Elamur Research⌕
☰
home / papers / 2026 / Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption

Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption

Paper · 2026 · Yepeng Liu, Xuandong Zhao, Dawn Song et al.

Summary

This position paper asks why LLM watermarking is rarely deployed despite many proposed algorithms. The authors argue that the main obstacle is not technical performance. Instead, LLM providers, platforms, and end users want different things. They identify three barriers: competitive risk for providers who adopt watermarking first, the difficulty of governing secret detection keys, and unfair attribution when human-edited text is labelled as AI output. They then assess three families of methods against these barriers. Model watermarking protects providers' IP at no cost to users, so it fits their interests, although open-source distribution adds complications. Text watermarking framed purely as an anti-misuse tool gives providers little reason to adopt it. It becomes more attractive for narrow tasks such as filtering self-generated training data or user-controlled provenance. In-context watermarking (ICW) lets trusted parties, such as conference organizers or teachers, hide watermark instructions in documents, which keeps providers neutral. The paper offers design principles for incentive-aligned, domain-specific watermarking and argues that regulation alone will not secure adoption.

Key points

  • Only Google's SynthID (on Gemini web and mobile) is cited as a deployed text watermark. Scott Aaronson's Gumbel-max proposal for OpenAI was reportedly not adopted.
  • The paper compares model watermarking to traditional digital watermarking in services like iTunes, with Hugging Face playing the platform role. Backdoor triggers and fingerprinting via key-response pairs are the main techniques.
  • In ICW, a dishonest reviewer or student who passes a document to an LLM receives output carrying a mark that the trusted party can detect. That party alone holds the keys and detector.
  • ICW is compared to the EURion constellation on banknotes. The authors suggest providers could co-design recognisable patterns that trigger watermarking or refusal.
  • Proposed future work includes information-theoretic multi-bit watermarking for richer attribution and ICW benchmarks as a measure of instruction-following ability.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of California, BerkeleyBerkeley · United States175 works · 227,440 citations🎓Massachusetts Institute of TechnologyCambridge · United States211 works · 69,000 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksComputer Vision and Pattern Recognition · 2,869 worksHardware and Architecture · 81 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,320 works

Cite

Cite as Yepeng Liu, Xuandong Zhao, Dawn Song, Gregory W. Wornell and Yuheng Bu. 2026. Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1290

@inproceedings{liu2026position,
  title = {{Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption}},
  author = {Yepeng Liu, Xuandong Zhao, Dawn Song, Gregory W. Wornell and Yuheng Bu},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1290},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1290}
}

References

116 references, 11 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Massieh Kordi Boroujeny, Ya Jiang, Kai Zeng, and Brian Mark. 2024. Multi-bit distortion-free watermarking for large language models. arXiv preprint arXiv:2402.16578. — [arXiv:2402.16578](https://arxiv.org/abs/2402.16578) find
  2. Jack T Brassil, Steven Low, Nicholas F Maxemchuk, and Lawrence O’Gorman. 1995. Electronic marking and identification techniques to discourage document copying. IEEE Journal on Selected Areas in Communications, 13(8):1495–1504. find
  3. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. Language models are few-shot learners. Advances in neural information processing systems, 33:1877–1901.
