Making Open-Source Text LLM Watermarks Durable Against Merging

# Making Open-Source Text LLM Watermarks Durable Against Merging
Source: [https://arxiv.org/html/2607.20435](https://arxiv.org/html/2607.20435)
###### Abstract

Open\-source LLMs \(OSMs\) are reaching near state\-of\-the\-art performance, prompting prior works to trace the text they generate by embedding text watermarking algorithms directly into their weights\. Yet, OSMs are subject to post\-training modifications, which has been shown to remove the watermark\. Model merging in particular, a prominent method used for combining expert knowledge and preventing catastrophic forgetting, strongly removes such OSMs watermarks\. A key question is how to enable OSM watermarks that survive subsequent merging\. In this work, we show for the first time how to design an OSM watermark that is durable against model merging\. We propose Merge\-Adversarial Training, an adversarial training algorithm to distill text watermarks into model weights while being robust to subsequent model merging\. Our approach consistently outperforms all baselines \(e\.g\. with SLERP up to \+51 percentage points \(pp\) TPR@1%FPR with \+25 pp on average\) while preserving downstream capabilities\. We also for the first time evaluate OSM watermarks against realistic merge scenarios, representing common use\-cases such as combining expert capabilities or preventing catastrophic forgetting, and with 3 prominent merging algorithms\. More broadly, our findings suggest that adversarial training is a reliable approach for increasing OSM watermark durability against post\-training modifications\.

## 1Introduction

Large language model \(LLM\) watermarking is reaching maturity, becoming increasingly integrated into regulatory frameworks\[[1](https://arxiv.org/html/2607.20435#bib.bib1)\]and consumer\-facing products\[[2](https://arxiv.org/html/2607.20435#bib.bib2)\]\. Most existing watermarking methods are based on modifying the LLM sampling procedure to imprint a human\-invisible but detectable signal in the generated output\. Crucially, these methods are*generation\-time*and designed for closed\-source models served via an API, and are thus inapplicable to open\-source models \(OSMs\)\.

##### Open\-source LLM watermarks

Given the widespread adoption of capable open\-source models\[[3](https://arxiv.org/html/2607.20435#bib.bib3),[4](https://arxiv.org/html/2607.20435#bib.bib4),[5](https://arxiv.org/html/2607.20435#bib.bib5)\], the community has increasingly shifted its focus to OSM watermarks, which directly embed the watermarking behavior into model weights\. Prior work\[[6](https://arxiv.org/html/2607.20435#bib.bib6)\]has highlighted a new challenge for OSM watermarks:*durability*under common OSM modifications\. Among these,*model merging*, which combines two or more trained models to join their capabilities, has proven to be surprisingly adverse to OSM watermarks\. This is concerning because model merging is common and cost\-effective: merged models routinely rank near the top of leaderboards\[[7](https://arxiv.org/html/2607.20435#bib.bib7)\], and over4040thousand are publicly shared on HuggingFace\. Thus, model merging poses a significant operational challenge: even non\-adversarial merges of a released watermarked model may inadvertently remove the watermark\.

![Refer to caption](https://arxiv.org/html/2607.20435v1/x1.png)Figure 1:Overview of our method and evaluation:\(*Left*\) Unlike standard watermark distillation, we train the watermark using an adversarial objective: at each step, we simulate a merge operation and optimize for it to remain watermarked\. \(*Middle*\) After training, both standard distillation and our model are watermarked as long as they are not modified\. \(*Right*\) Yet, users might finetune the model and create complex merged models \(e\.g\., to prevent forgetting or to combine capabilities\)\. While standard watermark distillation loses its watermark, our method preserves it consistently\.
##### This work: OSM watermarks durable against merging

In this work, we introduce the first OSM watermark specifically designed to be durable against model merging\. Specifically, building on the popular watermark\-distillation approach\[[8](https://arxiv.org/html/2607.20435#bib.bib8)\], we propose*merge\-resistant adversarial training*\(MAT\), a watermark\-distillation objective explicitly designed for robustness to model merging\.

MAT builds on an adversarial\-training\-inspired meta\-loss component that directly includes a low\-cost merge operation inside the watermark training loop: at each step, we temporarily create a merged model that interpolates the current checkpoint with a reference model, compute the watermark\-distillation loss through this merge, and backpropagate gradients only to the current model\. Our experimental evaluation shows that MAT yields a significantly more durable watermark compared to both standard watermark\-distillation approaches and other OSM watermarks\[[9](https://arxiv.org/html/2607.20435#bib.bib9)\]while retaining the same model performance as standard watermark\-distillation\.

Beyond our method, we introduce a rigorous evaluation pipeline for OSM durability under model merging\. Unlike prior work, which only merges the watermarked model with the unwatermarked base model, we evaluate durability across realistic scenarios, including multiple fine\-tuned models, multi\-round merging, and three merging algorithms: LINEAR, SLERP, and TIES\. At the same time, our experimental results establish the evaluation of durability under unwatermarked base model merging as an effective worst\-case proxy for faster OSM watermarking evaluations\.

##### Our contributions

We make the following contributions:

1. 1\.We introduce MAT, an adversarial\-training\-based objective \([Section˜3](https://arxiv.org/html/2607.20435#S3)\) that simulates model merging during training, directly optimizing our watermark to be durable against merging\.
2. 2\.We show that MAT consistently improves watermark detectability under realistic merge scenarios and multiple watermarking schemes, significantly outperforming standard watermark distillation while maintaining downstream performance\.
3. 3\.We demonstrate that OSM watermarks can be trained in a way that provides additional downstream benefits \(e\.g\., durability against merging\)\.

## 2Background and Related Work

In this section, we review prior work on LLM watermarking, with a particular focus on approaches for open\-source models\. We further provide the relevant background on model merging\.

##### Generation\-time LLM watermarking

LLM watermarking aims to embed a statistically detectable signal into generated text, enabling later attribution to a particular model or provider\. Most existing schemes operate at generation time: given a private key, they modify the sampling procedure to insert a detectable key\-dependent signal into the model output\. The most prominent class is the Red\-Green family \(KGW\)\[[10](https://arxiv.org/html/2607.20435#bib.bib10)\], where a pseudorandom function partitions the vocabulary into green and red tokens and biases generation toward green tokens\. Other popular schemes include KTH\[[11](https://arxiv.org/html/2607.20435#bib.bib11)\], AAR\[[12](https://arxiv.org/html/2607.20435#bib.bib12)\], and SynthID\[[2](https://arxiv.org/html/2607.20435#bib.bib2)\]\. Unlike Red\-Green, these schemes are distortion\-free: they preserve the model distribution in expectation over the private key\. However, all methods require modifying the LLM sampling procedure, making them incompatible with the user\-controlled open\-source setting\.

##### Watermarks for open\-source models\.

Watermarking an open\-source model requires embedding the signal into the model weights, so that standard inference already produces watermarked text \(i\.e\., text with a detectable watermark signal\)\. This setting has only recently received systematic attention\[[6](https://arxiv.org/html/2607.20435#bib.bib6)\]\. Existing approaches broadly fall into gradient\-based methods\[[8](https://arxiv.org/html/2607.20435#bib.bib8),[13](https://arxiv.org/html/2607.20435#bib.bib13),[14](https://arxiv.org/html/2607.20435#bib.bib14)\], which train the model to internalize a watermark, and weight\-editing methods\[[9](https://arxiv.org/html/2607.20435#bib.bib9)\], which directly modify model parameters\. Watermark distillation\[[8](https://arxiv.org/html/2607.20435#bib.bib8)\]is the most widely used gradient\-based approach: a student model is trained to imitate the output distribution of a watermarked teacher, embedding the watermark behavior into its weights\. Meanwhile, weight\-editing methods inject the watermark via direct weight modifications requiring no additional training\[[9](https://arxiv.org/html/2607.20435#bib.bib9)\]\. Crucially, while\[[13](https://arxiv.org/html/2607.20435#bib.bib13)\]improves durability against finetuning, no prior work directly improves OSM watermark durability against other common post\-training modifications such as model merging\.

##### Robustness, security, and durability

Prior work on LLM watermark reliability has studied several distinct failure modes\. Text\-level robustness asks whether a watermark remains detectable after edits to generated text, such as paraphrasing, translation, deletion, or insertion\[[10](https://arxiv.org/html/2607.20435#bib.bib10),[11](https://arxiv.org/html/2607.20435#bib.bib11),[15](https://arxiv.org/html/2607.20435#bib.bib15)\]\. Security work studies adversarial attribution manipulation, including spoofing attacks that generate text falsely detected as watermarked and scrubbing attacks that remove watermarks from generated text\[[16](https://arxiv.org/html/2607.20435#bib.bib16),[17](https://arxiv.org/html/2607.20435#bib.bib17),[18](https://arxiv.org/html/2607.20435#bib.bib18),[19](https://arxiv.org/html/2607.20435#bib.bib19)\]\. These directions primarily target generation\-time watermarks and text\-level adversaries\.

Open\-source watermarking introduces an additional requirement:*durability*under model modifications\. Because open\-source models are routinely finetuned, quantized, and merged after release, useful OSM watermarks should remain detectable after such transformations\. Importantly, recent work evaluating existing OSM watermarks under common post\-release modifications finds that current methods remain fragile in these settings\[[6](https://arxiv.org/html/2607.20435#bib.bib6)\]: OSM watermarks may survive mild compression\-like transformations, but degrade sharply under stronger modifications such as merging\.

##### Model merging

Model merging constructs a new model by combining the weights of two or more independently trained checkpoints without additional training\. Simple linear interpolation averages model parameters directly, while SLERP\[[20](https://arxiv.org/html/2607.20435#bib.bib20)\]interpolates on the hypersphere\. Task\-vector methods such as Task Arithmetic\[[21](https://arxiv.org/html/2607.20435#bib.bib21)\]interpret finetuning updates as directions in weight space that can be added, subtracted, or combined\. TIES\[[22](https://arxiv.org/html/2607.20435#bib.bib22)\]and DARE\-TIES\[[23](https://arxiv.org/html/2607.20435#bib.bib23)\]further modify task\-vector merging by resolving sign conflicts, pruning updates, or reducing interference between parent models\. These methods are attractive in open\-source development because they are inexpensive, require no data or retraining, and can combine specialized finetunes into a single checkpoint\.

## 3Our Method

In this section, we introduce our training algorithm,*Merge\-Adversarial Training*\(MAT\), specifically designed to make OSM watermarks more durable against merging \([Section˜3\.1](https://arxiv.org/html/2607.20435#S3.SS1)\)\. In[Section˜3\.2](https://arxiv.org/html/2607.20435#S3.SS2), we additionally detail all realistic merge scenarios considered for evaluation\.

### 3\.1Merge\-Adversarial Training

##### Threat model

We consider a model\-provider that releases an OSM watermarked model\. Downstream users can then finetune this model into multiple experts and subsequently merge them freely with one another, additional finetunes, the original base, or community checkpoints\. Importantly, once the watermarked model is released, we assume we have no control over how users use it\.

##### Training setting

For training, we assume that we have access to an unwatermarked base model\. Our goal is to distill a generation\-time watermark into this model as in\[[8](https://arxiv.org/html/2607.20435#bib.bib8)\]\. To embed a watermark that is durable against model merging, we adapt standard watermark\-distillation using an adversarial training approach\. In particular, we consider model merging as an adversarial action, and regularize our model to be robust against it\. In order to avoid any assumptions on later downstream merging behavior, we instantiate our adversarial merge using the unwatermarked base model\. We show in[Section˜4\.2](https://arxiv.org/html/2607.20435#S4.SS2)that this is, in most cases, a worst\-case proxy for watermark durability\.

