LLM Output Detectability and Task Performance Can be Jointly Optimized
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
Detecting machine-generated text is essential for transparency and accountability when deploying LLMs. Watermarking enables statistically reliable detection by biasing token distributions to embed detectable signals into LLM outputs. However, it has been reported that watermarked LLMs often perform worse on downstream tasks. We propose PUPPET, a framework that fine-tunes an LLM via DPO to generate text that is both more detectable by a target detector and better performing on downstream tasks. We use two rewards: a detector that outputs a machine-class likelihood and an evaluator that measures a task-specific metric. Just as a watermark is verified with its secret key, this detector-specific design lets an LLM provider track how its published model is used. Experiments on long-form QA, summarization, and essay writing show that LLMs trained with PUPPET achieve detectability competitive with watermarking methods---even at strict low FPRs---while outperforming them on downstream tasks. Moreover, this optimization requires only a few thousand samples and 1--2 GPU hours, and its gains hold across out-of-domain tasks, six detectors of diverse architectures, and different LLM families and sizes, and are even robust to paraphrasing attacks.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 42 of its 53 references that are in the map. First posted on arXiv 2 May 2026.
Builds on
42 of 53 references.
Closest ancestors · 11
Same direction, newest first
- 2025From Trade-off to Synergy: A Versatile Symbiotic Watermarking Framework for Large Language Models15 May
- 2024MarkLLM: An Open-Source Toolkit for LLM Watermarking16 May
- 2024k-SemStamp: A Clustering-Based Semantic Watermark for Detection of Machine-Generated Text17 Feb
- 2023Downstream Trade-offs of a Family of Text Watermarks16 Nov
- 2023WaterBench: Towards Holistic Evaluation of Watermarks for Large Language Models13 Nov
- 2023A Semantic Invariant Robust Watermark for Large Language Models10 Oct
- 2023Three Bricks to Consolidate Watermarks for Large Language Models26 Jul
- 2023Watermarking Conditional Text Generation for AI Detection: Unveiling Challenges and a Semantic-Aware Watermark Remedy25 Jul
- 2023Provable Robust Watermarking for AI-Generated Text30 Jun
- 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense23 Mar
- 2023A Watermark for Large Language Models24 Jan
Other references · 31
- 2017Proximal Policy Optimization Algorithmscited by 15,215
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
- 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
- 2023G-Eval: NLG Evaluation using GPT-4 with Better Human Alignmentcited by 2,276
- 2020Gradient Surgery for Multi-Task Learningcited by 1,256
- 2024SimPO: Simple Preference Optimization with a Reference-Free Rewardcited by 963
- 2023DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvaturecited by 726
- 2021BARTScore: Evaluating Generated Text as Text Generationcited by 722
19 more
- 2019ELI5: Long Form Question Answeringcited by 575
- 2019Release Strategies and the Social Impacts of Language Modelscited by 513
- 2023How Close is ChatGPT to Human Experts? Comparison Corpus, Evaluation, and Detectioncited by 481
- 2019Multi-News: a Large-Scale Multi-Document Summarization Dataset and Abstractive Hierarchical Modelcited by 431
- 2021All That's 'Human' Is Not Gold: Evaluating Human Evaluation of Generated Textcited by 287
- 2023Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvaturecited by 287
- 2024Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Textcited by 263
- 2023RADAR: Robust AI-Text Detection via Adversarial Learningcited by 190
- 2023Can LLM-Generated Misinformation Be Detected?cited by 177
- 2023Generative Language Models and Automated Influence Operations: Emerging Threats and Potential Mitigationscited by 158
- 2023MAGE: Machine-generated Text Detection in the Wildcited by 132
- 2023Intrinsic Dimension Estimation for Robust Detection of AI-Generated Textscited by 112
- 2022Human heuristics for AI-generated language are flawedcited by 105
- 2024SemEval-2024 Task 8: Multidomain, Multimodel and Multilingual Machine-Generated Text Detectioncited by 30
- 2024Revisiting the Robustness of Watermarking to Paraphrasing Attackscited by 25
- 2025Self-Improvement Towards Pareto Optimality: Mitigating Preference Conflicts in Multi-Objective Alignmentcited by 16
- 2025SafeSearch: Do Not Trade Safety for Utility in LLM Search Agentscited by 9
- 2024Beyond Agreement: Diagnosing the Rationale Alignment of Automated Essay Scoring Methods based on Linguistically-informed Counterfactualscited by 8
- 2025Is Human-Like Text Liked by Humans? Multilingual Human Detection and Preference Against AIcited by 4
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2024Learning to Watermark LLM-generated Text via Reinforcement Learning
- 2025SoK: Are Watermarks in LLMs Ready for Deployment?
- 2024PostMark: A Robust Blackbox Watermark for Large Language Models
- 2023Unbiased Watermark for Large Language Models
- 2024Can Watermarked LLMs be Identified by Users via Crafted Prompts?
- 2026Beyond Heuristic Tuning: Power-Calibrated LLM Watermarking
- 2026Adaptively Robust LLM Monitoring via Activation Watermarking
- 2025Mark Your LLM: Detecting the Misuse of Open-Source Large Language Models via Watermarking