-sentence Units27 Aug 2026
- 2026Global Sketch-Based Watermarking for Diffusion Language Models3 Jun 2026
- 2026KBF: Knowledge Boundary as Fingerprint for Language Model and Black-Box API Auditing28 May 2026
- 2026AliMark: Enhancing Robustness of Sentence-Level Watermarking Against Text Paraphrasing28 May 2026
- 2026SAMark: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustness25 May 2026
- 2026Decoding by Perturbation: Mitigating MLLM Hallucinations via Dynamic Textual Perturbation14 Apr 2026
- 2026RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resilience13 Apr 2026
4 more
- 2026A Visual Semantic Adaptive Watermark grounded by Prefix-Tuning for Large Vision-Language Model12 Jan 2026
- 2026Vision-Language Introspection: Mitigating Overconfident Hallucinations in MLLMs via Interpretable Bi-Causal Steering8 Jan 2026
- 2026Distilling the Thought, Watermarking the Answer: A Principle Semantic Guided Watermark for Large Reasoning Models8 Jan 2026
- 2025LLM Watermark Evasion via Bias Inversion27 Sep 2025
- 2026RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resiliencecited by 2
- 2026SAMark: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustnesscited by 2
- 2025LLM Watermark Evasion via Bias Inversioncited by 1
- 2026AliMark: Enhancing Robustness of Sentence-Level Watermarking Against Text Paraphrasingcited by 1
- 2026Semantic Watermarking with Order-Robust Detection over Sub-sentence Unitscited by 1
- 2026SemTrace: Source-Grounded Semantic Signatures for Tracing LLM Exposure to Protected Documentscited by 0
- 2026Beyond Semantic Narrowing: Robust and Efficient LLM Watermarking with Hamming Neighborhoodscited by 0
- 2026ByteMark: A Unified Byte-Level Watermark for Detection Across Language Modelscited by 0
- 2026ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models10 Oct 2026
- 2026Beyond Semantic Narrowing: Robust and Efficient LLM Watermarking with Hamming Neighborhoods29 Sep 2026
- 2026SemTrace: Source-Grounded Semantic Signatures for Tracing LLM Exposure to Protected Documents30 Aug 2026
- 2026Semantic Watermarking with Order-Robust Detection over Sub-sentence Units27 Aug 2026
- 2026AliMark: Enhancing Robustness of Sentence-Level Watermarking Against Text Paraphrasing28 May 2026
- 2026SAMark: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustness25 May 2026
- 2026RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resilience13 Apr 2026
- 2025LLM Watermark Evasion via Bias Inversion27 Sep 2025
- 2026Vision-Language Introspection: Mitigating Overconfident Hallucinations in MLLMs via Interpretable Bi-Causal Steeringcited by 8
- 2026A Visual Semantic Adaptive Watermark grounded by Prefix-Tuning for Large Vision-Language Modelcited by 3
- 2026Decoding by Perturbation: Mitigating MLLM Hallucinations via Dynamic Textual Perturbationcited by 3
- 2026Decoding by Perturbation: Mitigating MLLM Hallucinations via Dynamic Textual Perturbation14 Apr 2026
- 2026A Visual Semantic Adaptive Watermark grounded by Prefix-Tuning for Large Vision-Language Model12 Jan 2026
- 2026Vision-Language Introspection: Mitigating Overconfident Hallucinations in MLLMs via Interpretable Bi-Causal Steering8 Jan 2026
Similar, not cited
Close in wording, no citation either way
- 2023Robust Distortion-free Watermarks for Language Models
- 2025CATMark: A Context-Aware Thresholding Framework for Robust Cross-Task Watermarking in Large Language Models
- 2025From Trade-off to Synergy: A Versatile Symbiotic Watermarking Framework for Large Language Models
- 2024PostMark: A Robust Blackbox Watermark for Large Language Models
- 2025DERMARK: A Dynamic, Efficient and Robust Multi-bit Watermark for Large Language Models
- 2025WaterSearch: Exploring Seed Pooling for Improving the Quality-Detectability Trade-off in LLM Watermarking
- 2025Learning to Watermark: A Selective Watermarking Framework for Large Language Models via Multi-Objective Optimization
- 2024Provably Robust Watermarks for Open-Source Language Models