Elamur Research⌕
☰
home / papers / 2026 / Topic-Based Watermarks for Large Language Models

Topic-Based Watermarks for Large Language Models

Paper · 2026 · Alexander Nemecek, Yuzhou Jiang and Erman Ayday

Summary

LLM output is hard to tell apart from human writing. This creates risks of misuse and of "model collapse" when synthetic text ends up in training data. Existing generation-time watermarks force a choice. Cheap schemes like KGW and SynthID-Text are fragile under paraphrasing, while sturdier ones such as EXP-Edit or SIR need extra decoding passes or decoder changes.

The authors propose Topic-Based Watermarking (TBW):

  • Partitioning: offline, every vocabulary token is assigned to one of K predefined topic lists by embedding similarity. Tokens below the threshold are spread across lists using a secret seed.
  • Generation: a lightweight extractor identifies the prompt's topic, and decoding is nudged toward that topic's list, which acts as the green list.
  • Detection: each topic partition is tested, and the strongest z-score is taken.

Because the favored tokens fit the subject, fluency is largely preserved. Experiments on several LLMs with C4 prompts show text quality comparable to production systems, better resistance to paraphrasing and lexical perturbation, and generation cost close to KGW and SynthID. No extra inference machinery is required, which makes adoption easy.

Key points

  • Token mapping: uses all-MiniLM-L6-v2 embeddings, cosine similarity, and a threshold τ. With K = 4 topics, each green list covers about 25% of the vocabulary, roughly matching KGW's γ = 0.2.
  • Baselines: KGW, Unigram, SynthID-Text, DiPmark, SIR, and EXP/EXP-Edit/ITS-Edit. EXP-Edit and SIR showed noticeably slower generation than TBW, and the efficiency advantage also held on OPT-2.7B.
  • Detection cost: on GEMMA-7B (δ = 2.0, τ = 0.5, 100 prompts), detection time grows roughly linearly with K, from about 2.0 s at K = 4 to about 6.6 s at K = 32. The z-score drops as K rises, but text quality stays stable.
  • Vocabulary size matters: OPT-6.7B (50,272 tokens) yields slightly weaker detection and more false positives than GEMMA-7B (256,000 tokens). For small models, the authors suggest tailoring topics to the target domain.
  • Other limitations: the main evaluation uses 200-token outputs, and reliability is expected to fall for shorter texts. Recovering the partition is argued to be infeasible without the private round-robin seed.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🏢MetaMenlo Park · United States183 works · 228,558 citations🎓Case Western Reserve UniversityCleveland · United States5 works · 280 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksComputer Vision and Pattern Recognition · 2,869 worksHardware and Architecture · 81 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,320 works

Cite

Cite as Alexander Nemecek, Yuzhou Jiang and Erman Ayday. 2026. Topic-Based Watermarks for Large Language Models. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1220

@inproceedings{nemecek2026topic,
  title = {{Topic-Based Watermarks for Large Language Models}},
  author = {Alexander Nemecek, Yuzhou Jiang and Erman Ayday},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1220},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1220}
}