Algorithm 1Merge\-Adversarial Training1:Frozen base

θ0\\theta\_\{0\}; watermark transform

wk​\(⋅\)w\_\{k\}\(\\cdot\)with top\-

kkgating; dataset

𝒟\\mathcal\{D\}; merge\-weight range

\[αmin,αmax\]\[\\alpha\_\{\\min\},\\alpha\_\{\\max\}\]; learning rate

η\\eta; training steps

TT
2:

θ←θ0\\theta\\leftarrow\\theta\_\{0\}⊳\\trianglerightInitialize trainable copy

3:for

ssfrom 0 to

T−1T\-1do

4:

x←Sample​\(𝒟\)x\\leftarrow\\text\{Sample\}\(\\mathcal\{D\}\)⊳\\trianglerightBatch of sequences

5:

p~\(⋅∣x<t\)←wk\(pθ0\(⋅∣x<t\)\)\\tilde\{p\}\(\\cdot\\mid x\_\{<t\}\)\\leftarrow w\_\{k\}\\\!\\left\(p\_\{\\theta\_\{0\}\}\(\\cdot\\mid x\_\{<t\}\)\\right\)
6:

α←Sample​\(𝒰​\(αmin,αmax\)\)\\alpha\\leftarrow\\text\{Sample\}\\\!\\left\(\\mathcal\{U\}\(\\alpha\_\{\\min\},\\alpha\_\{\\max\}\)\\right\)⊳\\trianglerightMerge weight

7:

θM←α​θ\+\(1−α\)​θ0\\theta\_\{M\}\\leftarrow\\alpha\\,\\theta\+\(1\-\\alpha\)\\,\\theta\_\{0\}⊳\\trianglerightLinear merge

8:

ℒ←∑t=1\|x\|KL\(p~\(⋅∣x<t\)∥pθM\(⋅∣x<t\)\)\\mathcal\{L\}\\leftarrow\\displaystyle\\sum\_\{t=1\}^\{\|x\|\}\\mathrm\{KL\}\\\!\\left\(\\tilde\{p\}\(\\cdot\\mid x\_\{<t\}\)\\,\\big\\\|\\,p\_\{\\theta\_\{M\}\}\(\\cdot\\mid x\_\{<t\}\)\\right\)
9:

g←∇θℒg\\leftarrow\\nabla\_\{\\theta\}\\mathcal\{L\}
10:

θ←θ−η​g\\theta\\leftarrow\\theta\-\\eta g
11:endfor

12:return

θ\\theta

##### Merge\-adversarial training \(MAT\)

We present an overview of our method in[Algorithm˜1](https://arxiv.org/html/2607.20435#alg1)\. Letθ0\\theta\_\{0\}denote the frozen base model andθ\\thetathe trainable copy initialised fromθ0\\theta\_\{0\}\(line 1\)\. We writeθM\\theta\_\{M\}for a merged model formed by linearly combiningθ\\thetawithθ0\\theta\_\{0\}\. Lastly,wk​\(⋅\)w\_\{k\}\(\\cdot\)corresponds to the generation\-time watermarking algorithm, applied to the top\-kklogits\. It maps the next\-token probability distribution to its watermarked counterpart\. At each step we sample a merge weightα∼𝒰​\(αmin,αmax\)\\alpha\\sim\\mathcal\{U\}\(\\alpha\_\{\\min\},\\alpha\_\{\\max\}\)and form the merged parametersθM=α​θ\+\(1−α\)​θ0\\theta\_\{M\}=\\alpha\\,\\theta\+\(1\-\\alpha\)\\,\\theta\_\{0\}\(lines 5\-6\)\. The merged model is trained to mirror the watermarked teacher’s next\-token distribution using KL divergence \(line 7\):

ℒ\(θ\)=𝔼x∼𝒟∑t=1\|x\|KL\(wk\(pθ0\(⋅∣x<t\)\)∥pθM\(⋅∣x<t\)\),\\mathcal\{L\}\(\\theta\)\\;=\\;\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\}\\sum\_\{t=1\}^\{\|x\|\}\\mathrm\{KL\}\\\!\\left\(w\_\{k\}\\\!\\left\(p\_\{\\theta\_\{0\}\}\(\\cdot\\mid x\_\{<t\}\)\\right\)\\,\\big\\\|\\,p\_\{\\theta\_\{M\}\}\(\\cdot\\mid x\_\{<t\}\)\\right\),\(1\)wherepθ0\(⋅∣x<t\)p\_\{\\theta\_\{0\}\}\(\\cdot\\mid x\_\{<t\}\)andpθM\(⋅∣x<t\)p\_\{\\theta\_\{M\}\}\(\\cdot\\mid x\_\{<t\}\)correspond to the frozen baseθ0\\theta\_\{0\}and the mergedθM\\theta\_\{M\}, respectively\. We then backpropagate this loss back to the student modelθ\\theta\(lines 8\-9\) to complete our training loop\.

##### Watermark\-algorithmwkw\_\{k\}

Like standard watermark\-distillation, our method is agnostic to the underlying generation\-time algorithm\. In[Section˜4](https://arxiv.org/html/2607.20435#S4), we evaluate it extensively on KGW, with additional experiments on the AAR and KTH families\. UnlikeGu et al\. \[[8](https://arxiv.org/html/2607.20435#bib.bib8)\], however, we find in App\.[B\.1](https://arxiv.org/html/2607.20435#A2.SS1)that watermark distillation should be performed only on the top\-kklogits to improve model performance\.

##### Choice of merge adversary

Even though we only explicitely train against linear interpolation withθ0\\theta\_\{0\}, we find in[Section˜4](https://arxiv.org/html/2607.20435#S4)that the resulting watermark survives non\-linear merges as well, suggesting that robustness learned against the simpler merges consistently transfers to more complex methods\. We ablate the merge\-weight range\[αmin,αmax\]\[\\alpha\_\{\\min\},\\alpha\_\{\\max\}\], the top\-kkgating, and the watermark strengthδ\\deltain App\.[B](https://arxiv.org/html/2607.20435#A2), and report the full training hyperparameters in App\.[A\.1](https://arxiv.org/html/2607.20435#A1.SS1)\.

### 3\.2Merge Scenarios and Evaluation Pipeline

Next, we detail all merge scenarios we consider for evaluation, also illustrated in[Figure˜2](https://arxiv.org/html/2607.20435#S3.F2)\. We first introduce notation for the parent models involved in each merge, then list the configurations themselves, and lastly describe the resulting evaluation pipeline\.

![Refer to caption](https://arxiv.org/html/2607.20435v1/x2.png)Figure 2:Merge evaluation pipeline:The provider releases a watermarked Instruct base \(BB\), and produces watermarked finetunes \(FF\) via SFT\. Downstream users merge any combination of these models, yielding the scenariosF​FFF,B​FBF,F2​FF^\{2\}F,F​B​FFBF,F2​B​FF^\{2\}BF,B​B′BB^\{\\prime\}, andB​F′BF^\{\\prime\}that we evaluate\.Following[Section˜3\.1](https://arxiv.org/html/2607.20435#S3.SS1), letBB\(the watermarked base\) correspond to the trained and watermarkedθ\\thetareleased by the provider\. LetB′B^\{\\prime\}be the unwatermarked baseθ0\\theta\_\{0\}\. We further useFFfor a finetune ofBB, andF′F^\{\\prime\}for an unwatermarked finetune \(from the provider\)\.

We group the merges into two families, each corresponding to a real\-world deployment scenario\. The*watermarked*family \([Figure˜2](https://arxiv.org/html/2607.20435#S3.F2)right\) covers four configurations in which every parent is derived fromBB: \(i\) the two\-expert mergeF​FFF\(German FT⊗\\otimesMath FT\), corresponding to a user who has trained multiple domain experts and combines them into a single multi\-skilled model; \(ii\) the base\-expert mergeB​FBF\(BB⊗\\otimesMath FT\), the standard recipe for mitigating catastrophic forgetting on the FT\-target domain by merging a finetune back with the watermarked base; \(iii\) the multi\-stage cascadesF2​B​FF^\{2\}BFandF​B​FFBF, simulating more complex post\-training pipelines such as the recursive expert\-and\-base merges \(e\.g\., used to buildBgGPT\[[24](https://arxiv.org/html/2607.20435#bib.bib24)\]\), where intermediateF​FFForB​FBFcheckpoints are themselves merged again with a third parent\. We additionally considerF2​FF^\{2\}F\(German FT⊗\\otimesMath FT⊗\\otimesFrench FT\), as an example of a multi\-stage merge of individual finetunes \([Section˜4\.1](https://arxiv.org/html/2607.20435#S4.SS1)\)\. For every cascaded merge, the inner merge is fixed atα=0\.5\\alpha=0\.5\(e\.g\., inF2​B​FF^\{2\}BFboth the innerF​FFFand the innerB​FBFare constructed atα=0\.5\\alpha=0\.5\) while we sweep the outermostα∈\[0\.1,0\.9\]\\alpha\\in\[0\.1,0\.9\]using0\.10\.1steps\.

The*unwatermarked*family \([Figure˜2](https://arxiv.org/html/2607.20435#S3.F2)left\) covers the case in which the watermarked baseBBis merged with a parent that does not carry the watermark:B​F′BF^\{\\prime\}\(BB⊗\\otimesPrivate Instruct Model Finetune\) andB​B′BB^\{\\prime\}\(B⊗B\\otimesPrivate Instruct Model\)\. While not reflective of typical deployment scenarios, we find thatB​B′BB^\{\\prime\}serves as an empirical lower bound on detection for the harder all\-watermarked cascades at matched effective dose \([Section˜4\.2](https://arxiv.org/html/2607.20435#S4.SS2)\), making it a cheap single\-merge proxy for evaluating these configurations\. We note that MAT only optimizes against the linearB​B′BB^\{\\prime\}during training \([Section˜3\.1](https://arxiv.org/html/2607.20435#S3.SS1)\), yet still consistently improves durability across all merge scenarios, including the non\-linear ones\.

## 4Experimental Evaluation

In this section, we show that MAT preserves the performance of standard watermark distillation while being significantly more durable against realistic merges \([Section˜4\.1](https://arxiv.org/html/2607.20435#S4.SS1)\)\. Following prior work, we also evaluate durability against unwatermarked\-parent merges \([Section˜4\.2](https://arxiv.org/html/2607.20435#S4.SS2)\) and find that they serve as an effective worst\-case proxy for merge\-durability evaluation\. In[Section˜4\.3](https://arxiv.org/html/2607.20435#S4.SS3), we ablate across watermarking algorithms, model architectures, and other OSM watermarks\. We defer additional results to[App\.˜A](https://arxiv.org/html/2607.20435#A1)\.

##### Experimental setup

We useLlama\-3\.1\-8B\-Instruct, deferring additional results onQwen\-2\.5\-3B\-Instructto[Section˜4\.3](https://arxiv.org/html/2607.20435#S4.SS3)\. We compare MAT against standard watermark distillation \(KGW\-D\) using the same hyperparameters \(δ=2\.3\\delta=2\.3,γ=0\.25\\gamma=0\.25\)\. Each base model is distilled on a multi\-domain mixture spanning English \(Alpaca\-GPT4\[[25](https://arxiv.org/html/2607.20435#bib.bib25)\],OpenWebText\[[26](https://arxiv.org/html/2607.20435#bib.bib26)\]\), German \(Alpaca\-GPT4\-DE\[[27](https://arxiv.org/html/2607.20435#bib.bib27)\],FineWeb\-2\[[28](https://arxiv.org/html/2607.20435#bib.bib28)\]\), math \(MetaMathQA\[[29](https://arxiv.org/html/2607.20435#bib.bib29)\]\), and code \(CodeAlpaca\[[30](https://arxiv.org/html/2607.20435#bib.bib30)\]\), ensuring watermark learning across domains\[[14](https://arxiv.org/html/2607.20435#bib.bib14)\]\. We then derive finetuned versions of each watermarked base using domain\-specific datasets:NuminaMath\-CoT\[[31](https://arxiv.org/html/2607.20435#bib.bib31)\]for math,Evol\-Instruct\-DE\[[32](https://arxiv.org/html/2607.20435#bib.bib32)\]for German, and a 58k mix ofFrench\-Alpaca\[[33](https://arxiv.org/html/2607.20435#bib.bib33)\]with the Lucie corpus\[[34](https://arxiv.org/html/2607.20435#bib.bib34)\]for French\.

To measure watermark detectability, we report true positive rate at 1% false positive rate \(TPR@1%\) averaged over500500English prompts from C4\[[35](https://arxiv.org/html/2607.20435#bib.bib35)\]\. Additionally, we measure TPR@1% on German prompts from FineWeb\-2deu\_Latn\[[28](https://arxiv.org/html/2607.20435#bib.bib28)\]and math prompts from GSM8K\[[36](https://arxiv.org/html/2607.20435#bib.bib36)\], ensuring the watermark persists in finetuned\-model domains\. For quality, we report perplexity underLlama\-2\-13Bandseq\-rep\-3, i\.e\., the fraction of repeated 3\-grams in the continuation\. Lower perplexity reflects more natural generations under an external reference judge, whileseq\-rep\-3captures degenerate repetition that perplexity alone can mask\. We further benchmark downstream capabilities with the evaluation harness fromGao et al\. \[[37](https://arxiv.org/html/2607.20435#bib.bib37)\]on ARC\[[38](https://arxiv.org/html/2607.20435#bib.bib38)\], MMLU\[[39](https://arxiv.org/html/2607.20435#bib.bib39)\], HellaSwag\[[40](https://arxiv.org/html/2607.20435#bib.bib40)\], GSM8K\[[36](https://arxiv.org/html/2607.20435#bib.bib36)\], and MATH\[[41](https://arxiv.org/html/2607.20435#bib.bib41)\]\. We defer the full training hyperparameters and data compositions to[Section˜A\.1](https://arxiv.org/html/2607.20435#A1.SS1)\.

##### Merge scenarios and evaluation

We follow the threat model from[Section˜3\.1](https://arxiv.org/html/2607.20435#S3.SS1): we act as the provider of a watermarked baseBBthat users subsequently merge\. We organize results into two categories\. First,*all\-watermarked*merges \([Section˜4\.1](https://arxiv.org/html/2607.20435#S4.SS1)\), where every parent derives from our watermarked release; here, our method consistently improves merge robustness over theKGW\-Dbaseline\. Second, we test*unwatermarked\-parent*merges \([Section˜4\.2](https://arxiv.org/html/2607.20435#S4.SS2)\), whereBBis merged with either an external community finetune or the original unwatermarked Instruct base\. In particular, we compareB​B′BB^\{\\prime\}directly against cascadedF​B​FFBFresults at matched effectiveα\\alpha, and additionally evaluateB​F′BF^\{\\prime\}as a real\-world deployment scenario where the watermarked base meets an externally trained community finetune\.

### 4\.1Durability Against Realistic Merge Scenarios

Table 1:Watermark evaluation pre\-merge:TPR@1 and generation quality \(PPL; lower is better\) of the generation\-time KGW \(KGW\), watermark\-distillation \(KGW\-D\), and ours\.TPR@1PPLVariantENDEMathENDEFRKGW100\.0100\.0100\.05\.655\.685\.59KGW\-D98\.798\.895\.85\.395\.665\.93Ours98\.099\.096\.45\.695\.595\.46

Here, we evaluate watermark durability under a range of realistic scenarios \(illustrated in[Figure˜2](https://arxiv.org/html/2607.20435#S3.F2)\)\. We first consider two merge configurations widely used in practice: combining two domain\-expert finetunes \(F​FFF\) and merging the watermarked base with a single domain finetune to mitigate catastrophic forgetting \(B​FBF\)\. We then evaluate three cascaded merges, which stress\-test our watermark durability against more complex post\-training pipelines\.

