SAC-Copula: Quality-Preserving Watermarking for Diffusion Language Models via Smooth Correlated Gumbel Fields

# SAC-Copula: Quality-Preserving Watermarking for Diffusion Language Models via Smooth Correlated Gumbel Fields
Source: [https://arxiv.org/html/2608.20839](https://arxiv.org/html/2608.20839)
Haiyun HeAffiliation:The Hong Kong University of Science and Technology \(Guangzhou\)Affiliation:baixinli31@connect\.hku\.hk, haiyunhe@hkust\-gz\.edu\.cn

###### Abstract

Watermarking diffusion language models \(DLMs\) requires mechanisms compatible with iterative parallel unmasking rather than autoregressive decoding\. Existing sampling\-based watermarking methods typically inject position\-wise i\.i\.d\. perturbations, which can be poorly aligned with DLM decoding dynamics and degrade generation quality\. We propose SAC\-Copula, a quality\-preserving watermarking method for DLMs based on smooth, locally correlated Gumbel perturbation fields constructed via a Gaussian copula\. We further develop a SAC\-aware detector using covariance\-aware filtering and native\-sample calibration\. Mechanism\-level analysis shows that local correlation reduces latent perturbation roughness and better matches iterative refinement dynamics\. Experiments on LLaDA show that SAC\-Copula achieves a favorable quality–detectability trade\-off compared with existing baselines\. In particular, further evaluations on Dream\-7B and additional datasets show that SAC\-Copula substantially improves PPL tail stability over the i\.i\.d\. Gumbel baseline, while maintaining strong low\-FPR detectability and competitive overall generation quality\. Additional token\-edit stress tests further assess watermark robustness under controlled synchronization drift\.

![Refer to caption](https://arxiv.org/html/2608.20839v1/fig1_sac_motivation_iid_vs_sac.png)Figure 1:Motivation for smooth watermark fields in DLM decoding\. Position\-indexed i\.i\.d\. Gumbel perturbations create independent high\-frequency noises across neighboring positions, whereas SAC\-Copula introduces controlled low\-lag dependence while preserving one\-coordinate Gumbel marginals\. Token examples are illustrative rather than deterministic generation outcomes\.![Refer to caption](https://arxiv.org/html/2608.20839v1/fig2_sac_workflow_generation_detection.png)Figure 2:Overview of SAC\-Copula\. The generation side constructs a locally correlated Gumbel tape through variance\-normalized convolution, dual\-stream mixing, and a Gaussian\-copula transform, then injects it at currently masked generated positions during DLM refinement\. The detection side reads token\-level evidence and applies SAC\-aware filtering with thresholds calibrated on native, unwatermarked samples\. GO\-FFR is shown only as an auxiliary diagnostic for controlled insertion/deletion edits\.## 1Introduction

As Large Language Models \(LLMs\) become widely deployed, it becomes increasingly critical to establish a safety line between LLMs and humans, where one important brick is to distinguish the model\-generated content from the human\-created one\. Watermarking offers a practical route: a generator embeds a private statistical signal during content decoding, and a detector later tests whether a text carries that signal via a shared secret key\.

Most existing language\-model watermarking methods are developed for autoregressive LLMs, including green\-list token biasing, sampling\-based or distortion\-free schemes, robust watermarking variants, and multi\-bit identification mechanisms\([14](https://arxiv.org/html/2608.20839#bib.bib17);[16](https://arxiv.org/html/2608.20839#bib.bib5);[27](https://arxiv.org/html/2608.20839#bib.bib22);[24](https://arxiv.org/html/2608.20839#bib.bib23)\)\. In these methods, watermark signals are typically synchronized with the left context and tokens are generated sequentially from left to right conditioned on the prefix and watermark signal\. In contrast, Diffusion Language Models \(DLMs\), such as LLaDA\([18](https://arxiv.org/html/2608.20839#bib.bib3)\), generate text through iterative masked denoising, where multiple positions are updated in parallel and previously generated tokens can be revised across steps\. This non\-sequential and dynamically coupled decoding process makes watermark design fundamentally different from the autoregressive setting\. In particular, watermarking schemes based on i\.i\.d\. injected signals are poorly matched to DLM decoding dynamics, which can disrupt local refinement consistency across denoising steps\. This may lead to degraded generation quality, including unstable neighboring predictions, semantic inconsistency, degraded fluency, and refinement oscillation\. Figure[1](https://arxiv.org/html/2608.20839#S0.F1)shows an illustrative example that compares i\.i\.d\. and correlated perturbations\.

### 1\.1Related Works

#### Autoregressive and sampling\-based watermarking\.

A large body of LLM watermarking work embeds keyed statistical signals during autoregressive decoding and detects them under a false\-positive constraint\([14](https://arxiv.org/html/2608.20839#bib.bib17);[17](https://arxiv.org/html/2608.20839#bib.bib1)\)\. Stronger watermark signals can improve detection power but may degrade fluency, semantic fidelity, or diversity, motivating selective, adaptive, and quality\-aware objectives\([22](https://arxiv.org/html/2608.20839#bib.bib2);[8](https://arxiv.org/html/2608.20839#bib.bib7);[10](https://arxiv.org/html/2608.20839#bib.bib8)\)\. A related line uses Gumbel\-max, inverse\-transform, or distortion\-free sampling ideas to embed keyed randomness under specific sampling and security assumptions\([1](https://arxiv.org/html/2608.20839#bib.bib26);[5](https://arxiv.org/html/2608.20839#bib.bib4);[4](https://arxiv.org/html/2608.20839#bib.bib19)\)\. This paper follows the sampling\-based watermarking paradigm, while explicitly adapting the design to DLM decoding dynamics\.

#### DLM watermarking\.

Some recent works have started to explore designing watermarking methods adapted to DLMs\.[9](https://arxiv.org/html/2608.20839#bib.bib6)propose the first watermark tailored for DLMs by applying the green\-red list watermarking\([14](https://arxiv.org/html/2608.20839#bib.bib17)\)in expectation over partially observed contexts and promoting tokens that strengthen future watermark signals\. To address the non\-sequential decoding process, some works\([23](https://arxiv.org/html/2608.20839#bib.bib21);[20](https://arxiv.org/html/2608.20839#bib.bib25)\)further consider synchronizing watermark signals using both left and right contexts\. Instead of directly perturbing token probabilities,[11](https://arxiv.org/html/2608.20839#bib.bib24)embed watermark by steering the decoding order to improve quality preservation in DLMs\.

More closely related to our work,[2](https://arxiv.org/html/2608.20839#bib.bib20)apply Gumbel\-max watermarking[1](https://arxiv.org/html/2608.20839#bib.bib26)to diffusion decoding using sequence\-position\-indexed randomness\. Although this approach is theoretically distribution\-preserving, the injected i\.i\.d\. Gumbel perturbations are not well aligned with DLM decoding dynamics, as discussed earlier, and can degrade generated text quality in practice\. Existing Gumbel\-based methods primarily focus on how randomness is indexed across positions\. In contrast, we argue that the*joint structure*of the perturbation field is itself a critical design dimension for DLM watermarking\. Under iterative refinement decoding, independent high\-frequency perturbations across neighboring positions can conflict with local consistency\. Motivated by this observation, we shift the design focus from injecting independent randomness to designing structured perturbation fields whose geometry and smoothness better align with diffusion decoding dynamics and detector evidence geometry\.

The main insight of our paper is that locally smooth and correlated watermark perturbations may be more compatible with DLM decoding than high\-frequency i\.i\.d\. perturbations, motivating the hypothesis of improved generation stability\. Based on this insight, we proposeSAC\-Copula, which constructs correlated Gumbel perturbation fields via a Gaussian copula \(cf\. Figure[1](https://arxiv.org/html/2608.20839#S0.F1)\)\. Under suitable assumptions, SAC\-Copula preserves Gumbel marginals while introducing controlled local dependence across neighboring token positions\. This structured perturbation field is designed to better align with DLM refinement dynamics and supports a strong quality–detectability trade\-off\.

### 1\.2Main Contributions

Our contributions can be summarized as follows:

- •We introduceSAC\-Copula, a DLM watermarking method withSmooth andAuto\-Correlated Gumbel Copula perturbations through a GaussianCopula, which preserves one\-coordinate Gumbel marginals under mild assumptions\. This is a DLM\-aware watermarking perspective that treats the joint geometry of the perturbation field as a key design dimension for DLM decoding\.
- •We provide a mechanism\-level analysis showing that positive low\-lag dependence reduces latent perturbation roughness, decreasing the local\-difference energy fromDi\.i\.d=2D\_\{\\mathrm\{i\.i\.d\}\}=2toDSAC=2​\(1−ρ2​r1\)D\_\{\\mathrm\{SAC\}\}=2\(1\-\\rho^\{2\}r\_\{1\}\)and providing a mechanistic rationale for the DLM\-refinement hypothesis\.
- •We develop a SAC\-aware detector that reads the induced local evidence geometry through covariance\-aware filtering and native\-sample calibration\. For controlled edit diagnostics, we further include a global\-offset scan that provides coarse synchronization recovery under token–signal misalignment\.
- •Experiments on LLaDA show that SAC\-Copula achieves a strong quality–detectability trade\-off, with strong clean detectability and a balanced multi\-dimensional quality profile\. Relative to the matched i\.i\.d\. Gumbel baseline, the clearest generation\-side gain is substantially improved upper\-tail stability\. We further report mild token\-edit stress tests as diagnostic analyses of residual watermark evidence\.

## 2Watermark Injection and Detection

SAC\-Copula replaces position\-indexed i\.i\.d\. Gumbel perturbations with a smooth, locally correlated Gumbel field for DLM decoding\. The generation side defines this field, while the detector provides a matched readout for the induced evidence geometry\. Figure[2](https://arxiv.org/html/2608.20839#S0.F2)summarizes the pipeline\.

#### Baseline i\.i\.d\. Gumbel Watermarking\.

Let𝒱\\mathcal\{V\}be the token vocabulary,j∈𝒱j\\in\\mathcal\{V\}a token,t∈\[T\]t\\in\[T\]a generated\-token position, andnna DLM denoising step\. The direct baseline applies position\-indexed i\.i\.d\. Gumbel perturbations\([2](https://arxiv.org/html/2608.20839#bib.bib20);[1](https://arxiv.org/html/2608.20839#bib.bib26)\),Gi\.i\.d\.​\(t,j\)∼Gumbel⁡\(0,1\)G\_\{\\mathrm\{i\.i\.d\.\}\}\(t,j\)\\sim\\mathrm\{Gumbel\}\(0,1\), to masked\-position logits:

ℓ~n,t,j=ℓn,t,j\+α​Gi\.i\.d\.​\(t,j\),t∈\[T\],j∈𝒱\.\\widetilde\{\\ell\}\_\{n,t,j\}=\\ell\_\{n,t,j\}\+\\alpha G\_\{\\mathrm\{i\.i\.d\.\}\}\(t,j\),\\quad t\\in\[T\],j\\in\\mathcal\{V\}\.Hereℓn,t,j\\ell\_\{n,t,j\}is the clean logit andα\\alphais the perturbation scale\. In the controlled mechanism comparison used in this paper, the direct i\.i\.d\. Gumbel baseline is theρ=0\\rho=0endpoint of the same tape family: settingρ=0\\rho=0removes cross\-position correlation while retaining standard\-Gumbel candidate marginals and the same perturbation scaleα\\alpha\. In the main comparison, both settings useα=1\.0\\alpha=1\.0and temperature1\.01\.0, with the same key/tape interface, prompts, seeds, generation length, diffusion steps, masked\-position injection, decoding, and remasking pipeline\. We do not introduce or tune a separateδ\\delta\-style logit\-bias strength for this matched i\.i\.d\.–SAC comparison;α\\alphais fixed at1\.01\.0, whileWW,σK\\sigma\_\{K\}, andρ\\rhoparameterize the cross\-position dependence structure\.

### 2\.1SAC\-Copula Perturbation Field

SAC\-Copula constructs a locally correlated Gaussian latent field and maps each coordinate to a standard Gumbel variable through a Gaussian copula\. It starts from two independent key\-seeded standard Gaussian position–vocabulary tapesZwhite,1,Zwhite,2Z\_\{\\mathrm\{white\},1\},Z\_\{\\mathrm\{white\},2\}, withZwhite,r​\(t,j\)∼𝒩⁡\(0,1\)Z\_\{\\mathrm\{white\},r\}\(t,j\)\\sim\\mathcal\{N\}\(0,1\)\. LetWWbe an odd window,h=\(W−1\)/2h=\(W\-1\)/2, andσK\\sigma\_\{K\}the kernel shape parameter\. Fork∈\{−h,…,h\}k\\in\\\{\-h,\\ldots,h\\\}, define

KW​\[k\]=exp\(−k2/\(2σK2\)\)∑m=−hhexp\(−m2/\(2σK2\)\)\.K\_\{W\}\[k\]=\\frac\{\\exp\\\!\\left\(\-k^\{2\}/\(2\\sigma\_\{K\}^\{2\}\)\\right\)\}\{\\sum\_\{m=\-h\}^\{h\}\\exp\\\!\\left\(\-m^\{2\}/\(2\\sigma\_\{K\}^\{2\}\)\\right\)\}\.\(1\)For full\-window positions, the normalized spatial branch is

Z~spatial​\(t,j\)=∑k=−hhKW​\[k\]​Zwhite,1​\(t−k,j\)∑k=−hhKW​\[k\]2\.\\widetilde\{Z\}\_\{\\mathrm\{spatial\}\}\(t,j\)=\\frac\{\\sum\_\{k=\-h\}^\{h\}K\_\{W\}\[k\]Z\_\{\\mathrm\{white\},1\}\(t\-k,j\)\}\{\\sqrt\{\\sum\_\{k=\-h\}^\{h\}K\_\{W\}\[k\]^\{2\}\}\}\.\(2\)The final latent field mixes the independent white noise and the normalized spatial stream:

Zfinal​\(t,j\)\\displaystyle Z\_\{\\mathrm\{final\}\}\(t,j\)=1−ρ2​Zwhite,2​\(t,j\)\\displaystyle=\\sqrt\{1\-\\rho^\{2\}\}\\,Z\_\{\\mathrm\{white\},2\}\(t,j\)\(3\)\+ρ​Z~spatial​\(t,j\),\\displaystyle\+\\rho\\,\\widetilde\{Z\}\_\{\\mathrm\{spatial\}\}\(t,j\),whereρ∈\[0,1\]\\rho\\in\[0,1\]controls the local dependence strength\. Under the full\-window or boundary\-normalized convention, this normalization keeps each valid coordinate ofZfinalZ\_\{\\mathrm\{final\}\}standard normal\. Appendices[A\.1](https://arxiv.org/html/2608.20839#A1.SS1)and[A\.2](https://arxiv.org/html/2608.20839#A1.SS2)state the boundary convention and prove the resulting one\-coordinate marginal exactness\.

