水印适用性：基于Logit的水印度量并提升语言模型兼容性

# Watermarkability: Measuring and Improving Language-Model Compatibility with Logit-Based Watermarks
Source: [https://arxiv.org/html/2610.22810](https://arxiv.org/html/2610.22810)
Mohamed SeifAffiliation:Department of Computer Science and Engineering, Oakland UniversityAffiliation:Princeton UniversityLiyan XieAffiliation:Department of Industrial and Systems Engineering, University of Minnesota

###### Abstract

Language\-model watermarks can help identify model\-generated text, encode provenance information, and detect post\-generation edits\. A broad class of logit\-based watermarks increases the logits of a designated token set at each decoding step\. Because a base model’s native probability mass on this set varies across contexts, models, and watermark rules, the same logit bias can yield different adherence rates and increases in perplexity \(PPL\)\. We introduce*watermarkability*to characterize the compatibility between a model and the token sets requested by a watermark\. At a target massτ\\tau, we quantify this property through a*watermarkability cost*: the expected minimum KL divergence from the base\-model distribution required to assign probability at leastτ\\tauto the requested set\. A lower cost means that the model is more watermarkable for that request distribution\. To reduce this cost, we propose a two\-stage method\. In the first stage, we train a target\-set\-conditioned low\-rank adapter on unions drawn from a 16\-way vocabulary partition to increase the requested set’s probability mass\. In the second stage, a closed\-form controller applies the smallest remaining uniform logit bias needed to reach the target mass\. We evaluate the method on six watermark schedules using OPT\-125M and Qwen3\-8B\. Across the 12 model–schedule pairs, the pre\-adaptation watermarkability cost correlates with the log\-PPL increase under a near\-hard fixed\-bias baseline \(pooled Pearsonr=0\.929r=0\.929\)\. For every schedule, at least 99\.80% of sampled tokens fall in the target set requested at their decoding step\. At this reliability, the adapter and controller reduce average per\-schedule prompt\-conditional PPL by 46\.3% on OPT\-125M and 5\.2% on Qwen3\-8B relative to the fixed\-bias baseline\.††footnotetext:Code is available at[https://github\.com/zeweid1221/LLM\_Watermarkability](https://github.com/zeweid1221/LLM_Watermarkability)\.

## 1Introduction

Many logit\-based watermarks for language models modify generation by adding a bias to the logits of a selected token set\. Specifically, let𝒱\\mathcal\{V\}denote the model vocabulary andx1:T∈𝒱Tx\_\{1:T\}\\in\\mathcal\{V\}^\{T\}denote a generated token sequence, and writex<t=\(x1,…,xt−1\)x\_\{<t\}=\(x\_\{1\},\\ldots,x\_\{t\-1\}\)for the prefix at decoding steptt\. A watermark rule selects a target set𝒜t⊆𝒱\\mathcal\{A\}\_\{t\}\\subseteq\\mathcal\{V\}and adds a scalar biasδ\\deltato every token in𝒜t\\mathcal\{A\}\_\{t\}\. If the base distribution mass of the next tokenxtx\_\{t\}isp0​\(v∣x<t\)p\_\{0\}\(v\\mid x\_\{<t\}\)forv∈𝒱v\\in\\mathcal\{V\}, the resulting watermarked distribution is

qδ​\(v∣x<t\)=p0\(v∣x<t\)exp\{δ𝟏\[v∈𝒜t\]\}∑u∈𝒱p0\(u∣x<t\)exp\{δ𝟏\[u∈𝒜t\]\}\.q\_\{\\delta\}\(v\\mid x\_\{<t\}\)=\\frac\{p\_\{0\}\(v\\mid x\_\{<t\}\)\\exp\\\{\\delta\\mathbf\{1\}\[v\\in\\mathcal\{A\}\_\{t\}\]\\\}\}\{\\sum\_\{u\\in\\mathcal\{V\}\}p\_\{0\}\(u\\mid x\_\{<t\}\)\\exp\\\{\\delta\\mathbf\{1\}\[u\\in\\mathcal\{A\}\_\{t\}\]\\\}\}\.\(1\)This form covers green/red\-list watermarks\([Kirchenbauer et al\., 2023](https://arxiv.org/html/2610.22810#bib.bib1);[Zhao et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib3)\), multi\-bit watermarks\([Yoo et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib22);[Xu et al\., 2026](https://arxiv.org/html/2610.22810#bib.bib23)\), and code\-constrained or pattern\-based watermarks\([Chao et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib7);[Xie et al\., 2025](https://arxiv.org/html/2610.22810#bib.bib10);[Deng et al\., 2026b](https://arxiv.org/html/2610.22810#bib.bib8);[Deng et al\., 2026a](https://arxiv.org/html/2610.22810#bib.bib9)\)\. The effect ofδ\\deltadepends on the probability that the base model already assigns to𝒜t\\mathcal\{A\}\_\{t\}\. Consequently, the same bias can produce different adherence rates and perplexity changes across contexts, models, and watermark rules\. This motivates our central research question: what is the minimum distributional change needed to reach a prescribed target\-set probability, and can it be reduced while keeping the requested sets fixed?

![Refer to caption](https://arxiv.org/html/2610.22810v1/pipeline.png)Figure 1:Two\-stage watermark realization\. The target\-conditioned LoRA redistributes probability toward contextually plausible tokens inside the requested set\. The controller then applies a common residual logit shift, preserving the adapted token scores while bringing aggregate target mass fromMtθM\_\{t\}^\{\\theta\}toτ\\tau\. Aligned illustrative gauges compare native, adapted, and controlled target mass\.To answer this question, we introduce*watermarkability*as the compatibility between the base language model and a watermarking rule\. For a given context and requested set𝒜t\\mathcal\{A\}\_\{t\}, we define the watermarkability cost at target massτ\\tauas the minimum KL divergence from the base\-model distribution over all next\-token distributions that assign probability at leastτ\\tauto𝒜t\\mathcal\{A\}\_\{t\}\. We average this cost over the contexts and target sets induced by the watermark rule\. A lower cost means that the model is more watermarkable: it can reach the prescribed target mass with less distributional distortion\. The native probability mass is the total probability that the unmodified model assigns to all tokens in𝒜t\\mathcal\{A\}\_\{t\}before watermarking\. When this mass is small, enforcing the request tends to select lower\-probability tokens and thereby increase PPL under the base model\. To reduce this cost without modifying the watermark rule, we propose a two\-stage method \(see Figure[1](https://arxiv.org/html/2610.22810#S1.F1)\)\. To make one adapter reusable across schedules, we partition each model’s vocabulary into 16 disjoint subsets and express each evaluated target set as a union of these subsets\. Fixed schedules use prescribed unions, whereas prefix\-dependent schedules select a new union from the prefix and key\. The two stages serve complementary roles: the target\-set\-conditioned adapter raises the mass of contextually suitable tokens in𝒜t\\mathcal\{A\}\_\{t\}, and the closed\-form controller determines the smallest remaining nonnegative uniform logit biasαt\\alpha\_\{t\}needed to reach target massτ\\tau\.

We evaluate the proposed two\-stage method on OPT\-125M and Qwen3\-8B using long\-form question\-answering prompts and six vocabulary\-partition watermark schedules\. Our contributions are summarized as follows\.

- •We characterize model–rule compatibility through watermarkability cost, the minimum distributional change needed to meet target\-set requests at a prescribed reliability\. Across 12 model–rule pairs, pairs with higher watermarkability cost generally exhibit larger fixed\-bias log\-PPL increases \(Pearsonr=0\.929r=0\.929\)\.
- •We propose a two\-stage method to reduce this cost\. First, we train a target\-set\-conditioned low\-rank adapter on generic unions from a 16\-way vocabulary partition\. Second, a closed\-form controller applies the smallest remaining uniform logit bias needed to reachτ=0\.99\\tau=0\.99\. We evaluate the adapter on six held\-out schedules spanning fixed, multi\-symbol, and prefix\-dependent designs\.
- •Across all six schedules, the two\-stage method maintains at least 99\.80% sampled\-token adherence on both models\. Relative to the near\-hardδ=20\\delta=20baseline, it reduces mean per\-schedule prompt\-conditional PPL by 46\.3% on OPT\-125M and 5\.2% on Qwen3\-8B\. PPL decreases for all six OPT schedules and four of six Qwen schedules\.