  4. Jiacheng Cai, Jiahao Yu, Yangguang Shao, Yuhang Wu, and Xinyu Xing. 2024. Utf: Undertrained tokens as fingerprints a novel approach to LLM identification. arXiv preprint arXiv:2410.12318. — [arXiv:2410.12318](https://arxiv.org/abs/2410.12318) find
  5. Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. 2023. On the possibilities of ai-generated text detection. arXiv preprint arXiv:2304.04736. — [arXiv:2304.04736](https://arxiv.org/abs/2304.04736) find
  6. Bilva Chandra, Jesse Dunietz, and Kathleen Roberts. 2024. Reducing risks posed by synthetic content: An overview of technical approaches to digital content transparency. Technical Report NIST AI 100-4, National Institute of Standards and Technology, Gaithersburg, MD. find
  7. Scott Aaronson. 2023. Watermarking of large language Yapei Chang, Kalpesh Krishna, Amir Houmansadr, models. https://simons.berkeley.edu/talks/ ↗
  8. John Wieting, and Mohit Iyyer. 2024. Postmark: A scott-aaronson-ut-austin-openai-2023-08-17. robust blackbox watermark for large language mod-Accessed: 2023-08. els. arXiv preprint arXiv:2406.14517. — [arXiv:2406.14517](https://arxiv.org/abs/2406.14517) find
  9. Anirudh Ajith, Sameer Singh, and Danish Pruthi. 2024. Harsh Chaudhari, Giorgio Severi, John Abascal, Downstream trade-offs of a family of text watermarks. Matthew Jagielski, Christopher A Choquette-Choo, In Findings of the Association for Computational Milad Nasr, Cristina Nita-Rotaru, and Alina Opr… find
  10. Linguistics: EMNLP 2024, pages 14039–14053. 2024. Phantom: General trigger attacks on retrieval augmented language generation. arXiv preprint Li An, Yujian Liu, Yepeng Liu, Yuheng Bu, Yang Zhang, arXiv:2405.20485. and Shiyu Chang. 2026. A reinforcement learning framework for robust and secure llm wa… find
  11. Brian Chen and Gregory W Wornell. 2001. Quanti-In Proceedings of the 19th Conference of the Euro-zation index modulation: A class of provably good pean Chapter of the Association for Computational methods for digital watermarking and information Linguistics (Volume 1: Long Papers), pages 7181– embed… find
  12. Li An, Yujian Liu, Yepeng Liu, Yang Zhang, Yuheng Bu, Ruibo Chen, Yihan Wu, Junfeng Guo, and Heng Huang. and Shiyu Chang. 2025. Defending LLM watermark-2025. Improved unbiased watermark for large lan-ing against spoofing attacks with contrastive repre-guage models. arXiv preprint arXiv:2502.11268. s… — [arXiv:2502.11268](https://arxiv.org/abs/2502.11268) find
  13. Maya Anderson, Guy Amit, and Abigail Goldsteen. 2024. Is my data in your retrieval database? membership inference attacks against retrieval augmented generation. arXiv preprint arXiv:2405.20446. — [arXiv:2405.20446](https://arxiv.org/abs/2405.20446) find
  14. Dara Bahri, John Wieting, Dana Alon, and Donald Metzler. 2024. A watermark for black-box language models. arXiv preprint arXiv:2410.02099. — [arXiv:2410.02099](https://arxiv.org/abs/2410.02099) find
  15. Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. Agentpoison: Red-teaming LLM agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems, 37:130185–130213. find
  16. Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. 2024. Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models. arXiv preprint arXiv:2405.13401. — [arXiv:2405.13401](https://arxiv.org/abs/2405.13401) find
  17. IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 4815–4819. IEEE. Wei-Lin Chiang, Lianmin Zheng, Ying Sheng, Anastasios Nikolas Angelopoulos, Tianle Li, Dacheng Li, Banghua Zhu, Hao Zhang, Michael Jordan, Joseph E Gonzalez, and 1 others. 2024. Chatbot arena: A… — Chatbot Arena: An Open Platform for Evaluating LLMs by Human Preference
  18. Jiayi Fu, Xuandong Zhao, Ruihan Yang, Yuansen Zhang, Jiangjie Chen, and Yanghua Xiao. 2024. Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick. arXiv preprint arXiv:2402.12948. find
  19. Miranda Christ, Sam Gunn, and Or Zamir. 2023. Undetectable watermarks for language models. arXiv preprint arXiv:2306.09194. — [arXiv:2306.09194](https://arxiv.org/abs/2306.09194) find
  20. A Feder Cooper, Katherine Lee, James Grimmelmann, Daphne Ippolito, Christopher Callison-Burch, Christopher A Choquette-Choo, Niloofar Mireshghallah, Miles Brundage, David Mimno, Madiha Zahrah Choksi, and 1 others. 2023. Report of the 1st workshop on generative ai and law. arXiv preprint arXiv:2311.0… — [arXiv:2311.06477](https://arxiv.org/abs/2311.06477) find
  21. Soumya Suvra Ghosal, Souradip Chakraborty, Jonas Geiping, Furong Huang, Dinesh Manocha, and Amrit Singh Bedi. 2023. Towards possibilities & impossibilities of ai-generated text detection: A survey. arXiv preprint arXiv:2310.15264. — [arXiv:2310.15264](https://arxiv.org/abs/2310.15264) find
  22. Eva Giboulot and Teddy Furon. 2024. Watermax: breaking the LLM watermark detectability-robustness-quality trade-off. arXiv preprint arXiv:2403.04808. — [arXiv:2403.04808](https://arxiv.org/abs/2403.04808) find
  23. Thibaud Gloaguen, Nikola Jovanović, Robin Staab, and Martin Vechev. 2024. Black-box detection of language model watermarks. arXiv preprint arXiv:2405.20777. — [arXiv:2405.20777](https://arxiv.org/abs/2405.20777) find
  24. Xinyue Cui, Johnny Tian-Zheng Wei, Swabha Swayamdipta, and Robin Jia. 2025. Robust data watermarking in language models by injecting fictitious knowledge. arXiv preprint arXiv:2503.04036. find
  25. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, and 1 others. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783.
