# Watermarking generated content and models Area: [LLM safety and security](https://mlsanity.com/safety/index.md). HTML: https://mlsanity.com/safety/watermarking-generated-content-and-models/ ## Key facts - Watermarking generated content and models: 717 papers on arXiv since 2021 (data through 14 Oct 2026). - 282 of its 717 mapped papers (39%) cite “A Watermark for Large Language Models” (2023, arXiv 2301.10226). - 227 of its 717 mapped papers (32%) cite “Robust Distortion-free Watermarks for Language Models” (2023, arXiv 2307.15593). - 30 new papers 24 Sep–14 Oct. ## Most cited here - [A Watermark for Large Language Models](https://mlsanity.com/paper/2301.10226/) (2023), cited by 282 papers here - [Robust Distortion-free Watermarks for Language Models](https://mlsanity.com/paper/2307.15593/) (2023), cited by 227 papers here - [Provable Robust Watermarking for AI-Generated Text](https://mlsanity.com/paper/2306.17439/) (2023), cited by 205 papers here - [Undetectable Watermarks for Language Models](https://mlsanity.com/paper/2306.09194/) (2023), cited by 148 papers here - [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://mlsanity.com/paper/2303.15435/) (2023), cited by 145 papers here - [Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense](https://mlsanity.com/paper/2303.13408/) (2023), cited by 137 papers here - [On the Reliability of Watermarks for Large Language Models](https://mlsanity.com/paper/2306.04634/) (2023), cited by 119 papers here - [Who Wrote this Code? Watermarking for Code Generation](https://mlsanity.com/paper/2305.15060/) (2023), cited by 108 papers here - [SemStamp: A Semantic Watermark with Paraphrastic Robustness for Text Generation](https://mlsanity.com/paper/2310.03991/) (2023), cited by 99 papers here - [Can AI-Generated Text be Reliably Detected?](https://mlsanity.com/paper/2303.11156/) (2023), cited by 90 papers here ## New (24 Sep–14 Oct) - [Pin It on Anyone: Certified Targeted Displacement of Multi-Bit LLM Watermarks Without the Key](https://mlsanity.com/paper/2610.18359/) (2026-10-13) - [Perturbation, Not Provenance: Why Activation Steering Does Not Make a Robust Text Watermark](https://mlsanity.com/paper/2610.17810/) (2026-10-13) - [textGrain watermarking is harder to detect: can sum-tests still do it optimally?](https://mlsanity.com/paper/2610.17655/) (2026-10-13) - [SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification](https://mlsanity.com/paper/2610.15725/) (2026-10-11) - [GAMW: Generation-Aware Mel-Domain Watermarking for TTS Traceability](https://mlsanity.com/paper/2610.15082/) (2026-10-10) - [ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models](https://mlsanity.com/paper/2610.14427/) (2026-10-10) - [Tokenization-Invariant Watermarking: A Byte-Local Method for LLM Text](https://mlsanity.com/paper/2610.14378/) (2026-10-09) - [WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models](https://mlsanity.com/paper/2610.12952/) (2026-10-09) - [Could LLM Watermark Detection be Public?](https://mlsanity.com/paper/2610.12106/) (2026-10-08) - [Diffusion-Generated Image Watermarking: A Two-Axis Taxonomy and Three Protocol-Bounded Case Studies](https://mlsanity.com/paper/2610.09755/) (2026-10-07) - [Latent Watermarks under Generative Editing: A Benchmark and Analysis of Detection Survival](https://mlsanity.com/paper/2610.09702/) (2026-10-07) - [Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents](https://mlsanity.com/paper/2610.08668/) (2026-10-06) - [MARCO: The Radioactive Watermark for Protein Generative Models](https://mlsanity.com/paper/2610.08316/) (2026-10-06) - [Rethinking Visual Provenance: Detection and Watermarking Across Direct Visual Generation and LLM-Driven Code Rendering](https://mlsanity.com/paper/2610.08137/) (2026-10-06) - [SimpleMark: Fast Multi-Bit Text Watermarking under f -Divergence Constraints](https://mlsanity.com/paper/2610.05712/) (2026-10-05) - [The Poisoned Conversation: Privacy-Leaking Watermarks in Unified Multimodal Models](https://mlsanity.com/paper/2610.05453/) (2026-10-04) - [Invisible Ink, Visible Lies: How Production Watermarking Causes LLMs to Hallucinate](https://mlsanity.com/paper/2610.04860/) (2026-10-04) - [Language Model Fingerprinting Requires Rethinking Watermark Teachers](https://mlsanity.com/paper/2610.04169/) (2026-10-03) - [RMCW: A Deletion-Robust Watermark Based on Reed--Muller Codes for Language Models](https://mlsanity.com/paper/2610.02817/) (2026-10-02) - [Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking](https://mlsanity.com/paper/2610.02010/) (2026-10-01) - [Persistent Watermarking of Text-to-Image Models](https://mlsanity.com/paper/2609.39024/) (2026-09-30) - [Anchor-ECC: Local Integrity Checking for Watermarked LLM Outputs via Error-Correcting Codes](https://mlsanity.com/paper/2609.38722/) (2026-09-30) - [AutoMark: Enabling Autoresearch to Discover Better LLM Watermarks](https://mlsanity.com/paper/2609.37310/) (2026-09-29) - [Beyond Semantic Narrowing: Robust and Efficient LLM Watermarking with Hamming Neighborhoods](https://mlsanity.com/paper/2609.37218/) (2026-09-29) - [TTMark: Pairwise Distortion-Free Watermarking Beyond Single-Token Entropy](https://mlsanity.com/paper/2609.36372/) (2026-09-28) - [TANGO: Watermarking Masked Diffusion Language Models in Token Pairs](https://mlsanity.com/paper/2609.35224/) (2026-09-28) - [GenoTrace: Inheritable Watermarks for Genome Foundation Model Distillation](https://mlsanity.com/paper/2609.35881/) (2026-09-27) - [Tokens Change, Structure Endures: Spectral Watermarking for Generated Speech](https://mlsanity.com/paper/2609.33774/) (2026-09-27) - [CertMark: Distortion-Free Multi-Bit Watermarking with Certified Decoding](https://mlsanity.com/paper/2609.33332/) (2026-09-27) - [FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models](https://mlsanity.com/paper/2609.30980/) (2026-09-25)