##### Watermark detectability\-quality trade\-off prior to merging

To ensure a fair comparison, in[Table˜1](https://arxiv.org/html/2607.20435#S4.T1), we verify that,*prior to merging*, our method has a similar detectability\-quality trade\-off toKGW\-D\. This means that our method’s improvement in durability against merging is not induced by a stronger watermark\. It also shows that our method does not hurt model performance prior to merging compared toKGW\-D, both when measuring perplexity \([Table˜1](https://arxiv.org/html/2607.20435#S4.T1)\) and benchmark accuracies \(App\.[A\.2\.3](https://arxiv.org/html/2607.20435#A1.SS2.SSS3)\)\.

![Refer to caption](https://arxiv.org/html/2607.20435v1/x3.png)Figure 3:Watermark detectability for different merge ratios of experts \(FF\):We compare watermark detectability \(TPR@1\) when merging anα\\alphamath\-finetuned model with a\(1−α\)\(1\-\\alpha\)German\-finetuned model using three different merging algorithms\. We average results over500500samples with English, German, and math prompts, respectively\. The dashed line corresponds to the single\-finetuning baseline, i\.e\., the maximum TPR@1 of the finetuned models for the given domain\.![Refer to caption](https://arxiv.org/html/2607.20435v1/x4.png)Figure 4:Watermark detectability for different merge ratios against catastrophic forgetting \(BF\):We compare watermark detectability \(TPR@1\) when merging anα\\alpha\-weighted math\-finetuned model with a\(1−α\)\(1\-\\alpha\)\-weighted base \(watermarked\) model using three different merging algorithms\. We average results over500500samples with English, German, and math prompts, respectively\.
##### Our method is durable against finetune merges

To measure durability against finetune merges \([Figure˜2](https://arxiv.org/html/2607.20435#S3.F2), second row\), we compare the merged\-model TPR@1% to the highest parent TPR@1% on a given domain \(called the*single\-finetuning baseline*\)\. Intuitively, a non\-durable watermark should yield merged\-model TPR@1% no higher than this baseline\. We also measure watermark detectability on the*expert domains*\(i\.e\., German for the German finetune and math for the math finetune\), because, as we show in[Table˜5](https://arxiv.org/html/2607.20435#A1.T5), these are the domains where the watermark of the finetuned experts is the weakest \(e\.g\., on average, TPR@1% on the expert domain drops from∼98%\{\\sim\}98\\%pre\-finetuning to∼15​–​25%\{\\sim\}15\\text\{\-\-\}25\\%post\-finetuning, while outside this domain detection only drops to∼28​–​40%\{\\sim\}28\\text\{\-\-\}40\\%\)\.

In[Figure˜3](https://arxiv.org/html/2607.20435#S4.F3), we compare our method withKGW\-Din the expert\-knowledge combination \(FF\) scenario\. Across English and the expert domains \(German and math\), our method systematically outperformsKGW\-D\. More importantly, unlikeKGW\-D, with our method the merged model always has a higher TPR than the single\-finetuning baseline \(dashed line in[Figure˜3](https://arxiv.org/html/2607.20435#S4.F3)\), which means that our method effectively improves durability against merging by successfully recovering the watermark degradation caused by finetuning\. At the same time, we find in App\.[A\.3\.5](https://arxiv.org/html/2607.20435#A1.SS3.SSS5)that this improvement to durability does not prevent the merged model from successfully combining the expert knowledge\.

For theB​FBFmerge, corresponding to anti\-catastrophic forgetting merges, where one parent is the watermarked baseBBitself, the watermark is, by construction, better preserved than underF​FFF, since one half of the merged weights still encodes the full distillation signal\. Nonetheless,[Figure˜4](https://arxiv.org/html/2607.20435#S4.F4)shows that our method systematically outperformsKGW\-D, especially in the expert domain where finetuning has weakened the watermark\. This confirms that our method is robust to finetune merges\.

![Refer to caption](https://arxiv.org/html/2607.20435v1/figures/fig_french_merge.png)Figure 5:Watermark detectability with cascaded merges:We compare watermark detectability \(TPR@1\) when merging anα\\alpha\-weightedF​FFF\-merged model with a\(1−α\)\(1\-\\alpha\)\-weighted French finetuned model using SLERP merging\. We average results over500500samples with English, German, and math prompts, respectively\. The dashed line corresponds to the single\-finetuning baseline, i\.e\., the maximum TPR@1 of theF​FFF\-merged and finetuned models for the given domain\.
##### Our method remains durable against cascaded merges

We next evaluate whether durability against finetuned merges extends to cascaded merges \([Figure˜2](https://arxiv.org/html/2607.20435#S3.F2), last row\)\. Specifically, we consider anF2​FF^\{2\}Fconfiguration: theF​FFFmerge above \(math finetune merged with German finetune\) is merged again with a French finetune\.[Figure˜5](https://arxiv.org/html/2607.20435#S4.F5)shows that MAT remains durable, significantly outperformingKGW\-Dacross all evaluated domains and exceeding the single\-finetuning baseline\. Full per\-method results for the remaining cascaded merges \(F​B​FFBF,F2​B​FF^\{2\}BF\) are in App\.[A\.3](https://arxiv.org/html/2607.20435#A1.SS3)\.

Overall, our results show that our method is durable against all tested merging algorithms and realistic scenarios, unlike prior work\. Importantly, this comes at no cost to model performance before merging\.

### 4\.2Durability Against Unwatermarked\-Parent Merges

Following prior work\[[6](https://arxiv.org/html/2607.20435#bib.bib6)\], we consider merge scenarios where one parent is unwatermarked\. We verify that these merges are effective proxies for realistic merge scenarios, enabling efficient evaluation of OSM watermark durability under model merging\. App\.[A\.3\.4](https://arxiv.org/html/2607.20435#A1.SS3.SSS4)further shows that our watermark is durable across unwatermarked\-parent scenarios, includingB​B′BB^\{\\prime\}merges with the unwatermarked base andB​F′BF^\{\\prime\}merges with finetunes such as FuseChat\[[42](https://arxiv.org/html/2607.20435#bib.bib42)\], OpenMath\[[43](https://arxiv.org/html/2607.20435#bib.bib43)\], or Tulu\[[44](https://arxiv.org/html/2607.20435#bib.bib44)\]\.

![Refer to caption](https://arxiv.org/html/2607.20435v1/x5.png)Figure 6:Watermark detectability forB​B′BB^\{\\prime\}andF​B​FFBFwith effective merge ratios:We compare watermark detectability \(TPR@1%\) between the unwatermarked mergeB​B′BB^\{\\prime\}andF​B​FFBFat matched effective merge ratioαeff\\alpha\_\{\\text\{eff\}\}\. We highlight points whereB​B′BB^\{\\prime\}has higher TPR@1% thanF​B​FFBF\.##### Unwatermarked\-parent merges as a proxy for realistic merges

We compare durability againstB​B′BB^\{\\prime\}with durability against cascaded merges \(F​B​FFBF\)\. For cascaded merges, letαeff\\alpha\_\{\\mathrm\{eff\}\}denote the final weight fraction from the watermarked model; e\.g\., two successive merges atα=0\.5\\alpha=0\.5yieldαeff≔0\.25\\alpha\_\{\\mathrm\{eff\}\}\\coloneq 0\.25\. We hypothesize that cascaded\-merge durability, measured by TPR@1%, is greater than that ofB​B′BB^\{\\prime\}at matchedαeff\\alpha\_\{\\mathrm\{eff\}\}\. If so,B​B′BB^\{\\prime\}provides a lower bound for watermark durability under merging and, because it requires no finetuning, serves as an efficient proxy\.

In[Figure˜6](https://arxiv.org/html/2607.20435#S4.F6), we compare the watermark detectability ofF​B​FFBFwith that ofB​B′BB^\{\\prime\}at matchedαeff\\alpha\_\{\\mathrm\{eff\}\}\. We find that in the overwhelming majority of settings \(93% of tested configurations\), the TPR@1% ofB​B′BB^\{\\prime\}is indeed lower than that ofF​B​FFBF, validating our hypothesis\. The lower bound is violated only in the math domain at highαeff\\alpha\_\{\\mathrm\{eff\}\}\(i\.e\., with a high portion of the math finetuned model\)\. We suspect this is because math finetuning significantly lowered the entropy of the resulting model on the math domain, making it harder to watermark than even the base \(unwatermarked\) model\. As a result, a high fraction of the math finetuned model degrades the watermark faster than a similar fraction of the base \(unwatermarked\) model\. Nonetheless,B​B′BB^\{\\prime\}remains in most cases an effective proxy for evaluating durability against merging\. Full results and the per\-αeff\\alpha\_\{\\mathrm\{eff\}\}breakdown are in App\.[A\.3\.2](https://arxiv.org/html/2607.20435#A1.SS3.SSS2)\.

### 4\.3Ablations on watermark families and model architectures

![Refer to caption](https://arxiv.org/html/2607.20435v1/x6.png)Figure 7:Durability gain across watermark families and architectures:Post\-merge TPR@1% FPR underB​B′BB^\{\\prime\}on English \(C4\)\.*Top:*AAR\(left\) andKTH\(right\) onLlama\-3\.1\-8B\-Instruct\.*Bottom:*KGW\-DonQwen\-2\.5\-3B\-Instruct\(left, SLERP only\) andGaussMarkonLlama\-3\.1\-8B\-Instruct\(right, baseline only\)Next, we test whether our gains are specific toKGW\-DonLlama\-3\.1\-8B\-Instructalong two distinct axes: watermark family and base architecture\. In particular, we apply the MAT objective to two additional watermark\-distillation variants,AARandKTH, and we also transfer it to a different base model,Qwen\-2\.5\-3B\-Instruct\. Additionally, we evaluate the weight\-spaceGaussMark\[[9](https://arxiv.org/html/2607.20435#bib.bib9)\]on merge robustness in order to verify that merge\-induced degradation is not specific to distillation\-based OSM watermarking approaches\.

##### MAT generalises across watermark families

We evaluate durability againstB​B′BB^\{\\prime\}acrossα\\alphaforAARandKTH, implemented as in\[[8](https://arxiv.org/html/2607.20435#bib.bib8)\], onLlama\-3\.1\-8B\-Instruct\. As shown in[Figure˜7](https://arxiv.org/html/2607.20435#S4.F7), baseline distillation collapses under merging at lowα\\alphafor both schemes \(TPR@1% near zero on Linear and SLERP\), while our method preserves detectability consistently across the fullα\\alpharange\. Notably, this mirrors the recovery we observe forKGW\-D, indicating that the merge\-adversary objective is not specific to KGW but also transfers to other watermark families\. We provide the full results in App\.[A\.4](https://arxiv.org/html/2607.20435#A1.SS4)\.

##### MAT transfers to different base architectures

We further apply our method toQwen\-2\.5\-3B\-Instruct, reusing the same hyperparameters as in theLlama\-3\.1\-8B\-Instructrun\. As we show in[Figure˜7](https://arxiv.org/html/2607.20435#S4.F7)\(bottom\-left\), despite this direct transfer, our method maintains a consistent improvement overKGW\-Dacross allα\\alpha’s, showing even larger gains for higherα\\alpha’s where the watermarked base modelBBdominates\. These results indicate that MAT can already provide benefits across base architectures even without requiring model\-specific tuning of hyperparameters\.

##### Other watermark schemes also collapse under merging

Beyond watermark\-distillation, we also evaluateGaussMark, which directly embeds the watermark via key\-dependent perturbations of the model weights\. The bottom\-right panel of[Figure˜7](https://arxiv.org/html/2607.20435#S4.F7)shows thatGaussMark\(likeKGW\-D\) collapses under merging, dropping from∼89%\{\\sim\}89\\%TPR@1% standalone to∼34%\{\\sim\}34\\%atα=0\.5\\alpha=0\.5using SLERP\. This suggests that the merge\-induced collapse is not an artifact of any single watermarking mechanism, motivating future work on adapting MAT to weight\-space watermarks\.

## 5Limitations and Future Work

While we provide an extensive evaluation of MAT, several directions remain open\. On the merge side, we evaluate MAT across three popular weight\-space algorithms \(LINEAR, SLERP, TIES\), showing that MAT requires only linear interpolation during training\. Although this transfers well to SLERP and TIES, extending MAT to more aggressive trim\-and\-rescale schemes such as DARE\-TIES\[[23](https://arxiv.org/html/2607.20435#bib.bib23)\], Model Breadcrumbs\[[45](https://arxiv.org/html/2607.20435#bib.bib45)\], or evolutionary and learned merge operators is an interesting direction for future research\. Similarly, while we are the first to evaluate watermark durability in cascaded scenarios, we focus on depth two to three \(e\.g\.,F2​FF^\{2\}FandF2​B​FF^\{2\}BF\); scaling to longer merge chains that mix more checkpoints is an important direction for real\-world model use\-cases\.

On the watermark side, we train MAT variants forKGW\-D,AAR, andKTH, and additionally report the merge\-collapse behavior ofGaussMark\. Adapting MAT to weight\-space watermarks likeGaussMarkwould require backpropagating through the detector, which we leave to future work\. More broadly, extending MAT to additional schemes, such as SynthID, semantic watermarks \(SemStamp, SemaMark\), and unbiased schemes \(DiPmark\), is a promising avenue for future work\.

