DMark: Dynamic Multi-bit Watermarking for LLMs

• DMark is a dynamic multi-bit watermarking framework that segments generated LLM text based on local token capacity for reliable embedding.
• It deploys a two-stage process combining capacity-aware dynamic segmentation with token biasing to adaptively embed watermark bits.
• Empirical results indicate about 20% fewer tokens per bit and a 50% reduction in embedding time compared to state-of-the-art approaches.

DMark most directly denotes DERMARK, a Dynamic, Efficient and Robust Multi-bit Watermark for LLMs that addresses a specific failure mode in prior multi-bit LLM watermarking: fixed-length segmentation can mismatch the actual watermarking capacity of generated text, causing embedding failures when segments are too short or too low-entropy to carry a bit reliably (Lin et al., 4 Feb 2025). In adjacent literature, closely related names denote distinct mechanisms in watermarking, fingerprinting, tracking, and marker removal, including De-mark for watermark removal in LLMs, dgMARK for watermarking discrete diffusion LLMs, DeMark for black-box attacks on deepfake watermarking defenses, DeepMarks for DNN fingerprinting, DM-DCF for RGB-D tracking, and Echo-DM for ultrasound marker removal (Chen et al., 2024, Hong et al., 30 Jan 2026, Song et al., 23 Jan 2026, Chen et al., 2018, Kart et al., 2018, Wang et al., 8 Jun 2026).

1. Terminological scope and disambiguation

The most direct mapping of “DMark” in the present context is to DERMARK, but the label is not unique across arXiv-indexed research. A concise disambiguation is therefore necessary.

Term	Paper	Research focus
DERMARK	(Lin et al., 4 Feb 2025)	Multi-bit watermarking for LLM-generated text
De-mark	(Chen et al., 2024)	Watermark removal in LLMs
dgMARK	(Hong et al., 30 Jan 2026)	Decoding-guided watermarking for discrete diffusion LLMs
DeMark	(Song et al., 23 Jan 2026)	Query-free black-box attack on deepfake watermarking defenses
DeepMarks	(Chen et al., 2018)	Digital fingerprinting framework for deep neural networks
DM-DCF	(Kart et al., 2018)	Depth-aware RGB-D object tracking
Echo-DM	(Wang et al., 8 Jun 2026)	Ultrasound marker removal

Within this naming landscape, DERMARK is the only method explicitly described as also written “DMark” in the prompt (Lin et al., 4 Feb 2025). A plausible implication is that “DMark” functions less as a uniquely standardized acronym than as a recurrent naming pattern attached to several technically unrelated methods.

2. Formal problem setting of DERMARK

DERMARK formulates multi-bit watermarking as a segmentation-and-embedding problem over an autoregressively generated token sequence

$\mathbf{s}=\{s^{(0)}, s^{(1)}, \ldots\},$

conditioned on a prompt $\mathbf{x}^p$. At generation step $t$, the model emits logits

$$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$

which are mapped by softmax to

$$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$

The watermark message is

$m \in \{0,1\}^K,$

with one bit assigned per segment (Lin et al., 4 Feb 2025).

The framework decomposes multi-bit watermarking into two stages. First, the generated text is divided into consecutive segments $S_1,\ldots,S_K$. Second, each segment $S_k$ carries one watermark bit $m_k$. This decomposition is central: DERMARK treats the segmentation problem, rather than the one-bit embedding primitive itself, as the main source of failure in prior methods (Lin et al., 4 Feb 2025).

The one-bit primitive follows the standard green/red-list construction. The vocabulary $V$ is partitioned into

$\mathbf{x}^p$0

To embed bit $\mathbf{x}^p$1, the method adds bias $\mathbf{x}^p$2 to green logits if $\mathbf{x}^p$3, and to red logits if $\mathbf{x}^p$4; extraction then determines the bit by checking whether the segment contains more green or red tokens (Lin et al., 4 Feb 2025).

A common misconception in this area is that one can embed one bit per fixed-length segment without regard to local token statistics. DERMARK rejects that assumption explicitly: different generated texts, and even different parts of the same text, have different watermarking capacities (Lin et al., 4 Feb 2025).