The correlated Gumbel noise tape is obtained by the Gaussian\-copula transform

Gcorr​\(t,j\)=FG−1​\(Φ⁡\(Zfinal​\(t,j\)\)\)∼Gumbel⁡\(0,1\),G\_\{\\mathrm\{corr\}\}\(t,j\)\\\!=\\\!F\_\{G\}^\{\-1\}\\\!\(\\Phi\(Z\_\{\\mathrm\{final\}\}\(t,j\)\)\)\\\!\\sim\\\!\\operatorname\{Gumbel\}\(0,1\),\(4\)whereΦ\\Phiis the standard Gaussian cumulative distribution function \(CDF\) andFGF\_\{G\}is the standard Gumbel CDF\. Appendix[A\.2](https://arxiv.org/html/2608.20839#A1.SS2)shows that this coordinate\-wise transform preserves one\-coordinate Gumbel marginals under assumptions stated in Appendix[A\.1](https://arxiv.org/html/2608.20839#A1.SS1), while introducing the joint noise tape structure\. Since the perturbations are also independent across vocabulary items at each fixed position, it further implies that the single\-position conditional sampling marginal is preserved:

PYt\|contextSAC=PYt\|contexti\.i\.d\.,P\_\{Y\_\{t\}\\mid\\mathrm\{context\}\}^\{\\mathrm\{SAC\}\}=P\_\{Y\_\{t\}\\mid\\mathrm\{context\}\}^\{\\mathrm\{i\.i\.d\.\}\},where the context denotes all information used to compute the current logits\. This is a fixed\-context, single\-position statement, not invariance of the full generated\-text joint distribution\. Appendix[A\.3](https://arxiv.org/html/2608.20839#A1.SS3)derives the finite\-window latent autocorrelation used by the detector design\.

### 2\.2Injection into LLaDA Decoding

SAC\-Copula noise is injected only into currently masked generated positions\. At a masked generated positiontt, SAC\-Copula perturbs logits before applying the decoding rule:

ℓ~n,t,j=ℓn,t,j\+α​Gcorr​\(t,j\),t∈\[T\],j∈𝒱,\\widetilde\{\\ell\}\_\{n,t,j\}=\\ell\_\{n,t,j\}\+\\alpha G\_\{\\mathrm\{corr\}\}\(t,j\),\\quad t\\in\[T\],j\\in\\mathcal\{V\},\(5\)Hereℓn,t,j\\ell\_\{n,t,j\}is the contemporaneous clean logit from the current partially masked denoising state\. The keyed tapeGcorrG\_\{\\mathrm\{corr\}\}is constructed independently of model logits; the logits determine how the fixed tape perturbation affects token selection, not how the tape itself is constructed\. The perturbation scaleα\\alphais an experimental configuration parameter\. In the main configuration it matches the generation temperature, but this equality is not a theoretical requirement\. Prompt tokens are not perturbed, and remasking confidence is computed from the unperturbed logits\. The same token\-position perturbationGcorr​\(t,⋅\)G\_\{\\mathrm\{corr\}\}\(t,\\cdot\)is reused across denoising steps, indexed by generated token position and token but not by denoising step\.

### 2\.3SAC\-Aware Detector

For a clean fixed\-alignment sequencey=\(y1,…,yT\)y=\(y\_\{1\},\\ldots,y\_\{T\}\), the detector reconstructs the same private keyedGcorrG\_\{\\mathrm\{corr\}\}tape and indexes it with the observed token at each generated position, yielding token\-level watermark evidence𝐬⁡\(y\)=\(s1​\(y\),…,sT​\(y\)\)⊤\\mathbf\{s\}\(y\)=\(s\_\{1\}\(y\),\\ldots,s\_\{T\}\(y\)\)^\{\\top\}, where

st​\(y\)=Gcorr​\(t,yt\)\.s\_\{t\}\(y\)=G\_\{\\mathrm\{corr\}\}\(t,y\_\{t\}\)\.\(6\)The tape reconstruction depends on the private key rather than on a second model evaluation; detection does not recompute fully revealed logits or require an additional language\-model forward pass\. The legacy detector treats these values as exchangeable i\.i\.d\. Gumbel evidence and applies an equal\-weight z\-score; Appendix[B\.1](https://arxiv.org/html/2608.20839#A2.SS1)gives the full old\-score form\. SAC\-Copula intentionally induces low\-lag evidence structure, so relying only on an i\.i\.d\. equal\-weight readout can discard useful local geometry\. We therefore use the Full Filtered Ridge \(FFR\) detector, defined as a ridge\-regularized matched linear statistic after SAC\-aware local filtering and covariance calibration on native samples\.

FFR first centers raw evidence using the Gumbel meanμG\\mu\_\{G\}and a residual mean𝝁^x,0\\widehat\{\\boldsymbol\{\\mu\}\}\_\{x,0\}estimated from held\-out native \(aka\. unwatermarked\) samples generated under the same decoding protocol:

𝐱⁡\(y\)=𝐬⁡\(y\)−μG​𝟏−𝝁^x,0\.\\mathbf\{x\}\(y\)=\\mathbf\{s\}\(y\)\-\\mu\_\{G\}\\mathbf\{1\}\-\\widehat\{\\boldsymbol\{\\mu\}\}\_\{x,0\}\.\(7\)It then applies a SAC\-aware local feature map

𝐮⁡\(y\)=Hω​𝐱​\(y\),ωτ∝exp\(−τ24​σK2\)𝟏\{\|τ\|≤B\},\\begin\{gathered\}\\mathbf\{u\}\(y\)=H\_\{\\omega\}\\mathbf\{x\}\(y\),\\\\ \\omega\_\{\\tau\}\\propto\\exp\\\!\\left\(\-\\frac\{\\tau^\{2\}\}\{4\\sigma\_\{K\}^\{2\}\}\\right\)\\mathbf\{1\}\\\{\|\\tau\|\\leq B\\\},\\end\{gathered\}\(8\)whereHωH\_\{\\omega\}is a filter motivated by the autocorrelation envelope of the SAC kernel \(cf\. Appendix[B\.2](https://arxiv.org/html/2608.20839#A2.SS2)\) andB=min⁡\(W−1,T−1\)B=\\min\(W\-1,T\-1\)\. The lag template mirrors the Gaussian\-envelope smoothing used by SAC\-Copula, soHωH\_\{\\omega\}aggregates evidence over the local low\-lag structure introduced by the correlated perturbation field\.

The filtered native\-sample covariance and ridge covariance are

Σ^u,0=Hω​Σ^x,0​Hω⊤,Cλ=Σ^u,0\+λ​I\.\\widehat\{\\Sigma\}\_\{u,0\}=H\_\{\\omega\}\\widehat\{\\Sigma\}\_\{x,0\}H\_\{\\omega\}^\{\\top\},\\qquad C\_\{\\lambda\}=\\widehat\{\\Sigma\}\_\{u,0\}\+\\lambda I\.\(9\)HereΣ^x,0\\widehat\{\\Sigma\}\_\{x,0\}is estimated from held\-out native samples under the same detector configuration\. Let𝚫^u\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}be the filtered mean direction estimated from development or cross\-fit data, not evaluation samples\. The FFR score is

ZFFR​\(y\)=𝚫^u⊤​Cλ−1​𝐮​\(y\)𝚫^u⊤​Cλ−1​𝚫^u\.Z\_\{\\mathrm\{FFR\}\}\(y\)=\\frac\{\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}^\{\\top\}C\_\{\\lambda\}^\{\-1\}\\mathbf\{u\}\(y\)\}\{\\sqrt\{\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}^\{\\top\}C\_\{\\lambda\}^\{\-1\}\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}\}\.\}\(10\)The detector flags a sequence as watermarked when

ZFFR​\(y\)≥τη,Z\_\{\\mathrm\{FFR\}\}\(y\)\\geq\\tau\_\{\\eta\},\(11\)where the thresholdτη\\tau\_\{\\eta\}can be calibrated from held\-out native samples\. In our experiments, we report ROC\-based AUC and TPR at target FPR levels using the corresponding Native\-score distribution\. FFR provides a matched linear readout for the SAC\-induced evidence geometry under the stated calibration model\. Appendix[B\.1](https://arxiv.org/html/2608.20839#A2.SS1)–[B\.4](https://arxiv.org/html/2608.20839#A2.SS4)provide the full FFR rationale, matched\-direction derivation, and relation to the old detector\.

Furthermore, as one step towards robust detection, we introduce another detector, GO\-FFR, extended from FFR by considering controlled insertion/deletion attacks:

ZGO​\-​FFR​\(Y\)=maxd∈𝒟⁡Zd​\(Y\),Z\_\{\\mathrm\{GO\\text\{\-\}FFR\}\}\(Y\)=\\max\_\{d\\in\\mathcal\{D\}\}Z\_\{d\}\(Y\),\(12\)where𝒟\\mathcal\{D\}is a scan window andZd​\(Y\)Z\_\{d\}\(Y\)is a test statistic defined in Appendix[B\.5](https://arxiv.org/html/2608.20839#A2.SS5)\. It scans a small family of global offsets to partially recover mismatched token–signal alignment, reuses the FFR scoring direction, and calibrates its threshold on native samples under the same offset\-scan rule\. Appendices[B\.5](https://arxiv.org/html/2608.20839#A2.SS5)–[B\.6](https://arxiv.org/html/2608.20839#A2.SS6)give the full analyses\.

## 3Why Correlated Perturbations Help DLMs

This section provides a mechanism\-level rationale for why smooth, locally correlated perturbations may be better aligned with DLM refinement dynamics than high\-frequency i\.i\.d\. perturbations\. We analyze the geometry of the latent perturbation field and the induced detector evidence, and derive empirical predictions on generation quality and detectability that are evaluated in Section[4](https://arxiv.org/html/2608.20839#S4)\.

### 3\.1DLM Decoding Couples Neighboring Decisions

Autoregressive watermarking perturbs a left\-to\-right sampler whose prefix is fixed once a token is emitted\. DLM decoding is different\. LLaDA\-style generation repeatedly predicts multiple masked positions in parallel, accepts or remasks tokens according to confidence, and revises a partially generated sequence over denoising steps\([18](https://arxiv.org/html/2608.20839#bib.bib3);[7](https://arxiv.org/html/2608.20839#bib.bib18)\)\. More recent masked\-diffusion and non\-Markovian discrete\-diffusion work likewise emphasizes iterative denoising and refinement\-sensitive generation dynamics\([26](https://arxiv.org/html/2608.20839#bib.bib10);[21](https://arxiv.org/html/2608.20839#bib.bib16)\)\. As a result, neighboring token positions are not isolated one\-step decisions: local choices can be compared, retained, or revised together during refinement\.

This difference makes the geometry of the perturbation field relevant\. Beyond its marginal strength at each position, a watermark also determines how perturbations vary across adjacent positions\. An i\.i\.d\. Gumbel field can vary sharply across neighboring masked positions that are refined together, creating a plausible mismatch with the local consistency preference of iterative masked refinement\. A smoother locally correlated field makes nearby perturbation preferences more coherent, which motivates the quality\-stability hypothesis tested in Section[4](https://arxiv.org/html/2608.20839#S4)\. Figure[1](https://arxiv.org/html/2608.20839#S0.F1)illustrates this contrast, while the following subsections formalize it using a latent local\-difference proxy\.

### 3\.2Independent Latent Fields Create Local Roughness

We first define a latent local\-difference proxy before the coordinate\-wise Gumbel transform\. Fix a vocabulary itemjj, and consider the Gaussian latent fieldZ⁡\(t,j\)Z\(t,j\)that is later mapped monotonically into Gumbel noise\. We measure lag\-one local variation by

D=𝔼⁡\[\(Z⁡\(t\+1,j\)−Z⁡\(t,j\)\)2\],D=\\mathbb\{E\}\\\!\\left\[\\left\(Z\(t\+1,j\)\-Z\(t,j\)\\right\)^\{2\}\\right\],\(13\)A largerDDindicates sharper adjacent changes in the latent perturbation field\.