Our main experiments in[Section˜4](https://arxiv.org/html/2607.20435#S4)use a single objective formulation with stochastic uniformα\\alphaand a fixed top\-kklogit gate\. Although we ablate the chosen parameters in[App\.˜B](https://arxiv.org/html/2607.20435#A2), alternative, more complex formulations \(e\.g\., curricula overα\\alpha, worst\-case\-α\\alphaadversarial training, multi\-step inner adversaries, or merge\-aware regularizers\) may improve the robustness\-quality trade\-off even further \(at the cost of simplicity\)\. Finally, our experiments focus onLlama\-3\.1\-8B\-InstructandQwen\-2\.5\-3B\-Instruct\. We consider scaling MAT, as in[Section˜3](https://arxiv.org/html/2607.20435#S3), to larger models conceptually straightforward\.

## 6Conclusion

We introduced Merge\-Adversarial Training \(MAT\), a method for improving the durability of open\-source model watermarks under model merging\. MAT trains the watermarked model against a simulated merge adversary, encouraging the watermark signal to remain detectable even after the released weights are interpolated with other checkpoints\. Despite using only linear interpolation during training, MAT generalizes across merge algorithms, consistently improving over standard watermark distillation\.

We also introduce a broader evaluation pipeline for merge durability and show that unwatermarked\-base merges provide an effective worst\-case proxy for faster evaluations\. To our knowledge, this is the first work to demonstrate that watermark durability under merging can be explicitly optimized during training without sacrificing model quality\. Together, MAT and our evaluation framework provide a practical step toward operationalizing OSM watermarks that remain detectable after common post\-release modifications, and highlight that durability should be treated as a first\-class requirement for open\-source watermarking alongside detectability, quality, and text\-level robustness\.

## References

- R et al\. \[2024\]Hamon R, Sanchez I, Fernandez Llorca D, and Gomez E\.Generative ai transparency: Identification of machine\-generated content\.Scientific analysis or review, Ispra \(Italy\), 2024\.
- Dathathri et al\. \[2024\]Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po\-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, et al\.Scalable watermarking for identifying large language model outputs\.*Nature*, 634\(8035\):818–823, 2024\.
- Qwen Team \[2026\]Qwen Team\.Qwen3\.5: Towards native multimodal agents, February 2026\.URL[https://qwen\.ai/blog?id=qwen3\.5](https://qwen.ai/blog?id=qwen3.5)\.
- DeepSeek\-AI \[2026\]DeepSeek\-AI\.Deepseek\-v4: Towards highly efficient million\-token context intelligence, 2026\.
- Team et al\. \[2026\]Kimi Team, Tongtong Bai, Yifan Bai, Yiping Bao, et al\.Kimi k2\.5: Visual agentic intelligence, 2026\.URL[https://arxiv\.org/abs/2602\.02276](https://arxiv.org/abs/2602.02276)\.
- Gloaguen et al\. \[2025\]Thibaud Gloaguen, Nikola Jovanović, Robin Staab, and Martin Vechev\.Towards watermarking of open\-source llms\.*arXiv preprint arXiv:2502\.10525*, 2025\.
- Beeching et al\. \[2023\]Edward Beeching, Clémentine Fourrier, Nathan Habib, Sheon Han, Nathan Lambert, Nazneen Rajani, Omar Sanseviero, Lewis Tunstall, and Thomas Wolf\.Open llm leaderboard\.[https://huggingface\.co/spaces/open\-llm\-leaderboard/open\_llm\_leaderboard](https://huggingface.co/spaces/open-llm-leaderboard/open_llm_leaderboard), 2023\.
- Gu et al\. \[2024\]Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto\.On the learnability of watermarks for language models\.In*The Twelfth International Conference on Learning Representations \(ICLR\)*, 2024\.URL[https://openreview\.net/forum?id=9k0krNzvlV](https://openreview.net/forum?id=9k0krNzvlV)\.
- Block et al\. \[2025\]Adam Block, Ayush Sekhari, and Alexander Rakhlin\.Gaussmark: A practical approach for structural watermarking of language models, 2025\.URL[https://arxiv\.org/abs/2501\.13941](https://arxiv.org/abs/2501.13941)\.
- Kirchenbauer et al\. \[2023a\]John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein\.A watermark for large language models\.In*International Conference on Machine Learning*, pages 17061–17084\. PMLR, 2023a\.
- Kuditipudi et al\. \[2024\]Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang\.Robust distortion\-free watermarks for language models\.*TMLR*, 2024\.
- Aaronson \[2023\]Scott Aaronson\.Watermarking of large language models\.In*Workshop on Large Language Models and Transformers, Simons Institute, UC Berkeley*, 2023\.
- Xue et al\. \[2025\]Jiaqi Xue, Yifei Zhao, Mansour Al Ghanim, Shangqian Gao, Ruimin Sun, Qian Lou, and Mengxin Zheng\.Pro: Enabling precise and robust text watermark for open\-source llms\.*arXiv preprint arXiv:2510\.23891*, 2025\.
- Gloaguen et al\. \[2026\]Thibaud Gloaguen, Robin Staab, Nikola Jovanović, and Martin Vechev\.LLM fingerprinting via semantically conditioned watermarks\.In*The Fourteenth International Conference on Learning Representations*, 2026\.URL[https://openreview\.net/forum?id=t38nZqqi3Z](https://openreview.net/forum?id=t38nZqqi3Z)\.
- Kirchenbauer et al\. \[2023b\]John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein\.On the reliability of watermarks for large language models\.*arXiv preprint arXiv:2306\.04634*, 2023b\.
- Sadasivan et al\. \[2023\]Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi\.Can ai\-generated text be reliably detected?*arXiv preprint arXiv:2303\.11156*, 2023\.
- Jovanović et al\. \[2024\]Nikola Jovanović, Robin Staab, and Martin Vechev\.Watermark stealing in large language models\.In*International Conference on Machine Learning*, pages 22570–22593\. PMLR, 2024\.
- He et al\. \[2024\]Zhiwei He, Binglin Zhou, Hongkun Hao, Aiwei Liu, Xing Wang, Zhaopeng Tu, Zhuosheng Zhang, and Rui Wang\.Can watermarks survive translation? on the cross\-lingual consistency of text watermark for large language models\.In*Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, pages 4115–4129, 2024\.
- Pang et al\. \[2024\]Qi Pang, Shengyuan Hu, Wenting Zheng, and Virginia Smith\.No free lunch in llm watermarking: Trade\-offs in watermarking design choices\.*Advances in Neural Information Processing Systems*, 37:138756–138788, 2024\.
- Goddard et al\. \[2024\]Charles Goddard, Shamane Siriwardhana, Malikeh Ehghaghi, Luke Meyers, Vladimir Karpukhin, Brian Benedict, Mark McQuade, and Jacob Solawetz\.Arcee’s MergeKit: A toolkit for merging large language models\.In Franck Dernoncourt, Daniel Preoţiuc\-Pietro, and Anastasia Shimorina, editors,*Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry Track*, pages 477–485, Miami, Florida, US, November 2024\. Association for Computational Linguistics\.doi:10\.18653/v1/2024\.emnlp\-industry\.36\.URL[https://aclanthology\.org/2024\.emnlp\-industry\.36](https://aclanthology.org/2024.emnlp-industry.36)\.
- Ilharco et al\. \[2022\]Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi\.Editing models with task arithmetic\.*arXiv preprint arXiv:2212\.04089*, 2022\.
- Yadav et al\. \[2023\]Prateek Yadav, Derek Tam, Leshem Choshen, Colin A Raffel, and Mohit Bansal\.Ties\-merging: Resolving interference when merging models\.*Advances in neural information processing systems*, 36:7093–7115, 2023\.
- Yu et al\. \[2024a\]Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li\.Language models are super mario: Absorbing abilities from homologous models as a free lunch\.In*Forty\-first International Conference on Machine Learning*, 2024a\.
- Alexandrov et al\. \[2024\]Anton Alexandrov, Veselin Raychev, Dimitar I\. Dimitrov, Ce Zhang, Martin Vechev, and Kristina Toutanova\.Bggpt 1\.0: Extending english\-centric llms to other languages, 2024\.URL[https://arxiv\.org/abs/2412\.10893](https://arxiv.org/abs/2412.10893)\.
- Peng et al\. \[2023\]Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao\.Instruction tuning with GPT\-4, 2023\.
- Gokaslan and Cohen \[2019\]Aaron Gokaslan and Vanya Cohen\.OpenWebText corpus\.[http://Skylion007\.github\.io/OpenWebTextCorpus](http://skylion007.github.io/OpenWebTextCorpus), 2019\.
- LeoLM \[2023\]LeoLM\.Alpaca\-GPT4\-DE: German translation of the Alpaca\-GPT4 instruction dataset\.[https://huggingface\.co/datasets/LeoLM/alpaca\_gpt4\_de](https://huggingface.co/datasets/LeoLM/alpaca_gpt4_de), 2023\.
- Penedo et al\. \[2024\]Guilherme Penedo, Hynek Kydlíček, Vinko Sabolcěc, Bettina Messmer, Negar Foroutan, Martin Jaggi, Leandro von Werra, and Thomas Wolf\.FineWeb\-2: A sparkling update with 1000s of languages\.[https://huggingface\.co/datasets/HuggingFaceFW/fineweb\-2](https://huggingface.co/datasets/HuggingFaceFW/fineweb-2), 2024\.
- Yu et al\. \[2024b\]Longhui Yu, Weisen Jiang, Han Shi, Jincheng Yu, Zhengying Liu, Yu Zhang, James T\. Kwok, Zhenguo Li, Adrian Weller, and Weiyang Liu\.MetaMath: Bootstrap your own mathematical questions for large language models\.In*The Twelfth International Conference on Learning Representations \(ICLR\)*, 2024b\.URL[https://openreview\.net/forum?id=N8N0hgNDRt](https://openreview.net/forum?id=N8N0hgNDRt)\.
- Chaudhary \[2023\]Sahil Chaudhary\.Code Alpaca: An instruction\-following LLaMA model for code generation\.[https://github\.com/sahil280114/codealpaca](https://github.com/sahil280114/codealpaca), 2023\.
- LI et al\. \[2024\]Jia LI, Edward Beeching, Lewis Tunstall, Ben Lipkin, Roman Soletskyi, Shengyi Costa Huang, Kashif Rasul, Longhui Yu, Albert Jiang, Ziju Shen, Zihan Qin, Bin Dong, Li Zhou, Yann Fleureau, Guillaume Lample, and Stanislas Polu\.Numinamath\.[\[https://huggingface\.co/AI\-MO/NuminaMath\-CoT\]\(https://github\.com/project\-numina/aimo\-progress\-prize/blob/main/report/numina\_dataset\.pdf\)](https://arxiv.org/html/2607.20435v1/%5Bhttps://huggingface.co/AI-MO/NuminaMath-CoT%5D(https://github.com/project-numina/aimo-progress-prize/blob/main/report/numina_dataset.pdf)), 2024\.
- Chen et al\. \[2023\]Zhihong Chen, Shuo Yan, Juhao Liang, Feng Jiang, Xiangbo Wu, Fei Yu, Guiming Hardy Chen, Junying Chen, Hongbo Zhang, Li Jianquan, Wan Xiang, and Benyou Wang\.MultilingualSIFT: Multilingual Supervised Instruction Fine\-tuning, July 2023\.URL[https://github\.com/FreedomIntelligence/MultilingualSIFT\.git](https://github.com/FreedomIntelligence/MultilingualSIFT.git)\.
- Pacifico \[2024\]Jonathan Pacifico\.French\-alpaca: A French instruction\-following dataset \(110k\)\.[https://huggingface\.co/datasets/jpacifico/French\-Alpaca\-dataset\-Instruct\-110K](https://huggingface.co/datasets/jpacifico/French-Alpaca-dataset-Instruct-110K), 2024\.
- Gouvert et al\. \[2025\]Olivier Gouvert, Julie Hunter, Jérôme Louradour, Christophe Cerisara, Evan Dufraisse, Yaya Sy, Laura Rivière, Jean\-Pierre Lorré, and OpenLLM\-France community\.The lucie\-7b llm and the lucie training dataset: Open resources for multilingual language generation, 2025\.URL[https://arxiv\.org/abs/2503\.12294](https://arxiv.org/abs/2503.12294)\.
- Raffel et al\. \[2023\]Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J\. Liu\.Exploring the limits of transfer learning with a unified text\-to\-text transformer, 2023\.URL[https://arxiv\.org/abs/1910\.10683](https://arxiv.org/abs/1910.10683)\.
- Cobbe et al\. \[2021\]Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman\.Training verifiers to solve math word problems\.*arXiv preprint arXiv:2110\.14168*, 2021\.
- Gao et al\. \[2024\]Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac’h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Jason Phang, Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lintang Sutawika, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou\.The language model evaluation harness, 07 2024\.URL[https://zenodo\.org/records/12608602](https://zenodo.org/records/12608602)\.
- Clark et al\. \[2018\]Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord\.Think you have solved question answering? try arc, the ai2 reasoning challenge, 2018\.URL[https://arxiv\.org/abs/1803\.05457](https://arxiv.org/abs/1803.05457)\.
- Hendrycks et al\. \[2021\]Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt\.Measuring massive multitask language understanding, 2021\.URL[https://arxiv\.org/abs/2009\.03300](https://arxiv.org/abs/2009.03300)\.
- Zellers et al\. \[2019\]Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi\.Hellaswag: Can a machine really finish your sentence?, 2019\.URL[https://arxiv\.org/abs/1905\.07830](https://arxiv.org/abs/1905.07830)\.
- Lewkowycz et al\. \[2022\]Aitor Lewkowycz, Anders Andreassen, David Dohan, Ethan Dyer, Henryk Michalewski, Vinay Ramasesh, Ambrose Slone, Cem Anil, Imanol Schlag, Theo Gutman\-Solo, Yuhuai Wu, Behnam Neyshabur, Guy Gur\-Ari, and Vedant Misra\.Solving quantitative reasoning problems with language models, 2022\.URL[https://arxiv\.org/abs/2206\.14858](https://arxiv.org/abs/2206.14858)\.
- Wan et al\. \[2024\]Fanqi Wan, Longguang Zhong, Ziyi Yang, Ruijun Chen, and Xiaojun Quan\.Fusechat: Knowledge fusion of chat models, 2024\.URL[https://arxiv\.org/abs/2408\.07990](https://arxiv.org/abs/2408.07990)\.
- Toshniwal et al\. \[2024\]Shubham Toshniwal, Wei Du, Ivan Moshkov, Branislav Kisacanin, Alexan Ayrapetyan, and Igor Gitman\.Openmathinstruct\-2: Accelerating ai for math with massive open\-source instruction data\.*arXiv preprint arXiv:2410\.01560*, 2024\.
- Lambert et al\. \[2024\]Nathan Lambert, Jacob Morrison, Valentina Pyatkin, Shengyi Huang, Hamish Ivison, Faeze Brahman, Lester James V\. Miranda, Alisa Liu, Nouha Dziri, Shane Lyu, Yuling Gu, Saumya Malik, Victoria Graf, Jena D\. Hwang, Jiangjiang Yang, Ronan Le Bras, Oyvind Tafjord, Chris Wilhelm, Luca Soldaini, Noah A\. Smith, Yizhong Wang, Pradeep Dasigi, and Hannaneh Hajishirzi\.Tülu 3: Pushing frontiers in open language model post\-training\.2024\.
- Davari and Belilovsky \[2024\]MohammadReza Davari and Eugene Belilovsky\.Model breadcrumbs: Scaling multi\-task model merging with sparse masks\.In*European Conference on Computer Vision*, pages 270–287\. Springer, 2024\.
- Grattafiori et al\. \[2024\]Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, et al\.The Llama 3 herd of models\.*arXiv preprint arXiv:2407\.21783*, 2024\.
- Touvron et al\. \[2023\]Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, et al\.Llama 2: Open foundation and fine\-tuned chat models, 2023\.URL[https://arxiv\.org/abs/2307\.09288](https://arxiv.org/abs/2307.09288)\.
- Wortsman et al\. \[2022\]Mitchell Wortsman, Gabriel Ilharco, Samir Yitzhak Gadre, Rebecca Roelofs, Raphael Gontijo\-Lopes, Ari S\. Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, and Ludwig Schmidt\.Model soups: averaging weights of multiple fine\-tuned models improves accuracy without increasing inference time, 2022\.URL[https://arxiv\.org/abs/2203\.05482](https://arxiv.org/abs/2203.05482)\.
- Team \[2024\]Qwen Team\.Qwen2\.5: A party of foundation models, September 2024\.URL[https://qwenlm\.github\.io/blog/qwen2\.5/](https://qwenlm.github.io/blog/qwen2.5/)\.

