Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
Despite progress in watermarking algorithms for large language models (LLMs), real-world deployment remains limited. We argue that this gap stems from misaligned incentives among LLM providers, platforms, and end users, which manifest as three key barriers: competitive risk, detection-tool governance, and attribution issues. We revisit three classes of watermarking through this lens. Model watermarking naturally aligns with LLM provider interests, yet faces new challenges in open-source ecosystems. LLM text watermarking offers modest provider benefit when framed solely as an anti-misuse tool, but can gain traction in narrowly scoped settings such as dataset de-contamination or user-controlled provenance. In-context watermarking (ICW) is tailored for trusted parties, such as conference organizers or educators, who embed hidden watermarking instructions into documents. If a dishonest reviewer or student submits this text to an LLM, the output carries a detectable watermark indicating misuse. This setup aligns incentives: users experience no quality loss, trusted parties gain a detection tool, and LLM providers remain neutral by simply following watermark instructions. We advocate for a broader exploration of incentive-aligned methods, with ICW as an example, in domains where trusted parties need reliable tools to detect misuse. More broadly, we distill design principles for incentive-aligned, domain-specific watermarking and outline future research directions. Our position is that the practical adoption of LLM watermarking requires aligning stakeholder incentives in targeted application domains and fostering active community engagement.
Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 89 of its 118 references that are in the map. First posted on arXiv 21 Oct 2025.
Builds on
89 of 118 references.
Closest ancestors · 52
Same direction, newest first
- 2025In-Context Watermarks for Large Language Models22 May
- 2025Defending LLM Watermarking Against Spoofing Attacks with Contrastive Representation Learning9 Apr
- 2025Mark Your LLM: Detecting the Misuse of Open-Source Large Language Models via Watermarking6 Mar
- 2025Robust Data Watermarking in Language Models by Injecting Fictitious Knowledge6 Mar
- 2025Improved Unbiased Watermark for Large Language Models16 Feb
- 2025Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs15 Feb
- 2024SoK: Watermarking for AI-Generated Content27 Nov
- 2024Robust Detection of Watermarks for Large Language Models Under Human Edits21 Nov
- 2024Watermarking Language Models through Language Models7 Nov
- 2024Provably Robust Watermarks for Open-Source Language Models24 Oct
- 2024A Watermark for Black-Box Language Models2 Oct
- 2024Can Watermarking Large Language Models Prevent Copyrighted Text Generation and Hide Training Data?24 Jul
38 more
- 2024PostMark: A Robust Blackbox Watermark for Large Language Models20 Jun
- 2024Black-Box Detection of Language Model Watermarks28 May
- 2024MarkLLM: An Open-Source Toolkit for LLM Watermarking16 May
- 2024A Statistical Framework of Watermarks for Large Language Models: Pivot, Detection Efficiency and Optimal Rules1 Apr
- 2024Learning to Watermark LLM-generated Text via Reinforcement Learning13 Mar
- 2024Duwak: Dual Watermarks in Large Language Models12 Mar
- 2024WaterMax: breaking the LLM watermark detectability-robustness-quality trade-off6 Mar
- 2024Watermark Stealing in Large Language Models29 Feb
- 2024Token-Specific Watermarking with Enhanced Detectability and Semantic Coherence for Large Language Models28 Feb
- 2024Multi-Bit Distortion-Free Watermarking for Large Language Models26 Feb
- 2024No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choices25 Feb
- 2024Watermarking Makes Language Models Radioactive22 Feb
- 2024Double-I Watermark: Protecting Model Copyright for LLM Fine-tuning22 Feb
- 2024GumbelSoft: Diversified Language Model Watermarking via the GumbelMax-trick20 Feb
- 2024Proving membership in LLM pretraining data via data watermarks16 Feb
- 2024Permute-and-Flip: An optimally stable and watermarkable decoder for LLMs8 Feb
- 2024Adaptive Text Watermark for Large Language Models25 Jan
- 2023A Survey of Text Watermarking in the Era of Large Language Models13 Dec
- 2023On the Learnability of Watermarks for Language Models7 Dec
- 2023Downstream Trade-offs of a Family of Text Watermarks16 Nov
- 2023A Robust Semantics-based Watermark for Large Language Model against Paraphrasing15 Nov
- 2023Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models7 Nov
- 2023REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Models18 Oct
- 2023Embarrassingly Simple Text Watermarks13 Oct
- 2023A Semantic Invariant Robust Watermark for Large Language Models10 Oct
- 2023Unbiased Watermark for Large Language Models22 Sep
- 2023An Unforgeable Publicly Verifiable Watermark for Large Language Models30 Jul
- 2023Towards Codable Watermarking for Injecting Multi-bits Information to LLMs29 Jul
- 2023Robust Distortion-free Watermarks for Language Models28 Jul
- 2023Three Bricks to Consolidate Watermarks for Large Language Models26 Jul