For an i\.i\.d\. latent Gaussian field,Var⁡\(Z⁡\(t,j\)\)=1\\operatorname\{Var\}\(Z\(t,j\)\)=1andCov⁡\(Z⁡\(t,j\),Z⁡\(t\+1,j\)\)=0\\operatorname\{Cov\}\(Z\(t,j\),Z\(t\+1,j\)\)=0\. Therefore, the difference proxy for i\.i\.d\. latent Gaussian field is

Di\.i\.d=2\.D\_\{\\mathrm\{i\.i\.d\}\}=2\.\(14\)

### 3\.3SAC\-Copula Reduces Local Perturbation Variation

SAC\-Copula changes the joint structure of the perturbation field rather than the one\-coordinate marginal\. Letrτ​\(W,σK\)r\_\{\\tau\}\(W,\\sigma\_\{K\}\)denote the finite\-window autocorrelation of the normalized spatial branch defined in Appendix[A\.3](https://arxiv.org/html/2608.20839#A1.SS3)\. This quantity is large at small lags when the smoothing kernel strongly overlaps with its shifted copy, and decays as the lag exceeds the kernel support\. For the final latent field, the nonzero\-lag covariance is

Cov⁡\(Zfinal​\(t,j\),Zfinal​\(t\+τ,j\)\)=ρ2​rτ​\(W,σK\)\.\\begin\{split\}&\\operatorname\{Cov\}\\\!\\left\(Z\_\{\\mathrm\{final\}\}\(t,j\),Z\_\{\\mathrm\{final\}\}\(t\+\\tau,j\)\\right\)=\\rho^\{2\}r\_\{\\tau\}\(W,\\sigma\_\{K\}\)\.\\end\{split\}Letr1=rτ=1​\(W,σK\)r\_\{1\}=r\_\{\\tau=1\}\(W,\\sigma\_\{K\}\), and writeΔt=Zfinal​\(t\+1,j\)−Zfinal​\(t,j\)\\Delta\_\{t\}=Z\_\{\\mathrm\{final\}\}\(t\+1,j\)\-Z\_\{\\mathrm\{final\}\}\(t,j\), the lag\-one local difference energy becomes

DSAC\\displaystyle D\_\{\\mathrm\{SAC\}\}=𝔼⁡\[Δt2\]=2​\(1−ρ2​r1\)\.\\displaystyle=\\mathbb\{E\}\[\\Delta\_\{t\}^\{2\}\]=2\(1\-\\rho^\{2\}r\_\{1\}\)\.\(15\)Whenr1\>0r\_\{1\}\>0andρ\>0\\rho\>0, SAC\-Copula has lower latent local variation than the i\.i\.d\. field:

DSAC<Di\.i\.d\.D\_\{\\mathrm\{SAC\}\}<D\_\{\\mathrm\{i\.i\.d\}\}\.This lower local variation gives a plausible quality mechanism for DLM decoding\. LLaDA\-style models refine neighboring masked positions jointly, so when clean logits are locally uncertain, abrupt independent perturbation changes can push nearby positions toward inconsistent random preferences\. SAC\-Copula does not reduce the single\-coordinate probability of large Gumbel values: after the monotone Gaussian\-copula\-to\-Gumbel transform, each coordinate still has the standard Gumbel marginal under the assumptions in Appendix[A\.2](https://arxiv.org/html/2608.20839#A1.SS2)\. Instead, it reduces abrupt local changes across positions by inducing positive low\-lag dependence\. This motivates the empirical hypothesis that smoother perturbation fields may improve quality stability under iterative masked refinement\.

Because the inverse\-Gumbel transform is nonlinear, this latent local\-difference proxy characterizes only the dependence structure before the copula transform and should not be interpreted as invariance of the full generated\-text distribution\.

Figure[3](https://arxiv.org/html/2608.20839#S3.F3)visualizes these perturbation\-field diagnostics\. The autocorrelation view shows that SAC\-Copula introduces a positive low\-lag dependence, while the adjacent\-variation view shows the corresponding reduction in the latent roughness proxy\.

Figure 3:Perturbation\-field smoothness diagnostics\. SAC\-Copula induces positive low\-lag autocorrelation and lowers the latent adjacent\-variation proxy fromDiid=2D\_\{\\mathrm\{iid\}\}=2toDSAC≈1\.286D\_\{\\mathrm\{SAC\}\}\\approx 1\.286\. These are latent\-field diagnostics, not text\-quality measurements\.Together, these results suggest that locally correlated perturbations better support DLM decoding quality while preserving watermark detectability\. Section[4](https://arxiv.org/html/2608.20839#S4)evaluates these predictions empirically\.

## 4Experiments

We evaluate four questions: clean quality–detectability and matched\-i\.i\.d\. tail stability; correlation strength; detector, calibration, and targeted\-transfer controls; and residual evidence under controlled token edits\.Code:[https://anonymous\.4open\.science/status/review\-artifact\-90EF](https://anonymous.4open.science/status/review-artifact-90EF)

### 4\.1Experimental Setup

We evaluate generation from LLaDA\-8B\-Instruct\([18](https://arxiv.org/html/2608.20839#bib.bib3)\)on ELI5 prompts\([6](https://arxiv.org/html/2608.20839#bib.bib27)\)\. LLaDA–ELI5 is our primary benchmark; the targeted Dream\-7B and C4\-en evaluations reported below test transfer across a second DLM backbone and a second task/source setting without redefining the primary protocol\. The comparison includes native decoding and the direct i\.i\.d\. Gumbel baseline\. We evaluate the LLaDA\-adapted KGW\-style\([14](https://arxiv.org/html/2608.20839#bib.bib17)\)and Unigram\([27](https://arxiv.org/html/2608.20839#bib.bib22)\)baselines, together with a PatternMark baseline\([3](https://arxiv.org/html/2608.20839#bib.bib28)\), overδ∈\{1,2,3\}\\delta\\in\\\{1,2,3\\\}\. For KGW and Unigram, we use green\-list fractionγ=0\.25\\gamma=0\.25; each method uses its mechanism\-specific detector\.

Unless otherwise stated, SAC\-Copula usesW=39,σK=15\.0,ρ=0\.6W=39,\\sigma\_\{K\}=15\.0,\\rho=0\.6, controlling correlation range, kernel shape, and correlated\-branch strength\. The original mixed\-parameter study informed this submitted setting \(Appendix[C\.5](https://arxiv.org/html/2608.20839#A3.SS5)\); the fixed\-\(W,σK\)\(W,\\sigma\_\{K\}\)sweep below directly testsρ\\rhoand supportsρ=0\.6\\rho=0\.6as a balanced interior operating point\. Full generation, watermark, detector, calibration, seed, and evaluator details are reported in Appendix[C\.2](https://arxiv.org/html/2608.20839#A3.SS2)\.

Quality metrics \(details in Table[4](https://arxiv.org/html/2608.20839#A3.T4)\) include median PPL, PPL\>100\>100, SBERT, MAUVE\([19](https://arxiv.org/html/2608.20839#bib.bib9)\), Token TV, Rep3, and Distinct3; the matched i\.i\.d\.–SAC comparison additionally reports PPL tail collapse\. AUC and TPR at nominal 1%/5% FPR summarize score discrimination\([17](https://arxiv.org/html/2608.20839#bib.bib1);[10](https://arxiv.org/html/2608.20839#bib.bib8)\); realized FPR under frozen thresholds separately tests operational transfer\.

#### Ablation on Correlation Strength\.

Figure[4](https://arxiv.org/html/2608.20839#S4.F4)varies onlyρ\\rhounder fixedW=39,σK=15,α=1W=39,\\sigma\_\{K\}=15,\\alpha=1, withρ=0\\rho=0representing the i\.i\.d\. Gumbel\. FFR AUC/TPR@1%FPR rises from0\.9683/0\.8200\.9683/0\.820atρ=0\\rho=0to0\.9900/0\.9800\.9900/0\.980at0\.60\.6, then falls to0\.9631/0\.8300\.9631/0\.830at11\. P99 decreases from4256\.634256\.63to99\.6599\.65and27\.5527\.55, butρ=1\\rho=1worsens semantic, repetition, and diversity metrics relative to0\.60\.6\. Thusρ=0\.6\\rho=0\.6is a balanced interior point; full tables are in Appendix[C\.9](https://arxiv.org/html/2608.20839#A3.SS9)\.

### 4\.2Text Quality and Stability

Text quality is the primary empirical target\. Relative to matched i\.i\.d\. Gumbel, the central PPL values are close \(median8\.4468\.446vs\.8\.2608\.260\), whereas the upper tail differs substantially: P95 decreases from48\.42048\.420to30\.81030\.810, P99 from4256\.6344256\.634to99\.65399\.653, and the fraction above PPL 100 from3\.5%3\.5\\%\(7/200\) to1\.0%1\.0\\%\(2/200\)\. Thus, the clearest PPL gain is reduced severe upper\-tail failures rather than a uniform per\-prompt improvement\. Table[1](https://arxiv.org/html/2608.20839#S4.T1)and Figure[5](https://arxiv.org/html/2608.20839#S4.F5)provide the broader context: SAC retains strong low\-FPR detectability together with a competitive semantic, distributional, repetition, diversity, and token\-drift profile\. Full paired tail diagnostics and complete sweep results are in Appendix[C\.9](https://arxiv.org/html/2608.20839#A3.SS9)\.

Figure 4:Correlation\-strengthρ\\rhosweep under \(W=39,σK=15,α=1W=39,\\sigma\_\{K\}=15,\\alpha=1\);ρ=0\\rho=0is matched i\.i\.d\. Gumbel\. Detection peaks at moderate correlation and falls atρ=1\\rho=1; the PPL tail keeps improving, but broader endpoint quality degrades\. Thusρ=0\.6\\rho=0\.6is a balanced interior point\.Table 1:Clean detection and text\-quality trade\-off\. AUC and low\-FPR TPR report detection; Median PPL and PPL\>100\>100report central fluency and severe tail failures; the remaining raw metrics report broader quality\. The normalized Quality score is descriptive only\.Bestandsecond\-bestwatermarked results are marked in each column\.Figure 5:Generation\-quality profile for SAC\-Copula, i\.i\.d\. Gumbel, and representative external baselines on direction\-normalized axes; larger values indicate better or more native\-like behavior\. Raw metrics remain primary\.
### 4\.3Clean Detection

Table[1](https://arxiv.org/html/2608.20839#S4.T1)establishes clean fixed\-alignment detectability; Appendix[C\.1](https://arxiv.org/html/2608.20839#A3.SS1), Figure[7](https://arxiv.org/html/2608.20839#A3.F7), retains the full external sweep\.

#### Detector\-readout control\.

Under the legacy readout, i\.i\.d\. versus SAC AUC/TPR@5%FPR is0\.966/0\.8550\.966/0\.855versus0\.987/0\.9500\.987/0\.950; FFR further raises SAC TPR@1%FPR/TPR@5%FPR to0\.980/0\.9850\.980/0\.985\. Thus the SAC signal difference is visible under the common legacy readout, while FFR provides an additional covariance\-aware readout gain\. Appendix[C\.6](https://arxiv.org/html/2608.20839#A3.SS6), Table[13](https://arxiv.org/html/2608.20839#A3.T13), gives the full control\.

#### Calibration sensitivity\.

With model\-nativeH0H\_\{0\}, AUC/TPR@1%FPR/TPR@5%FPR rises from0\.9867/0\.9078/0\.96670\.9867/0\.9078/0\.9667atN=100N=100to0\.9900/0\.980/0\.9850\.9900/0\.980/0\.985atN=500N=500, withN=200N=200intermediate; the strict 1% point benefits most from added calibration\. AtN=500N=500, human\-answer, C4, and WikipediaH0H\_\{0\}give AUC0\.98610\.9861–0\.98780\.9878and TPR@1%FPR0\.9500\.950–0\.9550\.955, quantifying calibration\-source sensitivity\.

Freezing the original LLaDA–ELI5 model\-native\-H0H\_\{0\}thresholds without C4 refitting and applying them to2,0002\{,\}000held\-out non\-watermarked C4realnewslikerecords yields0\.95%0\.95\\%/5\.50%5\.50\\%realized FPR at nominal1%1\\%/5%5\\%\. This is detector\-only threshold transfer, not C4 generation; full controls are in Appendix[C\.10](https://arxiv.org/html/2608.20839#A3.SS10)\.

Table 2:Generalization across models and datasets\. Tail failure denotes Composite collapse for Dream\-7B/ELI5 and PPL \>100 for LLaDA/C4\-en
#### Targeted model/task transfer\.

Table[2](https://arxiv.org/html/2608.20839#S4.T2)evaluates SAC\-Copula on two additional model–dataset settings\. On Dream\-7B/ELI5, SAC\-Copula maintains near\-perfect detection while substantially reducing P99 and the Composite\-collapse rate\. On LLaDA/C4\-en, it improves detection while reducing P99 and the PPL\-tail failure rate, with nearly unchanged median PPL \(13\.71 vs\. 13\.73\)\. These results demonstrate that the benefits of SAC\-Copula generalize across different models and datasets\. Appendix[C\.11](https://arxiv.org/html/2608.20839#A3.SS11)provides full Dream\-7B/ELI5 \(Table[27](https://arxiv.org/html/2608.20839#A3.T27)\) and LLaDA/C4\-en results, including a separate common\-detector control \(Tables[28](https://arxiv.org/html/2608.20839#A3.T28)–[29](https://arxiv.org/html/2608.20839#A3.T29)\)\.

### 4\.4Residual Evidence under Controlled Token Edits

We evaluate deletion, insertion, and substitution as controlled token\-level stress tests\. At 20%, GO\-FFR raises TPR@1%FPR from0\.1500\.150to0\.4600\.460under deletion and from0\.1950\.195to0\.5050\.505under insertion, showing partial coarse synchronization while low\-FPR detection remains degraded\. Substitution is less alignment\-disruptive: SAC\+FFR reaches TPR@1%FPR0\.8900\.890versus0\.7550\.755for i\.i\.d\.\+Old\. Full readout and rate sweeps are in Appendix[C\.7](https://arxiv.org/html/2608.20839#A3.SS7)\.

GO\-FFR scans a coarse global\-offset family, while cumulative token–tape drift under deletion and insertion remains unresolved\. Semantic/document paraphrasing replaces, reorders, or regenerates the evidence\-bearing sequence and remains outside the current robustness scope\. Full failure diagnostics are in Appendix[C\.8](https://arxiv.org/html/2608.20839#A3.SS8)\.

## 5Discussion and Limitations

SAC\-Copula focuses on smooth, locally correlated DLM Gumbel fields and achieves a strong quality–detectability trade\-off\. Relative to matched i\.i\.d\. Gumbel, its clearest quality gain is improved upper\-tail stability with a competitive broader profile\. The latent\-field analysis is a mechanism\-level rationale: one\-coordinate marginals neither imply invariance of the complete generated\-text distribution nor prove downstream text quality\.

FFR provides a SAC\-aware covariance\-matched readout under the Gaussian mean\-shift rationale\. GO\-FFR extends this readout with coarse global\-offset recovery for insertion/deletion, while cumulative local drift remains unresolved\.

