---
title: 'CentralMark: Multi-Domain Watermarking'
url: https://www.emergentmind.com/topics/centralmark
type: topic
---

# CentralMark: Multi-Domain Watermarking

Searching arXiv for the cited CentralMark-related papers to ground the article in current records.
CentralMark is a name used in recent arXiv literature for multiple unrelated technical constructs. In one usage, it denotes an efficiency-focused approach to element marking in adaptive mesh refinement (AMR) driven by Kelly error indicators for steady solid and fluid mechanics benchmarks. In another, it denotes an inheritable watermarking scheme for DNA language models that deliberately induces a protein-level signal detectable after translation. In synthesized watermarking systems literature, it also names a centralized detection and benchmarking service derived from the "Mark My Words" evaluation framework, and it is further associated with the CORE-based text image watermarking framework CoreMark [2605.05234] [2509.18207] [2312.00273] [2506.23066].

## 1. Terminological scope

The term appears in at least four distinct technical settings in the supplied literature. These settings are not methodologically unified; they share a label rather than a common formalism.

| Usage of “CentralMark” | Domain | Defining idea |
|---|---|---|
| CentralMark | Adaptive FEM / AMR | Efficiency-focused marking for AMR with Kelly indicators |
| CentralMark | DNA and protein watermarking | Inheritable watermark detectable on DNA or translated protein |
| CentralMark | Watermark operations | Centralized detection and benchmarking service |
| CentralMark ↔ CoreMark | Text image watermarking | CORE-based embedding by modifying character CORE thickness |

A plausible implication is that “CentralMark” is domain-local terminology rather than the name of a single cross-domain framework. The most developed and self-contained usage is the biomolecular watermarking scheme introduced alongside DNAMark, while the AMR usage is a benchmarking and decision framework for refinement marking, and the watermark-service usage is an operational synthesis built on an external benchmark [2509.18207] [2605.05234] [2312.00273].

## 2. CentralMark in adaptive mesh refinement

In AMR, CentralMark is described as “efficiency-focused marking for AMR with Kelly indicators,” evaluated on steady solid mechanics and steady incompressible flow problems [2605.05234]. The benchmark includes plane strain (SC0) and plane stress (SC1) in 2D, using triangular meshes and first-order Lagrange elements (P1), as well as the lid-driven cavity (FC0) and flow around cylinder at \(Re=20\) (FC1), again in 2D, using triangular meshes with equal-order velocity–pressure P1–P1 and Galerkin–Least-Squares stabilization. SC0 features a crack-tip singularity, SC1 is smooth, FC0 contains corner pressure singularities induced by a “non-leaky” lid, and FC1 is regular apart from boundary-layer structure. Across all tests, marked elements are refined by approximately halving element size, no coarsening is used, remeshing is performed through Gmsh on each cycle, and convergence is defined by a relative error target of \(1\%\) in the energy norm for solids or the \(L^2\) velocity norm for fluids [2605.05234].

All marking strategies are driven by the residual-based Kelly estimator. For a scalar field \(u\), the per-element indicator is
\[
\eta_K^2 = \sum_{e \subset \partial K} h_e \cdot \| [\nabla u_h \cdot n_e] \|_{L^2(e)}^2,
\]
while for vector fields a common extension uses the Frobenius norm of the gradient jump,
\[
\eta_K^2 = \sum_{e \subset \partial K} h_e \cdot \| [\nabla u_h] \|_{F,L^2(e)}^2,
\]
or component-wise aggregation. Globally, the study uses \(p=2\) aggregation,
\[
\mathcal{E}^2 = \sum_K \eta_K^2.
\]
The benchmark keeps the estimator form fixed across cycles and emphasizes consistent local scaling proportional to edge length on 2D triangles [2605.05234].

