Elamur Research⌕
☰
home / papers / 2026 / SWAN: Semantic Watermarking with Abstract Meaning Representation

SWAN: Semantic Watermarking with Abstract Meaning Representation

Summary

Watermarks for LLM-generated text are usually planted at the token level by biasing which tokens the decoder picks. A paraphrase or synonym swap can erase them. Embedding-based sentence-level schemes hold up better, but they still fail when rewriting shifts a sentence's vector. SWAN instead places the signal in the meaning of each sentence, using Abstract Meaning Representation (AMR) graphs. The authors build a secret bank of template AMRs from MASSIVE-AMR, with specific nouns and entities replaced by placeholders. During generation, an LLM is prompted to write each sentence following a randomly drawn template while staying coherent with the context. The output is parsed back into AMR and kept only if its S2match score against the template passes a threshold. Otherwise it is resampled, or a new template is drawn. Detection parses each sentence, counts template matches and applies a one-proportion z-test. On RealNews, SWAN matches state-of-the-art detection on clean text and is clearly more robust to paraphrasing. It needs no training and no logit access, which makes it usable with proprietary LLMs.

Key points

  • The template bank comes from MASSIVE-AMR, which contains about 84K AMR graphs covering 1,685 information-seeking utterances. Placeholders such as "NE" stand in for named entities, and the bank serves as the private key.

  • Injection is purely prompt-based and uses S2match-guided rejection sampling. Adaptive target switching swaps in a new template after a capped number of failed attempts.

  • Detection uses an off-the-shelf AMR parser plus a one-proportion z-test over the matched sentences in a paragraph.

  • On the RealNews benchmark, SWAN improves detection AUC under paraphrase attacks by up to 13.9 percentage points over prior methods. It is compared against token-level and sentence-level baselines such as SemStamp and k-SemStamp, and LLM-judged coherence, fluency and diversity stay comparable.

  • The authors report several limitations:

    • rejection-sampling overhead;
    • dependence on parser quality, with false-positive and fairness risks in low-resource languages;
    • vulnerability to sentence splitting or merging attacks.

    Code is released at github.com/amazon-science/SWAN.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

Fields: Machine translation · Natural language processing

Cite

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1681

@inproceedings{ye2026swan,
  title = {{SWAN: Semantic Watermarking with Abstract Meaning Representation}},
  author = {Ye, Ziping and Dey, Gourab and Christodoulopoulos, Christos and Peris, Charith and Ramakrishna, Anil and Ruan, Weitong and Galstyan, Aram and Chang, Kai-Wei and Gupta, Rahul and Mehrabi, Ninareh},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1681},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1681}
}