Detection relies on calibratedH0H\_\{0\}samples and development data; the size/source controls and frozen\-threshold C4 test quantify calibration sensitivity and threshold transfer\. LLaDA–ELI5 remains the primary setting, while Dream\-7B–ELI5 and LLaDA–C4\-en extend the evaluation to a second DLM backbone and a second task/source setting\. The fixed\-W,σKW,\\sigma\_\{K\}six\-point sweep identifies an interior operating region aroundρ=0\.6\\rho=0\.6\. Deployment requires private\-tape access and representative calibration data\.

Under edit stress tests, GO\-FFR partially recovers coarse insertion/deletion offsets, while low\-FPR detection degrades as cumulative drift grows\. Paraphrastic rewriting remains challenging because it breaks the fixed tape readout\([15](https://arxiv.org/html/2608.20839#bib.bib12);[12](https://arxiv.org/html/2608.20839#bib.bib11)\)\. Broader watermark\-security work studies strong\-watermark impossibility limits and watermark stealing\([25](https://arxiv.org/html/2608.20839#bib.bib15);[13](https://arxiv.org/html/2608.20839#bib.bib13)\)\. Natural extensions include broader architectural coverage, more systematicW/σKW/\\sigma\_\{K\}studies, runtime characterization, and deployment\-oriented robustness evaluation\([28](https://arxiv.org/html/2608.20839#bib.bib14)\)\.

## References

- Aaronson \(2023\)S\. AaronsonWatermarking of large language models\.Note:[https://simons\.berkeley\.edu/talks/scott\-aaronson\-ut\-austin\-openai\-2023\-08\-17](https://simons.berkeley.edu/talks/scott-aaronson-ut-austin-openai-2023-08-17)Accessed: 2023\-08Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px1.p1.1),[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px2.p2.1),[§2](https://arxiv.org/html/2608.20839#S2.SS0.SSS0.Px1.p1.1)\.
- Bagchiet al\.\(2026\)A\. Bagchi, A\. Bhimaraju, M\. Choraria, D\. Alabi, and L\. R\. VarshneyWatermarking discrete diffusion language models\.InICLR 2026 Workshop on Principled Design for Trustworthy AI \- Interpretability, Robustness, and Safety across Modalities,External Links:[Link](https://openreview.net/forum?id=lNmp7kHLQG)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px2.p2.1),[§2](https://arxiv.org/html/2608.20839#S2.SS0.SSS0.Px1.p1.1)\.
- Chenet al\.\(2025\)R\. Chen, Y\. Wu, Y\. Chen, C\. Liu, J\. Guo, and H\. HuangA watermark for order\-agnostic language models\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Nlm3Xf0W9S)Cited by:[§4\.1](https://arxiv.org/html/2608.20839#S4.SS1.p1.1)\.
- Christet al\.\(2024\)M\. Christ, S\. Gunn, and O\. ZamirUndetectable watermarks for language models\.InProceedings of Thirty Seventh Conference on Learning Theory,Proceedings of Machine Learning Research, Vol\.247,pp\. 1125–1139\.External Links:[Link](https://proceedings.mlr.press/v247/christ24a.html)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px1.p1.1)\.
- Fairozeet al\.\(2023\)J\. Fairoze, S\. Garg, S\. Jha, S\. Mahloujifar, M\. Mahmoody, and M\. WangPublicly\-Detectable Watermarking for Language Models\.Note:Cryptology ePrint Archive, Paper 2023/1661External Links:[Link](https://eprint.iacr.org/2023/1661)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px1.p1.1)\.
- Fanet al\.\(2019\)A\. Fan, Y\. Jernite, E\. Perez, D\. Grangier, J\. Weston, and M\. AuliELI5: long form question answering\.InProceedings of the 57th Annual Meeting of the Association for Computational Linguistics,A\. Korhonen, D\. Traum, and L\. Màrquez \(Eds\.\),Florence, Italy,pp\. 3558–3567\.External Links:[Link](https://aclanthology.org/P19-1346/),[Document](https://dx.doi.org/10.18653/v1/P19-1346)Cited by:[§4\.1](https://arxiv.org/html/2608.20839#S4.SS1.p1.1)\.
- Ghazvininejadet al\.\(2019\)M\. Ghazvininejad, O\. Levy, Y\. Liu, and L\. ZettlemoyerMask\-predict: parallel decoding of conditional masked language models\.InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing \(EMNLP\-IJCNLP\),Hong Kong, China,pp\. 6112–6121\.External Links:[Document](https://dx.doi.org/10.18653/v1/D19-1633),[Link](https://aclanthology.org/D19-1633/)Cited by:[§3\.1](https://arxiv.org/html/2608.20839#S3.SS1.p1.1)\.
- Giboulot and Furon \(2024\)E\. Giboulot and T\. FuronWaterMax: breaking the llm watermark detectability\-robustness\-quality trade\-off\.InAdvances in Neural Information Processing Systems 37,External Links:[Document](https://dx.doi.org/10.52202/079017-0597),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/21b5883bc8fec922fdbbb06675388164-Abstract-Conference.html)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px1.p1.1)\.
- Gloaguenet al\.\(2026\)T\. Gloaguen, R\. Staab, N\. Jovanović, and M\. VechevWatermarking diffusion language models\.InInternational Conference on Learning Representations,External Links:[Link](https://iclr.cc/virtual/2026/poster/10011629)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px2.p1.1)\.
- Heet al\.\(2025\)H\. He, Y\. Liu, Z\. Wang, Y\. Mao, and Y\. BuTheoretically grounded framework for llm watermarking: a distribution\-adaptive approach\.InAdvances in Neural Information Processing Systems 38,pp\. 114528–114564\.External Links:[Document](https://dx.doi.org/10.52202/085713-3456),[Link](https://papers.nips.cc/paper_files/paper/2025/hash/956f80e60a211e3a0f6ec5f2dfa3551a-Abstract-Conference.html)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.20839#S4.SS1.p3.1)\.
- Hong and No \(2026\)P\. M\. Hong and A\. NoDgMARK: decoding\-guided watermarking for diffusion language models\.InForty\-third International Conference on Machine Learning,External Links:[Link](https://openreview.net/forum?id=mJJaz04lQR)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px2.p1.1)\.
- Houet al\.\(2024\)A\. Hou, J\. Zhang, T\. He, Y\. Wang, Y\. Chuang, H\. Wang, L\. Shen, B\. V\. Durme, D\. Khashabi, and Y\. TsvetkovSemStamp: a semantic watermark with paraphrastic robustness for text generation\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),Mexico City, Mexico,pp\. 4067–4082\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.226),[Link](https://aclanthology.org/2024.naacl-long.226/)Cited by:[§5](https://arxiv.org/html/2608.20839#S5.p4.1)\.
- Jovanovićet al\.\(2024\)N\. Jovanović, R\. Staab, and M\. VechevWatermark stealing in large language models\.InProceedings of the 41st International Conference on Machine Learning,Vol\.235,pp\. 22570–22593\.External Links:[Link](https://proceedings.mlr.press/v235/jovanovic24a.html)Cited by:[§5](https://arxiv.org/html/2608.20839#S5.p4.1)\.
- Kirchenbaueret al\.\(2023\)J\. Kirchenbauer, J\. Geiping, Y\. Wen, J\. Katz, I\. Miers, and T\. GoldsteinA watermark for large language models\.InProceedings of the 40th International Conference on Machine Learning,A\. Krause, E\. Brunskill, K\. Cho, B\. Engelhardt, S\. Sabato, and J\. Scarlett \(Eds\.\),Proceedings of Machine Learning Research, Vol\.202,pp\. 17061–17084\.External Links:[Link](https://proceedings.mlr.press/v202/kirchenbauer23a.html)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px1.p1.1),[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2608.20839#S1.p2.1),[§4\.1](https://arxiv.org/html/2608.20839#S4.SS1.p1.1)\.
- Krishnaet al\.\(2023\)K\. Krishna, Y\. Song, M\. Karpinska, J\. Wieting, and M\. IyyerParaphrasing evades detectors of ai\-generated text, but retrieval is an effective defense\.InAdvances in Neural Information Processing Systems 36,External Links:[Document](https://dx.doi.org/10.52202/075280-1195),[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/575c450013d0e99e4b0ecf82bd1afaa4-Abstract-Conference.html)Cited by:[§5](https://arxiv.org/html/2608.20839#S5.p4.1)\.
- Kuditipudiet al\.\(2024\)R\. Kuditipudi, J\. Thickstun, T\. Hashimoto, and P\. LiangRobust distortion\-free watermarks for language models\.Transactions on Machine Learning Research\.External Links:[Link](https://openreview.net/forum?id=FpaCL1MO2C)Cited by:[§1](https://arxiv.org/html/2608.20839#S1.p2.1)\.
- Liet al\.\(2025\)X\. Li, F\. Ruan, H\. Wang, Q\. Long, and W\. J\. SuA statistical framework of watermarks for large language models: pivot, detection efficiency and optimal rules\.The Annals of Statistics53\(1\),pp\. 322–351\.External Links:ISSN 0090\-5364,[Link](http://dx.doi.org/10.1214/24-AOS2468),[Document](https://dx.doi.org/10.1214/24-aos2468)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.20839#S4.SS1.p3.1)\.
- Nieet al\.\(2025\)S\. Nie, F\. Zhu, Z\. You, X\. Zhang, J\. Ou, J\. Hu, J\. Zhou, Y\. Lin, J\. Wen, and C\. LiLarge language diffusion models\.InAdvances in Neural Information Processing Systems 38,External Links:[Document](https://dx.doi.org/10.52202/085713-1689),[Link](https://proceedings.neurips.cc/paper_files/paper/2025/hash/48b383b24230e0e6e649d9c98dae4d8c-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.20839#S1.p2.1),[§3\.1](https://arxiv.org/html/2608.20839#S3.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.20839#S4.SS1.p1.1)\.
- Pillutlaet al\.\(2021\)K\. Pillutla, S\. Swayamdipta, R\. Zellers, J\. Thickstun, S\. Welleck, Y\. Choi, and Z\. HarchaouiMAUVE: measuring the gap between neural text and human text using divergence frontiers\.InAdvances in Neural Information Processing Systems 34,External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2021/hash/260c2432a0eecc28ce03c10dadc078a4-Abstract.html)Cited by:[§4\.1](https://arxiv.org/html/2608.20839#S4.SS1.p3.1)\.
- Rabanet al\.\(2026\)O\. Raban, G\. Chechik, and E\. FetayaLR\-dwm: efficient watermarking for diffusion language models\.InFindings of the Association for Computational Linguistics: ACL 2026,San Diego, California, United States,pp\. 43510–43517\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.findings-acl.2161),[Link](https://aclanthology.org/2026.findings-acl.2161/)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px2.p1.1)\.
- Sahooet al\.\(2024\)S\. S\. Sahoo, M\. Arriola, Y\. Schiff, A\. Gokaslan, E\. Marroquin, J\. T\. Chiu, A\. Rush, and V\. KuleshovSimple and effective masked diffusion language models\.InAdvances in Neural Information Processing Systems 37,External Links:[Document](https://dx.doi.org/10.52202/079017-4135),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/eb0b13cc515724ab8015bc978fdde0ad-Abstract-Conference.html)Cited by:[§3\.1](https://arxiv.org/html/2608.20839#S3.SS1.p1.1)\.
- Wanget al\.\(2025\)C\. Wang, J\. Shu, B\. Chiu, Y\. Li, S\. Alharbi, M\. Zhang, and J\. LiLearning to watermark: a selective watermarking framework for large language models via multi\-objective optimization\.InAdvances in Neural Information Processing Systems 38,External Links:[Document](https://dx.doi.org/10.52202/085713-4316),[Link](https://proceedings.neurips.cc/paper_files/paper/2025/hash/bc222e8153a49c1b30a1b8ba96b35117-Abstract-Conference.html)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px1.p1.1)\.
- Wuet al\.\(2025\)L\. Wu, L\. Zhong, W\. Qu, Y\. Li, Y\. Liu, S\. Zhai, C\. Shen, and J\. ZhangDMark: order\-agnostic watermarking for diffusion large language models\.External Links:2510\.02902,[Link](https://arxiv.org/abs/2510.02902)Cited by:[§1\.1](https://arxiv.org/html/2608.20839#S1.SS1.SSS0.Px2.p1.1)\.
- Yooet al\.\(2024\)K\. Yoo, W\. Ahn, and N\. KwakAdvancing beyond identification: multi\-bit watermark for large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),Mexico City, Mexico,pp\. 4031–4055\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.224),[Link](https://aclanthology.org/2024.naacl-long.224/)Cited by:[§1](https://arxiv.org/html/2608.20839#S1.p2.1)\.
- Zhanget al\.\(2024\)H\. Zhang, B\. L\. Edelman, D\. Francati, D\. Venturi, G\. Ateniese, and B\. BarakWatermarks in the sand: impossibility of strong watermarking for language models\.InProceedings of the 41st International Conference on Machine Learning,Vol\.235,pp\. 58851–58880\.External Links:[Link](https://proceedings.mlr.press/v235/zhang24o.html)Cited by:[§5](https://arxiv.org/html/2608.20839#S5.p4.1)\.
- Zhanget al\.\(2025\)Y\. Zhang, S\. He, D\. Levine, L\. Zhao, D\. Zhang, S\. A\. Rizvi, S\. Zhang, E\. Zappala, R\. Ying, and D\. van DijkNon\-markovian discrete diffusion with causal language models\.InAdvances in Neural Information Processing Systems 38,External Links:[Link](https://openreview.net/forum?id=qYSgnmT3dp)Cited by:[§3\.1](https://arxiv.org/html/2608.20839#S3.SS1.p1.1)\.
- Zhaoet al\.\(2024\)X\. Zhao, P\. Ananth, L\. Li, and Y\. WangProvable robust watermarking for ai\-generated text\.InInternational Conference on Learning Representations,External Links:[Link](https://proceedings.iclr.cc/paper_files/paper/2024/hash/beae9ed5316bcc48e616754c06c11875-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.20839#S1.p2.1),[§4\.1](https://arxiv.org/html/2608.20839#S4.SS1.p1.1)\.
- Zhaoet al\.\(2025\)X\. Zhao, S\. Gunn, M\. Christ, J\. Fairoze, A\. Fabrega, N\. Carlini, S\. Garg, S\. Hong, M\. Nasr, F\. Tramer, S\. Jha, L\. Li, Y\. Wang, and D\. SongSoK: watermarking for ai\-generated content\.In2025 IEEE Symposium on Security and Privacy \(SP\),pp\. 2621–2639\.External Links:[Document](https://dx.doi.org/10.1109/SP61157.2025.00178),[Link](https://doi.org/10.1109/SP61157.2025.00178)Cited by:[§5](https://arxiv.org/html/2608.20839#S5.p4.1)\.

