mlsanityData to 7 Oct 2026

More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensembles

arXiv 2602.11793 ↗First posted 12 Feb 2026cs.CR cs.CLcited by 2

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Watermarking has emerged as a crucial technique for detecting and attributing content generated by large language models. While recent advancements have utilized watermark ensembles to enhance robustness, prevailing methods typically prioritize maximizing the strength of the watermark at every individual layer. In this work, we identify a critical limitation in this "stronger-is-better" approach: strong watermarks significantly reduce the entropy of the token distribution, which paradoxically weakens the effectiveness of watermarking in subsequent layers. We theoretically and empirically show that detectability is bounded by entropy and that watermark ensembles induce a monotonic decrease in both entropy and the expected green-list ratio across layers. To address this inherent trade-off, we propose a general framework that utilizes weaker single-layer watermarks to preserve the entropy required for effective multi-layer ensembling. Empirical evaluations demonstrate that this counter-intuitive strategy mitigates signal decay and consistently outperforms strong baselines in both detectability and robustness.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 15 of its 29 references that are in the map. First posted on arXiv 12 Feb 2026.

Builds on

15 of 29 references.

Closest ancestors · 11

Same direction, newest first

  1. 2025Leave No TRACE: Black-box Detection of Copyrighted Dataset Usage in Large Language Models via Watermarking3 Oct
  2. 2025Analyzing and Evaluating Unbiased Language Model Watermark28 Sep
  3. 2025An Ensemble Framework for Unbiased Language Model Watermarking28 Sep
  4. 2025BiMark: Unbiased Multilayer Watermarking for Large Language Models19 Jun
  5. 2024A Watermark for Order-Agnostic Language Models17 Oct
  6. 2024Distortion-free Watermarks are not Truly Distortion-free under Watermark Key Collisions2 Jun
  7. 2024WaterMax: breaking the LLM watermark detectability-robustness-quality trade-off6 Mar
  8. 2023Robust Distortion-free Watermarks for Language Models28 Jul
  9. 2023Provable Robust Watermarking for AI-Generated Text30 Jun
  10. 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense23 Mar
  11. 2023Can AI-Generated Text be Reliably Detected?17 Mar

Other references · 4

  1. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  2. 2024The Llama 3 Herd of Modelscited by 14,192
  3. 2021Ethical and social risks of harm from Language Modelscited by 957
  4. 2023Generative Language Models and Automated Influence Operations: Emerging Threats and Potential Mitigationscited by 157

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.