## Appendix ASupplementary Results

### A\.1Watermark Distillation and SFT Hyperparameters

#### A\.1\.1Data Mixture

Watermark distillation uses a multi\-domain mix: 30% math \(MetaMathQA\[[29](https://arxiv.org/html/2607.20435#bib.bib29)\]\), 30% German \(20%Alpaca\-GPT4\-DE\[[27](https://arxiv.org/html/2607.20435#bib.bib27)\]\+ 10%FineWeb\-2\[[28](https://arxiv.org/html/2607.20435#bib.bib28)\]deu\_Latn\), 30% English \(20%Alpaca\-GPT4\[[25](https://arxiv.org/html/2607.20435#bib.bib25)\]\+ 10%OpenWebText\[[26](https://arxiv.org/html/2607.20435#bib.bib26)\]\), and 10% code \(CodeAlpaca\[[30](https://arxiv.org/html/2607.20435#bib.bib30)\]\)\. Datasets are streamed and interleaved with sampling probabilities equal to the percentages above \(fixed seed 42\), and each sample is truncated/packed to a sequence length of512512tokens\.

#### A\.1\.2Watermark Distillation

BothKGW\-D\(replication of\[[8](https://arxiv.org/html/2607.20435#bib.bib8)\]\) andMAT KGW\-Dare trained fromLlama\-3\.1\-8B\-Instruct\[[46](https://arxiv.org/html/2607.20435#bib.bib46)\]inbfloat16, using AdamW \(β1=0\.9,β2=0\.999\\beta\_\{1\}\{=\}0\.9,\\,\\beta\_\{2\}\{=\}0\.999,ε=10−8\\varepsilon\{=\}10^\{\-8\}\), cosine LR schedule with500500warm\-up steps and peak LR1×10−51\{\\times\}10^\{\-5\}, a batch size of6464, and gradient checkpointing enabled\. We use the same KGW parameters in both runs \(γ=0\.25\\gamma\{=\}0\.25,k=1k\{=\}1\)\. The bias isδ=2\.3\\delta\{=\}2\.3forKGW\-DandMAT KGW\-D, with the latter additionally using the rank\-top\-kkrestriction \(k=100k\{=\}100\)\. The merge adversary samplesα∼𝒰​\(0\.1,1\.0\)\\alpha\\sim\\mathcal\{U\}\(0\.1,1\.0\)per step and is disabled for the KGW\-D baseline\. BothKGW\-DandMAT KGW\-Dare trained for5,0005\{,\}000steps\. We run the experiments on NVIDIA RTX Blackwell 6000 Pro GPUs with 96GB VRAM\.KGW\-Duses1×41\{\\times\}4GPUs under FSDP \(full shard,∼4\\sim 4h training time\) andMAT KGW\-Duses2×42\{\\times\}4GPUs under DeepSpeed ZeRO\-2 \(∼6\\sim 6h training time\)\. The teacher copy is held on CPU and moved to GPU on demand to fit the merge\-adversary forward pass within GPU memory\.

#### A\.1\.3Per\-Domain SFT

Each domain SFT starts from theKGW\-D/MAT KGW\-Dcheckpoint\-5,0005\{,\}000and uses AdamW with weight decay0\.010\.01, cosine schedule andbfloat16with gradient checkpointing\. Hyperparameters per domain are reported in[Table˜2](https://arxiv.org/html/2607.20435#A1.T2)\.

Table 2:Per\-domain SFT hyperparameters:Each finetune starts from the correspondingKGW\-D/MAT KGW\-Dcheckpoint\-5,0005\{,\}000\.DomainDatasetEpochsLREff\. batchSeq\. lenMathNuminaMath\-CoT\[[31](https://arxiv.org/html/2607.20435#bib.bib31)\]11×10−51\{\\times\}10^\{\-5\}12812840964096GermanEvol\-Instruct\-DE\[[32](https://arxiv.org/html/2607.20435#bib.bib32)\]22×10−52\{\\times\}10^\{\-5\}646420482048FrenchLucie\+French\-Alpaca\(58k\)\[[34](https://arxiv.org/html/2607.20435#bib.bib34),[33](https://arxiv.org/html/2607.20435#bib.bib33)\]22×10−52\{\\times\}10^\{\-5\}646420482048The French SFT mixes 29k French\-Alpaca instructions sampled from\[[33](https://arxiv.org/html/2607.20435#bib.bib33)\]with 29k continued\-pretraining pseudo\-pairs sampled from theRedPajama\-frsubset of the Lucie Training Dataset\[[34](https://arxiv.org/html/2607.20435#bib.bib34)\]for a total of 58k examples, chosen for sample\-count parity with the GermanEvol\-Instruct\-DEset so both fine\-tunes run for an equal number of optimizer steps\. All other settings follow the HuggingFaceTrainerdefaults\.

### A\.2Benchmark Results and Downstream Capabilities

#### A\.2\.1Downstream Capabilities

We evaluate downstream capabilities with the EleutherAIlm\-evaluation\-harness\[[37](https://arxiv.org/html/2607.20435#bib.bib37)\]using each benchmark’s standard few\-shot regime: for English/general reasoning we runMMLU\[[39](https://arxiv.org/html/2607.20435#bib.bib39)\]\(5\-shot\),HellaSwag\[[40](https://arxiv.org/html/2607.20435#bib.bib40)\]\(10\-shot\),ARC\-Challenge\[[38](https://arxiv.org/html/2607.20435#bib.bib38)\]\(25\-shot\)\. For math we runGSM8K\[[36](https://arxiv.org/html/2607.20435#bib.bib36)\]\(8\-shot\) andMinerva\-MATH \(MATH\)\[[41](https://arxiv.org/html/2607.20435#bib.bib41)\]\(0\-shot\)\. Because two of our merge\-parent fine\-tunes target non\-English domains \(German and French\), we additionally evaluate onMMLU\-DE\[[39](https://arxiv.org/html/2607.20435#bib.bib39)\],HellaSwag\-DE\[[40](https://arxiv.org/html/2607.20435#bib.bib40)\]and the analogousfra\_Latnsuite\.

#### A\.2\.2Generation Quality

We measure generation quality using the reference\-model perplexity protocol established byGu et al\. \[[8](https://arxiv.org/html/2607.20435#bib.bib8)\]and used inGloaguen et al\. \[[6](https://arxiv.org/html/2607.20435#bib.bib6)\]: from the watermarked model, we generate, unless otherwise mentioned,n=500n=500continuations conditioned on natural\-text prefixes drawn from a domain\-matched corpus \(C4\-RealNewsLike\[[35](https://arxiv.org/html/2607.20435#bib.bib35)\]for English,FineWeb\-2deu\_Latn\[[28](https://arxiv.org/html/2607.20435#bib.bib28)\]/fra\_Latn\[[28](https://arxiv.org/html/2607.20435#bib.bib28)\]for German/French, andGSM8K\[[36](https://arxiv.org/html/2607.20435#bib.bib36)\]prompts for math\)\. We compute their perplexity withLlama\-2\-13B\[[47](https://arxiv.org/html/2607.20435#bib.bib47)\]and report the median PPL\. Alongside reference perplexity, we report*seq\-rep\-3*, the fraction of repeated trigrams in the generated continuation, which captures the degenerate repetition failure mode that low perplexity alone can mask\.

#### A\.2\.3Baseline Model Benchmarks

[Table˜3](https://arxiv.org/html/2607.20435#A1.T3)\(Basesblock\) reports the downstream performance of the baseLlama\-3\.1\-8B\-Instructmodel and both watermarked variants \(KGW\-D and MAT KGW\-D\) prior to any finetuning or merging\. Watermark distillation incurs limited quality loss: reference perplexity rises by∼0\.9\{\\sim\}0\.9–1\.91\.9PPL and MMLU, HellaSwag, and MATH scores remain within∼\\sim2 pp of the unwatermarked baseline, confirming that the watermark embedding itself does not substantially degrade model utility\.

#### A\.2\.4Finetune Benchmarks

TheMath FT,German FT, andFrench FTblocks of[Table˜3](https://arxiv.org/html/2607.20435#A1.T3)compare the per\-language finetunes derived from each watermarked variant\. All three finetunes achieve comparable on\-domain quality regardless of whether the parent model was trained with KGW\-D or MAT: German finetunes reach similar perplexity on held\-out German text, math finetunes show nearly equivalent MATH accuracy, and French finetunes match on French perplexity and MMLU\-FR\.

Table 3:Per\-task downstream accuracy across the unwatermarkedLlama\-3\.1\-8B\-Instructbase, the two watermarked bases \(KGW\-D,MAT KGW\-D\), and the Math, German, and French finetunes derived from each watermarked base, no merging:Cells colored relative to the Instruct baseline:≥95%\{\\geq\}95\\%,≥90%\{\\geq\}90\\%,<90%\{<\}90\\%\. Per\-language perplexity and seq\-rep\-3 are reported separately in[Table˜4](https://arxiv.org/html/2607.20435#A1.T4)\.Accuracy \[%\]ModelScenarioARCMMLUHeSwGSM8KMATHMMLU\_DEMMLU\_FRBasesInstruct61\.968\.876\.785\.044\.057\.559\.3KGW\-D58\.567\.574\.782\.542\.056\.158\.5MAT KGW\-D59\.367\.675\.881\.942\.356\.658\.9Math FTKGW\-D53\.863\.271\.381\.947\.152\.354\.1MAT KGW\-D52\.762\.170\.582\.448\.351\.255\.4German FTKGW\-D56\.663\.170\.476\.836\.858\.353\.4MAT KGW\-D56\.062\.370\.275\.937\.457\.954\.0French FTKGW\-D52\.660\.971\.174\.237\.743\.158\.9MAT KGW\-D51\.554\.470\.475\.436\.042\.158\.7

Table 4:Per\-language generation quality \(no merging\):Reference perplexity \(PPL, computed underLlama\-2\-13B\) and seq\-rep\-3 ofLlama\-3\.1\-8B\-Instructunder each watermarking variant\. Per\-task downstream accuracy is reported separately in[Table˜3](https://arxiv.org/html/2607.20435#A1.T3)\.PPLseq\-rep\-3ModelScenarioENDEFRENDEFRBasesInstruct3\.813\.984\.550\.0580\.0930\.077KGW\-D5\.395\.665\.930\.0490\.0950\.076MAT KGW\-D5\.695\.595\.460\.0580\.0940\.089Math FTKGW\-D5\.415\.715\.870\.0510\.0970\.081MAT KGW\-D5\.705\.735\.400\.0590\.0960\.090German FTKGW\-D5\.403\.535\.890\.0610\.0780\.087MAT KGW\-D5\.683\.655\.420\.0540\.0800\.092French FTKGW\-D5\.435\.694\.090\.0480\.0910\.072MAT KGW\-D5\.715\.714\.140\.0570\.0960\.070Table 5:Standalone single\-model TPR@1% FPR detection \(no merging\):Bases are evaluated before any finetuning; the finetune blocks are evaluated post\-SFT\.Logit proc\. KGWis the decoding\-time KGW reference\.ScenarioMethodEnglishGermanMathBasesLogit proc\. KGW100\.0100\.0100\.0KGW\-D98\.798\.895\.8MAT KGW\-D \(ours\)98\.099\.096\.4German FTKGW\-D35\.414\.025\.0MAT KGW\-D33\.817\.128\.5Math FTKGW\-D34\.941\.421\.4MAT KGW\-D36\.139\.824\.4French FT \(unseen\)KGW\-D52\.042\.221\.0MAT KGW\-D51\.453\.827\.0

### A\.3Supplementary Results for All\-Watermarked Merges

[Figure˜8](https://arxiv.org/html/2607.20435#A1.F8),[Figure˜9](https://arxiv.org/html/2607.20435#A1.F9),[Figure˜10](https://arxiv.org/html/2607.20435#A1.F10), and[Figure˜11](https://arxiv.org/html/2607.20435#A1.F11)provide the full TPR@1% sweeps across the all\-watermarked merge family \(F​FFF,B​FBF,F2​B​FF^\{2\}BF,F​B​FFBF\), all merge methods \(Linear, SLERP, TIES\), and all three detection domains \(English, German, Math\) as recovery curves\. We report 95% confidence intervals on every TPR@1% withn=500n=500prompts per cell\. The shaded band around each curve in[Figures˜8](https://arxiv.org/html/2607.20435#A1.F8),[9](https://arxiv.org/html/2607.20435#A1.F9),[10](https://arxiv.org/html/2607.20435#A1.F10)and[11](https://arxiv.org/html/2607.20435#A1.F11)and the unwatermarked\-parent recovery figures depicts this interval\.