## Appendix AWatermark Properties

This appendix gives proof details behind the SAC\-Copula field in Section[2\.1](https://arxiv.org/html/2608.20839#S2.SS1)\. The claims are about the latent watermark tape\. They are not claims about invariance of the complete output\-text law\.

### A\.1Boundary Convention

The current convolution convention uses zero padding and divides by the global full\-window energy

S2=∑k=−hhKW​\[k\]2\.S\_\{2\}=\\sum\_\{k=\-h\}^\{h\}K\_\{W\}\[k\]^\{2\}\.\(16\)Therefore exact unit variance is guaranteed for full\-window interior positions\. Boundary positions can have smaller variance because fewer nonzero taps contribute\.

An all\-position idealization would define

𝒦t\\displaystyle\\mathcal\{K\}\_\{t\}=\{k∈\[−h,h\]:1≤t−k≤Lmax\},\\displaystyle=\\\{k\\in\[\-h,h\]:1\\leq t\-k\\leq L\_\{\\max\}\\\},\(17\)S2​\(t\)\\displaystyle S\_\{2\}\(t\)=∑k∈𝒦tKW​\[k\]2,\\displaystyle=\\sum\_\{k\\in\\mathcal\{K\}\_\{t\}\}K\_\{W\}\[k\]^\{2\},\(18\)and divide the boundary convolution byS2​\(t\)\\sqrt\{S\_\{2\}\(t\)\}\. In this paper, strict marginal claims are made under the full\-window or boundary\-normalized convention\. Boundary deviations under zero padding are treated as implementation checks rather than as part of the exact marginal claim\.

### A\.2Marginal Gaussian and Gumbel Exactness

At a full\-window position,

Zspatial​\(t,j\)=∑k=−hhKW​\[k\]​Zwhite,1​\(t−k,j\)\.Z\_\{\\mathrm\{spatial\}\}\(t,j\)=\\sum\_\{k=\-h\}^\{h\}K\_\{W\}\[k\]Z\_\{\\mathrm\{white\},1\}\(t\-k,j\)\.\(19\)This is a linear combination of independent Gaussian variables, hence Gaussian\. Since the source variables have unit variance,

Var⁡\(Zspatial​\(t,j\)\)=∑k=−hhKW​\[k\]2=S2\.\\operatorname\{Var\}\\\!\\left\(Z\_\{\\mathrm\{spatial\}\}\(t,j\)\\right\)=\\sum\_\{k=\-h\}^\{h\}K\_\{W\}\[k\]^\{2\}=S\_\{2\}\.\(20\)Thus

Z~spatial​\(t,j\)=Zspatial​\(t,j\)S2∼𝒩⁡\(0,1\)\.\\widetilde\{Z\}\_\{\\mathrm\{spatial\}\}\(t,j\)=\\frac\{Z\_\{\\mathrm\{spatial\}\}\(t,j\)\}\{\\sqrt\{S\_\{2\}\}\}\\sim\\mathcal\{N\}\(0,1\)\.\(21\)The same proof applies to the boundary\-normalized ideal form after replacingS2S\_\{2\}byS2​\(t\)S\_\{2\}\(t\)\.

The white stream and spatial stream are independent\. Therefore

Zfinal​\(t,j\)\\displaystyle Z\_\{\\mathrm\{final\}\}\(t,j\)=1−ρ2​Zwhite,2​\(t,j\)\\displaystyle=\\sqrt\{1\-\\rho^\{2\}\}Z\_\{\\mathrm\{white\},2\}\(t,j\)\(22\)\+ρ​Z~spatial​\(t,j\)\\displaystyle\+\\rho\\widetilde\{Z\}\_\{\\mathrm\{spatial\}\}\(t,j\)is Gaussian with zero mean and variance\(1−ρ2\)\+ρ2=1\(1\-\\rho^\{2\}\)\+\\rho^\{2\}=1\. Hence each valid coordinate ofZfinalZ\_\{\\mathrm\{final\}\}is𝒩⁡\(0,1\)\\mathcal\{N\}\(0,1\)\.

By the probability integral transform,

U⁡\(t,j\)=Φ⁡\(Zfinal​\(t,j\)\)∼Uniform⁡\(0,1\)\.U\(t,j\)=\\Phi\(Z\_\{\\mathrm\{final\}\}\(t,j\)\)\\sim\\operatorname\{Uniform\}\(0,1\)\.\(23\)Applying the inverse standard Gumbel CDF gives

Gcorr​\(t,j\)=FG−1​\(U⁡\(t,j\)\)∼Gumbel⁡\(0,1\)\.G\_\{\\mathrm\{corr\}\}\(t,j\)=F\_\{G\}^\{\-1\}\(U\(t,j\)\)\\sim\\operatorname\{Gumbel\}\(0,1\)\.\(24\)For the standard Gumbel distribution,FG−1​\(u\)=−log⁡\(−log⁡u\)F\_\{G\}^\{\-1\}\(u\)=\-\\log\(\-\\log u\)\. In numerical evaluation,UUis clamped to avoid floating\-point extremes, so exact unbounded Gumbel statements refer to the ideal transform\.

### A\.3Finite\-Window Latent Autocorrelation

Let

bk=KW​\[k\]S2,bk=0for​k∉\[−h,h\]\.b\_\{k\}=\\frac\{K\_\{W\}\[k\]\}\{\\sqrt\{S\_\{2\}\}\},\\qquad b\_\{k\}=0\\quad\\text\{for \}k\\notin\[\-h,h\]\.\(25\)Then

Z~spatial​\(t,j\)=∑kbk​Zwhite,1​\(t−k,j\)\.\\widetilde\{Z\}\_\{\\mathrm\{spatial\}\}\(t,j\)=\\sum\_\{k\}b\_\{k\}Z\_\{\\mathrm\{white\},1\}\(t\-k,j\)\.\(26\)Expanding the covariance and using independence of the white source gives the finite\-window autocorrelation

rτ​\(W,σK\)=∑kbk​bk\+τ\.r\_\{\\tau\}\(W,\\sigma\_\{K\}\)=\\sum\_\{k\}b\_\{k\}b\_\{k\+\\tau\}\.\(27\)Thusr0=1r\_\{0\}=1,r−τ=rτr\_\{\-\\tau\}=r\_\{\\tau\}, andrτ=0r\_\{\\tau\}=0for\|τ\|\>W−1\|\\tau\|\>W\-1\. For the final latent field andτ≠0\\tau\\neq 0,

Cov⁡\(Zfinal​\(t,j\),Zfinal​\(t\+τ,j\)\)=ρ2​rτ​\(W,σK\),\\begin\{split\}&\\operatorname\{Cov\}\\\!\\left\(Z\_\{\\mathrm\{final\}\}\(t,j\),Z\_\{\\mathrm\{final\}\}\(t\+\\tau,j\)\\right\)\\\\ &\\quad=\\rho^\{2\}r\_\{\\tau\}\(W,\\sigma\_\{K\}\),\\end\{split\}\(28\)because the white stream contributes no cross\-position covariance\. This latent autocorrelation motivates the detector\-sideHωH\_\{\\omega\}template, while the detector covariance itself is estimated from extracted Native evidence\.

For the lag\-one local\-difference proxy used in Section[3\.3](https://arxiv.org/html/2608.20839#S3.SS3), the unit marginal variance and the covariance above give

DSAC\\displaystyle D\_\{\\mathrm\{SAC\}\}=𝔼⁡\[\(Zfinal​\(t\+1,j\)−Zfinal​\(t,j\)\)2\]\\displaystyle=\\mathbb\{E\}\\\!\\left\[\\left\(Z\_\{\\mathrm\{final\}\}\(t\+1,j\)\-Z\_\{\\mathrm\{final\}\}\(t,j\)\\right\)^\{2\}\\right\]\(29\)=2−2​ρ2​r1​\(W,σK\)=2​\(1−ρ2​r1\)\.\\displaystyle=2\-2\\rho^\{2\}r\_\{1\}\(W,\\sigma\_\{K\}\)=2\(1\-\\rho^\{2\}r\_\{1\}\)\.Thus the Section[3\.3](https://arxiv.org/html/2608.20839#S3.SS3)expression is a direct consequence of the finite\-window autocorrelation and the preserved one\-coordinate latent variance\.

### A\.4Latent Tape KL Proxy

LetP0=𝒩⁡\(0,IT\)P\_\{0\}=\\mathcal\{N\}\(0,I\_\{T\}\)be an i\.i\.d\. latent Gaussian tape andPρ=𝒩⁡\(0,ΣT\)P\_\{\\rho\}=\\mathcal\{N\}\(0,\\Sigma\_\{T\}\)the SAC latent Gaussian tape, where

ΣT\\displaystyle\\Sigma\_\{T\}=\(1−ρ2\)​IT\+ρ2​RT,\\displaystyle=\(1\-\\rho^\{2\}\)I\_\{T\}\+\\rho^\{2\}R\_\{T\},\(30\)\[RT\]a​b\\displaystyle\[R\_\{T\}\]\_\{ab\}=ra−b​\(W,σK\)\.\\displaystyle=r\_\{a\-b\}\(W,\\sigma\_\{K\}\)\.\(31\)AssumeΣT≻0\\Sigma\_\{T\}\\succ 0, so the log\-determinant is well\-defined\. This holds forρ<1\\rho<1whenRTR\_\{T\}is positive semidefinite; the endpointρ=1\\rho=1additionally requires nonsingularity ofRTR\_\{T\}\.

For zero\-mean Gaussians,

DKL\(Pρ∥P0\)=12\(trΣT−T−logdetΣT\)\.D\_\{\\mathrm\{KL\}\}\(P\_\{\\rho\}\\parallel P\_\{0\}\)=\\frac\{1\}\{2\}\\left\(\\operatorname\{tr\}\\Sigma\_\{T\}\-T\-\\log\\det\\Sigma\_\{T\}\\right\)\.\(32\)Sincediag⁡\(ΣT\)=1\\operatorname\{diag\}\(\\Sigma\_\{T\}\)=1,tr⁡ΣT=T\\operatorname\{tr\}\\Sigma\_\{T\}=T, and

ℒtape\(T\)=1TDKL\(Pρ∥P0\)=−12​TlogdetΣT\.\\mathcal\{L\}\_\{\\mathrm\{tape\}\}^\{\(T\)\}=\\frac\{1\}\{T\}D\_\{\\mathrm\{KL\}\}\(P\_\{\\rho\}\\parallel P\_\{0\}\)=\-\\frac\{1\}\{2T\}\\log\\det\\Sigma\_\{T\}\.\(33\)This is a latent process diagnostic, not semantic KL and not output\-text KL\.

This expansion is an explanatory approximation obtained from the log\-determinant series around the identity covariance\. SetA=RT−ITA=R\_\{T\}\-I\_\{T\}\. SinceΣT=IT\+ρ2​A\\Sigma\_\{T\}=I\_\{T\}\+\\rho^\{2\}Aandtr⁡\(A\)=0\\operatorname\{tr\}\(A\)=0,

ℒtape\(T\)=ρ44​T​tr⁡\(A2\)\+O⁡\(ρ6\)\.\\mathcal\{L\}\_\{\\mathrm\{tape\}\}^\{\(T\)\}=\\frac\{\\rho^\{4\}\}\{4T\}\\operatorname\{tr\}\(A^\{2\}\)\+O\(\\rho^\{6\}\)\.\(34\)For the Toeplitz finite\-window case,

tr⁡\(A2\)=∑τ≠0\(T−\|τ\|\)​rτ​\(W,σK\)2\.\\operatorname\{tr\}\(A^\{2\}\)=\\sum\_\{\\tau\\neq 0\}\(T\-\|\\tau\|\)r\_\{\\tau\}\(W,\\sigma\_\{K\}\)^\{2\}\.\(35\)The leading term isO⁡\(ρ4\)O\(\\rho^\{4\}\)because the diagonal marginal variances are preserved and the trace term cancels\.

### A\.5Implementation Checks

Implementation checks should include:

- •marginal Gaussian and Gumbel QQ plots;
- •empirical versus theoretical autocorrelation;
- •low\-frequency energy of the noise tape;
- •effective sample size estimates;
- •boundary variance curves\.

For a diagnostic sequenceaa, with discrete Fourier transforma^​\(f\)\\widehat\{a\}\(f\), define the low\-frequency energy fraction as

LFE⁡\(a\)=∑f∈ℱlow\|a^​\(f\)\|2∑f∈ℱ\|a^​\(f\)\|2\.\\operatorname\{LFE\}\(a\)=\\frac\{\\sum\_\{f\\in\\mathcal\{F\}\_\{\\mathrm\{low\}\}\}\|\\widehat\{a\}\(f\)\|^\{2\}\}\{\\sum\_\{f\\in\\mathcal\{F\}\}\|\\widehat\{a\}\(f\)\|^\{2\}\}\.\(36\)These checks validate the noise\-tape construction, not the distributional invariance of generated text\.

## Appendix BDetector Rationale

This appendix expands the detector rationale in Section[2\.3](https://arxiv.org/html/2608.20839#S2.SS3)\. It clarifies why the detector is matched to the evidence geometry induced by the SAC\-Copula perturbation field\.