## 2Related Work

#### Vocabulary\-partition and structured watermarking\.

Green\-list watermarks use a key and usually the generated prefix to select a preferred vocabulary subset, increase its logits, and detect an excess of preferred tokens\([Kirchenbauer et al\., 2023](https://arxiv.org/html/2610.22810#bib.bib1);[Kirchenbauer et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib2)\)\. Fixed\-list, entropy\-gated, semantically balanced, and context\-adaptive variants modify how that subset is formed or activated\([Zhao et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib3);[Lee et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib21);[Liu and Bu, 2024](https://arxiv.org/html/2610.22810#bib.bib4);[Guo et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib5)\), while multi\-bit methods select among several color classes to encode payload symbols\([Yoo et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib22);[Xu et al\., 2026](https://arxiv.org/html/2610.22810#bib.bib23)\)\. Other constructions impose local patterns or code constraints, including error\-correcting\-code, combinatorial, and synchronization\-assisted VT watermarks\([Chao et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib7);[Xie et al\., 2025](https://arxiv.org/html/2610.22810#bib.bib10);[Deng et al\., 2026b](https://arxiv.org/html/2610.22810#bib.bib8);[Deng et al\., 2026a](https://arxiv.org/html/2610.22810#bib.bib9)\)\. Across these schedules, our framework adapts the model to each step’s preferred token set while leaving the request sequence and detector to the watermark rule\.

#### Adaptive intervention and probability\-aware partitioning\.

The detectability–quality trade\-off of logit\-based watermarking is well established\([Pang et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib6)\), and recent methods show that a fixed bias need not represent the same effective strength across settings\. Adaptive\-bias approaches calibrate intervention using a constrained KGW objective, native green\-list mass, or sequence\-level logit heterogeneity\([Cai et al\., 2026](https://arxiv.org/html/2610.22810#bib.bib16);[Wang et al\., 2025](https://arxiv.org/html/2610.22810#bib.bib17);[Moon et al\., 2026](https://arxiv.org/html/2610.22810#bib.bib18)\)\. textGrain constructs an unbiased watermark by coupling keyed randomness to vocabulary blocks while constraining the resulting loss of sampling entropy\([Li et al\., 2026](https://arxiv.org/html/2610.22810#bib.bib24)\)\. A complementary line improves the requested set itself: SSG constructs logit\-balanced green and red lists\([Gu et al\., 2026](https://arxiv.org/html/2610.22810#bib.bib19)\), WaterMod partitions probability ranks into balanced classes\([Park et al\., 2026](https://arxiv.org/html/2610.22810#bib.bib20)\), and semantic or context\-aware methods retain plausible alternatives within each partition\([Liu and Bu, 2024](https://arxiv.org/html/2610.22810#bib.bib4);[Guo et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib5)\)\. These methods calibrate the intervention or redesign the partition within a particular watermark construction\. We instead measure compatibility for externally specified target\-set requests, train one adapter across set compositions, and use closed\-form control to meet target\-mass requirements\.

#### Learning watermarked generation\.

Watermark distillation trains a model to reproduce a particular watermarked teacher\([Gu et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib11)\)\. Our adapter instead conditions at runtime on the current requested set, supporting different keys, symbols, set cardinalities, and prefix\-dependent schedules over shared base buckets\. We implement this conditioning with low\-rank adaptation\([Hu et al\., 2022](https://arxiv.org/html/2610.22810#bib.bib12)\)and an input\-side summary of the requested set, combining cross\-schedule training with an analytic reliability controller\.

## 3Watermarkability

#### A single\-step view of watermarkability\.

Consider a decoding stepttwith prefixx<tx\_\{<t\}, where the watermark rule requests a target set𝒜t\\mathcal\{A\}\_\{t\}and requires the model to assign it probability at leastτ\\tau\. How readily the model can satisfy this request depends on how much probability it already assigns to𝒜t\\mathcal\{A\}\_\{t\}\. We use*watermarkability*to describe this compatibility: at a fixedτ\\tau, a request that requires less adjustment to the model’s next\-token distribution has higher watermarkability\.

We denote the base model’s native probability mass on𝒜t\\mathcal\{A\}\_\{t\}byMt=∑v∈𝒜tp0​\(v∣x<t\)M\_\{t\}=\\sum\_\{v\\in\\mathcal\{A\}\_\{t\}\}p\_\{0\}\(v\\mid x\_\{<t\}\)\. After applying a uniform biasδ\\delta, letMt​\(δ\):=qδ​\(𝒜t∣x<t\)M\_\{t\}\(\\delta\):=q\_\{\\delta\}\(\\mathcal\{A\}\_\{t\}\\mid x\_\{<t\}\)denote the resulting target mass, so thatMt​\(0\)=MtM\_\{t\}\(0\)=M\_\{t\}\. Eq\. \([1](https://arxiv.org/html/2610.22810#S1.E1)\) gives the minimum nonnegative bias required to reach target massτ\\tau:

δt\(τ\)=\[logit⁡\(τ\)−logit⁡\(Mt\)\]\+,\\delta\_\{t\}^\{\(\\tau\)\}=\\left\[\\operatorname\{logit\}\(\\tau\)\-\\operatorname\{logit\}\(M\_\{t\}\)\\right\]\_\{\+\},\(2\)wherelogit⁡\(u\)=log⁡\(u/\(1−u\)\)\\operatorname\{logit\}\(u\)=\\log\(u/\(1\-u\)\)and\[a\]\+=max⁡\{a,0\}\[a\]\_\{\+\}=\\max\\\{a,0\\\}\. Thus,δt\(τ\)\\delta\_\{t\}^\{\(\\tau\)\}measures the minimum logit adjustment needed to satisfy this request\. However, the magnitude of this bias does not directly show how much the resulting next\-token distribution differs from the base model\. We therefore measure the cost of realizing the request by this distributional change: the smaller the minimum KL divergence needed to reachτ\\tau, the higher the request’s watermarkability\.

#### The cost of realizing a request\.

WhenMt≤τM\_\{t\}\\leq\\tau, Eq\. \([2](https://arxiv.org/html/2610.22810#S3.E2)\) givesMt​\(δt\(τ\)\)=τM\_\{t\}\(\\delta\_\{t\}^\{\(\\tau\)\}\)=\\tau, and the corresponding KL divergence is

DKL\(qδt\(τ\)\(⋅∣x<t\)∥p0\(⋅∣x<t\)\)=τδt\(τ\)−log\(1−Mt\+eδt\(τ\)Mt\)=τlogτMt\+\(1−τ\)log1−τ1−Mt\.\\displaystyle D\_\{\\mathrm\{KL\}\}\\Big\(q\_\{\\delta\_\{t\}^\{\(\\tau\)\}\}\(\\cdot\\mid x\_\{<t\}\)\\,\\\|\\,p\_\{0\}\(\\cdot\\mid x\_\{<t\}\)\\Big\)=\\tau\\delta\_\{t\}^\{\(\\tau\)\}\-\\log\\big\(1\-M\_\{t\}\+e^\{\\delta\_\{t\}^\{\(\\tau\)\}\}M\_\{t\}\\big\)=\\tau\\log\\frac\{\\tau\}\{M\_\{t\}\}\+\(1\-\\tau\)\\log\\frac\{1\-\\tau\}\{1\-M\_\{t\}\}\.\(3\)WhenMt\>τM\_\{t\}\>\\tau, Eq\. \([2](https://arxiv.org/html/2610.22810#S3.E2)\) givesδt\(τ\)=0\\delta\_\{t\}^\{\(\\tau\)\}=0; the resulting distribution is then the base\-model distribution itself, and the corresponding KL divergence is zero\.