#### A\.3\.1Merge Methods and Hyperparameters

We evaluate three merge methods, all parameterised by a single mixing coefficientα∈\[0,1\]\\alpha\\in\[0,1\]\.Linear\[[48](https://arxiv.org/html/2607.20435#bib.bib48)\]averages the two parents in weight space:θmerge=α​θA\+\(1−α\)​θB\\theta\_\{\\mathrm\{merge\}\}=\\alpha\\,\\theta\_\{A\}\+\(1\-\\alpha\)\\,\\theta\_\{B\}\.SLERP\[[20](https://arxiv.org/html/2607.20435#bib.bib20)\]interpolates the two parents on the unit hypersphere with the same coefficient, normalising and renormalising each parameter tensor before/after the spherical interpolation\.TIES\[[22](https://arxiv.org/html/2607.20435#bib.bib22)\]is computed viaMergeKit\[[20](https://arxiv.org/html/2607.20435#bib.bib20)\]with parentAAacting as the task\-vector base: we form a task vectorτB=θB−θA\\tau\_\{B\}=\\theta\_\{B\}\-\\theta\_\{A\}, retain the top\-ddfraction of\|τB\|\|\\tau\_\{B\}\|per parameter tensor \(densityd=0\.5d=0\.5throughout\), and combine asθmerge=θA\+α​τ~B\\theta\_\{\\mathrm\{merge\}\}=\\theta\_\{A\}\+\\alpha\\,\\widetilde\{\\tau\}\_\{B\}, whereτ~B\\widetilde\{\\tau\}\_\{B\}is the magnitude\-trimmed and renormalised task vector\. We sweepα∈\{0\.1,0\.2,…,0\.9\}\\alpha\\in\\\{0\.1,0\.2,\\ldots,0\.9\\\}for all three methods in the per\-merge results in[Figures˜8](https://arxiv.org/html/2607.20435#A1.F8),[9](https://arxiv.org/html/2607.20435#A1.F9),[10](https://arxiv.org/html/2607.20435#A1.F10)and[11](https://arxiv.org/html/2607.20435#A1.F11)\.

![Refer to caption](https://arxiv.org/html/2607.20435v1/x7.png)Figure 8:F​FFFwatermark detection:TPR@1% as a function ofα\\alpha= fraction of Math FT across Linear, SLERP, and TIES\.![Refer to caption](https://arxiv.org/html/2607.20435v1/x8.png)Figure 9:B​FBFwatermark detection:TPR@1% as a function ofα\\alpha= fraction of Math FT across Linear, SLERP, and TIES\.![Refer to caption](https://arxiv.org/html/2607.20435v1/x9.png)Figure 10:F2​B​FF^\{2\}BFwatermark detection:TPR@1% as a function ofα\\alpha= fraction ofF​FFFacross Linear, SLERP and TIES\.![Refer to caption](https://arxiv.org/html/2607.20435v1/x10.png)Figure 11:F​B​FFBFwatermark detection:TPR@1% as a function ofα\\alpha= fraction ofB​FBFacross Linear, SLERP, and TIES\.
#### A\.3\.2B​B′BB^\{\\prime\}as a Lower Bound forF​B​FFBF

In[Section˜4\.2](https://arxiv.org/html/2607.20435#S4.SS2), we introduceB​B′BB^\{\\prime\}as an empirical lower bound onF​B​FFBFat matched effective watermark dose\. Here we present the per\-α\\alphasweep behind that claim \([Figure˜12](https://arxiv.org/html/2607.20435#A1.F12)\)\. The matched dose is the B\-fraction in the merged weights:αeff​\(F​B​F\)=0\.5⋅αF​B​F\\alpha\_\{\\mathrm\{eff\}\}\(FBF\)=0\.5\\cdot\\alpha\_\{FBF\}, sinceB​FBFcontains0\.5​B0\.5\\,B\. The bound holds where theF​B​FFBFcurve lies above theB​B′BB^\{\\prime\}curve at the sameαeff\\alpha\_\{\\mathrm\{eff\}\}\.

![Refer to caption](https://arxiv.org/html/2607.20435v1/x11.png)Figure 12:F​B​FFBFvs\.B​B′BB^\{\\prime\}lower\-bound test on TPR@1%, full SLERP sweepαeff∈\{0\.05,0\.10,…,0\.45\}\\alpha\_\{\\mathrm\{eff\}\}\\in\\\{0\.05,0\.10,\\ldots,0\.45\\\}:The bound holds where the solid line sits above the dashed line; configurations where it fails \(B​B′\>F​B​FBB^\{\\prime\}\>FBF\) are circled\.The bound holds across nearly all\(αeff,domain\)\(\\alpha\_\{\\mathrm\{eff\}\},\\text\{domain\}\)configurations\. The few failures all fall in the Math domain at highαeff\\alpha\_\{\\mathrm\{eff\}\}: the Math FT parent on its own retains very little watermark signal, so when it dominates theF​B​FFBFmerge it contributes less detectable signal thanB​B′BB^\{\\prime\}’s simple mix ofBBwith the unwatermarked Instruct\. The same conclusion holds under Linear merging \([Figure˜13](https://arxiv.org/html/2607.20435#A1.F13)\)\.

The lower\-bound test does not extend to TIES at densityd=0\.5d=0\.5: TIES keeps the dominant per\-parameter values from each parent rather than averaging them, so the watermarkedBBside ofB​B′BB^\{\\prime\}is largely preserved and TPR@1% remains high \(∼80\{\\sim\}80–90%90\\%on English,∼82\{\\sim\}82–91%91\\%on German,∼70\{\\sim\}70–88%88\\%on Math\) regardless ofαeff\\alpha\_\{\\mathrm\{eff\}\}\.B​B′BB^\{\\prime\}therefore sits aboveF​B​FFBFat everyαeff\\alpha\_\{\\mathrm\{eff\}\}and the proxy is uninformative; we omit the corresponding figure and instead report the raw values in[Table˜6](https://arxiv.org/html/2607.20435#A1.T6)\.

Table 6:TIES variant of theF​B​FFBFvs\.B​B′BB^\{\\prime\}lower\-bound test \(densityd=0\.5d=0\.5\):Values are TPR@1% FPR \(in %\) atα=0\.5\\alpha=0\.5\.B​B′BB^\{\\prime\}remains substantially higher thanF​B​FFBFin every cell, so the lower\-bound interpretation does not apply on TIES\.F​B​FFBFB​B′BB^\{\\prime\}DomainKGW\-DMATKGW\-DMATEnglish32\.042\.079\.790\.0German9\.940\.181\.791\.3Math5\.734\.770\.087\.7![Refer to caption](https://arxiv.org/html/2607.20435v1/x12.png)Figure 13:F​B​FFBFvs\.B​B′BB^\{\\prime\}lower\-bound test on TPR@1%, full Linear sweepαeff∈\{0\.05,0\.10,…,0\.45\}\\alpha\_\{\\mathrm\{eff\}\}\\in\\\{0\.05,0\.10,\\ldots,0\.45\\\}:Same conventions as[Figure˜12](https://arxiv.org/html/2607.20435#A1.F12): the bound holds where the solid line sits above the dashed line; configurations where it fails \(B​B′\>F​B​FBB^\{\\prime\}\>FBF\) are circled\.
#### A\.3\.3F​FFFvs\. the Single\-FT Baseline

[Table˜7](https://arxiv.org/html/2607.20435#A1.T7)compares the merged\-model TPR@1% against the better of the two single\-finetune baselines \(max of Math FT and German FT, by domain\) for both KGW\-D and MAT across Linear, SLERP, and TIES atα∈\{0\.3,0\.5,0\.7\}\\alpha\\in\\\{0\.3,0\.5,0\.7\\\}\. MAT sits above the single\-FT baseline \(green\) in every Linear and SLERP cell, and dominates on the German domain across all three merge methods\. On TIES, MAT clears the baseline on English and German across all threeα\\alpha, and on Math atα∈\{0\.5,0\.7\}\\alpha\\in\\\{0\.5,0\.7\\\}; the onlyorangecell \(TIES Math atα=0\.3\\alpha=0\.3, within11SE of the baseline\) is unsurprising given that the watermark on Math is intrinsically weak post\-SFT \(∼25\{\\sim\}25–29%29\\%standalone\), leaving little headroom for the merge to add signal\. KGW\-D, by contrast, falls below or within11standard error in 24 of 27 cells and only exceeds the baseline \(green\) on the TIES German rows\. This is structural to TIES rather than a merge\-recovery effect: TIES keeps the dominant per\-parameter values from each parent, so the strong watermark signal inBBthat survives at standalone is preserved through the merge on the German domain, while Linear and SLERP dilute it\. In other words, KGW\-D cannot recover the signal beyond the single\-finetune baseline under Linear and SLERP, while MAT consistently preserves or recovers it under Linear and SLERP and on the TIES German rows\.

Table 7:F​FFFvs\. single\-FT baseline:F​FFFover Linear, SLERP, TIES atα∈\{0\.3,0\.5,0\.7\}\\alpha\\in\\\{0\.3,0\.5,0\.7\\\}\. Values are TPR@1% FPR \(in %\)\. Cells coloured relative to the*better*of the two single\-finetune baselines per \(method, domain\) \(i\.e\., the max of theMath FTandGerman FTrows in[Table˜5](https://arxiv.org/html/2607.20435#A1.T5)\):above by\>1\>1SE,within±1\\pm 1SE,below by\>1\>1SE, where SE is the per\-column binomial standard error of TPR@1% onn=500n=500prompts\.EnglishGermanMathMethodα\\alphaKGW\-DMATKGW\-DMATKGW\-DMATLinear0\.328\.449\.641\.879\.810\.339\.70\.532\.646\.626\.072\.55\.042\.10\.729\.439\.010\.251\.49\.744\.0SLERP0\.326\.440\.238\.684\.48\.049\.00\.534\.847\.021\.670\.48\.353\.00\.729\.444\.412\.649\.411\.756\.0TIES0\.330\.445\.656\.076\.49\.131\.30\.530\.249\.453\.678\.010\.732\.90\.731\.444\.059\.276\.410\.437\.0

#### A\.3\.4Unwatermarked\-Parent Merges \(B​F′BF^\{\\prime\}andB​B′BB^\{\\prime\}\)

[Figures˜14](https://arxiv.org/html/2607.20435#A1.F14),[15](https://arxiv.org/html/2607.20435#A1.F15)and[16](https://arxiv.org/html/2607.20435#A1.F16)report the per\-domainB​F′BF^\{\\prime\}recovery sweeps for the three community finetunes \(FuseChat\[[42](https://arxiv.org/html/2607.20435#bib.bib42)\], OpenMath\[[43](https://arxiv.org/html/2607.20435#bib.bib43)\], Tulu\[[44](https://arxiv.org/html/2607.20435#bib.bib44)\]\) and[Figure˜17](https://arxiv.org/html/2607.20435#A1.F17)theB​B′BB^\{\\prime\}recovery against the unwatermarkedLlama\-3\.1\-8B\-Instructbase\. Under Linear and SLERP, MAT keeps the watermark detectable down to smaller fractions of the watermarked baseBBthan KGW\-D in every domain\. TIES behaves differently: onB​F′BF^\{\\prime\}it remains in the moderately\-detectable regime for both methods \(KGW\-D∼40\{\\sim\}40–76%76\\%, MAT∼70\{\\sim\}70–86%86\\%across domains\), with MAT consistently∼\\sim8–12 pp above KGW\-D; onB​B′BB^\{\\prime\}TIES stays high but no longer fully saturated, with KGW\-D at∼70\{\\sim\}70–82%82\\%and MAT at∼88\{\\sim\}88–91%91\\%\.