Five marking strategies are compared: maximum marking (MAX), Dörfler bulk-chasing (DOE), quantile marking (QUA), z-score marking (ZSC), and Isolation Forest (ISO). MAX marks elements satisfying \(\eta_K \ge \alpha \max_T \eta_T\), DOE finds a minimal marked set \(M\) such that \(\sum_{K \in M}\eta_K^2 \ge \theta \sum_T \eta_T^2\), QUA marks the top \(q\)-quantile, ZSC marks statistical outliers above a threshold \(k\), and ISO treats large indicators as anomalies with contamination parameter \(c\) [2605.05234].

The efficiency results are problem-dependent but sharply differentiated. Quantile and z-score markings are the most robust performers across cases. For SC0, QUA is best with \(\gamma \approx 0.6\text{–}0.8\), while ZSC is strong for \(k \lesssim 1\), particularly \(k \approx 0.25\) with log scaling. For SC1, QUA and ZSC remain strong across wide parameter ranges; MAX is good at \(\alpha = 0.1\text{–}0.3\); DOE is strong for \(\theta \ge 0.8\). For FC0, QUA performs best with low \(\gamma\) around \(0.1\), ZSC is good with small \(k \approx 0.25\), DOE and MAX are moderate, and ISO is comparable to ZSC when contamination is generous. For FC1, DOE is excellent at \(\theta = 0.9\), QUA performs well across \(\gamma\), ZSC is again good near \(k \approx 0.25\), MAX is good with \(\alpha \approx 0.1\), and ISO is slightly weaker than ZSC unless \(c\) is large [2605.05234].

The failure modes are explicit. MAX is brittle with irregular fields and stagnates on SC0; DOE under-marks distributed error unless \(\theta\) is large; ISO may fail or underperform for aggressive low contamination levels such as \(c \le 0.1\). The study therefore recommends Quantile marking when direct control of per-cycle refinement cost is needed, z-score with log-scaled indicators when a data-driven but still lightweight rule is preferred, and Dörfler with \(\theta = 0.8\text{–}0.9\) when bulk-error chasing is the priority [2605.05234].

## 3. CentralMark as inheritable watermarking across the central dogma

In biomolecular sequence generation, CentralMark is an inheritable watermarking scheme for DNA language models that deliberately imprints a protein-level signature while the sequence is being generated at the DNA level [2509.18207]. Unlike DNAMark, which uses synonymous codon substitutions in the third base so that protein identity is unchanged, CentralMark targets the second base of codons and intentionally biases the amino-acid distribution in the translated protein. The watermark is designed to be detectable from either the DNA sequence or the protein alone, so that the signal “travels” across the central dogma. The stated threat models include random point mutations, synonymous codon rewrites, insertions and deletions, partial or full protein-only release, and adversarial edits intended to remove or mask watermarks [2509.18207].

The formalization begins with a coding DNA sequence
\[
x \in \{A,C,G,T\}^N,
\]
where \(N\) is divisible by \(3\), and codons
\[
c_t = (b_1,b_2,b_3), \quad t=1,\dots,T, \quad T=N/3.
\]
Translation yields a protein
\[
y = \mathrm{Translate}(x) \in \mathcal{A}^T,
\]
with \(\mathcal{A}\) the \(20\)-amino-acid alphabet. CentralMark uses protein embeddings \(E_{\text{protein}}(y)\), obtained from protein language models such as ESM or ESM2, and in implementation these embeddings are projected to a \(1024\)-dimensional vector before watermark-logit prediction through a small MLP with residual blocks and LayerNorm [2509.18207].