### B\.1From i\.i\.d\. Evidence to Covariance\-Aware Calibration

The old detector aggregates raw evidence with an equal\-weight i\.i\.d\. Z\-score:

Zold=𝟏⊤​\(𝐬−μG​𝟏\)σG​T\.Z\_\{\\mathrm\{old\}\}=\\frac\{\\mathbf\{1\}^\{\\top\}\(\\mathbf\{s\}\-\\mu\_\{G\}\\mathbf\{1\}\)\}\{\\sigma\_\{G\}\\sqrt\{T\}\}\.\(37\)It implicitly assumes

Σx,0≈σG2​I,Δx∝𝟏\.\\Sigma\_\{x,0\}\\approx\\sigma\_\{G\}^\{2\}I,\\qquad\\Delta\_\{x\}\\propto\\mathbf\{1\}\.\(38\)For non\-i\.i\.d\. evidence, however, the null variance of the equal\-weight sum is

Var0⁡\(𝟏⊤​𝐱\)=𝟏⊤​Σx,0​𝟏\.\\operatorname\{Var\}\_\{0\}\(\\mathbf\{1\}^\{\\top\}\\mathbf\{x\}\)=\\mathbf\{1\}^\{\\top\}\\Sigma\_\{x,0\}\\mathbf\{1\}\.\(39\)Positive local dependence increases this variance relative to the i\.i\.d\. value, reducing effective sample size\. HAC or covariance\-aware calibration corrects this null variance while keeping the evidence direction𝟏\\mathbf\{1\}\. If a calibration\-only score is a positive rescaling,

Zh0​\_​hac=cd​Zold,cd\>0,Z\_\{\\mathrm\{h0\\\_hac\}\}=c\_\{d\}Z\_\{\\mathrm\{old\}\},\\qquad c\_\{d\}\>0,\(40\)then within the same detector group and fixed calibration setting it does not change ROC ordering or AUC\. This explains why calibration alone is insufficient when the useful watermark shift is not aligned with𝟏\\mathbf\{1\}\.

### B\.2Why Filtering is Needed for SAC\-Copula Evidence

SAC\-Copula injects a locally correlated, low\-lag perturbation field\. The resulting evidence is not merely a uniform mean shift across positions\. Full Filtered Ridge maps centered raw evidence into a SAC\-aligned filtered feature:

𝐮=Hω​𝐱\.\\mathbf\{u\}=H\_\{\\omega\}\\mathbf\{x\}\.\(41\)The filterHωH\_\{\\omega\}is motivated by the autocorrelation envelope of the SAC kernel, using weights proportional toexp\(−τ2/\(4σK2\)\)\\exp\(\-\\tau^\{2\}/\(4\\sigma\_\{K\}^\{2\}\)\)with boundary renormalization\. Concretely, with

aτ=exp\(−τ24​σK2\)𝟏\{\|τ\|≤B\},a\_\{\\tau\}=\\exp\\\!\\left\(\-\\frac\{\\tau^\{2\}\}\{4\\sigma\_\{K\}^\{2\}\}\\right\)\\mathbf\{1\}\\\{\|\\tau\|\\leq B\\\},\(42\)a row\-normalized filtered readout can be written as

\[Hω\]t,s=as−t∑r:1≤t\+r≤Tar\.\[H\_\{\\omega\}\]\_\{t,s\}=\\frac\{a\_\{s\-t\}\}\{\\sum\_\{r:\\,1\\leq t\+r\\leq T\}a\_\{r\}\}\.\(43\)wherear=0a\_\{r\}=0outside\[−B,B\]\[\-B,B\]\. This filter is a detector\-side transform, not generation noise\.

Native text and the decoding process may also introduce background correlations\. Therefore the latent tape covariance should not be used directly as the detector’s null covariance\. The detector estimates the observed\-evidence Native covariance and projects it into filtered space:

Σ^u,0=Hω​Σ^x,0​Hω⊤\.\\widehat\{\\Sigma\}\_\{u,0\}=H\_\{\\omega\}\\widehat\{\\Sigma\}\_\{x,0\}H\_\{\\omega\}^\{\\top\}\.\(44\)Thus FFR combines a SAC\-motivated feature map with NativeH0H\_\{0\}observed\-evidence covariance whitening\.

### B\.3Ridge\-Regularized Matched Direction

In the detector statistic, raw evidence is centered before filtering, so𝐮=Hω​𝐱\\mathbf\{u\}=H\_\{\\omega\}\\mathbf\{x\}is alreadyH0H\_\{0\}\-centered up to finite\-sample error\. The surrogateTw​\(𝐮\)=w⊤​\(𝐮−𝝁u,0\)T\_\{w\}\(\\mathbf\{u\}\)=w^\{\\top\}\(\\mathbf\{u\}\-\\boldsymbol\{\\mu\}\_\{u,0\}\)writes the same idea in abstract filtered\-space notation\.

In filtered feature space, use the Gaussian mean\-shift surrogate

H0:𝐮\\displaystyle H\_\{0\}:\\quad\\mathbf\{u\}∼\(𝝁u,0,Σu,0\),\\displaystyle\\sim\(\\boldsymbol\{\\mu\}\_\{u,0\},\\Sigma\_\{u,0\}\),\(45\)H1:𝐮\\displaystyle H\_\{1\}:\\quad\\mathbf\{u\}∼\(𝝁u,0\+𝚫u,Σu,0\)\.\\displaystyle\\sim\(\\boldsymbol\{\\mu\}\_\{u,0\}\+\\boldsymbol\{\\Delta\}\_\{u\},\\Sigma\_\{u,0\}\)\.\(46\)For a linear score

Tw​\(𝐮\)=w⊤​\(𝐮−𝝁u,0\),T\_\{w\}\(\\mathbf\{u\}\)=w^\{\\top\}\(\\mathbf\{u\}\-\\boldsymbol\{\\mu\}\_\{u,0\}\),\(47\)the standardized separation is

SNR⁡\(w\)=w⊤​𝚫uw⊤​Σu,0​w\.\\operatorname\{SNR\}\(w\)=\\frac\{w^\{\\top\}\\boldsymbol\{\\Delta\}\_\{u\}\}\{\\sqrt\{w^\{\\top\}\\Sigma\_\{u,0\}w\}\}\.\(48\)Letb=Σu,01/2​wb=\\Sigma\_\{u,0\}^\{1/2\}w, sow=Σu,0−1/2bw=\\Sigma\_\{u,0\}^\{\-1/2\}b, and

a=Σu,0−1/2𝚫u\.a=\\Sigma\_\{u,0\}^\{\-1/2\}\\boldsymbol\{\\Delta\}\_\{u\}\.\(49\)Then

SNR⁡\(w\)\\displaystyle\\operatorname\{SNR\}\(w\)=b⊤​a‖b‖2\\displaystyle=\\frac\{b^\{\\top\}a\}\{\\\|b\\\|\_\{2\}\}\(50\)≤‖a‖2\.\\displaystyle\\leq\\\|a\\\|\_\{2\}\.Equality holds whenb∝ab\\propto a, giving

w⋆∝Σu,0−1​𝚫u\.w^\{\\star\}\\propto\\Sigma\_\{u,0\}^\{\-1\}\\boldsymbol\{\\Delta\}\_\{u\}\.\(51\)
The practical direction is the ridge\-regularized plug\-in estimate

wλ=\(Σ^u,0\+λ​I\)−1​𝚫^u\.w\_\{\\lambda\}=\(\\widehat\{\\Sigma\}\_\{u,0\}\+\\lambda I\)^\{\-1\}\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}\.\(52\)Because the main detector centers evidence in raw space before filtering, the implemented scalar score can be written without an additional filtered\-space mean subtraction:

ZFFR​\(y\)=𝚫^u⊤​\(Σ^u,0\+λ​I\)−1​𝐮​\(y\)γFFR\.Z\_\{\\mathrm\{FFR\}\}\(y\)=\\frac\{\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}^\{\\top\}\(\\widehat\{\\Sigma\}\_\{u,0\}\+\\lambda I\)^\{\-1\}\\mathbf\{u\}\(y\)\}\{\\gamma\_\{\\mathrm\{FFR\}\}\}\.\(53\)For scores expressed directly in centered raw\-evidence space, the corresponding linear direction is

𝐪\\displaystyle\\mathbf\{q\}=Hω⊤​wλγFFR,\\displaystyle=\\frac\{H\_\{\\omega\}^\{\\top\}w\_\{\\lambda\}\}\{\\gamma\_\{\\mathrm\{FFR\}\}\},\(54\)γFFR\\displaystyle\\gamma\_\{\\mathrm\{FFR\}\}=𝚫^u⊤​\(Σ^u,0\+λ​I\)−1​𝚫^u\.\\displaystyle=\\sqrt\{\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}^\{\\top\}\(\\widehat\{\\Sigma\}\_\{u,0\}\+\\lambda I\)^\{\-1\}\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}\}\.\(55\)The ridge is finite\-sample regularization for an empirical covariance inverse\. The direction𝚫^u\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}must be estimated from a development split or cross\-fitting protocol without evaluation leakage\. The optimality statement is limited to the linear detector class under the shared\-covariance Gaussian surrogate\.

### B\.4Relation to the Original Detector

FFR reduces to the old detector under

Hω\\displaystyle H\_\{\\omega\}=I,\\displaystyle=I,Σ^u,0\\displaystyle\\widehat\{\\Sigma\}\_\{u,0\}=σG2​I,\\displaystyle=\\sigma\_\{G\}^\{2\}I,\(56\)𝚫^u\\displaystyle\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}∝𝟏,\\displaystyle\\propto\\mathbf\{1\},λ\\displaystyle\\lambda=0,\\displaystyle=0,\(57\)𝝁^x,0\\displaystyle\\widehat\{\\boldsymbol\{\\mu\}\}\_\{x,0\}=0\.\\displaystyle=0\.\(58\)In this case the FFR direction is proportional to𝟏\\mathbf\{1\}, and the score becomes the old equal\-weight Gumbel evidence sum\. FFR is therefore a covariance\-aware, direction\-aware, SAC\-aware generalization of the original i\.i\.d\. detector\.

### B\.5Global Offset Extension

FFR assumes fixed token\-to\-tape alignmentj=ij=i\. Insertion and deletion can instead induce

j=i\+δ⁡\(i\),j=i\+\\delta\(i\),\(59\)whereδ⁡\(i\)\\delta\(i\)is an unknown drift\. For an alignmentAA, the ideal alignment\-aware centered evidence would be

xiA=s⁡\(yA⁡\(i\),i\)−μG−μ^x,0,i,x\_\{i\}^\{A\}=s\(y\_\{A\(i\)\};i\)\-\\mu\_\{G\}\-\\widehat\{\\mu\}\_\{x,0,i\},\(60\)with score

Z⁡\(A\)=𝐪⊤​𝐱A\.Z\(A\)=\\mathbf\{q\}^\{\\top\}\\mathbf\{x\}^\{A\}\.\(61\)GO\-FFR restricts alignment to the global\-offset family

𝒜GO=\{Ad​\(i\)=i\+d:d∈𝒟\},\\mathcal\{A\}\_\{\\mathrm\{GO\}\}=\\\{A\_\{d\}\(i\)=i\+d:\\ d\\in\\mathcal\{D\}\\\},\(62\)where𝒟⊂ℤ\\mathcal\{D\}\\subset\\mathbb\{Z\}is a finite candidate offset set\. In the reported attack\-aware implementation,𝒟=\{−Dmax,…,0\}\\mathcal\{D\}=\\\{\-D\_\{\\max\},\\ldots,0\\\}for deletion,𝒟=\{0,…,Dmax\}\\mathcal\{D\}=\\\{0,\\ldots,D\_\{\\max\}\\\}for insertion, and𝒟=\{0\}\\mathcal\{D\}=\\\{0\\\}for fixed\-alignment clean or substitution settings, withDmax=96D\_\{\\max\}=96\. The resulting score is

ZGO​\-​FFR​\(Y\)\\displaystyle Z\_\{\\mathrm\{GO\\text\{\-\}FFR\}\}\(Y\)=maxd∈𝒟⁡Zd​\(Y\),\\displaystyle=\\max\_\{d\\in\\mathcal\{D\}\}Z\_\{d\}\(Y\),\(63\)Zd​\(Y\)\\displaystyle Z\_\{d\}\(Y\)=𝐪⊤​𝐱\(d\)​\(Y\)\.\\displaystyle=\\mathbf\{q\}^\{\\top\}\\mathbf\{x\}^\{\(d\)\}\(Y\)\.\(64\)This is a GLRT\-style scan over a small alignment family\. The max over offsets inflates the NativeH0H\_\{0\}right tail\. The GO\-specific threshold is the empirical1−η1\-\\etaquantile ofZGO​\-​FFRZ\_\{\\mathrm\{GO\\text\{\-\}FFR\}\}on NativeH0H\_\{0\}samples under the same offset\-scan rule\. GO\-FFR recovers coarse global synchronization within the scanned global\-offset family; cumulative local drift and semantic rewriting remain outside this alignment family\.

### B\.6Scope and Limitations

FFR adapts detection to correlated SAC\-Copula evidence, while GO\-FFR extends the same scoring direction with coarse synchronization recovery for mild insertion/deletion\. Low\-FPR evaluation uses detector\-specific NativeH0H\_\{0\}calibration, and𝚫^u\\widehat\{\\boldsymbol\{\\Delta\}\}\_\{u\}is estimated without evaluation leakage\. Semantic rewriting and cumulative edit\-path drift remain outside the global\-offset family analyzed here\.

## Appendix CAdditional Experiment Evidence

This appendix records supporting clean\-setting summaries, frozen\-output re\-analysis, calibration and targeted\-transfer controls, and frozen attack\-summary evidence used in Section[4](https://arxiv.org/html/2608.20839#S4)\. The clean quality and clean detection claims in the main text are supported by the frozen clean multi\-baseline sweep summaries, not by the attack\-summary evidence\. The attack sources are summary\-only artifacts derived from token\-level edit outputs and semantic/paraphrase attack summaries; the attack\-detail and failure\-analysis sections do not use per\-sample generated text, exact noise tapes, or full detector\-score files\.