![Refer to caption](https://arxiv.org/html/2607.20435v1/x13.png)Figure 14:B​F′BF^\{\\prime\}FuseChat\[[42](https://arxiv.org/html/2607.20435#bib.bib42)\]recovery:TPR@1% as a function ofα\\alpha= fraction of the watermarkedBBinB⊗FuseChatB\\otimes\\text\{FuseChat\}, where FuseChat is a community finetune ofLlama\-3\.1\-8B\-Instruct\[[46](https://arxiv.org/html/2607.20435#bib.bib46)\]\.![Refer to caption](https://arxiv.org/html/2607.20435v1/x14.png)Figure 15:B​F′BF^\{\\prime\}OpenMath\[[43](https://arxiv.org/html/2607.20435#bib.bib43)\]recovery:TPR@1% as a function ofα\\alpha= fraction of the watermarkedBBinB⊗OpenMathB\\otimes\\text\{OpenMath\}, where OpenMath is a community finetune of theLlama\-3\.1\-8Bbase model\[[46](https://arxiv.org/html/2607.20435#bib.bib46)\]\. Same conventions as[Figure˜14](https://arxiv.org/html/2607.20435#A1.F14)\.![Refer to caption](https://arxiv.org/html/2607.20435v1/x15.png)Figure 16:B​F′BF^\{\\prime\}Tulu\[[44](https://arxiv.org/html/2607.20435#bib.bib44)\]recovery:TPR@1% as a function ofα\\alpha= fraction of the watermarkedBBinB⊗TuluB\\otimes\\text\{Tulu\}, where Tulu is a community finetune of theLlama\-3\.1\-8Bbase model\[[46](https://arxiv.org/html/2607.20435#bib.bib46)\]\. Same conventions as[Figure˜14](https://arxiv.org/html/2607.20435#A1.F14)\.![Refer to caption](https://arxiv.org/html/2607.20435v1/x16.png)Figure 17:B​B′BB^\{\\prime\}recovery:TPR@1% as a function ofα\\alpha= fraction of the watermarkedBBinB⊗Bunwm′B\\otimes B^\{\\prime\}\_\{\\text\{unwm\}\}, whereBunwm′B^\{\\prime\}\_\{\\text\{unwm\}\}is the unwatermarkedLlama\-3\.1\-8B\-Instructbase\[[46](https://arxiv.org/html/2607.20435#bib.bib46)\]\.
#### A\.3\.5Post\-Merge Benchmark Results forF​FFFandB​FBF

[Table˜3](https://arxiv.org/html/2607.20435#A1.T3)reports lm\-eval\-harness accuracies for the unwatermarked base, the two watermarked bases \(KGW\-D,MAT KGW\-D\), and the per\-domain finetunes*prior to merging*\.[Table˜8](https://arxiv.org/html/2607.20435#A1.T8)reports the same suite of benchmarks on the*merged*checkpoints in the two main all\-watermarked merge configurations from[Section˜4\.1](https://arxiv.org/html/2607.20435#S4.SS1):F​FFF\(Math FT⊗\\otimesGerman FT\) andB​FBF\(the watermarked baseBBpaired with each per\-domain finetune\)\. The objective is to verify that our merge\-adversary objective does not degrade downstream capability of the merged checkpoint relative to theKGW\-Dbaseline at matched merge configuration\.

Table 8:Post\-merge benchmark results forF​FFFandB​FBF:Per\-task downstream accuracy and per\-language reference perplexity of the merged models for theF​FFFandB​FBFscenarios at SLERPα∈\{0\.5,0\.7\}\\alpha\\in\\\{0\.5,0\.7\\\}, for bothKGW\-DandMAT KGW\-D\. Accuracy cells are coloured relative to the unwatermarked Instruct baseline \([Table˜3](https://arxiv.org/html/2607.20435#A1.T3),Basesblock\):≥95%\{\\geq\}95\\%,≥90%\{\\geq\}90\\%,<90%\{<\}90\\%\. PPL is measured under theLlama\-2\-13Breference model on the same per\-language corpora used in[Table˜4](https://arxiv.org/html/2607.20435#A1.T4)Accuracy \[%\]PPLScenarioα\\alphaVariantARCMMLUHeSwGSM8KMATHMMLU\_DEMMLU\_FRENDEFRF​FFF\(MathFT⊗\\otimesGermanFT\)0\.5KGW\-D56\.765\.571\.476\.742\.054\.753\.85\.424\.655\.86MAT KGW\-D56\.764\.871\.176\.543\.054\.754\.75\.684\.555\.420\.7KGW\-D55\.865\.270\.977\.744\.054\.753\.55\.415\.065\.88MAT KGW\-D55\.864\.570\.577\.045\.054\.754\.05\.695\.115\.41B​FBF\(B⊗\\otimesMathFT\)0\.5KGW\-D56\.265\.372\.782\.144\.554\.356\.45\.405\.685\.90MAT KGW\-D56\.064\.873\.082\.445\.553\.957\.05\.695\.655\.450\.7KGW\-D55\.764\.572\.282\.145\.953\.455\.45\.405\.705\.89MAT KGW\-D55\.964\.072\.182\.346\.953\.356\.55\.705\.695\.42

### A\.4Generalization Across Watermark Families and Architectures

#### A\.4\.1Watermark Families

[Table˜9](https://arxiv.org/html/2607.20435#A1.T9)summarises standalone \(un\-merged\) detection and quality for the AAR and KTH watermark variants on English\.[Figure˜18](https://arxiv.org/html/2607.20435#A1.F18)and[Figure˜19](https://arxiv.org/html/2607.20435#A1.F19)show the post\-merge TPR@1% recovery on English under theB​B′BB^\{\\prime\}merge across Linear, SLERP, and TIES for AAR and KTH, respectively: in both schemes, the baseline distillation \(AAR\-D,KTH\-D\), distilled as in\[[8](https://arxiv.org/html/2607.20435#bib.bib8)\], collapses post\-merge while MAT preserves detectability acrossα\\alpha\. ForGaussMark\[[9](https://arxiv.org/html/2607.20435#bib.bib9)\]we report the baseline detection collapse under merging and discuss it separately in App\.[A\.4\.3](https://arxiv.org/html/2607.20435#A1.SS4.SSS3)\. TheQwen\-2\.5\-3B\-Instruct\[[49](https://arxiv.org/html/2607.20435#bib.bib49)\]ablation underB​B′BB^\{\\prime\}is reported separately in[Table˜10](https://arxiv.org/html/2607.20435#A1.T10)\.

BothAAR\-DandKTH\-Dreproduce the merge\-collapse pattern we observed forKGW\-D: atα=0\.5\\alpha=0\.5under SLERP / LinearB​B′BB^\{\\prime\}, post\-merge TPR@1% drops from∼87\{\\sim\}87–90%90\\%standalone to∼7%\{\\sim\}7\\%\(AAR\-D\) and∼2%\{\\sim\}2\\%\(KTH\-D\)\. ForMAT AARandMAT KTHwe apply only the merge\-adversary training on top of the standard distillation; the top\-kklogit restriction we use forMAT KGW\-Dis not applied here\. Even without that additional component, the merge\-adversary objective alone recovers detection to∼88%\{\\sim\}88\\%\(MAT AAR\) and∼87%\{\\sim\}87\\%\(MAT KTH\) atα=0\.5\\alpha=0\.5, a\+80\+80to\+85\+85pp gain, while leaving standalone detection and generation quality essentially unchanged \([Table˜9](https://arxiv.org/html/2607.20435#A1.T9)\)\. The merge\-induced collapse is therefore not specific toKGWand the merge\-adversary objective transfers to other watermark families\.

Table 9:Standalone watermark\-family ablation onLlama\-3\.1\-8B\-Instruct, English \(C4\):Pre\-merge detection and quality for the AAR and KTH watermark variants\. Post\-merge results underB​B′BB^\{\\prime\}across Linear, SLERP, and TIES are in[Figure˜18](https://arxiv.org/html/2607.20435#A1.F18)\(AAR\) and[Figure˜19](https://arxiv.org/html/2607.20435#A1.F19)\(KTH\)\. GaussMark is reported separately in App\.[A\.4\.3](https://arxiv.org/html/2607.20435#A1.SS4.SSS3)\.DetectionQualitySchemeVariantTPR@1%PPLrep\-3AARAAR\-D87\.75\.270\.073MAT AAR\(ours\)84\.75\.680\.093KTHKTH\-D89\.76\.80\.090MAT KTH\(ours\)88\.56\.20\.097![Refer to caption](https://arxiv.org/html/2607.20435v1/x17.png)Figure 18:AARB​B′BB^\{\\prime\}scenario on English domain:TPR@1% as a function ofα\\alpha= fraction of the watermarked AAR baseBBinB​B′BB^\{\\prime\}, across Linear, SLERP, and TIES\.AAR\-D\(dashed, open markers\) collapses on Linear/SLERP atα≤0\.5\\alpha\\leq 0\.5;MAT AARpreserves detectability down toα=0\.3\\alpha=0\.3\. TIES is saturated for both variants\.![Refer to caption](https://arxiv.org/html/2607.20435v1/x18.png)Figure 19:KTHB​B′BB^\{\\prime\}scenario on English domain:TPR@1% as a function ofα\\alpha= fraction of the watermarked KTH baseBBinB​B′BB^\{\\prime\}, across Linear, SLERP, and TIES\.KTH\-D\(dashed, open markers\) collapses on Linear/SLERP atα≤0\.4\\alpha\\leq 0\.4;MAT KTH\(solid, filled markers\) preserves detectability fromα=0\.4\\alpha=0\.4upward\. TIES is saturated for both variants\.
#### A\.4\.2Qwen\-2\.5\-3B\-Instruct Model

[Table˜10](https://arxiv.org/html/2607.20435#A1.T10)reports the same merge\-recovery effect on a different base architecture:Qwen\-2\.5\-3B\-Instruct\[[49](https://arxiv.org/html/2607.20435#bib.bib49)\]\(δ=2\.3\\delta=2\.3,γ=0\.25\\gamma=0\.25; logit\-processor reference 100% TPR@1%, PPL = 11\.67, rep\-3 = 0\.041\), evaluated on English \(C4\) under theB​B′BB^\{\\prime\}merge with the unwatermarkedQwen\-2\.5\-3B\-Instruct\.

We did not retune any of the MAT hyperparameters when porting them fromLlama\-3\.1\-8B\-Instruct: the sameδ\\delta,γ\\gamma, top\-kkrestriction, and merge\-adversaryα\\alphaschedule were applied directly\. Even with this transfer,MAT KGW\-Dimproves post\-merge English TPR@1% underB​B′BB^\{\\prime\}by\+17\+17to\+20\+20pp atα∈\{0\.5,0\.7\}\\alpha\\in\\\{0\.5,0\.7\\\}over theKGW\-Dbaseline \([Table˜10](https://arxiv.org/html/2607.20435#A1.T10)\)\. The gain shrinks atα=0\.3\\alpha=0\.3where the unwatermarked Qwen parent dominates the merge, but the qualitative recovery pattern matches theLlamabase, suggesting the merge\-adversary objective does not require base\-specific tuning to provide a benefit\.

Table 10:Qwen\-2\.5\-3B\-InstructB​B′BB^\{\\prime\}merge ablation:TPR@1% under SLERPB​B′BB^\{\\prime\}acrossα∈\{0\.3,0\.5,0\.7\}\\alpha\\in\\\{0\.3,0\.5,0\.7\\\}on English \(C4\)\.KGW\-D= standard KGW logit distillation applied to Qwen\-2\.5\-3B\-Instruct;MAT KGW\-D= the same with merge\-adversary training and top\-kk\.Δ\\Delta= MAT KGW\-D−\-KGW\-D \(in pp\); cells coloured≥\+10\{\\geq\}\{\+\}10pp,≥\+3\{\\geq\}\{\+\}3pp, uncolored<\+3\{<\}\{\+\}3pp\.TPR@1%Mergeα\\alphaKGW\-DMAT KGW\-D\(ours\)Δ\\DeltaB​B′BB^\{\\prime\}\(SLERP\)0\.39\.013\.8\+4\.80\.527\.444\.8\+17\.40\.758\.478\.4\+20\.0
#### A\.4\.3GaussMark

GaussMark\[[9](https://arxiv.org/html/2607.20435#bib.bib9)\]is a weight\-space watermark: instead of biasing logits or modifying sampling, it perturbs a fixed subset of the model parameters with low\-amplitude Gaussian noise drawn from a key\-dependent distribution, and detection runs a likelihood\-ratio test on those parameters\.

We applyGaussMarktoLlama\-3\.1\-8B\-Instructas described inBlock et al\. \[[9](https://arxiv.org/html/2607.20435#bib.bib9)\], and then run the sameB​B′BB^\{\\prime\}merge sweep used forKGW\-D\. Standalone \(no merge\), the watermarked model reaches∼89%\{\\sim\}89\\%TPR@1% on English \([Table˜11](https://arxiv.org/html/2607.20435#A1.T11)\)\. UnderB​B′BB^\{\\prime\}atα=0\.5\\alpha=0\.5under SLERP, it drops to∼34%\{\\sim\}34\\%TPR@1% \([Figure˜20](https://arxiv.org/html/2607.20435#A1.F20)\), the same collapse pattern we observe forKGW\-D,AAR\-D, andKTH\-D\.

The GaussMark panel in[Figure˜7](https://arxiv.org/html/2607.20435#S4.F7)reports the baseline collapse and is included to underline that the collapse is not an artefact of any single watermarking mechanism\.