For any fixed value ofq⁡\(𝒜t∣x<t\)q\(\\mathcal\{A\}\_\{t\}\\mid x\_\{<t\}\), KL divergence from the base\-model distribution is minimized by preserving the base model’s relative token probabilities within𝒜t\\mathcal\{A\}\_\{t\}and within its complement𝒜tc\\mathcal\{A\}\_\{t\}^\{c\}\. Minimizing overq⁡\(𝒜t∣x<t\)≥τq\(\\mathcal\{A\}\_\{t\}\\mid x\_\{<t\}\)\\geq\\tautherefore yields the distribution produced byδt\(τ\)\\delta\_\{t\}^\{\(\\tau\)\}\. We define the minimum single\-step cost as

ct\(τ\):=minq:q⁡\(𝒜t∣x<t\)≥τDKL\(q\(⋅∣x<t\)∥p0\(⋅∣x<t\)\)=DKL\(qδt\(τ\)\(⋅∣x<t\)∥p0\(⋅∣x<t\)\)\.\\displaystyle c\_\{t\}\(\\tau\):=\\min\_\{q:\\,q\(\\mathcal\{A\}\_\{t\}\\mid x\_\{<t\}\)\\geq\\tau\}D\_\{\\mathrm\{KL\}\}\\big\(q\(\\cdot\\mid x\_\{<t\}\)\\,\\\|\\,p\_\{0\}\(\\cdot\\mid x\_\{<t\}\)\\big\)=D\_\{\\mathrm\{KL\}\}\\Big\(q\_\{\\delta\_\{t\}^\{\(\\tau\)\}\}\(\\cdot\\mid x\_\{<t\}\)\\,\\\|\\,p\_\{0\}\(\\cdot\\mid x\_\{<t\}\)\\Big\)\.\(4\)Thus,ct​\(τ\)=0c\_\{t\}\(\\tau\)=0whenMt≥τM\_\{t\}\\geq\\tauand is given by Eq\. \([3](https://arxiv.org/html/2610.22810#S3.E3)\) otherwise\. Notably, the cost depends on the specific target set: two sets of the same size can have different costs if the base model assigns them different native probability masses\.

#### Watermarkability of a model–rule pair\.

For a fixed base modelp0p\_\{0\}and watermark ruleℛ\\mathcal\{R\}, let𝒟p0,ℛ\\mathcal\{D\}\_\{p\_\{0\},\\mathcal\{R\}\}denote the joint distribution of prefixes and requested target sets under the specified context\-sampling protocol and the rule’s key and payload randomness\. We define the watermarkability cost at target massτ\\tauas

𝖶p0,ℛ​\(τ\)=𝔼\(x<t,𝒜t\)∼𝒟p0,ℛ​\[ct​\(τ\)\]\.\\mathsf\{W\}\_\{p\_\{0\},\\mathcal\{R\}\}\(\\tau\)=\\mathbb\{E\}\_\{\(x\_\{<t\},\\mathcal\{A\}\_\{t\}\)\\sim\\mathcal\{D\}\_\{p\_\{0\},\\mathcal\{R\}\}\}\\left\[c\_\{t\}\(\\tau\)\\right\]\.\(5\)At a fixedτ\\tau, a lower value means that the model can realize the rule’s requests with less distributional change and is therefore more watermarkable for that rule\. Unlike a comparison at a fixed biasδ\\delta, this definition fixes the target mass and allows the required biasδt\(τ\)\\delta\_\{t\}^\{\(\\tau\)\}to vary across contexts and requests\. When a requested set has little native probability mass, enforcing it tends to select tokens assigned lower probability by the base model and can therefore increase perplexity\. Watermarkability cost provides a pre\-generation measure of model–rule compatibility at a matched target mass, while PPL measures the quality of the continuation ultimately produced under watermarking\.

## 4A Two\-Stage Method for Reducing Watermarking Cost

The definition in Section[3](https://arxiv.org/html/2610.22810#S3)quantifies the cost of realizing a target\-set request\. We now describe a two\-stage method for reducing this cost while preserving the watermark’s schedule and detectability\. At each decoding step, the watermark rule specifies a target set𝒜t\\mathcal\{A\}\_\{t\}\. In the first stage, a low\-rank adapter conditioned on𝒜t\\mathcal\{A\}\_\{t\}is trained to increase the probability assigned to this set\. In the second stage, a closed\-form controller applies the smallest remaining uniform logit bias needed to reach target massτ\\tau\. Neither stage changes the target set given by the watermark rule\. The adapter is intended to reduce the residual bias required by the controller, and we evaluate its effect on prompt\-conditional perplexity empirically\. Figure[1](https://arxiv.org/html/2610.22810#S1.F1)summarizes the method\.

### 4\.1Vocabulary Partition and Training Requests

We partition each model’s vocabulary intoL=16L=16disjoint*base buckets*ℬ1,…,ℬ16\\mathcal\{B\}\_\{1\},\\ldots,\\mathcal\{B\}\_\{16\}\. Each base bucket is one of the smallest disjoint vocabulary subsets used by our construction\. A watermark’s target set is formed by taking a union of these buckets:

𝒜t=⋃ℓ∈Jtℬℓ,Jt⊆\{1,…,L\}\.\\mathcal\{A\}\_\{t\}=\\bigcup\_\{\\ell\\in J\_\{t\}\}\\mathcal\{B\}\_\{\\ell\},\\qquad J\_\{t\}\\subseteq\\\{1,\\ldots,L\\\}\.The index setJtJ\_\{t\}may be fixed, follow a payload or code schedule, or be recomputed from the prefix and key\. This gives several alphabet sizes and target rates without retraining a separate adapter for every materialized partition\. A finer partition is also needed for the one\-eighth boundary allocation in Anchor\-ECC\([Deng et al\., 2026a](https://arxiv.org/html/2610.22810#bib.bib9)\): we assign approximately one eighth of the usable vocabulary to the boundary set and divide the remainder equally between two payload sets\. Here the choice ofL=16L=16represents the smallest power\-of\-two granularity that realizes this allocation with whole base buckets, using22buckets for boundaries and77for each payload symbol, while also providing many keyed unions for the KGW variants\.

Table[1](https://arxiv.org/html/2610.22810#S4.T1)summarizes the native target\-set split of each evaluated watermark schedule before its realization with the shared 16\-bucket partition\. Figure[2](https://arxiv.org/html/2610.22810#S4.F2)then shows how these native splits are assembled from the 16 base buckets\.

Table 1:Native bucket structures of the evaluated watermarks, grouped by the number of bucket classes\. Vocabulary shares follow the bucket\-label order\.Atomic basis12345678910111213141516ℬ1,…,ℬ16\\mathcal\{B\}\_\{1\},\\ldots,\\mathcal\{B\}\_\{16\}Binary / Unigramtwo88\-atom setsECC7:7:27\{:\}7\{:\}2payload/boundary setsCW\-ABCDfour44\-atom symbol setsAtomic\-KGW2544\-of\-1616,Jt=f⁡\(key,ht\)J\_\{t\}=f\(\\mathrm\{key\},h\_\{t\}\)Atomic\-KGW5088\-of\-1616, prefix/key dependent

Figure 2:One model\-specific 16\-bucket partition supports fixed and dynamic target\-set compositions\. Structured schedules regroup base buckets into symbol sets; dynamic schedules recomputeJtJ\_\{t\}from the prefix and key\. Highlighted buckets show one generation step\.The base buckets are designed to be model\-specific in our experiments\. Specifically, for a given base modelp0p\_\{0\}, we collect next\-token probabilities onNNcalibration contexts and optimize soft assignmentsav​ℓa\_\{v\\ell\}from every usable tokenv∈𝒱v\\in\\mathcal\{V\}to bucketℓ\\ell\. For contextii, letmi​\(ℓ\)m\_\{i\}\(\\ell\)be the probability mass assigned to bucketℓ\\ell\. At grouping resolutiong∈\{2,4,8,16\}g\\in\\\{2,4,8,16\\\},mi\(g\)​\(j\)=∑ℓ=\(j−1\)​L/g\+1j​L/gmi​\(ℓ\)m\_\{i\}^\{\(g\)\}\(j\)=\\sum\_\{\\ell=\(j\-1\)L/g\+1\}^\{jL/g\}m\_\{i\}\(\\ell\)denotes the mass of thejj\-th consecutive group ofL/gL/gbase buckets, forj=1,…,gj=1,\\ldots,g\. The objective balances grouped masses while regularizing token counts, semantic coverage, and assignment entropy:

ℒpart=∑g∈\{2,4,8,16\}1N​g​∑i=1N∑j=1g\(mi\(g\)​\(j\)−1g\)2\+λc​ℒcount\+λs​ℒsem\+λe​ℒent\.\\mathcal\{L\}\_\{\\mathrm\{part\}\}=\\sum\_\{g\\in\\\{2,4,8,16\\\}\}\\frac\{1\}\{Ng\}\\sum\_\{i=1\}^\{N\}\\sum\_\{j=1\}^\{g\}\\left\(m\_\{i\}^\{\(g\)\}\(j\)\-\\frac\{1\}\{g\}\\right\)^\{2\}\+\\lambda\_\{c\}\\mathcal\{L\}\_\{\\mathrm\{count\}\}\+\\lambda\_\{s\}\\mathcal\{L\}\_\{\\mathrm\{sem\}\}\+\\lambda\_\{e\}\\mathcal\{L\}\_\{\\mathrm\{ent\}\}\.\(6\)Hereℒcount\\mathcal\{L\}\_\{\\mathrm\{count\}\}balances token counts across buckets,ℒsem\\mathcal\{L\}\_\{\\mathrm\{sem\}\}distributes each semantic and native\-probability group across buckets, andℒent\\mathcal\{L\}\_\{\\mathrm\{ent\}\}encourages discrete assignments\. Appendix[F](https://arxiv.org/html/2610.22810#A6)gives their exact definitions\. We materialize the optimized assignment into a token lookup table\. Figure[2](https://arxiv.org/html/2610.22810#S4.F2)shows how representative fixed and dynamic schedules compose target sets from these base buckets\.

### 4\.2Target\-Set Conditioning and LoRA

Using the partition above, we train a shared adapter on target sets formed by unions of22,44,77, or88base buckets\. For each cardinality, the training curriculum is organized into complete passes over all possible bucket unions\. We implement the adapter with low\-rank adaptation \(LoRA\), which augments a frozen linear mapWWwith a trainable rank\-rrresidual, mappingW​hWhtoW​h\+\(γ/r\)​U​V​hWh\+\(\\gamma/r\)UVhfor learned low\-rank factorsUUandVVand scaleγ\\gamma\([Hu et al\., 2022](https://arxiv.org/html/2610.22810#bib.bib12)\)\. We insert these updates into the query and value projections of every self\-attention layer\. The query updates affect how the current position weights information from the prefix, while the value updates affect the content carried through attention\. All original language\-model parameters remain frozen, and the trainable parameters consist of the query/value LoRA factors and a target\-set projector described below\. Both components use rankr=16r=16, with LoRA scaleγ=32\\gamma=32\.

At decoding steptt, the watermark rule specifies the current target set𝒜t\\mathcal\{A\}\_\{t\}\. We summarize how this set intersects the base model’s plausible next\-token candidates before passing the request to the shared adapter\. Let𝒯t\(k\)\\mathcal\{T\}\_\{t\}^\{\(k\)\}contain thekktokens with largest probabilities underp0\(⋅∣x<t\)p\_\{0\}\(\\cdot\\mid x\_\{<t\}\), and leteve\_\{v\}denote the frozen input embedding of tokenvv\. Within this set,p~t​\(v\)=p0​\(v∣x<t\)/∑u∈𝒯t\(k\)p0​\(u∣x<t\)\\widetilde\{p\}\_\{t\}\(v\)=p\_\{0\}\(v\\mid x\_\{<t\}\)/\\sum\_\{u\\in\\mathcal\{T\}\_\{t\}^\{\(k\)\}\}p\_\{0\}\(u\\mid x\_\{<t\}\)is the renormalized base\-model probability, ande¯v=ev/∥ev∥2\\bar\{e\}\_\{v\}=e\_\{v\}/\\lVert e\_\{v\}\\rVert\_\{2\}is the normalized input embedding\. We usek=128k=128and form

st=norm\(∑v∈𝒯t\(k\)p~t\(v\)\(2⋅𝟏\[v∈𝒜t\]−1\)e¯v\)\.s\_\{t\}=\\operatorname\{norm\}\\\!\\left\(\\sum\_\{v\\in\\mathcal\{T\}\_\{t\}^\{\(k\)\}\}\\widetilde\{p\}\_\{t\}\(v\)\\bigl\(2\\cdot\\mathbf\{1\}\[v\\in\\mathcal\{A\}\_\{t\}\]\-1\\bigr\)\\bar\{e\}\_\{v\}\\right\)\.Herenorm⁡\(u\)=u/∥u∥2\\operatorname\{norm\}\(u\)=u/\\lVert u\\rVert\_\{2\}\. The indicator assigns positive signs to requested candidates and negative signs to the remaining candidates, and the probability weighting gives more influence to plausible next tokens\. The resulting vector summarizes the semantic contrast between likely tokens admitted by the current request and likely tokens outside it\.

A rank\-rrcondition projector maps this summary to the model hidden dimension asct=Uc​SiLU⁡\(Dc​LayerNorm⁡\(st\)\)c\_\{t\}=U\_\{c\}\\operatorname\{SiLU\}\(D\_\{c\}\\operatorname\{LayerNorm\}\(s\_\{t\}\)\)and addsctc\_\{t\}to the input representation used to predict the next token\. The conditioned representation then passes through the LoRA\-equipped query and value projections, producing the adapted next\-token distributionpθ​\(v∣x<t,𝒜t\)p\_\{\\theta\}\(v\\mid x\_\{<t\},\\mathcal\{A\}\_\{t\}\), whereθ\\thetacomprises the condition\-projector and LoRA parameters\. The parametersθ\\thetaare shared across decoding steps and schedules; the conditioning vector is recomputed from the current target set\. The controller uses the exact membership mask of𝒜t\\mathcal\{A\}\_\{t\}to calibrate target mass in the next stage\.

### 4\.3Closed\-Form Reliability Controller

After adaptation, the target mass is

Mtθ=∑v∈𝒜tpθ​\(v∣x<t,𝒜t\),M\_\{t\}^\{\\theta\}=\\sum\_\{v\\in\\mathcal\{A\}\_\{t\}\}p\_\{\\theta\}\(v\\mid x\_\{<t\},\\mathcal\{A\}\_\{t\}\),and we denoteztθ​\(v\)z\_\{t\}^\{\\theta\}\(v\)as the corresponding adapted\-model logit for tokenvv\. Adding a common shiftα\\alphato all target\-set logits changes this mass to

Mtθ​\(α\)=eα​Mtθ1−Mtθ\+eα​Mtθ\.M\_\{t\}^\{\\theta\}\(\\alpha\)=\\frac\{e^\{\\alpha\}M\_\{t\}^\{\\theta\}\}\{1\-M\_\{t\}^\{\\theta\}\+e^\{\\alpha\}M\_\{t\}^\{\\theta\}\}\.\(7\)SolvingMtθ​\(α\)=τM\_\{t\}^\{\\theta\}\(\\alpha\)=\\tauand applying no positive shift when the adapted mass already exceedsτ\\taugives

αt=\[logit\(τ\)−logit\(Mtθ\)\]\+,ztfinal\(v\)=ztθ\(v\)\+αt𝟏\[v∈𝒜t\]\.\\alpha\_\{t\}=\\left\[\\operatorname\{logit\}\(\\tau\)\-\\operatorname\{logit\}\(M\_\{t\}^\{\\theta\}\)\\right\]\_\{\+\},\\qquad z\_\{t\}^\{\\mathrm\{final\}\}\(v\)=z\_\{t\}^\{\\theta\}\(v\)\+\\alpha\_\{t\}\\mathbf\{1\}\[v\\in\\mathcal\{A\}\_\{t\}\]\.\(8\)Letqθq\_\{\\theta\}denote the normalized next\-token distribution induced byztfinalz\_\{t\}^\{\\mathrm\{final\}\}\. Because Eq\. \([7](https://arxiv.org/html/2610.22810#S4.E7)\) is monotone inα\\alpha, Eq\. \([8](https://arxiv.org/html/2610.22810#S4.E8)\) is the smallest nonnegative common shift that yields target mass at leastτ\\tauon𝒜t\\mathcal\{A\}\_\{t\}\. Applying the same shift to every requested token leaves their pairwise logit differences unchanged, so the controller preserves the adapter’s ranking within𝒜t\\mathcal\{A\}\_\{t\}\. The adapter determines which requested tokens fit the context; the controller chooses the remaining aggregate mass needed for reliability\.