References

31 references, 3 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Mikhail J. Atallah, Victor Raskin, Michael Crogan, Christian Hempelmann, Florian Kerschbaum, Dina Mohamed, and Sanket Naik. 2001. Natural language watermarking: Design, analysis, and a proof-of-concept implementation. In Proceedings of the 4th International Workshop on Information Hiding, IHW ’01, page 185–199, Berlin, Heidelberg. Springer-Verlag. find
  2. Laura Banarescu, Claire Bonial, Shu Cai, Madalina Georgescu, Kira Griffitt, Ulf Hermjakob, Kevin Knight, Philipp Koehn, Martha Palmer, and Nathan Schneider. 2013. Abstract Meaning Representation for sembanking. In Proceedings of the 7th Linguistic Annotation Workshop and Interoperability with Discourse, pages 178–186, Sofia, Bulgaria. Association for Computational Linguistics. find our card
  3. Laura Banarescu, Claire Bonial, Shu Cai, Madalina Georgescu, Kira Griffitt, Ulf Hermjakob, Kevin Knight, Philipp Koehn, Martha Palmer, and Nathan Schneider. 2019. Abstract meaning representation (AMR) 1.2.6 specification. https://github.com/ amrisi/amr-guidelines/blob/master/amr.md. Accessed: 2025-05-12. ↗
  4. Michael Brennan, Sadia Afroz, and Rachel Greenstadt. 2012. Adversarial stylometry: Circumventing authorship recognition to preserve privacy and anonymity. ACM Trans. Inf. Syst. Secur., 15(3). find
  5. Yapei Chang, Kalpesh Krishna, Amir Houmansadr, John Wieting, and Mohit Iyyer. 2024. Postmark: A robust blackbox watermark for large language models. Preprint, arXiv:2406.14517. ↗
  6. Yi Chen, Rui Wang, Haiyun Jiang, Shuming Shi, and Ruifeng Xu. 2023. Exploring the use of large language models for reference-free text quality evaluation: An empirical study. Preprint, arXiv:2304.00723. ↗
  7. Prithiviraj Damodaran. 2021. Parrot paraphraser. https://github.com/PrithivirajDamodaran/ Parrot_Paraphraser. ↗
  8. Sumanth Dathathri, Abigail See, Shubham Ghaisas, Pierre-Sacha Hürlimann, Jacob Walker, Brian Bartoldson, Rohan Mukherjee, Aditya Sen, Varun Bansal, Rohan Bhasin, Michael A. Munn, Alexey Ko-rotkevich, Rishabh Singh, Thomas Mensink, James Hennessey, Nisanth Venkateswaran, Benjamin Bichsel, Thomas Cooijmans, Zoubin Ghahramani, and 6 others. 2024. Scalable watermarking for identifying large language model outputs. Nature, 634(8035):818–823. find
  9. Chenxi Gu, Chengsong Huang, Xiaoqing Zheng, Kai-Wei Chang, and Cho-Jui Hsieh. 2023. Watermarking pre-trained language models with backdooring. Preprint, arXiv:2210.07543. ↗
  10. Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. 2023. SemStamp: A semantic watermark with paraphrastic robustness for text generation. In Annual Conference of the North American Chapter of the Association for Computational Linguistics. ↗
  11. Abe Bohan Hou, Jingyu Zhang, Yichen Wang, Daniel Khashabi, and Tianxing He. 2024. k-SemStamp: A clustering-based semantic watermark for detection of machine-generated text. In Findings of the Association for Computational Linguistics: ACL 2024, pages 1706–1715, Bangkok, Thailand. Association for Computational Linguistics. find
  12. Javier Huertas-Tato, Alejandro Martin, and David Camacho. 2022. Part: Pre-trained authorship representation transformer. Preprint, arXiv:2209.15373. ↗
  13. Piotr Indyk and Rajeev Motwani. 1998. Approximate nearest neighbors: towards removing the curse of dimensionality. In Proceedings of the Thirtieth Annual ACM Symposium on Theory of Computing, STOC ’98, page 604–613, New York, NY, USA. Association for Computing Machinery. find
  14. Brad Jascob. 2020. amrlib: A python library that makes amr parsing, generation and visualization simple. Accessed: 2025-05-12. find
  15. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2024a. A watermark for large language models. Preprint, arXiv:2301.10226. ↗ our card
  16. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. 2024b. On the reliability of watermarks for large language models. Preprint, arXiv:2306.04634. ↗
  17. Moshe Koppel, Jonathan Schler, and Shlomo Argamon. 2009. Computational methods in authorship attribution. Journal of the American Society for Information Science and Technology, 60(1):9–26. ↗
  18. Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2024. Robust distortion-free watermarks for language models. Preprint, arXiv:2307.15593. ↗
  19. Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. 2024. A semantic invariant robust watermark for large language models. Preprint, arXiv:2310.06356. ↗
  20. Juri Opitz, Letitia Parcalabescu, and Anette Frank. 2020. AMR similarity metrics from principles. Transactions of the Association for Computational Linguistics, 8:522–538. ↗
  21. Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2023. Exploring the limits of transfer learning with a unified text-to-text transformer. Preprint, arXiv:1910.10683. ↗
  22. Michael Regan, Shira Wein, George Baker, and Emilio Monti. 2024. Massive multilingual abstract meaning representation: A dataset and baselines for hallucination detection. Preprint, arXiv:2405.19285. ↗
  23. Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. 2024. A robust semantics-based watermark for large language model against paraphrasing. Preprint, arXiv:2311.08721. ↗
  24. Yunita Sari, Andreas Vlachos, and Mark Stevenson. 2017. Continuous n-gram representations for authorship attribution. In Proceedings of the 15th Conference of the European Chapter of the Association for Computational Linguistics: Volume 2, Short Papers, pages 267–273, Valencia, Spain. Association for Computational Linguistics. find
  25. Zhouxing Shi, Yihan Wang, Fan Yin, Xiangning Chen, Kai-Wei Chang, and Cho-Jui Hsieh. 2023. Red teaming language model detectors with language models. Preprint, arXiv:2305.19713. - "X " for unspecified concepts (e. g., " something " , " an idea ") . ↗
  26. Efstathios Stamatatos. 2009. A survey of modern authorship attribution methods. J. Am. Soc. Inf. Sci. Technol., 60(3):538–556. Instructions : - Do not write " NE " , " N", or " X" literally . Instead , replace them with appropriate English words to form a natural , meaningful sentence . - Ensure the generated sentence aligns with both the AMR structure and the given context . - Do not produce multiple sentences or lists . - Produce exactly one coherent sentence . ↗
  27. Angus R. Williams, Liam Burke-Moore, Ryan Sze-Yin Chan, Florence E. Enock, Federico Nanni, Tvesha Sippy, Yi-Ling Chung, Evelina Gabasova, Kobi Hackenburg, and Jonathan Bright. 2024. Large language models can consistently generate high-quality content for election disinformation operations. Preprint, arXiv:2408.06731. ↗
  28. Jialiang Xu, Shenglan Li, Zhaozhuo Xu, and Denghui Zhang. 2024. Do llms know to respect copyright notice? Preprint, arXiv:2411.01136. ↗
  29. KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. 2023. Robust multi-bit natural language watermarking through invariant features. Preprint, arXiv:2305.01904. AMR : { chosen_template } Context : { context } Please output only that one sentence . ↗
  30. Jingqing Zhang, Yao Zhao, Mohammad Saleh, and Peter J. Liu. 2020. Pegasus: Pre-training with extracted gap-sentences for abstractive summarization. Preprint, arXiv:1912.08777. ↗ our card
  31. Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. 2023. Provable robust watermarking for ai-generated text. Preprint, arXiv:2306.17439. ↗

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/ye-2026-swan-semantic-watermarking-abstract-meaning/