Table 3:Experiment appendix evidence index\. Each row points to the compact appendix evidence used to support Section[4](https://arxiv.org/html/2608.20839#S4)\. The index is organizational only and does not introduce new experimental values\.### C\.1Clean Quality and Detection Details

This subsection records supporting material for the clean multi\-baseline comparison in Section[4\.2](https://arxiv.org/html/2608.20839#S4.SS2)and Section[4\.3](https://arxiv.org/html/2608.20839#S4.SS3)\. The source tables are frozen clean\-text sweep summaries used to construct the main trade\-off table, quality\-score components, radar normalization, and heatmap points\. These tables explain the compact quality score and visualization normalization; they do not introduce additional experimental claims beyond the clean\-setting trade\-off reported in the main text\. Table[4](https://arxiv.org/html/2608.20839#A3.T4)defines metric directions, Tables[7](https://arxiv.org/html/2608.20839#A3.T7)–[8](https://arxiv.org/html/2608.20839#A3.T8)report the full raw quality metrics, Tables[9](https://arxiv.org/html/2608.20839#A3.T9)–[10](https://arxiv.org/html/2608.20839#A3.T10)document the radar normalization, and Figures[6](https://arxiv.org/html/2608.20839#A3.F6)–[7](https://arxiv.org/html/2608.20839#A3.F7)provide compact clean quality–detection and clean detection views\.

Table 4:Metric definitions and orientations used in Section[4](https://arxiv.org/html/2608.20839#S4)\. Raw metrics are the primary evidence\. The normalized Quality score is a descriptive display summary constructed from direction\-normalized components and should not be interpreted as an additional ground\-truth quality label\.
### C\.2Full Experimental Configuration

This appendix records implementation\-level details for reproducibility\. Fields not exposed by the frozen scripts or summary metadata are marked as unavailable rather than inferred\.

CategoryFieldSettingGenerationModel nameLLaDA\-8B\-InstructGenerationPrompt sourceELI5\.jsonlGenerationPrompt formatLLaDA chat templateGenerationSplit sizesNativeH0=500H\_\{0\}=500, Delta\-dev=200=200, eval=200=200GenerationOperating GPUNVIDIA RTX PRO 6000GenerationGeneration length256 tokensGenerationBlock length32GenerationDiffusion stepsmax\(1,⌊0\.5×\\max\(1,\\lfloor 0\.5\\timesgeneration length⌋\)=128\\rfloor\)=128GenerationTemperature1\.0Generationtop\-pp/ top\-kknot available in the frozen configuration fieldsGenerationMask id126336GenerationSeeds and keyfixed random seeds and a fixed private watermark key; exact values are kept in the implementation configurationGenerationCached artifactsgenerated texts and exact perturbation tapes are cached for reproducibility in the implementation artifactsWatermarkMain SAC\-CopulaW=39W=39,σK=15\.0\\sigma\_\{K\}=15\.0,ρ=0\.6\\rho=0\.6WatermarkSAC sensitivity rowsW=35,σK=11\.5,ρ=0\.7W=35,\\sigma\_\{K\}=11\.5,\\rho=0\.7;W=35,σK=13\.5,ρ=0\.7W=35,\\sigma\_\{K\}=13\.5,\\rho=0\.7;W=39,σK=15\.0,ρ=0\.6W=39,\\sigma\_\{K\}=15\.0,\\rho=0\.6WatermarkPerturbation scaleα=1\.0\\alpha=1\.0, passed as the generation temperature in the generation callWatermarkTape length256 generated positions in the clean evaluationWatermarkExact tapessaved underexact\_tapes; missing\-tape reconstruction disabledBaselinesDirect mechanism baselinei\.i\.d\. position\-indexed GumbelBaselinesExternal baselinesKGW context\-green bias, Unigram static\-green bias, PatternMark MarkovPattern ReferenceLiteBaselinesExternal sweepδ∈\{1,2,3\}\\delta\\in\\\{1,2,3\\\}for KGW, Unigram, and PatternMark;γ=0\.25\\gamma=0\.25for KGW and UnigramBaselinesKGW detailsconv\-kernel PRF, kernel\[−1\]\[\-1\], context width 1, sumhash seeding, no\-bias fallbackBaselinesUnigram detailsstatic greenlist bias; unique\-token detector is the main detectorBaselinesPatternMark detailsMarkovPattern ReferenceLite,k=2k=2, pattern length 4, 10000 null samples

Table 5:Generation, watermark, and baseline configuration for the clean multi\-baseline evaluation\. Values are taken from the frozen generation/detection script and collected run metadata\.Table 6:Detector, calibration, and evaluator configuration for the clean multi\-baseline evaluation\. Values are taken from the implementation scripts, collected run metadata, and existing summary tables\.#### Baseline adaptation notes\.

KGW is adapted as a context\-greenlist bias baseline with the configured context width, PRF, and detector listed in Table[5](https://arxiv.org/html/2608.20839#A3.T5)and Table[6](https://arxiv.org/html/2608.20839#A3.T6)\. Unigram is used as a static\-greenlist clean\-text trade\-off baseline with its unique\-token detector\. PatternMark is the MarkovPattern ReferenceLite variant used in the clean evaluation, not a claim of a complete independent reimplementation of every PatternMark setting\. Detector derivations for the old readout, covariance\-aware calibration, filtering, ridge matched direction, and GO\-FFR are provided in Appendix[B\.1](https://arxiv.org/html/2608.20839#A2.SS1), Appendix[B\.2](https://arxiv.org/html/2608.20839#A2.SS2), Appendix[B\.3](https://arxiv.org/html/2608.20839#A2.SS3), and Appendix[B\.5](https://arxiv.org/html/2608.20839#A2.SS5); this experiment appendix only records how those detectors are used in the experiments\.

Table 7:Full automatic quality metrics for the clean multibase comparison, part 1\. The table reports fluency and stability, semantic preservation, distributional fidelity, and token\-distribution drift\. Lower values are better for PPL, collapse, and token TV; higher values are better for semantic similarity and MAUVE\.Table 8:Full automatic quality metrics for the clean multibase comparison, part 2\. Lower values are better for token JS and repetition; higher values are better for vocabulary\-overlap, distinctness, entropy, and the normalized quality score\.Table 9:Metric orientation used in the v3\.8 quality radar\. All radar axes are direction\-normalized so that larger values indicate better or more Native\-like behavior\. Lower\-is\-better metrics, including repetition, collapse rate, and PPL\-P90, are inverted before normalization\. The normalization is used only for visualization; raw quality metrics remain the primary evidence in Table[1](https://arxiv.org/html/2608.20839#S4.T1), Table[7](https://arxiv.org/html/2608.20839#A3.T7), and Table[8](https://arxiv.org/html/2608.20839#A3.T8)\.Table 10:Display\-normalized scores used in the v3\.8 quality radar\. A small display floor is applied to low\-scoring axes to avoid degenerate polygons in the visualization\. These scores are descriptive display values, not additional primary quality metrics\.
#### Quality–detection heatmap\.

Figure[6](https://arxiv.org/html/2608.20839#A3.F6)summarizes the same clean\-setting trends using a compact heatmap\. The quality score averages direction\-normalized components for semantic preservation, MAUVE\-based distributional fidelity, token\-distribution fidelity, low repetition, lexical diversity, and PPL\-tail stability\. This visualization is intended as a compact summary of the quality–detection balance rather than a replacement for the raw metric values in Table[7](https://arxiv.org/html/2608.20839#A3.T7)\.

The external\-baseline clean detection sweep overδ∈\{1,2,3\}\\delta\\in\\\{1,2,3\\\}is fully visualized below in Figure[7](https://arxiv.org/html/2608.20839#A3.F7)and supports the clean multi\-method comparison in Table[1](https://arxiv.org/html/2608.20839#S4.T1)\. Figure[6](https://arxiv.org/html/2608.20839#A3.F6)and Table[13](https://arxiv.org/html/2608.20839#A3.T13)further connect the clean delta sweep to the raw quality tables and detector\-readout sanity checks without duplicating the full CSV rows\.

![Refer to caption](https://arxiv.org/html/2608.20839v1/quality_detection_heatmap.png)Figure 6:Quality–detection heatmap for the clean multibase comparison\. Rows correspond to representative watermark settings, and columns show the normalized quality\-preservation score, AUC, TPR@FPR1, and TPR@FPR5\. The heatmap quality score averages semantic preservation, MAUVE, token\-distribution fidelity, low repetition, lexical diversity, and tail stability after direction\-aware normalization\. SAC\-Copula maintains a favorable balance between clean detectability and quality preservation compared with high\-strength external baselines\.
#### Full clean detection sweep\.

Figure[7](https://arxiv.org/html/2608.20839#A3.F7)reports the full clean detection visualization for AUC, TPR@FPR1, and TPR@FPR5 across the external\-baseline strength sweep\. This appendix figure provides the full clean\-detection sweep across methods and watermark\-strength settings and does not introduce new experimental values\.

Figure 7:Full clean detection sweep across watermark strengths\. The panels report AUC, TPR@FPR1, and TPR@FPR5 for KGW, Unigram, and PatternMark overδ∈\{1,2,3\}\\delta\\in\\\{1,2,3\\\}, with i\.i\.d\. Gumbel and SAC\-Copula shown as reference operating points\. This figure reports clean fixed\-alignment detection only\.

### C\.3Unigram Strength Trade\-off

Figure[8](https://arxiv.org/html/2608.20839#A3.F8)keeps the Unigram strength sweep as a contrastive reference for static\-bias tuning\. It is included in the appendix so that the main text can focus on the SAC\-Copula clean quality and clean detection profile\. The figure shows that stronger Unigram settings can improve clean detectability, but the same sweep changes semantic, distributional, token\-drift, repetition, and diversity dimensions\. This supports the main\-text interpretation of Unigram as a trade\-off baseline, not as the central object of study\.

Figure 8:SAC\-Copula avoids the high\-strength static\-bias quality trade\-off\. The Unigram strength sweep is included as a contrastive reference: Panel \(a\) shows clean TPR@FPR5 increasing with Unigram strengthδ\\delta, while Panels \(b\)–\(d\) show the accompanying semantic, distributional, token\-drift, repetition, and diversity costs\. SAC\-Copula is shown as the reference operating point\.
### C\.4Traceable Clean\-Generation Example

Table[11](https://arxiv.org/html/2608.20839#A3.T11)provides one traceable qualitative example from the frozen generated\-text JSONL artifact\. The example is included only to make the automatic quality metrics more concrete; it is not used as primary evidence and is not selected to prove a general qualitative claim\.

Table 11:Traceable clean\-generation example for the prompt “How do dollar stores turn a profit?” Excerpts are copied from the frozen clean\-generation artifact and truncated for space\. The table is illustrative only and does not replace the automatic quality metrics\.
### C\.5SAC Parameter Sensitivity

This subsection documents the SAC operating point used in the main experiments\. The three SAC parameters have distinct roles:WWcontrols the correlation window or range,σK\\sigma\_\{K\}controls the kernel decay and smoothness, andρ\\rhocontrols the strength of the correlated branch\. Table[12](https://arxiv.org/html/2608.20839#A3.T12)compares several SAC configurations under the same clean\-text evaluation slice\.

Detection metrics come from the FFR clean\-detection summary, and quality metrics come from the multidimensional quality and token\-drift summaries in the shared clean\-text evaluation slice indexed asδ=1\\delta=1for the external\-baseline strength sweep\. Thisδ\\deltaindex is not a SAC parameter; the SAC parameters areW,σK,ρW,\\sigma\_\{K\},\\rho\. The normalized quality score is not included in these delta\-sweep summary files, so it remains marked as unavailable rather than reconstructed, and the interpretation should rely on the raw listed metrics\.

![Refer to caption](https://arxiv.org/html/2608.20839v1/fig_sac_parameter_sensitivity_heatmap.png)Figure 9:SAC parameter sensitivity for clean operating\-point selection\. The heatmap groups configurations byρ\\rho, withWWandσK\\sigma\_\{K\}on the axes and color indicating the joint quality–detectability score\. The selected settingW=39,σK=15\.0,ρ=0\.6W=39,\\sigma\_\{K\}=15\.0,\\rho=0\.6is used as the main SAC\-Copula configuration\. This visualization guides operating\-point selection and is not a claim of global optimality or raw\-metric dominance\.Table 12:Compact appendix summary of SAC parameter sensitivity under clean DLM generation\. The selected SAC\-Copula row corresponds to the main\-text configurationW=39,σK=15\.0,ρ=0\.6W=39,\\sigma\_\{K\}=15\.0,\\rho=0\.6\. The normalized composite Quality score is unavailable in the delta\-sweep summary CSVs used for this parameter table, so the Quality column is left blank and the table should be interpreted through the listed raw metrics\. Theδ=1\\delta=1data slice is a shared clean\-text evaluation slice, not a SAC parameter\.The table should be read as a compact trade\-off summary\. TheW=35,ρ=0\.7W=35,\\rho=0\.7variants can improve some central fluency or collapse indicators, especially forW=35,σK=13\.5,ρ=0\.7W=35,\\sigma\_\{K\}=13\.5,\\rho=0\.7, but they also shift diversity, token\-drift, and low\-FPR detection behavior\. The selectedW=39,σK=15\.0,ρ=0\.6W=39,\\sigma\_\{K\}=15\.0,\\rho=0\.6setting is used because it retains strong low\-FPR detection while maintaining favorable MAUVE, repetition/diversity, and token\-drift behavior\.

Table[12](https://arxiv.org/html/2608.20839#A3.T12)supports the selected configuration as a deliberate quality–detectability operating point over the reported local sensitivity configurations\.

### C\.6Detector Comparison for SAC Evidence

This subsection is included to separate generation\-side structure from detector\-side readout in the clean setting\. The old detector is the i\.i\.d\. equal\-weight baseline readout, while FFR is the SAC\-aware filtered statistic used to read the local low\-lag evidence geometry induced by SAC\-Copula\. GO\-FFR provides continuity with the mild insertion/deletion stress tests\.