### 4\.4Training Objective

We generate constrained trajectories from the generic composition curriculum and update only the adapter parametersθ\\theta\. Each training positionttprovides a target set𝒜t\\mathcal\{A\}\_\{t\}and a realized tokenyt∈𝒜ty\_\{t\}\\in\\mathcal\{A\}\_\{t\}\. We minimize the per\-position loss

ℒt=−logqθ\(yt∣x<t,𝒜t\)\+λrαt2\+λKLDKL\(pθ\(⋅∣x<t,𝒜t\)∥p0\(⋅∣x<t\)\),\\mathcal\{L\}\_\{t\}=\-\\log q\_\{\\theta\}\(y\_\{t\}\\mid x\_\{<t\},\\mathcal\{A\}\_\{t\}\)\+\\lambda\_\{r\}\\alpha\_\{t\}^\{2\}\+\\lambda\_\{\\mathrm\{KL\}\}D\_\{\\mathrm\{KL\}\}\\left\(p\_\{\\theta\}\(\\cdot\\mid x\_\{<t\},\\mathcal\{A\}\_\{t\}\)\\,\\\|\\,p\_\{0\}\(\\cdot\\mid x\_\{<t\}\)\\right\),whereλr,λKL≥0\\lambda\_\{r\},\\lambda\_\{\\mathrm\{KL\}\}\\geq 0are weighting coefficients\. The first term is the negative log\-likelihood \(NLL\) of the realized token under the controlled distribution and encourages natural choices within the target set\. The second term penalizes the squared residual biasαt2\\alpha\_\{t\}^\{2\}, which encourages the adapter itself to place probability mass on the target set before control is applied\. The KL term limits drift of the adapter from the frozen model\. Writingℐ\\mathcal\{I\}for the set of active training positions, we optimize the average per\-position loss,ℒtrain​\(θ\)=\|ℐ\|−1​∑t∈ℐℒt\\mathcal\{L\}\_\{\\mathrm\{train\}\}\(\\theta\)=\|\\mathcal\{I\}\|^\{\-1\}\\sum\_\{t\\in\\mathcal\{I\}\}\\mathcal\{L\}\_\{t\}, using the corresponding tokenwise average in each minibatch\.

## 5Experiments

### 5\.1Experimental Setup

#### Models and data\.

We evaluate OPT\-125M\([Zhang et al\., 2022](https://arxiv.org/html/2610.22810#bib.bib13)\)and Qwen3\-8B\([Yang et al\., 2025](https://arxiv.org/html/2610.22810#bib.bib15)\)\. Prompts are English long\-form questions derived from ELI5/LFQA\([Fan et al\., 2019](https://arxiv.org/html/2610.22810#bib.bib14)\)\. For each model, base\-bucket partition construction uses 5,000 calibration contexts and 500 validation contexts\. Adapter preparation pairs every prompt once with each of the four target cardinalities, producing 20,000 generic composition trajectories and 2,000 validation trajectories\. Evaluation uses 256 held\-out prompts per watermark schedule\.

#### Schedules\.

The six primary vocabulary\-partition watermark schedules are: a three\-symbol ECC schedule with seven payload positions and one boundary; an alternating binary schedule; the four\-symbol ACADBCBD combinatorial pattern\([Xie et al\., 2025](https://arxiv.org/html/2610.22810#bib.bib10)\); a fixed balanced Unigram\-style green list\([Zhao et al\., 2024](https://arxiv.org/html/2610.22810#bib.bib3)\); and prefix\-dependent 8\-of\-16 and 4\-of\-16 grouped KGW\. The ECC evaluation uses the Anchor\-ECC schedule\([Deng et al\., 2026a](https://arxiv.org/html/2610.22810#bib.bib9)\); synchronization\-string VT watermarking\([Deng et al\., 2026b](https://arxiv.org/html/2610.22810#bib.bib8)\)induces a closely related code\-constrained bucket pattern\. The grouped KGW rules retain prefix\- and key\-dependent target selection while selecting complete base buckets; we use the name Grouped\-KGW to distinguish them from native token\-level KGW\. The complete schedule registry and auxiliary results appear in Appendix[A](https://arxiv.org/html/2610.22810#A1)\.

#### Training and generation\.

Both experiments use six training epochs,τ=0\.99\\tau=0\.99, 96 generated tokens, temperature 0\.75, and full\-softmax sampling\. This target requires nearly all probability mass to lie in the requested set while retaining a1%1\\%tolerance for tokens outside it\. Settingτ=1\\tau=1would require eliminating all probability outside the requested set and hence an infinitely large logit shift whenever the model assigns any mass outside it\. The OPT adapter has 614,400 trainable parameters; the Qwen adapter has 7,798,784\. We report corpus\-level prompt\-conditional PPL under each frozen base model and compare it only within that model\.

#### Operating points\.

Fixed\-δ\\deltaadds bias 20 to the target set, following the approximate\-hard configuration in Anchor\-ECC\([Deng et al\., 2026a](https://arxiv.org/html/2610.22810#bib.bib9)\)\. Across the twelve primary model–schedule pairs, it achieves 99\.94–100% target\-set adherence \(Appendix[B](https://arxiv.org/html/2610.22810#A2)\), providing a high\-reliability comparison with the controller targetτ=0\.99\\tau=0\.99\.Controllerapplies Eq\. \([8](https://arxiv.org/html/2610.22810#S4.E8)\) to the frozen model\.LoRA\-onlyuses learned adaptation without residual control\.LoRA\+Controllercombines both\. Token adherence is the fraction of active positions whose sampled token belongs to𝒜t\\mathcal\{A\}\_\{t\}\. Exact\-block rate requires every request in a structured block to be realized\.

### 5\.2Watermarkability and Generation Cost

We first test whether pre\-adaptation watermarkability cost predicts the generation cost of different watermark requests\. For each model, we generate one unwatermarked continuation for each of the 256 held\-out LFQA prompts and evaluate all six schedules on the same teacher\-forced next\-token distributions\. Thus, the text and model distributions remain fixed while the requested target set changes\. We denote the finite\-sample average of Eq\. \([5](https://arxiv.org/html/2610.22810#S3.E5)\) by𝖶^​\(τ\)\\widehat\{\\mathsf\{W\}\}\(\\tau\)\. Table[2](https://arxiv.org/html/2610.22810#S5.T2)compares𝖶^​\(0\.99\)\\widehat\{\\mathsf\{W\}\}\(0\.99\)with the conditional log\-PPL increase measured from the corresponding fixed\-δ=20\\delta=20generations\.

Table 2:Pre\-adaptation watermarkability cost and observed fixed\-bias generation cost on matched prompts\.Δ​log⁡PPL=log⁡\(PPLδ=20/PPLclean\)\\Delta\\log\\mathrm\{PPL\}=\\log\(\\mathrm\{PPL\}\_\{\\delta=20\}/\\mathrm\{PPL\}\_\{\\mathrm\{clean\}\}\); negative values indicate lower fixed\-bias PPL\.Across the six rules,𝖶^​\(0\.99\)\\widehat\{\\mathsf\{W\}\}\(0\.99\)tracks observed log\-PPL increase on Qwen \(Pearsonr=0\.955r=0\.955, Spearmanρ=0\.943\\rho=0\.943\) and OPT \(r=0\.741r=0\.741,ρ=0\.600\\rho=0\.600\); pooling the twelve model–rule points givesr=0\.929r=0\.929andρ=0\.930\\rho=0\.930\. For every rule, Qwen has both higher watermarkability cost and a larger PPL increase relative to its own clean baseline\. Fixed\-bias PPL ranges from3\.58×3\.58\\timesto13\.18×13\.18\\timesthe clean value on Qwen, compared with0\.91×0\.91\\timesto3\.68×3\.68\\timeson OPT\. The two 4\-of\-16 schedules are the most expensive Qwen requests\. This agreement shows why the same nominal bias does not define a comparable operating point across different base models\.