- 2023Provable Robust Watermarking for AI-Generated Text30 Jun
- 2023Undetectable Watermarks for Language Models25 May
- 2023Who Wrote this Code? Watermarking for Code Generation24 May
- 2023Watermarking Text Data on Large Language Models for Dataset Copyright22 May
- 2023Watermarking Text Generated by Black-Box Language Models14 May
- 2023Robust Multi-bit Natural Language Watermarking through Invariant Features3 May
- 2023Protecting Language Generation Models via Invisible Watermarking6 Feb
- 2023A Watermark for Large Language Models24 Jan
50 newest of 52 All 52 (JSON)
Other references · 37
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
- 2024Qwen2.5 Technical Reportcited by 4,942
- 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
- 2023Instruction-Following Evaluation for Large Language Modelscited by 1,228
- 2024Chatbot Arena: An Open Platform for Evaluating LLMs by Human Preferencecited by 1,184
- 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 849
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
- 2023GPT detectors are biased against non-native English writerscited by 178
- 2024A Note on Shumailov et al. (2024): `AI Models Collapse When Trained on Recursively Generated Data'cited by 115
25 more
- 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 110
- 2023On the Possibilities of AI-Generated Text Detectioncited by 88
- 2024Instructional Fingerprinting of Large Language Modelscited by 68
- 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Modelscited by 67
- 2025The Leaderboard Illusioncited by 66
- 2024Image Watermarks are Removable Using Controllable Regeneration from Clean Noisecited by 50
- 2023Can LLMs Follow Simple Rules?cited by 46
- 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generationcited by 44
- 2024Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Techniquecited by 37
- 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
- 2023TrojLLM: A Black-box Trojan Prompt Attack on Large Language Modelscited by 31
- 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generationcited by 29
- 2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 28
- 2023Towards Possibilities & Impossibilities of AI-generated Text Detection: A Surveycited by 28
- 2025An Overview of Large Language Models for Statisticianscited by 24
- 2025CoheMark: A Novel Sentence-Level Watermark for Enhanced Text Qualitycited by 19
- 2024UTF:Undertrained Tokens as Fingerprints A Novel Approach to LLM Identificationcited by 18
- 2025Improving Your Model Ranking on Chatbot Arena by Vote Riggingcited by 17
- 2024Ward: Provable RAG Dataset Inference via LLM Watermarkscited by 16
- 2023Functional Invariants to Watermark Large Transformerscited by 15
- 2025Scalable Fingerprinting of Large Language Modelscited by 14
- 2023Report of the 1st Workshop on Generative AI and Lawcited by 13
- 2024Edit Distance Robust Watermarks via Indexing Pseudorandom Codescited by 13
- 2025Distributional Information Embedding: A Framework for Multi-bit Watermarkingcited by 9
- 2024vTune: Verifiable Fine-Tuning for LLMs Through Backdooringcited by 4
Built on by
Citing papers per year: 2025: 1; 2026: 6.
7 papers.
- 2026Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systemscited by 5
- 2026Watermarking Should Be Treated as a Monitoring Primitivecited by 2
- 2025TokenPure: Watermark Removal through Tokenized Appearance and Structural Guidancecited by 1
- 2026LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematizationcited by 1
- 2026Fighting Fire with Fire: On the Feasibility of Protecting Exercises Against AI Cheatingcited by 0
- 2026Learning to Follow In-Context Watermark Instructions via Self-Distillationcited by 0
- 2026SemTrace: Source-Grounded Semantic Signatures for Tracing LLM Exposure to Protected Documentscited by 0
- 2026SemTrace: Source-Grounded Semantic Signatures for Tracing LLM Exposure to Protected Documents30 Aug 2026
- 2026Learning to Follow In-Context Watermark Instructions via Self-Distillation29 Aug 2026
- 2026Fighting Fire with Fire: On the Feasibility of Protecting Exercises Against AI Cheating2 Aug 2026
- 2026LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematization11 Jul 2026
- 2026Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems25 Jun 2026
- 2026Watermarking Should Be Treated as a Monitoring Primitive13 May 2026
- 2025TokenPure: Watermark Removal through Tokenized Appearance and Structural Guidance1 Dec 2025
Similar, not cited
Close in wording, no citation either way
- 2025SoK: Are Watermarks in LLMs Ready for Deployment?
- 2025PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs
- 2025Watermarking Large Language Models in Europe: Interpreting the AI Act in Light of Technology
- 2025Copyright Protection for Large Language Models: A Survey of Methods, Challenges, and Trends
- 2024Watermarking Large Language Models and the Generated Content: Opportunities and Challenges
- 2024Can Watermarked LLMs be Identified by Users via Crafted Prompts?
- 2024Less is More: Sparse Watermarking in LLMs with Enhanced Text Quality
- 2025Towards Watermarking of Open-Source LLMs