  26. Cyberspace Administration of China. 2023. Interim administrative measures for generative artificial intelligence services. Issued 10 Jul 2023, effective 15 Aug 2023; requires explicit labels and implicit watermarks. find
  27. Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. 2023. On the learnability of watermarks for language models. arXiv preprint arXiv:2312.04469. find
  28. Yanbo Dai, Zongjie Li, Zhenlan Ji, and Shuai Wang. 2025. Seal: Subspace-anchored watermarks for llm ownership. arXiv preprint arXiv:2511.11356. — [arXiv:2511.11356](https://arxiv.org/abs/2511.11356) find
  29. Qingxiao Guo, Xinjie Zhu, Yilong Ma, Hui Jin, Yunhao Wang, Weifeng Zhang, and Xiaobing Guo. 2025. Invariant-based robust weights watermark for large language models. arXiv preprint arXiv:2507.08288. — [arXiv:2507.08288](https://arxiv.org/abs/2507.08288) find
  30. Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, and 1 others. 2024. Scalable watermarking for identifying large language model outputs. Nature, 634(8035):818–823. find
  31. Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Jingyuan Ma, Rui Li, Heming Xia, Jingjing Xu, Zhiyong Wu, Tianyu Liu, and 1 others. 2022. A survey on in-context learning. arXiv preprint arXiv:2301.00234.
  32. European Union. 2024. Regulation (eu) 2024/1689 of the european parliament and of the council of 13 march 2024 laying down harmonised rules on artificial intelligence and amending certain union legislative acts (artificial intelligence act). find
  33. Pierre Fernandez, Antoine Chaffin, Karim Tit, Vivien Chappelier, and Teddy Furon. 2023. Three bricks to consolidate watermarks for large language models. In 2023 IEEE International Workshop on Information Forensics and Security (WIFS), pages 1–6. IEEE. find
  34. Pierre Fernandez, Guillaume Couairon, Teddy Furon, and Matthijs Douze. 2024. Functional invariants to watermark large transformers. In ICASSP 2024-2024 find
  35. Haiyun He, Yepeng Liu, Ziqiao Wang, Yongyi Mao, and Yuheng Bu. 2024. Universally optimal watermarking schemes for LLMs: from theory to practice. arXiv preprint arXiv:2410.02890. — [arXiv:2410.02890](https://arxiv.org/abs/2410.02890) find
  36. Haiyun He, Yepeng Liu, Ziqiao Wang, Yongyi Mao, and Yuheng Bu. 2025. Distributional information embedding: A framework for multi-bit watermarking. arXiv preprint arXiv:2501.16558. — [arXiv:2501.16558](https://arxiv.org/abs/2501.16558) find
  37. Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. 2023. Semstamp: A semantic watermark with paraphrastic robustness for text generation. arXiv preprint arXiv:2310.03991. find
  38. Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. 2023. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669. — [arXiv:2310.10669](https://arxiv.org/abs/2310.10669) find
  39. Baihe Huang, Hanlin Zhu, Julien Piet, Banghua Zhu, Jason D. Lee, Kannan Ramchandran, Michael Jordan, and Jiantao Jiao. 2025. Watermarking using semantic-aware speculative sampling: from theory to practice. find
  40. Mingjia Huo, Sai Ashish Somayajula, Youwei Liang, Ruisi Zhang, Farinaz Koushanfar, and Pengtao Xie. 2024. Token-specific watermarking with enhanced detectability and semantic coherence for large language models. arXiv preprint arXiv:2402.18059. — [arXiv:2402.18059](https://arxiv.org/abs/2402.18059) find
  41. Xiang Li, Feng Ruan, Huiyuan Wang, Qi Long, and Weijie J Su. 2025. A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules. The Annals of Statistics, 53(1):322–351. find
  42. Wenlong Ji, Weizhe Yuan, Emily Getzen, Kyunghyun Cho, Michael I Jordan, Song Mei, Jason E Weston, Weijie J Su, Jing Xu, and Linjun Zhang. 2025. An overview of large language models for statisticians. arXiv preprint arXiv:2502.17814. find
  43. Yuying Li, Gaoyang Liu, Yang Yang, and Chen Wang. 2024c. Seeing is believing: Black-box membership inference attacks against retrieval augmented generation. arXiv e-prints, pages arXiv–2406. find
  44. Nikola Jovanović, Robin Staab, Maximilian Baader, and Martin Vechev. 2024a. Ward: Provable rag dataset inference via LLM watermarks. arXiv preprint arXiv:2410.03537. — [arXiv:2410.03537](https://arxiv.org/abs/2410.03537) find
  45. Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu, and James Zou. 2023. Gpt detectors are biased against non-native english writers. Patterns, 4(7).