Table[13](https://arxiv.org/html/2608.20839#A3.T13)reports the available clean detector comparison rows from the clean detection summary\. The comparison should be read in two steps: if SAC evidence already improves over i\.i\.d\. Gumbel under the old detector, that supports a generation\-side signal difference; if FFR improves further on SAC evidence, that supports a matched readout for SAC structure\.

Table 13:Compact appendix summary of available clean detector comparison rows for i\.i\.d\. Gumbel and SAC\-Copula evidence\. FFR and GO\-FFR read the local correlated evidence generated by SAC, while the old\-detector rows provide sanity checks against the legacy i\.i\.d\. readout\.The clean fixed\-alignment setting explains why GO\-FFR matches or closely tracks FFR here: offset recovery is unnecessary when alignment is intact\. Table[13](https://arxiv.org/html/2608.20839#A3.T13)serves as a clean\-detector sanity check connecting the shared legacy readout to the SAC\-aware readout; GO\-FFR is included for continuity with the controlled edit diagnostics\.

### C\.7Controlled Token\-Level Edit Details

Table[14](https://arxiv.org/html/2608.20839#A3.T14)and Figures[11](https://arxiv.org/html/2608.20839#A3.F11)–[13](https://arxiv.org/html/2608.20839#A3.F13)support Section[4\.4](https://arxiv.org/html/2608.20839#S4.SS4)\. These results are intended as controlled token\-edit diagnostics rather than a claim of adversarial robustness\. Across selected deletion, insertion, and substitution settings, the SAC\-aware detector retains partial residual evidence, and the Global Offset variant provides a coarse realignment benefit\. The full sweep figures report AUC, TPR@FPR1, and TPR@FPR5 across 0–50% attack rates\. Low\-FPR TPR remains substantially harder than AUC under deletion and insertion, which supports the failure analysis rather than a broad edit\-robustness claim\. These conclusions come from the frozen token\-edit summaries, relative\-gain, and global\-offset summaries\. They should not be inferred from the multi\-baseline clean\-text results\.

The full 20% cross\-method AUC and detector/readout comparison is shown in Figure[10](https://arxiv.org/html/2608.20839#A3.F10)\. Table[14](https://arxiv.org/html/2608.20839#A3.T14)focuses on the detector\-readout rows used to interpret SAC OLD, FFR, and GO\-FFR behavior\. Substitution does not induce cumulative position drift, so the fixed\-alignment rows are the relevant diagnostic; no separate GO\-FFR substitution row is needed for the synchronization\-drift interpretation\.

Figure 10:Full AUC comparison under20%20\\%token\-level edit attacks\. The three panels report deletion, insertion, and substitution for SAC\-Copula readouts, the direct i\.i\.d\. Gumbel baseline, and external clean\-text baselines\. This full comparison provides the complete cross\-method view supporting the compact quantitative token\-edit discussion in the main text and is reported as a residual\-evidence diagnostic, not as a broad robustness claim\.Table 14:Selected low\-rate token\-level edit diagnostics from the frozen token\-edit summary\. These results are reported as partial residual\-evidence diagnostics rather than broad robustness claims; the table is not evidence of full edit\-path alignment or semantic rewrite robustness\.Figure 11:Deletion stress\-test sweep from 0% to 50% token edit rate\. The three panels report AUC, TPR@FPR1, and TPR@FPR5 for SAC\-Copula readouts, i\.i\.d\. Gumbel, and external clean\-text baselines\. The curves are residual\-evidence diagnostics: GO\-FFR can partially recover coarse offset shifts, while low\-FPR TPR remains limited under accumulated deletion drift\.Figure 12:Insertion stress\-test sweep from 0% to 50% token edit rate\. The three panels report AUC, TPR@FPR1, and TPR@FPR5\. Insertion induces synchronization drift by shifting token\-to\-tape indexing; GO\-FFR provides a coarse\-offset diagnostic improvement but does not solve cumulative local drift\.Figure 13:Substitution stress\-test sweep from 0% to 50% token edit rate\. The three panels report AUC, TPR@FPR1, and TPR@FPR5\. Substitution corrupts token identities without shifting all subsequent positions, so it is a controlled token\-corruption diagnostic rather than a synchronization\-drift setting\.
### C\.8Failure Analysis under Edit Drift

Table 15:Diagnostics at 50% deletion/insertion from the frozen token\-edit summary\. GO\-FFR partially improves coarse synchronization, while cumulative local drift remains\.Deletion and insertion accumulate synchronization drift\. GO\-FFR recovers coarse shifts but not cumulative local drift, leaving edit\-path alignment unresolved\. Evidence comes from the frozen relative\-drop, token\-attack, and global\-offset summaries\.

The frozen semantic/paraphrase summaries cover paraphrase results, valid\-only filtering, realized TER bins, relative gains, and detector\-only comparisons\. They show degraded detection under semantic rewriting; offset\-style diagnostics provide only partial recovery\.

Table 16:Semantic/paraphrase failure\-analysis rows from the frozen summary, defining the current robustness boundary\.

### C\.9Tail Stability and Correlation\-Strength Controls

The tail analysis in Tables[17](https://arxiv.org/html/2608.20839#A3.T17)–[18](https://arxiv.org/html/2608.20839#A3.T18)re\-analyzes 200 frozen LLaDA\-8B\-Instruct ELI5 outputs for SACW=39,σK=15,ρ=0\.6W=39,\\sigma\_\{K\}=15,\\rho=0\.6, paired byPrompt\_IDandGen\_Len\. Conditional PPL is evaluated with Meta\-Llama\-3\.1\-8B\-Instruct; collapse isConditional\_PPL\>100\\texttt\{Conditional\\\_PPL\}\>100\. Confidence intervals use10,00010\{,\}000paired bootstrap resamples with seed2026071220260712\.

#### Fixed\-parameter correlation\-strength sweep\.

The canonical 8B sweep variesρ∈\{0,0\.2,0\.4,0\.6,0\.8,1\}\\rho\\in\\\{0,0\.2,0\.4,0\.6,0\.8,1\\\}while fixingW=39W=39,σK=15\\sigma\_\{K\}=15,α=1\\alpha=1, temperature11, generation length256256, block length3232,128128diffusion steps, and key4242\. Prompts, seeds, decoding, and remasking are fixed; both Old and FFR detectors are evaluated, and PPL uses Meta\-Llama\-3\.1\-8B\-Instruct\. Theρ=0\\rho=0row is the direct matched i\.i\.d\. endpoint\. This is a fixed\-parameter correlation\-strength sweep, not matched\-detectability or watermark\-strength optimization\.

Table 17:Conditional\-PPL summaries for frozen LLaDA–ELI5 outputs\. Q95 is the mean after trimming the highest 5%\.
Table 18:Paired collapse transitions and statistical diagnostics for SAC relative to matched i\.i\.d\. Gumbel\. The collapse\-rate difference is SAC minus i\.i\.d\.Table 19:Complete detection results for the canonical six\-pointρ\\rhosweep\. TPR1 and TPR5 denote TPR at 1% and 5% FPR, respectively\.Table 20:Complete quality\-tail results for the canonical six\-pointρ\\rhosweep\. At the two reported endpoints for broader quality context,ρ=0\.6\\rho=0\.6has Rep3≈\.414\\approx\.414and Distinct3≈\.586\\approx\.586, whileρ=1\\rho=1has Rep3≈\.528\\approx\.528and Distinct3≈\.472\\approx\.472; unreported intermediate repetition/diversity values are not imputed\.Detection improves toward moderate correlation and then declines, while the quality dimensions do not move uniformly\. The sweep therefore supportsρ=0\.6\\rho=0\.6as a balanced interior operating point, not a universal or global optimum, and does not isolate correlation as a causal theorem\.

### C\.10Calibration and Threshold\-Transfer Controls

#### Calibration\-size sensitivity\.

These controls use LLaDA–ELI5, SACW=39,σK=15,ρ=0\.6W=39,\\sigma\_\{K\}=15,\\rho=0\.6, and model\-nativeH0H\_\{0\}\. Calibration sizes are50/100/200/50050/100/200/500, with20/20/20/120/20/20/1repeats, respectively\. Development and evaluation identities are fixed and no evaluation example is used for calibration\.

Table 21:ROC discrimination as a function of model\-nativeH0H\_\{0\}calibration size\. Mean and standard deviation are reported when repeated subsamples are available\.Table 22:Operational\-threshold diagnostic across calibration sizes\. Strong ROC discrimination does not imply insensitivity of fixed low\-FPR thresholds toH0H\_\{0\}sample size\.
#### Calibration\-source controls\.

All four source conditions useN=500N=500, the same development identities, the same 200 LLaDA–ELI5 Native negative evaluations, and the same 200 LLaDA–ELI5 SAC positive evaluations; only theH0H\_\{0\}source changes\.

Table 23:Four\-sourceH0H\_\{0\}calibration control with fixed development and evaluation identities\. The results quantify source sensitivity; no formal equivalence margin was pre\-specified\.Table 24:Native/Human2×22\\times 2ROC control\. This matrix reports score discrimination rather than realized FPR at frozen operational thresholds\.
#### Threshold portability and prompt shift\.

Using WikipediaH0H\_\{0\}thresholds on ELI5 Native evaluation gives realized FPR6\.5%6\.5\\%\(13/20013/200\) and TPR97\.5%97\.5\\%at the nominal 1% point, and realized FPR21\.0%21\.0\\%\(42/20042/200\) and TPR98\.5%98\.5\\%at the nominal 5% point\. Thus, strong ROC separation is not equivalent to threshold portability\.

Table 25:Same\-model prompt\-shift control\. A→\\rightarrowB changes question/content samples; B→\\rightarrowC changes the prompt template with questions and seeds fixed; A→\\rightarrowC is the combined tested same\-model/same\-task shift\. This is not a prompt\-invariance claim beyond the evaluated setting\.

#### Frozen\-threshold C4realnewslikeFPR\.

This detector\-only transfer test freezes the original LLaDA–ELI5 model\-native\-H0H\_\{0\}thresholds, performs no C4 refit, and evaluates2,0002\{,\}000held\-out non\-watermarked C4realnewslikerecords\. It is not C4 watermark generation and is distinct from the C4\-en continuation experiments below\.

Table 26:Frozen\-threshold false\-positive transfer from LLaDA–ELI5 NativeH0H\_\{0\}to held\-out C4realnewslikenegatives\.As a secondary diagnostic, rebuildingH0H\_\{0\}on C4realnewslikeyields realized FPR2\.95%2\.95\\%, exact 95% CI\[2\.25%,3\.79%\]\[2\.25\\%,3\.79\\%\], at nominal 1%, and7\.55%7\.55\\%, CI\[6\.43%,8\.80%\]\[6\.43\\%,8\.80\\%\], at nominal 5%\. This evaluated sample does not show improved false\-positive control after rebuildingH0H\_\{0\}on C4; it does not establish that target\-domain recalibration is generally harmful\. Frozen\-threshold realized FPR and ROC\-selected detection answer different operational questions\.

### C\.11Targeted Backbone and Task Transfer

#### Dream\-v0\-Instruct\-7B on ELI5\.

This targeted second\-backbone evaluation uses 500 held\-out ELI5 human answers for calibration, a separate 200 human answers for negative evaluation, and 200 method\-specific Dream generations for positive evaluation\. The i\.i\.d\. system uses its original exact\-tape detector, while SAC uses FFR\.

DetectionMethodAUCTPR1TPR5i\.i\.d\. Gumbel1\.0000001\.0001\.000SAC\-Copula\.998625\.995\.995QualitySourceMedianP95P99CompositecollapseELI5 human answers13\.4224\.0430\.550\.0%i\.i\.d\. Gumbel30\.02889\.585988\.2524\.5%SAC\-Copula17\.8481\.69240\.684\.0%Table 27:Dream\-7B detection and quality evidence on ELI5\. Composite collapse is the Dream experiment’s preregistered PPL/repetition rule and is not the LLaDAConditional\_PPL\>100\\texttt\{Conditional\\\_PPL\}\>100statistic\.Both methods retain near\-perfect detection in this protocol, while SAC reduces the i\.i\.d\. upper\-tail and composite\-collapse profile\. This provides targeted evidence of cross\-DLM generalization to a second backbone\.

#### LLaDA on C4\-en continuation\.

The task uses a continuation instruction with a 128\-token passage and generates 256 tokens\. SAC usesW=39,σK=15,ρ=0\.6W=39,\\sigma\_\{K\}=15,\\rho=0\.6with no C4\-specific watermark retuning\. Calibration uses 200 C4\-prompted unwatermarked LLaDA outputs; evaluation uses 500 raw non\-watermarked C4\-en records and 200 method\-specific watermarked outputs\. The method\-matched pipelines use Old for i\.i\.d\. and FFR for SAC\.

Table 28:Method\-matched LLaDA C4\-en continuation results\. Detection differences are attributed to the complete i\.i\.d\.\+Old and SAC\+FFR pipelines, not solely to generation\-side SAC\.The two pipelines have nearly identical median PPL, while SAC\+FFR has a substantially less severe quality tail and stronger detection under the submitted method\-matched protocol\. This provides targeted evidence of cross\-domain generalization to a second task/source setting\.

#### Separate common\-detector control\.

This is a distinct detector\-control protocol and is not merged with the method\-matched result above\.

Table 29:Separate C4 common\-detector audit\. These detector\-control values must not be interpreted as the submitted method\-matched C4 result in Table[28](https://arxiv.org/html/2608.20839#A3.T28)\.Additional quality context in this separate audit is Rep30\.7298→0\.69540\.7298\\rightarrow 0\.6954, Distinct30\.2702→0\.30460\.2702\\rightarrow 0\.3046, and Ent31\.7293→1\.99861\.7293\\rightarrow 1\.9986from i\.i\.d\. to SAC\. The C4 raw\-text calibration\-source control, frozen\-threshold C4realnewslikeFPR test, C4\-en method\-matched experiment, and this common\-detector audit retain their distinctH0H\_\{0\}, evaluation, denominator, and detector identities\.