References

54 references, 13 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Association for the Advancement of Artificial Intelligence (AAAI). 2025. AAAI Launches AI-Powered Peer Review Assessment System. https://aaai.org/aaai-launches-ai-powered-peer-review-a ssessment-system/. Accessed: 2025-08-25. ↗
  2. Jainit Sushil Bafna, Hardik Mittal, Suyash Sethia, Manish Shrivastava, and Radhika Mamidi. 2024. Mast kalandar at semeval-2024 task 8: On the trail of textual origins: Roberta-bilstm approach to detect ai-generated text. Preprint, arXiv:2407.02978. find
  3. Isabel Cachola, Kyle Lo, Arman Cohan, and Daniel Weld. 2020. TLDR: Extreme summarization of scientific documents. In Findings of the Association for Computational Linguistics: EMNLP 2020, pages 4766–4777, Online. Association for Computational Linguistics.
  4. Yapei Chang, Kalpesh Krishna, Amir Houmansadr, John Frederick Wieting, and Mohit Iyyer. 2024. Postmark: A robust blackbox watermark for large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 8969–8987. find
  5. Canyu Chen and Kai Shu. 2024. Combating misinformation in the age of llms: Opportunities and challenges. AI Magazine, 45(3):354–368. find
  6. Cleveland Clinic. 2025. Cleveland Clinic Announces Rollout of Ambience Healthcare’s AI Platform. https://newsroom.clevelandclinic.org/2025/ 02/19/cleveland-clinic-announces-the-rol lout-of-ambience-healthcares-ai-platform. Accessed: 2025-08-25. ↗
  7. Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, and 1 others. 2024. Scalable watermarking for identifying large language model outputs. Nature, 634(8035):818–823. find
  8. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. Preprint, arXiv:1810.04805.
  9. Christiane Fellbaum. 1998. WordNet: An electronic lexical database. MIT press. find
  10. Xiaoyan Feng, He Zhang, Yanjun Zhang, Leo Yu Zhang, and Shirui Pan. 2025. Bimark: Unbiased multilayer watermarking for large language models. In Forty-second International Conference on Machine Learning. find
  11. Google. 2024. Introducing gemini 2.0: Our new ai model for the agentic era. https://blog.googl e/technology/google-deepmind/google-gemin i-ai-update-december-2024/. Accessed: 2025-07-29. ↗
  12. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, and 1 others. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783.
  13. Maarten Grootendorst. 2020. Keybert: Minimal keyword extraction with bert. https://maartengr.gi thub.io/KeyBERT/. Accessed: 2025-07-29. ↗
  14. Abe Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. 2024a. SemStamp: A semantic watermark with paraphrastic robustness for text generation. In Proceedings of the 2024 Conference of the North American… find
  15. Abe Hou, Jingyu Zhang, Yichen Wang, Daniel Khashabi, and Tianxing He. 2024b. k-SemStamp: A clustering-based semantic watermark for detection of machine-generated text. In Findings of the Association for Computational Linguistics: ACL 2024, pages 1706–1715, Bangkok, Thailand. Association for Computat… find
  16. Hugging Face. 2025. Hugging face - the ai community building the future. https://huggingface.co. Accessed: 2025-08-26. ↗
  17. Mingjia Huo, Sai Ashish Somayajula, Youwei Liang, Ruisi Zhang, Farinaz Koushanfar, and Pengtao Xie. 2024. Token-specific watermarking with enhanced detectability and semantic coherence for large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.o… find
  18. Niful Islam, Debopom Sutradhar, Humaira Noor, Jarin Tasnim Raya, Monowara Tabassum Maisha, and Dewan Md Farid. 2023. Distinguishing human generated text from chatgpt generated text using machine learning. Preprint, arXiv:2306.01761. — [arXiv:2306.01761](https://arxiv.org/abs/2306.01761) find
  19. Nikola Jovanović, Robin Staab, and Martin Vechev. 2024. Watermark stealing in large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org. find
  20. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In International Conference on Machine Learning, pages 17061–17084. PMLR.
  21. Kalpesh Krishna. 2023. ai-detection-paraphrases. https://github.com/martiansideofthemoon/ai-d etection-paraphrases. Accessed: 2025-08-01. ↗
  22. Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS ’23, Red Hook, NY, USA.…
  23. Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2024. Robust distortion-free watermarks for language models. Preprint, arXiv:2307.15593. find
  24. Alexander Nemecek, Yuzhou Jiang, and Erman Ayday. 2025. The feasibility of topic-based watermarking on academic peer reviews. In Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computation… find
  25. Jooyoung Lee, Thai Le, Jinghui Chen, and Dongwon Lee. 2023. Do language models plagiarize? In Proceedings of the ACM Web Conference 2023, pages 3637–3647. find
  26. Newsweek. 2025. World’s Best Hospitals 2025 - United States of America. https://rankings.newsweek.com/worlds-best-hospitals-2025/united-sta tes-america. Accessed: 2025-08-25. ↗
  27. Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. 2024. Who wrote this code? watermarking for code generation. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 4890–4911, Ba…
  28. Georg Niess and Roman Kern. 2025. Ensemble watermarks for large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2903–2916, Vienna, Austria. Association for Computational Linguistics. find