At generation step \(t\), the watermark model outputs logits over the second base:
\[
L_t = W(E_{\text{protein}}(y_{1:(t-1)})) \in \mathbb{R}^4,
\]
indexed by \(\{A,C,G,T\}\). The green set \(G_b(t)\) is defined by the top-2 bases in \(L_t\), and candidate codons are biased toward those with second base in that set. The constrained generation objective is
\[
\max_{c_t \in \{A,C,G,T\}^3}
\log p_\theta(c_t \mid x_{<t}) + \delta \cdot \mathbf{1}(c_t \in C_{\text{green}}(t))
- \lambda_{GC}\Psi_{GC}(x_{\le t})
- \lambda_{\text{usage}} D_{KL}(\mathrm{usage}(x_{\le t}) \,\|\, \mathrm{usage}_{\text{target}})
- \lambda_{\text{reg}}\Psi_{\text{reg}}(x_{\le t}).
\]
This objective encodes the paper’s biological constraints: maintaining reading frame, avoiding stop codons, constraining GC content within \([GC_{\min},GC_{\max}]\), following organism-specific codon-usage preferences, and skipping edits in low-entropy windows likely to contain regulatory motifs [2509.18207].

CentralMark’s watermark model is trained with an alignment loss and a normalization loss. The alignment term encourages similarity in watermark logits to track similarity in protein semantic embeddings, while the normalization term enforces balanced logits across bases. The total objective is
\[
\mathcal{L} = \mathcal{L}_a + \mathcal{L}_n.
\]
This design is intended to make the watermark semantic-aware and statistically neutral, thereby reducing susceptibility to simple frequency-based cracking [2509.18207].

## 4. Detection, robustness, and biomolecular evaluation

Detection is performed on both DNA and protein. On the DNA side, CentralMark counts second-base occurrences in the green set and applies a z-score detector with expected green proportion \(\gamma_{\text{DNA}} = 0.5\). On the protein side, amino acids are partitioned into green and red sets through second-base mapping, and the expected null green proportion is \(\gamma_{\text{protein}} \approx 0.55\), averaged across all possible green-set pairs. In both cases, the decision rule is \(z \ge \tau\), where \(\tau\) is calibrated to a target false positive rate such as \(1\%\) or \(10\%\) [2509.18207].

The scheme also admits an optional embedding-based detector,
\[
s(y) = \sigma(\mathbf{w}^\top E_{\text{protein}}(y)),
\]
with thresholding on \(s(y)\). The role of protein embeddings is central: the paper argues that they capture semantic and functional features that are relatively invariant to small mutations, synonymous rewrites, and local edits. Robustness is expressed as small embedding perturbation under a mutation operator \(M\) and persistence of elevated green counts after editing [2509.18207].

The reported results on the therapeutic DNA benchmark are specific. At \(1\%\) and \(10\%\) FPR, CentralMark with Evo2-7B achieves \(F1 \approx 0.928\) on DNA and \(0.924\) on protein under no attack; \(F1 \approx 0.916\) on DNA and \(0.920\) on protein under synonymous codon substitution; \(F1 \approx 0.908\) on DNA and \(0.900\) on protein under nucleotide substitutions; and \(F1 \approx 0.862\) on DNA and \(0.858\) on protein under indels. These values are all at least \(0.85\) under \(5\%\) edit rates, which the paper describes as far above typical biological mutation rates. Sequence similarity to ground truth remains at least \(60\%\), and the degeneracy score remains below \(15\%\) [2509.18207].

The CRISPR-Cas9 case study further characterizes the method. CentralMark is embedded during generation with Evo using the evo-1-8k-crispr model; Prodigal is used to extract Cas9 CDS, MinCED to detect CRISPR arrays, AlphaFold3 to predict structure, and structural alignment is performed to SpCas9 (PDB 4OO8). The outcomes reported are a TM-score of \(0.6802\), a protein z-score of approximately \(5.41\), and DNA similarity to wild type of \(67.3\%\). The study states that no obvious functional catastrophic changes were observed in silico and attributes this to the use of second-base watermarking under stop-codon and frame constraints [2509.18207].

The computational overhead is reported as approximately \(30\%\) relative to unwatermarked generation, with modest memory cost because the watermark model is compact and embeddings are computed on short contexts. Indels are identified as especially damaging, with TPR dropping to approximately \(0.76\text{–}0.85\), and proposed mitigations include stronger semantic bias with EMA-constrained \(\delta\), hybrid detection that triggers if either DNA or protein detection succeeds, and organism-specific calibration of \(\gamma\) and \(\tau\) [2509.18207].