  46. Nikola Jovanović, Robin Staab, and Martin Vechev. 2024b. Watermark stealing in large language models. arXiv preprint arXiv:2402.19361. — [arXiv:2402.19361](https://arxiv.org/abs/2402.19361) find
  47. Aiwei Liu, Leyi Pan, Xuming Hu, Shu’ang Li, Lijie Wen, Irwin King, and Philip S Yu. 2023a. An unforgeable publicly verifiable watermark for large language models. arXiv preprint arXiv:2307.16230. — [arXiv:2307.16230](https://arxiv.org/abs/2307.16230) find
  48. Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick SH Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. 2020. Dense passage retrieval for open-domain question answering. In EMNLP (1), pages 6769–6781.
  49. Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. 2024a. A semantic invariant robust watermark for large language models. In The Twelfth International Conference on Learning Representations. find
  50. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In International Conference on Machine Learning, pages 17061–17084. PMLR.
  51. Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. 2024b. A survey of text watermarking in the era of large language models. ACM Computing Surveys, 57(2):1–36. find
  52. Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2023. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593. find
  53. Mingrui Liu, Sixiao Zhang, and Cheng Long. 2025a. Mask-based membership inference attacks for retrieval-augmented generation. In Proceedings of the ACM on Web Conference 2025, pages 2894–2907. find
  54. Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. 2023. Who wrote this code? watermarking for code generation. arXiv preprint arXiv:2305.15060.
  55. Yepeng Liu and Yuheng Bu. 2024. Adaptive text watermark for large language models. arXiv preprint arXiv:2401.13927. — [arXiv:2401.13927](https://arxiv.org/abs/2401.13927) find
  56. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, and 1 others. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems, 33:9459–…
  57. Peixuan Li, Pengzhou Cheng, Fangqi Li, Wei Du, Haodong Zhao, and Gongshen Liu. 2023. Plmmark: a secure and robust black-box watermarking framework for pre-trained language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 14991–14999. find
  58. Shen Li, Liuyi Yao, Jinyang Gao, Lan Zhang, and Yaliang Li. 2024a. Double-i watermark: Protecting model copyright for llm fine-tuning. arXiv preprint arXiv:2402.14883. — [arXiv:2402.14883](https://arxiv.org/abs/2402.14883) find
  59. Xiang Li, Feng Ruan, Huiyuan Wang, Qi Long, and Weijie J Su. 2024b. Robust detection of watermarks for large language models under human edits. arXiv preprint arXiv:2411.13868. — [arXiv:2411.13868](https://arxiv.org/abs/2411.13868) find
  60. Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. 2024c. Image watermarks are removable using controllable regeneration from clean noise. arXiv preprint arXiv:2410.05470. — [arXiv:2410.05470](https://arxiv.org/abs/2410.05470) find
  61. Yepeng Liu, Xuandong Zhao, Christopher Kruegel, Dawn Song, and Yuheng Bu. 2025b. In-context watermarks for large language models. arXiv preprint arXiv:2505.16934. find
  62. Yepeng Liu, Xuandong Zhao, Dawn Song, and Yuheng Bu. 2025c. Dataset protection via watermarked canaries in retrieval-augmented LLMs. arXiv preprint arXiv:2502.10673. find
  63. Yixin Liu, Hongsheng Hu, Xun Chen, Xuyun Zhang, and Lichao Sun. 2023b. Watermarking text data on large language models for dataset copyright. arXiv preprint arXiv:2305.13257. — [arXiv:2305.13257](https://arxiv.org/abs/2305.13257) find
  64. Qian Lou, Yepeng Liu, and Bo Feng. 2023. Trojtext: Test-time invisible textual trojan insertion. arXiv preprint arXiv:2303.02242. — [arXiv:2303.02242](https://arxiv.org/abs/2303.02242) find