### 5\.3Reliability\-Matched Composition\-Pool Results

Table[3](https://arxiv.org/html/2610.22810#S5.T3)reports the reliability\-matched comparison\. We train one adapter on generic base\-bucket unions and evaluate it on six held\-out watermark schedules\. LoRA\+Controller reaches at least 99\.80% adherence for every primary rule on both models\. All six OPT schedules improve \(46\.3% mean per\-rule PPL reduction\), as do four Qwen schedules \(5\.2% mean reduction\)\.

Table 3:Held\-out results after generic composition\-pool training\.Δ\\Deltais the relative PPL reduction from fixedδ=20\\delta=20to LoRA\+Controller; positive is better\. The Mean\-rowΔ\\Deltaaverages the six per\-rule relative reductions\.Paired bootstrap over the 256 prompts gives 95% intervals of 43\.6–48\.6% on OPT and 0\.6–9\.3% on Qwen for the mean per\-rule reduction\. On Qwen, Binary and Unigram improve with intervals above zero, ECC increases PPL, and the intervals for CW\-ABCD and both Grouped\-KGW settings include zero\. The Qwen results therefore vary more across target\-set schedules than the OPT results\. At the same operating point, the exact\-block rates for ECC, CW, and Binary are 98\.44%, 98\.44%, and 99\.65% on OPT and 98\.63%, 98\.60%, and 99\.63% on Qwen\.

Table[4](https://arxiv.org/html/2610.22810#S5.T4)separates adaptation from residual control\. LoRA alone lowers PPL but reaches 46\.4% macro adherence on OPT and 44\.3% on Qwen\. Adding the controller raises adherence to 99\.83% and 99\.82%, while reducing residual bias from 4\.78 to 3\.64 and from 5\.09 to 4\.11, respectively\.

Table 4:Component\-level macro results;α¯\\overline\{\\alpha\}is the mean residual bias over active decoding steps\.

## 6Discussion and Conclusion

This work studied how compatible a language model is with the token sets requested by logit\-based watermarks\. We measured this compatibility by the watermarkability cost, the expected minimum KL divergence from the base model needed to place probability at leastτ\\tauon each requested set\. To reduce this cost without changing the requested sets, we trained a target\-set\-conditioned LoRA adapter on unions of sixteen vocabulary buckets and combined it with a closed\-form controller that adds only the remaining logit bias needed to reachτ\\tau\. On OPT\-125M and Qwen3\-8B with six watermark schedules, the pre\-adaptation cost tracked the PPL increase of fixed\-bias watermarking \(pooled Pearsonr=0\.929r=0\.929\), and every schedule was more costly for Qwen3\-8B than for OPT\-125M\. With adherence at or above 99\.80%, our method reduced PPL relative to the fixed bias by 46\.3% on OPT\-125M and by 5\.2% on Qwen3\-8B\.

Future work includes evaluating more models, prompt domains, and quality measures, and improving the gains on larger models through richer set encodings or training focused on the schedules a deployed watermark actually uses\. It would also be useful to extend watermarkability to watermarks that do not act through a target set, and to use the cost before deployment to choose a watermark rule and target mass for a given model\.

## References

- Caiet al\.\(2026\)Z\. Cai, S\. Liu, H\. Wang, H\. Zhong, and X\. LiTowards better statistical understanding of watermarking LLMs\.Journal of the American Statistical Association121\(553\),pp\. 247–258\.External Links:[Document](https://dx.doi.org/10.1080/01621459.2026.2618290)Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px2.p1.1)\.
- Chaoet al\.\(2024\)P\. Chao, Y\. Sun, E\. Dobriban, and H\. HassaniWatermarking language models with error correcting codes\.arXiv preprint arXiv:2406\.10281\.Cited by:[§1](https://arxiv.org/html/2610.22810#S1.p1.2),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1)\.
- Denget al\.\(2026a\)Z\. Deng, M\. Siddeek, L\. Xie, M\. Seif, M\. Wang, H\. V\. Poor, and A\. GoldsmithAnchor\-ECC: local integrity checking for watermarked LLM outputs via error\-correcting codes\.External Links:2609\.38722Cited by:[§1](https://arxiv.org/html/2610.22810#S1.p1.2),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2610.22810#S4.SS1.p1.2),[§5\.1](https://arxiv.org/html/2610.22810#S5.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2610.22810#S5.SS1.SSS0.Px4.p1.1)\.
- Denget al\.\(2026b\)Z\. Deng, M\. Siddeek, L\. Xie, M\. Seif, M\. Wang, H\. V\. Poor, and A\. GoldsmithDetecting post\-generation edits to watermarked LLM outputs via error\-correcting codes\.InFindings of the Association for Computational Linguistics: EMNLP 2026,Cited by:[§1](https://arxiv.org/html/2610.22810#S1.p1.2),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2610.22810#S5.SS1.SSS0.Px2.p1.1)\.
- Fanet al\.\(2019\)A\. Fan, Y\. Jernite, E\. Perez, D\. Grangier, J\. Weston, and M\. AuliELI5: long form question answering\.InProceedings of the 57th Annual Meeting of the Association for Computational Linguistics,pp\. 3558–3567\.Cited by:[§5\.1](https://arxiv.org/html/2610.22810#S5.SS1.SSS0.Px1.p1.1)\.
- Guet al\.\(2024\)C\. Gu, X\. L\. Li, P\. Liang, and T\. HashimotoOn the learnability of watermarks for language models\.InThe Twelfth International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px3.p1.1)\.
- Guet al\.\(2026\)C\. Gu, X\. Du, and J\. C\. GrundySSG: logit\-balanced vocabulary partitioning for LLM watermarking\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 36726–36737\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.acl-long.1702)Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px2.p1.1)\.
- Guoet al\.\(2024\)Y\. Guo, Z\. Tian, Y\. Song, T\. Liu, L\. Ding, and D\. LiContext\-aware watermark with semantic balanced green\-red lists for large language models\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,pp\. 22633–22646\.Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px2.p1.1)\.
- Huet al\.\(2022\)E\. J\. Hu, Y\. Shen, P\. Wallis, Z\. Allen\-Zhu, Y\. Li, S\. Wang, L\. Wang, and W\. ChenLoRA: low\-rank adaptation of large language models\.InThe Tenth International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px3.p1.1),[§4\.2](https://arxiv.org/html/2610.22810#S4.SS2.p1.1)\.
- Kirchenbaueret al\.\(2023\)J\. Kirchenbauer, J\. Geiping, Y\. Wen, J\. Katz, I\. Miers, and T\. GoldsteinA watermark for large language models\.InProceedings of the 40th International Conference on Machine Learning,pp\. 17061–17084\.Cited by:[§1](https://arxiv.org/html/2610.22810#S1.p1.2),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1)\.
- Kirchenbaueret al\.\(2024\)J\. Kirchenbauer, J\. Geiping, Y\. Wen, M\. Shu, K\. Saifullah, K\. Kong, K\. Fernando, A\. Saha, M\. Goldblum, and T\. GoldsteinOn the reliability of watermarks for large language models\.InThe Twelfth International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1)\.
- Leeet al\.\(2024\)T\. Lee, S\. Hong, J\. Ahn, I\. Hong, H\. Lee, S\. Yun, J\. Shin, and G\. KimWho wrote this code? watermarking for code generation\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 4890–4911\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.268)Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1)\.
- Liet al\.\(2026\)X\. Li, G\. Wen, X\. Chen, Q\. Long, A\. Jain, F\. Joly, M\. Lam, Q\. Song, and W\. SutextGrain: entropy\-calibrated watermarking for language model text\.Technical reportOpenAI\.Note:Technical report accompanying OpenAI’s October 5 blog postCited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px2.p1.1)\.
- Liu and Bu \(2024\)Y\. Liu and Y\. BuAdaptive text watermark for large language models\.InProceedings of the 41st International Conference on Machine Learning,pp\. 30718–30737\.Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px2.p1.1)\.
- Moonet al\.\(2026\)S\. Moon, J\. Kwon, and H\. KamigaitoDynamicBias: sequence\-aware calibrated watermarking for large language models\.InThe Fourteenth International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px2.p1.1)\.
- Panget al\.\(2024\)Q\. Pang, S\. Hu, W\. Zheng, and V\. SmithNo free lunch in LLM watermarking: trade\-offs in watermarking design choices\.InAdvances in Neural Information Processing Systems,Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px2.p1.1)\.
- Parket al\.\(2026\)S\. Park, H\. Park, H\. Ahn, and Y\. HanWaterMod: modular token\-rank partitioning for probability\-balanced LLM watermarking\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 32683–32691\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v40i39.40546)Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px2.p1.1)\.
- Wanget al\.\(2025\)Z\. Wang, T\. Gu, B\. Wu, and Y\. YangMorphMark: flexible adaptive watermarking for large language models\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 4842–4860\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.240)Cited by:[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px2.p1.1)\.
- Xieet al\.\(2025\)L\. Xie, M\. Siddeek, M\. Seif, A\. J\. Goldsmith, and M\. WangDetecting post\-generation edits to watermarked LLM outputs via combinatorial watermarking\.arXiv preprint arXiv:2510\.01637\.Cited by:[§1](https://arxiv.org/html/2610.22810#S1.p1.2),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2610.22810#S5.SS1.SSS0.Px2.p1.1)\.
- Xuet al\.\(2026\)J\. Xu, R\. Hu, O\. Kotevska, and Z\. ZhangXMark: reliable multi\-bit watermarking for LLM\-generated texts\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 14747–14763\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.acl-long.672)Cited by:[§1](https://arxiv.org/html/2610.22810#S1.p1.2),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1)\.
- Yanget al\.\(2025\)A\. Yang, A\. Li, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Gao, C\. Huang, C\. Lv,et al\.Qwen3 technical report\.arXiv preprint arXiv:2505\.09388\.Cited by:[§5\.1](https://arxiv.org/html/2610.22810#S5.SS1.SSS0.Px1.p1.1)\.
- Yooet al\.\(2024\)K\. Yoo, W\. Ahn, and N\. KwakAdvancing beyond identification: multi\-bit watermark for large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 4031–4055\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.224)Cited by:[§1](https://arxiv.org/html/2610.22810#S1.p1.2),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1)\.
- Zhanget al\.\(2022\)S\. Zhang, S\. Roller, N\. Goyal, M\. Artetxe, M\. Chen, S\. Chen, C\. Dewan, M\. Diab, X\. Li, X\. V\. Lin,et al\.OPT: open pre\-trained transformer language models\.arXiv preprint arXiv:2205\.01068\.Cited by:[§5\.1](https://arxiv.org/html/2610.22810#S5.SS1.SSS0.Px1.p1.1)\.
- Zhaoet al\.\(2024\)X\. Zhao, P\. V\. Ananth, L\. Li, and Y\. WangProvable robust watermarking for AI\-generated text\.InThe Twelfth International Conference on Learning Representations,Cited by:[§1](https://arxiv.org/html/2610.22810#S1.p1.2),[§2](https://arxiv.org/html/2610.22810#S2.SS0.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2610.22810#S5.SS1.SSS0.Px2.p1.1)\.