Table 11:Standalone GaussMark ablation onLlama\-3\.1\-8B\-Instruct, English \(C4\):DetectionQualityVariantTPR@1%PPLrep\-3GaussMark89\.04\.060\.061![Refer to caption](https://arxiv.org/html/2607.20435v1/x19.png)Figure 20:GaussMarkB​B′BB^\{\\prime\}merge scenario on English domain:TPR@1% under theB​B′BB^\{\\prime\}merge as a function ofα\\alpha= fraction of the watermarked GaussMark baseBB, across Linear, SLERP, and TIES\.

## Appendix BAblations

In this section, we ablate the components of our method presented in[Section˜3\.1](https://arxiv.org/html/2607.20435#S3.SS1)\.

##### Experimental Setup

All ablations are run onLlama\-3\.2\-1B\-Instructfor7 5007\\,500steps \(LR =1​e−51\\mathrm\{e\}\{\-\}5,500500\-step warm\-up, cosine decay\)\. The Hyperparameters are otherwise identical to the fullLlama\-3\.1\-8B\-Instructtraining described in[Section˜A\.1](https://arxiv.org/html/2607.20435#A1.SS1)\. We vary one hyperparameter at a time from the baseline settings\(k=200,αmin=0\.1,δ=2\.0\)\(k\\\!=\\\!200,\\,\\alpha\_\{\\min\}\\\!=\\\!0\.1,\\,\\delta\\\!=\\\!2\.0\)and then validate the joint best in a second pass\. The hyperparameters used in[Section˜3](https://arxiv.org/html/2607.20435#S3)correspond to the bolded row in each table:δ=2\.3\\delta\\\!=\\\!2\.3,k=100k\\\!=\\\!100,αmin=0\.1\\alpha\_\{\\min\}\\\!=\\\!0\.1\. Each row reports standalone \(un\-merged\) TPR@1% on C4 with PPL and seq\-rep\-3, alongside post\-merge TPR@1% under Linear merging atα=0\.5\\alpha\\\!=\\\!0\.5as the headline robustness number\.

### B\.1Top\-kkGating \(kk\)

kkcontrols how many top\-ranked teacher tokens the watermark delta is applied to\.[Table˜12](https://arxiv.org/html/2607.20435#A2.T12)sweepsk∈\{50,100,200,300,500\}k\\in\\\{50,100,200,300,500\\\}\. Post\-merge robustness broadly trends upward withkkat the cost of PPL;k=100k\\\!=\\\!100gives the best PPL/robustness trade\-off \(lower PPL than the base while matching its post\-merge TPR\), staying within11pp of the base standalone TPR, so we move it into the joint search\. Compared to the no\-gating baseline ofGu et al\. \[[8](https://arxiv.org/html/2607.20435#bib.bib8)\], restricting watermark distillation to the top\-kklogits lowers PPL while leaving standalone TPR essentially unchanged \(within∼\\sim2 pp\)\.

Table 12:Top\-kkablation:Varykk; holdαmin=0\.1\\alpha\_\{\\min\}\\\!=\\\!0\.1,δ=2\.0\\delta\\\!=\\\!2\.0\. Standalone and post\-merge TPR@1% in %; PPL onLlama\-3\.2\-1B\. Best checkpoint values reported\.kkTPR@1% \(st\.\)PPLTPR@1% \(α=0\.5\\alpha\\\!=\\\!0\.5\)seq\-rep\-35095\.75\.5855\.70\.09710095\.35\.9060\.00\.094200 \(base\)96\.06\.2559\.70\.08330097\.36\.2865\.70\.09450096\.76\.4567\.00\.089
### B\.2Watermark Strength \(δ\\delta\)

δ\\deltais the green\-list bias added by the teacher\. Higherδ\\deltaproduces a stronger watermark signal but degrades quality\.[Table˜13](https://arxiv.org/html/2607.20435#A2.T13)sweepsδ∈\{1\.0,2\.0,2\.3,2\.5,2\.7\}\\delta\\in\\\{1\.0,2\.0,2\.3,2\.5,2\.7\\\}\.δ=1\.0\\delta\\\!=\\\!1\.0is too weak \(standalone TPR∼55%\\sim\\\!55\\%\);δ=2\.3\\delta\\\!=\\\!2\.3gives the cleanest robustness/quality trade\-off, substantially improving post\-merge TPR over the base without the PPL inflation we see atδ=2\.5\\delta\\\!=\\\!2\.5/2\.72\.7\.

Table 13:Watermark\-strength ablation:Varyδ\\delta; holdk=200k\\\!=\\\!200,αmin=0\.1\\alpha\_\{\\min\}\\\!=\\\!0\.1\. Best checkpoint values reported\.δ\\deltaTPR@1% \(st\.\)PPLTPR@1% \(α=0\.5\\alpha\\\!=\\\!0\.5\)seq\-rep\-31\.055\.34\.9811\.70\.0772\.0 \(base\)96\.06\.2559\.70\.0832\.398\.36\.6976\.70\.0742\.599\.07\.1189\.30\.0862\.799\.07\.8289\.70\.068
### B\.3Merge\-Adversary Lower Bound \(αmin\\alpha\_\{\\min\}\)

The merge adversary samplesα∼𝒰​\(αmin,1\)\\alpha\\sim\\mathcal\{U\}\(\\alpha\_\{\\min\},1\)at each step\. Lowerαmin\\alpha\_\{\\min\}exposes the student to more aggressive merges\.[Table˜14](https://arxiv.org/html/2607.20435#A2.T14)sweepsαmin∈\{0\.1,0\.3,0\.5\}\\alpha\_\{\\min\}\\in\\\{0\.1,0\.3,0\.5\\\}\. Robustness drops sharply asαmin\\alpha\_\{\\min\}rises: atαmin=0\.5\\alpha\_\{\\min\}\\\!=\\\!0\.5, post\-merge TPR@1% drops by a third vs the base, because the model never trains againstα<0\.5\\alpha<0\.5\.αmin=0\.1\\alpha\_\{\\min\}\\\!=\\\!0\.1wins clearly and we keep it for the joint config\.

Table 14:Merge\-adversary lower\-bound ablation:Varyαmin\\alpha\_\{\\min\}; holdk=200k\\\!=\\\!200,δ=2\.0\\delta\\\!=\\\!2\.0\. Best checkpoint values reported\.αmin\\alpha\_\{\\min\}TPR@1% \(st\.\)PPLTPR@1% \(α=0\.5\\alpha\\\!=\\\!0\.5\)seq\-rep\-30\.1\(base\)96\.06\.2559\.70\.0830\.397\.36\.4654\.00\.0850\.597\.76\.3740\.30\.083
### B\.4Joint Search

[Table˜15](https://arxiv.org/html/2607.20435#A2.T15)validates the per\-parameter winners \(k=100k\\\!=\\\!100,αmin=0\.1\\alpha\_\{\\min\}\\\!=\\\!0\.1\) jointly with aδ\\deltasweep, fixing the other parameters at base\. The headline trade\-off isδ\\deltavs PPL:δ=2\.5\\delta\\\!=\\\!2\.5recovers88\.3%88\.3\\%atα=0\.5\\alpha\\\!=\\\!0\.5but pays\+0\.90\+0\.90PPL overδ=2\.0\\delta\\\!=\\\!2\.0, whileδ=2\.3\\delta\\\!=\\\!2\.3recovers80\.3%80\.3\\%atα=0\.5\\alpha\\\!=\\\!0\.5for only\+0\.26\+0\.26PPL\. We choose𝜹=2\.3,𝒌=𝟏𝟎𝟎,𝜶𝐦𝐢𝐧=0\.1\\boldsymbol\{\\delta\\\!=\\\!2\.3,\\,k\\\!=\\\!100,\\,\\alpha\_\{\\min\}\\\!=\\\!0\.1\}as the main\-paper config: best PPL/robustness frontier without the seq\-rep\-3 risk of higherδ\\delta\. Increasingkkfrom100100back to200200at the sameδ\\deltaslightly hurts both robustness \(−3\.3\-3\.3pp\) and PPL, confirmingk=100k\\\!=\\\!100as the joint\-best\.

Table 15:Joint search:Combine the per\-parameter winners \(αmin=0\.1\\alpha\_\{\\min\}\\\!=\\\!0\.1throughout\) with aδ\\deltasweep; the row inboldis the main\-paper configuration\.kkδ\\deltaTPR@1% \(st\.\)PPLTPR@1% \(α=0\.5\\alpha\\\!=\\\!0\.5\)seq\-rep\-31002\.096\.76\.3260\.30\.0861002\.298\.06\.5679\.70\.0801002\.397\.06\.5880\.30\.0822002\.397\.76\.8277\.00\.0781002\.597\.37\.2288\.30\.081
### B\.5Importance of Samplingα\\alpha

We test whether samplingα\\alphamatters at all by replacing the uniform adversary withα\\alpha*fixed*at0\.30\.3\.[Table˜16](https://arxiv.org/html/2607.20435#A2.T16)shows the fixed\-α\\alpharun sits below the sampled baseline at*every*evaluatedα\\alpha, including0\.30\.3itself; robustness collapses away from the training point \(2\.7%2\.7\\%atα=0\.1\\alpha\\\!=\\\!0\.1,40\.0%40\.0\\%atα=0\.5\\alpha\\\!=\\\!0\.5,−19\.7\-19\.7pp vs\. baseline\) and PPL rises sharply \(9\.359\.35vs\.6\.256\.25\) as the student over\-fits the single training point\. Uniformα\\alphasampling outperforms the fixed\-α\\alphaschedule at everyα\\alphaand at standalone PPL, which is why we adopt it as our default\.

Table 16:Sampled vs\. fixed merge\-adversaryα\\alpha:Post\-merge TPR@1% across the fullα\\alpharange \(Linear merging on C4\)\. Top row: the default merge adversary, which samplesα∼𝒰​\(0\.1,1\)\\alpha\\sim\\mathcal\{U\}\(0\.1,1\)at every training step \(same configuration asαmin=0\.1\\alpha\_\{\\min\}\\\!=\\\!0\.1in[Table˜14](https://arxiv.org/html/2607.20435#A2.T14)\)\.Merge\-adversaryα\\alphaPost\-merge TPR@1% at evalα=⋅\\alpha\\\!=\\\!\\cdotStandalone TPR@1%PPL0\.10\.30\.50\.70\.9α∼𝒰​\(0\.1,1\)\\alpha\\sim\\mathcal\{U\}\(0\.1,1\)\(sampled, default\)12\.738\.759\.781\.093\.796\.06\.25Fixedα=0\.3\\alpha\\\!=\\\!0\.3\(no sampling\)2\.710\.040\.070\.091\.396\.79\.35

## Appendix CExisting Assets and Licenses

We use the following existing datasets and models\. We list the license names as reported by the corresponding dataset or model cards, repositories, or project pages\.

##### Datasets\.

- •Alpaca\-GPT4: Creative Commons Attribution\-NonCommercial 4\.0 International \(CC BY\-NC 4\.0\)\.
- •OpenWebText: Creative Commons Zero v1\.0 Universal \(CC0 1\.0\) for the dataset packaging; the dataset creators state that they do not own the underlying extracted text\.
- •Alpaca\-GPT4\-DE: Apache License 2\.0\.
- •FineWeb\-2: Open Data Commons Attribution License v1\.0 \(ODC\-BY 1\.0\)\.
- •MetaMathQA: MIT License\.
- •CodeAlpaca: Creative Commons Attribution 4\.0 International \(CC BY 4\.0\) for the dataset release\.
- •NuminaMath\-CoT: Apache License 2\.0\.
- •Evol\-Instruct\-DE: Apache License 2\.0\.
- •French\-Alpaca: Apache License 2\.0\.
- •Lucie Training Dataset: Creative Commons Attribution\-NonCommercial\-ShareAlike 4\.0 International \(CC BY\-NC\-SA 4\.0\)\.
- •C4: Open Data Commons Attribution License v1\.0 \(ODC\-BY 1\.0\)\.
- •GSM8K: MIT License\.
- •ARC\-Challenge: Creative Commons Attribution\-ShareAlike 4\.0 International \(CC BY\-SA 4\.0\)\.
- •MMLU: MIT License\.
- •HellaSwag: MIT License\.
- •MATH: MIT License\.

##### Models\.

- •Llama\-3\.1\-8B\-Instruct: Llama 3\.1 Community License\.
- •Qwen\-2\.5\-3B\-Instruct: Qwen Research License Agreement\.
- •Llama\-2\-13B: Llama 2 Community License Agreement\.
- •FuseChat\-Llama\-3\.1\-8B\-Instruct: Apache License 2\.0 as listed by its model card; because it is derived fromLlama\-3\.1\-8B\-Instruct, we also treat it as subject to the Llama 3\.1 Community License\.
- •OpenMath2\-Llama3\.1\-8B: Llama 3\.1 Community License\.
- •Llama\-3\.1\-Tulu\-3\-8B: Llama 3\.1 Community License\.

## Appendix DBroader Impacts

Our work aims to make provenance signals for open\-source LLMs more durable under common downstream modifications\. A positive impact is that robust watermarking can help model providers, auditors, and researchers attribute generated text after benign post\-training workflows such as finetuning and model merging\. This can support accountability and make deployed open\-source systems easier to monitor\.

The same capability also has limitations and risks\. Watermark detection can be misinterpreted if users ignore false\-positive rates, key\-management assumptions, or the possibility that downstream transformations fall outside the evaluated threat model\. More robust watermarks may also strengthen unilateral control over models after release, so deployments should pair detection claims with transparent operating thresholds, appeals or audit procedures where relevant, and clear communication about the detector’s scope\.