  65. Yueyuan Ma. 2022. Specialization in a knowledge economy. Available at SSRN, 4052990. find
  66. Emin Martinian, Gregory W Wornell, and Brian Chen. 2005. Authentication with distortion criteria. IEEE Transactions on Information Theory, 51(7):2523– 2542. find
  67. Hasan Mesut Meral, Bülent Sankur, A Sumru Özsoy, Tunga Güngör, and Emre Sevinç. 2009. Natural language watermarking via morphosyntactic alterations. Computer Speech & Language, 23(1):107–125. find
  68. Rui Min, Tianyu Pang, Chao Du, Qian Liu, Minhao Cheng, and Min Lin. 2025. Improving your model ranking on chatbot arena by vote rigging. arXiv preprint arXiv:2501.17858. — [arXiv:2501.17858](https://arxiv.org/abs/2501.17858) find
  69. Piotr Molenda, Adian Liusie, and Mark Gales. 2024. Waterjudge: Quality-detection trade-off when watermarking large language models. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3515–3525. find
  70. Norman Mu, Sarah Chen, Zifan Wang, Sizhe Chen, David Karamardian, Lulwa Aljeraisy, Basel Alomair, Dan Hendrycks, and David Wagner. 2023. Can LLMs follow simple rules? arXiv preprint arXiv:2311.04235. — [arXiv:2311.04235](https://arxiv.org/abs/2311.04235) find
  71. Anshul Nasery, Jonathan Hayase, Creston Brooks, Peiyao Sheng, Himanshu Tyagi, Pramod Viswanath, and Sewoong Oh. 2025. Scalable fingerprinting of large language models. arXiv preprint arXiv:2502.07760. — [arXiv:2502.07760](https://arxiv.org/abs/2502.07760) find
  72. Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, and 1 others. 2024. Mark-LLM: An open-source toolkit for LLM watermarking. arXiv preprint arXiv:2405.10051. — [arXiv:2405.10051](https://arxiv.org/abs/2405.10051) find
  73. Michael-Andrei Panaitescu-Liess, Zora Che, Bang An, Yuancheng Xu, Pankayaraj Pathmanathan, Souradip Chakraborty, Sicheng Zhu, Tom Goldstein, and Furong Huang. 2025. Can watermarking large language models prevent copyrighted text generation and hide training data? In Proceedings of the AAAI Conferenc… find
  74. Qi Pang, Shengyuan Hu, Wenting Zheng, and Virginia Smith. 2024. No free lunch in LLM watermarking: Trade-offs in watermarking design choices. arXiv preprint arXiv:2402.16187. — [arXiv:2402.16187](https://arxiv.org/abs/2402.16187) find
  75. Lip Yee Por, KokSheik Wong, and Kok Onn Chee. 2012. Unispach: A text-based data hiding method using unicode space characters. Journal of Systems and Software, 85(5):1075–1082. find
  76. Jipeng Qiang, Shiyu Zhu, Yun Li, Yi Zhu, Yunhao Yuan, and Xindong Wu. 2023. Natural language watermarking via paraphraser-based lexical substitution. Artificial Intelligence, 317:103859. find
  77. Wenjie Qu, Dong Yin, Zixin He, Wei Zou, Tianyang Tao, Jinyuan Jia, and Jiaheng Zhang. 2024. Provably robust multi-bit watermarking for ai-generated text via error correction code. arXiv e-prints, pages arXiv– 2401. find
  78. Vishisht Rao, Aounon Kumar, Himabindu Lakkaraju, and Nihar B Shah. 2025. Detecting LLM-written peer reviews. arXiv preprint arXiv:2503.15772. — [arXiv:2503.15772](https://arxiv.org/abs/2503.15772) find
  79. Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. 2023. A robust semantics-based watermark for large language model against paraphrasing. arXiv preprint arXiv:2311.08721. find
  80. Stefano Giovanni Rizzo, Flavio Bertini, and Danilo Montesi. 2016. Content-preserving text watermarking through unicode homoglyph substitution. In Proceedings of the 20th International Database Engineering & Applications Symposium, pages 97–104. find
  81. Mark Russinovich and Ahmed Salem. 2024. Hey, that’s my model! introducing chain & hash, an LLM fingerprinting technique. arXiv preprint arXiv:2407.10887. — [arXiv:2407.10887](https://arxiv.org/abs/2407.10887) find