## Appendix ATarget Schedules and Composition Coverage

Table 5:Watermark schedules used only for held\-out evaluation\. “Dynamic” means the exact base\-bucket union changes with the generated prefix\.Adapter training uses the generic cardinality curriculum described in Section[4](https://arxiv.org/html/2610.22810#S4); none of the schedule labels above enters the training trajectories\. Table[6](https://arxiv.org/html/2610.22810#A1.T6)reports its exact target\-set coverage\.

Table 6:Distinct base\-bucket unions covered by the generic composition curriculum\.For ECC, a 96\-token continuation contains twelve blocks, each comprising seven payload requests and one boundary request\. Its payload schedule is drawn from the intersection of a length\-7 VT constraint and a Hamming parity constraint\. CW repeats its eight\-symbol pattern twelve times\. Exact\-block rate requires every position in a block to realize its requested set\.

## Appendix BComplete Composition\-Pool Results

Table 7:Complete OPT\-125M evaluation after generic composition\-pool training\. Adherence is shown as a fraction\.Table 8:Complete Qwen3\-8B evaluation after generic composition\-pool training\. Adherence is shown as a fraction\.
## Appendix CIllustrative Qwen Generations

To complement the aggregate PPL results, we present three matched Qwen cases in which lower sequence\-level NLL coincides with a visibly cleaner continuation\. Each comparison holds the prompt, decoding protocol, and target reliability fixed; PPL is computed from the continuation’s mean base\-model NLL\. These selected cases illustrate the observed quality difference, while the complete quantitative comparison is reported above\. The excerpts are taken directly from the saved outputs without language editing; ellipses indicate omitted trailing text\.

#### Binary, sequence 70\.

Prompt \(abridged\)\.What is the difference between a scientific theory and law? Why is something repeatedly confirmed not “upgraded” into a law?

Fixedδ=20\\delta=20\(PPL 18\.96; adherence 1\.000\)\.

> And if a law could be replaced with a new theory \(like if a new theory explains relatable things\), how is that possible that the old law could still work? Okay\. So the user is asking about scientific laws, likeF=m​aF=maversus theories like rel Okay\. Let me try and work out this question\. First, I remember the user is asking about scientific laws, likeF=m​aF=maversus theories like rel Okay\. …

LoRA\+Controller \(PPL 11\.76; adherence 1\.000\)\.

> And if a law could be replaced with a law, like how Newton was superseded with relavant laws, then why is that the case? Also for a law, likeF=m​aF=ma, it seems like an equation that is a formula that is used for calculations\. So if that’s not the case for a law, then what is a law? Because a law seems like a formula\. First, I’ll start by addressing what I think you’re confused by\. …

#### Unigram, sequence 127\.

Prompt \(abridged\)\.Does the electromagnetic spectrum abruptly stop at gamma rays, or are there still higher\-energy, shorter\-wavelength waves?

Fixedδ=20\\delta=20\(PPL 18\.09; adherence 1\.000\)\.

> \[Note: This was an actual physics exam from a few centuries ago, which was an essay exam, so this was not a multiple\-choice exam\.\] Okay, so my user asks a few questions regarding gamma radiation, higher energy waves, their origins, artificial production, etc\. Let’s dissect this\. …

LoRA\+Controller \(PPL 11\.87; adherence 0\.990\)\.

> The electromagnetic spectrum does not abruptly stop at gamma\-ray wavelengths, even though gamma\-ray wavelengths are considered to have higher energy\. The electromagnetic spectrum consists of electromagnetic waves\. …

#### Grouped\-KGW50, sequence 33\.

Prompt \(abridged\)\.If only one photon goes through a double slit, is there an interference pattern on the other side, and why does observation change it?

Fixedδ=20\\delta=20\(PPL 14\.93; adherence 1\.000\)\.

> Context: I’ve been trying to understand what exactly it is that the double slit shows us in laymen terms, so I thought this novel might help me\. I have so far only seen this in the form that if you do this without observation the pattern is interference pattern, but as soon the you observe it, the photons go as individual and you don’t observe the interference …

LoRA\+Controller \(PPL 7\.03; adherence 1\.000\)\.