  29. David D Lewis, Yiming Yang, Tony G Rose, and Fan Li. 2004. Rcv1: A new benchmark collection for text categorization research. Journal of machine learning research, 5(Apr):361–397.
  30. Qian Li, Hao Peng, Jianxin Li, Congying Xia, Renyu Yang, Lichao Sun, Philip S. Yu, and Lifang He. 2021. A survey on text classification: From shallow to deep learning. Preprint, arXiv:2008.00364. — [arXiv:2008.00364](https://arxiv.org/abs/2008.00364) find
  31. Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu, and James Zou. 2023. Gpt detectors are biased against non-native english writers. Patterns, 4(7).
  32. Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. 2024. A semantic invariant robust watermark for large language models. Preprint, arXiv:2310.06356. — [arXiv:2310.06356](https://arxiv.org/abs/2310.06356) find
  33. Yepeng Liu and Yuheng Bu. 2024. Adaptive text watermark for large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org. find
  34. Minjia Mao, Dongjun Wei, Zeyu Chen, Xiao Fang, and Michael Chau. 2025. Watermarking low-entropy generation for large language models: An unbiased and low-risk method. Preprint, arXiv:2405.14604. — [arXiv:2405.14604](https://arxiv.org/abs/2405.14604) find
  35. Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. 2023. Detectgpt: Zero-shot machine-generated text detection using probability curvature. In International conference on machine learning, pages 24950–24962. PMLR.
  36. Felix B Mueller, Rebekka Görge, Anna K Bernzen, Janna C Pirk, and Maximilian Poretschkin. 2024. Llms and memorization: On quality and specificity of copyright compliance. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, volume 7, pages 984–996. find
  37. OpenAI. 2022. Introducing chatgpt. https://openai.com/index/chatgpt/. Accessed: 2025-07-29. ↗
  38. OpenAI. 2023. New ai classifier for indicating ai-written text. https://openai.com/index/n ew-ai-classifier-for-indicating-ai-writt en-text. Accessed: 2025-07-29. ↗
  39. Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, Irwin King, and Philip S. Yu. 2024. MarkLLM: An open-source toolkit for LLM watermarking. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing:… find
  40. Wenjie Qu, Wengrui Zheng, Tianyang Tao, Dong Yin, Yanze Jiang, Zhihua Tian, Wei Zou, Jinyuan Jia, and Jiaheng Zhang. 2025. Provably robust multi-bit watermarking for ai-generated text. Preprint, arXiv:2401.16820. — [arXiv:2401.16820](https://arxiv.org/abs/2401.16820) find
  41. Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res., 21(1).
  42. Nils Reimers and Iryna Gurevych. 2020. Making monolingual sentence embeddings multilingual using knowledge distillation. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 4512–4525, Online. Association for Computational Linguistics.
  43. Ryoma Sato, Yuki Takezawa, Han Bao, Kenta Niwa, and Makoto Yamada. 2023. Embarrassingly simple text watermarks. Preprint, arXiv:2310.08920. — [arXiv:2310.08920](https://arxiv.org/abs/2310.08920) find
  44. Scott Aaronson. 2023. Watermarking of large language models. https://simons.berkeley.edu/talk s/scott-aaronson-ut-austin-openai-2023-0 8-17. Accessed: 2025-07-29. ↗
  45. Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Nicolas Papernot, Ross Anderson, and Yarin Gal. 2024. Ai models collapse when trained on recursively generated data. Nature, 631(8022):755–759. find
  46. SynthID-Team. 2024. Watermarking ai-generated text and video with synthid. Accessed: 2025-08-26. find
  47. Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, and 1 others. 2024. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295. find
  48. Shangqing Tu, Yuliang Sun, Yushi Bai, Jifan Yu, Lei Hou, and Juanzi Li. 2024. WaterBench: Towards holistic evaluation of watermarks for large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1517–1542, Bangkok,… find
  49. Yihan Wu, Zhengmian Hu, Junfeng Guo, Hongyang Zhang, and Heng Huang. 2024. A resilient and accessible distribution-preserving watermark for large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org. find
  50. Jingqing Zhang, Yao Zhao, Mohammad Saleh, and Peter J. Liu. 2020a. Pegasus: pre-training with extracted gap-sentences for abstractive summarization. In Proceedings of the 37th International Conference on Machine Learning, ICML’20. JMLR.org.
  51. Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushanfar. 2024. Remark-llm: a robust and efficient watermarking framework for generative large language models. In Proceedings of the 33rd USENIX Conference on Security Symposium, SEC ’24, USA. USENIX Association. find
  52. Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, Todor Mihaylov, Myle Ott, Sam Shleifer, Kurt Shuster, Daniel Simig, Punit Singh Koura, Anjali Sridhar, Tianlu Wang, and Luke Zettlemoyer. 2022. Opt: Open pre-trai…
  53. Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q. Weinberger, and Yoav Artzi. 2020b. Bertscore: Evaluating text generation with bert. Preprint, arXiv:1904.09675. find
  54. Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. 2024. Provable robust watermarking for AI-generated text. In The Twelfth International Conference on Learning Representations. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/nemecek-2026-topic-based-watermarks-large-language/