  82. Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. 2024. Watermarking makes language models radioactive. Advances in Neural Information Processing Systems, 37:21079– 21113. find
  83. Ryoma Sato, Yuki Takezawa, Han Bao, Kenta Niwa, and Makoto Yamada. 2023. Embarrassingly simple text watermarks. arXiv preprint arXiv:2310.08920. — [arXiv:2310.08920](https://arxiv.org/abs/2310.08920) find
  84. Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Nicolas Papernot, Ross Anderson, and Yarin Gal. 2024. Ai models collapse when trained on recursively generated data. Nature, 631(8022):755–759. find
  85. Shivalika Singh, Yiyang Nan, Alex Wang, Daniel D’Souza, Sayash Kapoor, Ahmet Üstün, Sanmi Koyejo, Yuntian Deng, Shayne Longpre, Noah Smith, and 1 others. 2025. The leaderboard illusion. arXiv preprint arXiv:2504.20879. find
  86. Mercan Topkara, Umut Topkara, and Mikhail J Atallah. 2006. Words are not enough: sentence level natural language watermarking. In Proceedings of the 4th ACM international workshop on Contents protection and security, pages 37–46. find
  87. Apurv Verma, NhatHai Phan, and Shubhendu Trivedi. 2025. Watermarking degrades alignment in language models: Analysis and mitigation. arXiv preprint arXiv:2506.04462. — [arXiv:2506.04462](https://arxiv.org/abs/2506.04462) find
  88. Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. 2023. Towards codable watermarking for injecting multi-bits information to LLMs. arXiv preprint arXiv:2307.15992. — [arXiv:2307.15992](https://arxiv.org/abs/2307.15992) find
  89. Johnny Tian-Zheng Wei, Ryan Yixiang Wang, and Robin Jia. 2024. Proving membership in LLM pre-training data via data watermarks. arXiv preprint arXiv:2402.10892. — [arXiv:2402.10892](https://arxiv.org/abs/2402.10892) find
  90. Xinhua News. 2024. World insights: Stanford ai team apologizes for plagiarizing chinese university’s model. Accessed: 2025-05-22. find
  91. Lee Xiong, Chenyan Xiong, Ye Li, Kwok-Fung Tang, Jialin Liu, Paul Bennett, Junaid Ahmed, and Arnold Overwijk. 2020. Approximate nearest neighbor negative contrastive learning for dense text retrieval. arXiv preprint arXiv:2007.00808.
  92. Xi Yang, Jie Zhang, Kejiang Chen, Weiming Zhang, Zehua Ma, Feng Wang, and Nenghai Yu. 2022. Tracing text provenance via context-aware lexical substitution. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 11613–11621. find
  93. KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. 2023. Robust multi-bit natural language watermarking through invariant features. arXiv preprint arXiv:2305.01904. find
  94. Eva Zhang, Arka Pal, Akilesh Potti, and Micah Goldblum. 2024a. vtune: Verifiable fine-tuning for LLMs through backdooring. arXiv preprint arXiv:2411.06611. — [arXiv:2411.06611](https://arxiv.org/abs/2411.06611) find
  95. Jiashu Xu, Mingyu Derek Ma, Fei Wang, Chaowei Xiao, and Muhao Chen. 2023. Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models. arXiv preprint arXiv:2305.14710. find
  96. Junyan Zhang, Shuliang Liu, Aiwei Liu, Yubo Gao, Jungang Li, Xiaojie Gu, and Xuming Hu. 2025. Cohemark: A novel sentence-level watermark for enhanced text quality. arXiv preprint arXiv:2504.17309. — [arXiv:2504.17309](https://arxiv.org/abs/2504.17309) find
  97. Jiashu Xu, Fei Wang, Mingyu Derek Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. 2024a. Instructional fingerprinting of large language models. arXiv preprint arXiv:2401.12255. find
  98. Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushanfar. 2024b. {REMARK-LLM}: A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1813–1830. find
  99. Xiaojun Xu, Yuanshun Yao, and Yang Liu. 2024b. Learning to watermark LLM-generated text via reinforcement learning. arXiv preprint arXiv:2403.10553. — [arXiv:2403.10553](https://arxiv.org/abs/2403.10553) find