## 5. CentralMark as centralized watermark detection and benchmarking

A separate usage presents CentralMark as a centralized watermark detection and benchmarking service derived from the "Mark My Words" benchmark for language model watermarks [2312.00273]. In that synthesis, the service is designed around the benchmark’s three principal metrics: quality \(Q\), size \(E\), and tamper-resistance \(R\). The benchmark itself evaluates three long-form English generation tasks—BookReport, Story, and FakeNews—with \(300\) generations total, using Llama-2 7B-chat for both generation and automated quality rating [2312.00273].

Quality is measured through automated rating, with reported correlation to GPT-3.5 ratings of \(R^2 \approx 0.97\) on average across benchmark prompts. Size is the median number of tokens required to detect a watermark at a controlled false positive rate of \(2\%\), determined by scanning prefixes until the shortest detected prefix is found. Tamper-resistance is defined through an AUC-style metric over attack outcomes, where each attack contributes a retained-quality coordinate \(Q_A\) and a retained-detection coordinate \(W_A\), and the final robustness score is twice the area under the convex hull of those points, normalized so that \(R \in [0,1]\) [2312.00273].

The benchmark’s primary scheme of interest is the distribution-shift watermark of Kirchenbauer et al. For each context, a keyed PRF produces a pseudorandom permutation of the vocabulary, defining a greenlist of fraction \(\gamma\). Watermarking shifts the logits by
\[
l'_t = l_t + \delta \quad \text{if } t \in G, \qquad l'_t = l_t \quad \text{otherwise,}
\]
and detection counts green tokens,
\[
S = \sum_{i=1}^{n} \mathbb{1}\{x_i \in G_i\}.
\]
Under the null, \(S\) is tested against \(\mathrm{Binomial}(n,\gamma)\), with normal approximation
\[
z = \frac{S - n\gamma}{\sqrt{n\gamma(1-\gamma)}}
\]
when appropriate [2312.00273].

For CentralMark as a service concept, the benchmark provides concrete operating points. Distribution-shift with \(\gamma = 0.5\), sliding window \(H=3\), and temperature-tuned \(\delta\) typically detects watermarks in approximately \(60\text{–}80\) tokens for \(T \in [0.0,0.7]\), while maintaining at least \(99\%\) relative quality and \(R \ge 0.2\). Across tasks, detection with fewer than \(100\) tokens is described as typical. Paraphrasing with GPT-3.5 removes the watermark approximately \(60\%\) of the time under near-optimal-size settings, translation attacks such as English↔Russian do so less than \(40\%\) of the time in most settings, and simpler perturbations are less effective [2312.00273].

Operationally, the service is specified to accept text, model family or tokenization, optional sampling metadata, scheme identifier, and a key identifier or centralized key handle; to return a binary detection decision together with confidence such as a p-value or z-score; and to perform key management server-side. The synthesis also recommends conservative thresholding, exact binomial testing when feasible, rate limiting, near-duplicate monitoring, and non-disclosure of detailed per-token statistics in order to impede iterative evasion [2312.00273].

## 6. CentralMark and the CORE-based watermarking framework

Another supplied source states that CentralMark corresponds to CoreMark, with “central” referring to the same core-based embedding feature introduced in the paper—COREs—and the overall framework being exactly the CoreMark system [2506.23066]. In that framework, a CORE is defined as a structural feature comprising consecutively aligned black pixel segments within a character image:
\[
S_{\mathrm{core}} = \{S_i \mid i=1,\dots,n\}.
\]
Each \(S_i\) is a run of black pixels aligned along a dominant direction \(\mathcal{D}\), horizontal or vertical. The associated parameters are the direction \(\mathcal{D}\), the starting points \(\mathcal{P}=\{(x_i,y_i)\}\), and the run lengths \(\mathcal{L}=\{l_i\}\) [2506.23066].