> Okay, the idea that a single photon behaves simultaneously as a wave and a particle and can have multiple probabilities of being in different states is a concept from quantum mechanics\. So if one photon is shot through a two\-slit apparatus, it’s not like it splits into two particles and each particle goes through one of the slits, but rather, the photon is in a superposition of being in either …

## Appendix DSchedule\-Aware Training Ablation

For each model, we train one shared adapter on target sets generated by the seven evaluation schedule families\. The adapter receives the current target set without a watermark identity or codeword label\. This schedule\-aware setting uses 35,000 training trajectories, compared with 20,000 generic composition trajectories in the main experiment\. On OPT, all six primary schedules improve and the mean per\-rule PPL reduction is 48\.5% \(95% paired\-bootstrap interval: 46\.1–50\.6%\), compared with 46\.3% under generic composition training\. On Qwen, the corresponding means are 8\.2% and 5\.2%; both settings improve four schedules in point estimate\.

Table 9:Complete corrected schedule\-aware OPT\-125M ablation\. Adherence is shown as a fraction\.#### Schedule\-aware OPT uncertainty\.

All six primary\-rule intervals for PPL reduction lie above zero: ECC\[21\.3,27\.4\]%\[21\.3,27\.4\]\\%, Binary\[59\.7,67\.3\]%\[59\.7,67\.3\]\\%, CW\-ABCD\[43\.5,57\.7\]%\[43\.5,57\.7\]\\%, Unigram\[53\.6,62\.7\]%\[53\.6,62\.7\]\\%, Grouped\-KGW50\[46\.4,55\.9\]%\[46\.4,55\.9\]\\%, and Grouped\-KGW25\[33\.7,49\.2\]%\[33\.7,49\.2\]\\%\.

Table 10:Complete schedule\-aware Qwen3\-8B ablation\. Adherence is shown as a fraction\.
#### Schedule\-aware Qwen uncertainty\.

We bootstrap paired sequence NLLs with 20,000 resamples\. Relative PPL changes from fixedδ=20\\delta=20to LoRA\+Controller have 95% intervals of\[\+13\.9,\+25\.0\]%\[\+13\.9,\+25\.0\]\\%for ECC,\[−23\.1,−7\.5\]%\[\-23\.1,\-7\.5\]\\%for Binary,\[−22\.5,\+1\.5\]%\[\-22\.5,\+1\.5\]\\%for CW,\[−45\.2,−29\.6\]%\[\-45\.2,\-29\.6\]\\%for Unigram,\[−14\.4,\+5\.3\]%\[\-14\.4,\+5\.3\]\\%for Grouped\-KGW50,\[−10\.1,\+13\.6\]%\[\-10\.1,\+13\.6\]\\%for Grouped\-KGW25, and\[\+2\.2,\+13\.9\]%\[\+2\.2,\+13\.9\]\\%for Entropy\-KGW\. Positive values mean higher PPL\.

## Appendix EController Derivation

LetM=p⁡\(𝒜\)M=p\(\\mathcal\{A\}\)and add a common biasα\\alphato target\-set logits\. The normalizer isZ=1−M\+eα​MZ=1\-M\+e^\{\\alpha\}M, and the resulting target mass iseα​M/Ze^\{\\alpha\}M/Z\. Solvingeα​M/Z=τe^\{\\alpha\}M/Z=\\taugives

α=logit⁡\(τ\)−logit⁡\(M\)\.\\alpha=\\operatorname\{logit\}\(\\tau\)\-\\operatorname\{logit\}\(M\)\.WhenM≥τM\\geq\\tau, no positive intervention is needed, yielding the rectified expression in Eq\. \([8](https://arxiv.org/html/2610.22810#S4.E8)\)\. Since the likelihood ratio iseα/Ze^\{\\alpha\}/Zinside the set and1/Z1/Zoutside it,

DKL\(q∥p\)\\displaystyle D\_\{\\mathrm\{KL\}\}\(q\\\|p\)=q⁡\(𝒜\)​log​eαZ\+\(1−q⁡\(𝒜\)\)​log​1Z=τ​α−log⁡Z\.\\displaystyle=q\(\\mathcal\{A\}\)\\log\\frac\{e^\{\\alpha\}\}\{Z\}\+\(1\-q\(\\mathcal\{A\}\)\)\\log\\frac\{1\}\{Z\}=\\tau\\alpha\-\\log Z\.

## Appendix FPartition, Training, and Compute Details

For completeness, the regularizers used in Eq\. \([6](https://arxiv.org/html/2610.22810#S4.E6)\) are

ℒcount\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{count\}\}=1L​∑ℓ=1L\(1\|𝒱u\|​∑v∈𝒱uav​ℓ−1L\)2,\\displaystyle=\\frac\{1\}\{L\}\\sum\_\{\\ell=1\}^\{L\}\\left\(\\frac\{1\}\{\|\\mathcal\{V\}\_\{u\}\|\}\\sum\_\{v\\in\\mathcal\{V\}\_\{u\}\}a\_\{v\\ell\}\-\\frac\{1\}\{L\}\\right\)^\{2\},ℒsem\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{sem\}\}=1\|𝒢\|​L​∑G∈𝒢∑ℓ=1L\(1\|G\|​∑v∈Gav​ℓ−1L\)2,\\displaystyle=\\frac\{1\}\{\|\\mathcal\{G\}\|L\}\\sum\_\{G\\in\\mathcal\{G\}\}\\sum\_\{\\ell=1\}^\{L\}\\left\(\\frac\{1\}\{\|G\|\}\\sum\_\{v\\in G\}a\_\{v\\ell\}\-\\frac\{1\}\{L\}\\right\)^\{2\},ℒent\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{ent\}\}=−1\|𝒱u\|∑v∈𝒱u∑ℓ=1Lav​ℓlogav​ℓ\.\\displaystyle=\-\\frac\{1\}\{\|\\mathcal\{V\}\_\{u\}\|\}\\sum\_\{v\\in\\mathcal\{V\}\_\{u\}\}\\sum\_\{\\ell=1\}^\{L\}a\_\{v\\ell\}\\log a\_\{v\\ell\}\.Here𝒢\\mathcal\{G\}groups tokens by the conjunction of an embedding\-based semantic LSH signature and a native\-probability stratum\. The count term balances bucket sizes, the semantic term spreads every group across theLLbuckets, and the entropy term makes the soft assignments discrete\. These definitions match the partition optimizer used in our experiments\.

Each model\-specific base\-bucket partition uses 5,000 LFQA calibration contexts and 500 validation contexts\. The optimizer estimates the mass\-balancing objective with minibatches of 256 calibration contexts\. Before materializing its token\-to\-bucket lookup, it applies aggregation levelsK∈\{2,4,8,16\}K\\in\\\{2,4,8,16\\\}, eight\-bit semantic LSH, and 256 native\-mass strata\. The partition\-loss weights areλc=0\.25\\lambda\_\{c\}=0\.25,λs=0\.10\\lambda\_\{s\}=0\.10, andλe=0\.02\\lambda\_\{e\}=0\.02\.

Both adapters use rank 16 \(LoRA scale 32\), dropout 0\.05, learning rate2×10−42\\times 10^\{\-4\}, weight decay 0\.01, six epochs, andλr=λKL=0\.02\\lambda\_\{r\}=\\lambda\_\{\\mathrm\{KL\}\}=0\.02; target summaries use the top 128 candidates\. Evaluation covers seven rules, five modes, and 256 prompts per rule–mode pair \(8,960 sequences per model\)\. Including preparation, training, and evaluation, the composition\-pool runs take 1\.49 hours for OPT and approximately 8\.6 hours for Qwen on one NVIDIA A100\-SXM4\-40GB GPU\. Qwen selects its epoch\-1 checkpoint by validation objective\.

The auxiliary schedule\-aware runs take 2\.63 hours for OPT and 15\.3 hours for Qwen on the same GPU\. Qwen uses its epoch\-1 checkpoint selected by validation objective\.

## Appendix GBroader Impact

Lower\-cost realization may aid provenance but also facilitate misuse\. Deployment requires defenses against spoofing, key theft, removal, and false attribution, plus key management, wrong\-key calibration, detector audits, and separation of provenance from content claims\.