  100. Yijie Xu, Aiwei Liu, Xuming Hu, Lijie Wen, and Hui Xiong. 2025a. Mark your LLM: Detecting the misuse of open-source large language models via watermarking. arXiv preprint arXiv:2503.04636. — [arXiv:2503.04636](https://arxiv.org/abs/2503.04636) find
  101. Zhenhua Xu, Xubin Yue, Zhebo Wang, Qichen Liu, Xixiang Zhao, Jingxuan Zhang, Wenjun Zeng, Wengpeng Xing, Dezhang Kong, Changting Lin, and 1 others. 2025b. Copyright protection for large language models: A survey of methods, challenges, and trends. arXiv preprint arXiv:2508.11548. — [arXiv:2508.11548](https://arxiv.org/abs/2508.11548) find
  102. Jiaqi Xue, Mengxin Zheng, Ting Hua, Yilin Shen, Yepeng Liu, Ladislau Bölöni, and Qian Lou. 2023. TrojLLM: A black-box trojan prompt attack on large language models. Advances in Neural Information Processing Systems, 36:65665–65677. find
  103. Shojiro Yamabe, Tsubasa Takahashi, Futa Waseda, and Koki Wataoka. 2024. Mergeprint: Robust fingerprinting against merging large language models. arXiv preprint arXiv:2410.08604. — [arXiv:2410.08604](https://arxiv.org/abs/2410.08604) find
  104. Ruisi Zhang and Farinaz Koushanfar. 2024. Emmark: Robust watermarks for ip protection of embedded quantized large language models. In Proceedings of the 61st ACM/IEEE Design Automation Conference, pages 1–6. find
  105. Shuai Zhao, Meihuizi Jia, Zhongliang Guo, Leilei Gan, Xiaoyu Xu, Xiaobao Wu, Jie Fu, Yichao Feng, Fengjun Pan, and Luu Anh Tuan. 2024a. A survey of recent backdoor attacks and defenses in large language models. arXiv preprint arXiv:2406.06852. — [arXiv:2406.06852](https://arxiv.org/abs/2406.06852) find
  106. Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. 2023a. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306.17439. find
  107. Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramer, and 1 others. 2024b. Sok: Watermarking for ai-generated content. arXiv preprint arXiv:2411.18479. find
  108. Xuandong Zhao, Lei Li, and Yu-Xiang Wang. 2022. Distillation-resistant watermarking for model protection in nlp. arXiv preprint arXiv:2210.03312. find
  109. An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, and 1 others. 2024. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115. find
  110. Xuandong Zhao, Lei Li, and Yu-Xiang Wang. 2025. Permute-and-flip: An optimally stable and watermarkable decoder for LLMs. In The Thirteenth International Conference on Learning Representations. find
  111. Xi Yang, Kejiang Chen, Weiming Zhang, Chang Liu, Yuang Qi, Jie Zhang, Han Fang, and Nenghai Yu. 2023. Watermarking text generated by black-box language models. arXiv preprint arXiv:2305.08883. — [arXiv:2305.08883](https://arxiv.org/abs/2305.08883) find
  112. Xuandong Zhao, Yu-Xiang Wang, and Lei Li. 2023b. Protecting language generation models via invisible watermarking. In International Conference on Machine Learning, pages 42187–42199. PMLR. find
  113. Xin Zhong, Agnibh Dasgupta, and Abdullah Tanvir. 2024. Watermarking language models through language models. arXiv preprint arXiv:2411.05091. — [arXiv:2411.05091](https://arxiv.org/abs/2411.05091) find
  114. Jeffrey Zhou, Tianjian Lu, Swaroop Mishra, Siddhartha Brahma, Sujoy Basu, Yi Luan, Denny Zhou, and Le Hou. 2023. Instruction-following evaluation for large language models. arXiv preprint arXiv:2311.07911.
  115. Chaoyi Zhu, Jeroen Galjaard, Pin-Yu Chen, and Lydia Y Chen. 2024. Duwak: Dual watermarks in large language models. arXiv preprint arXiv:2403.13000. find
  116. Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2024. Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models. arXiv preprint arXiv:2402.07867. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/liu-2026-position-llm-watermarking-should-align/