CORE extraction proceeds by run-length coding on rasterized binary character images. For the horizontal case, each row is represented as run-length pairs \(\zeta_m(\mu_j^m,\rho_j^m)\), where \(\rho_j^m \in \{0,1\}\) indicates black or white. The dominant direction is chosen by comparing the average maximal black-run lengths across rows and columns through quantities \(U_h/K_h\) and \(U_v/K_v\). Candidate vectors are then clustered into COREs under a tolerance \(T_c\), with adjacency and boundary-consistency rules suppressing isolated noise pixels [2506.23066].

Two measurements are fundamental. The CORE length of character \(c_i\) is
\[
l_{\mathrm{core}}^i =
\frac{\sum_{j=1}^{\mathrm{len}(\mathcal{I})}\mu_j^{\max}}
{\mathrm{len}(\mathcal{I})},
\]
the average run length over aligned CORE segments. The CORE thickness \(\alpha_i\) is the number of candidate vectors in the selected CORE cluster. CoreMark dynamically extracts COREs from characters, selects robust characters according to CORE length, and embeds hidden data by modifying CORE thickness. A plug-and-play embedding strength modulator is also proposed to enhance robustness for small font sizes by adjusting embedding strength according to font size [2506.23066].

The abstract-level claims are centered on transmission robustness and generalizability. CoreMark is stated to have inherent noise resistance during transmission and broad applicability across languages and fonts, and to resist screenshot, print-scan, and print camera attacks while maintaining satisfactory imperceptibility. This suggests that the “central” nomenclature, in this usage, is tied to the geometric core of character glyphs rather than to centralization of verification or to the biological central dogma [2506.23066].

## 7. Limitations and comparative interpretation

The AMR CentralMark is explicitly limited to stationary 2D problems, linear P1 and stabilized P1–P1 discretizations, and the Kelly residual-jump estimator as the sole driver. It does not include coarsening or hp-adaptivity, and fluid performance is assessed in the velocity \(L^2\) norm, which the study notes underweights gradients. The paper therefore cautions that other estimators, transient problems, nonlinear materials, or higher-order discretizations may shift parameter optima, even if the qualitative ranking of strategies persists [2605.05234].

The biomolecular CentralMark is limited primarily to coding DNA sequences and second-base watermarking under explicit biological constraints. Indels are the most damaging perturbation class, runtime incurs an approximately \(30\%\) overhead, and calibration of \(\gamma\) and \(\tau\) may need to change with organism-specific codon usage. The scheme trades a small degree of amino-acid perturbation for dual-channel detectability, unlike synonymous-only methods such as DNAMark [2509.18207].

The centralized watermark-service formulation is limited by the benchmark from which it is derived. "Mark My Words" focuses on English prose rather than code generation, and it notes that low-entropy next-token distributions make watermarking harder; code is identified as a setting requiring separate expectations and policies. The benchmark runtime is \(30\text{–}60\) minutes on an A5000 GPU for \(300\) generations with a \(1024\)-token cap, and exact testing is only available for some schemes [2312.00273].

The CORE-based correspondence is constrained by a binary-image pipeline and a character-structure view of embedding. The supplied technical description states that the method is robust to binarization but does not fix a specific binarization function. Its domain is document image watermarking rather than sequence generation or adaptive numerical simulation [2506.23066].

Taken together, these uses of CentralMark span adaptive numerical analysis, biomolecular provenance, centralized watermark operations, and document-image watermarking. A plausible implication is that the term should always be interpreted with immediate domain qualification, since its mathematical objects—finite-element error indicators, codon second bases, greenlist token counts, and aligned black-pixel runs—are entirely different despite the shared label [2605.05234] [2509.18207] [2312.00273] [2506.23066].

Source: https://www.emergentmind.com/topics/centralmark