3. Capacity-aware dynamic segmentation

DERMARK’s defining contribution is its formalization of watermarking capacity from the model’s logits and token-color probabilities. For a given step $\mathbf{x}^p$5, the pre-watermark green and red masses are

$\mathbf{x}^p$6

After watermarking, if the embedded bit requires green tokens, then

$\mathbf{x}^p$7

and analogously for red tokens,

$\mathbf{x}^p$8

Let $\mathbf{x}^p$9 denote the probability that the next token belongs to the color required by the current bit. Its expected value is

$t$0

(Lin et al., 4 Feb 2025)

For a segment $t$1 of length $t$2, if $t$3 is the number of required-color tokens and

$t$4

then the paper approximates $t$5 as Poisson binomial and then uses a CLT-based normal approximation:

$t$6

A segment can reliably embed one bit if the expected majority condition holds:

$t$7

With confidence level $t$8, the paper writes

$t$9

which implies the formal embedding inequality

$$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$0

(Lin et al., 4 Feb 2025)

This inequality is the basis of DERMARK’s dynamic segmentation principle. Tokens continue to accrue in the current segment until Eq. (7) is satisfied; only then is the segment finalized and the next bit started. The significance is straightforward: high-capacity text gets shorter segments, low-capacity text gets longer segments, and equal-length segmentation is no longer assumed to be valid (Lin et al., 4 Feb 2025).

4. Embedding, extraction, and robustness mechanics

The embedding pipeline is incremental. Tokens are generated autoregressively; the vocabulary is partitioned into green and red sets; the current bit determines which color receives bias $$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$1; and after each token the segment statistics are updated until the capacity condition is met. If extra tokens remain after the full watermark message has been embedded, DERMARK uses them as padding, embedding the inverse of the last bit to make the padding distinguishable (Lin et al., 4 Feb 2025).

Extraction is more involved because edited text no longer preserves the original boundaries. DERMARK therefore reconstructs a segmentation rather than assuming the embedding-time segmentation is still present. The extraction pipeline colors each token with the same hashing rule, identifies padding, and then solves a dynamic-programming optimization over candidate segmentations. The total loss for a segmentation $$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$2 is

$$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$3

where the segmentation loss is

$$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$4

with

$$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$5

and the color loss is

$$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$6

The parameters $$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$7 and $$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$8 are updated iteratively, and the optimal segmentation is found in $$\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},$$9 time (Lin et al., 4 Feb 2025).

The robustness claim of this design is limited but concrete. Insertions and deletions perturb boundaries and color ratios; dynamic re-segmentation reduces the dependence on exact original boundaries. The framework is also described as compatible with stronger one-bit primitives, including semantically unbiased watermarking and SIR-style semantic-invariant robust watermarking, because DERMARK is primarily a segmentation framework rather than a new single-bit token-bias rule (Lin et al., 4 Feb 2025).

5. Empirical behavior, efficiency, and limitations

The reported evaluation uses OPT-1.3B and GPT-2 on a news-like subset of C4, with prompt length 100 tokens, multinomial sampling with repetition penalty 1.5, and Balance-Marking as the baseline. The hyperparameters include $$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$0 in [0.8, 0.99] and $$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$1 (Lin et al., 4 Feb 2025).

The main empirical claim is that DERMARK improves capacity matching and therefore wastes fewer tokens per embedded bit. Relative to the state-of-the-art baseline, the method reports about 20% fewer tokens per bit and about 50% reduction in embedding time (Lin et al., 4 Feb 2025). The detailed results further state an average reduction of 2.26 fewer tokens per bit versus SOTA overall; on the full evaluation set, DERMARK uses about 2 fewer tokens/bit on OPT-1.3B and 1 fewer token/bit on GPT-2 at similar detection rates; and on the worst-performing “poor” dataset, it uses at least 4 fewer tokens/bit at the same detection rate (Lin et al., 4 Feb 2025).

Quality is reported as broadly preserved. Measured by PPL with OPT-2.7B, text quality is similar between DERMARK and Balance-Marking across different $$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$2 values, which the paper presents as evidence that efficiency gains do not introduce a clear quality penalty (Lin et al., 4 Feb 2025). Under insertion attacks and deletion attacks of 5% or 10%, DERMARK achieves higher detection rates and lower tokens-per-bit than the baseline (Lin et al., 4 Feb 2025).

The limitations are explicit. DERMARK relies on the robustness of the underlying one-bit watermark primitive; its capacity derivation depends on a Poisson binomial approximation and then a normal approximation; it estimates

$$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$3

which may be imperfect in highly noisy or heavily edited text; extraction is more expensive than naive decoding because of the $$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$4 dynamic programming step; and the method does not claim perfect resistance to all paraphrase-style attacks (Lin et al., 4 Feb 2025).

6. Related methods using adjacent “DMark” names

The overloaded naming pattern is especially visible in watermarking and provenance research. De-mark studies the security of n-gram red-green-list watermarking in autoregressive LLMs and introduces random selection probing to infer the watermark structure, estimate $$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$5, recover the red/green list, and then either remove the watermark or exploit it on another model (Chen et al., 2024). Its central finding is that local token-bias watermarking is practically inferable when token probabilities are exposed directly or can be approximated by repeated sampling (Chen et al., 2024).

dgMARK addresses a different generative regime: discrete diffusion LLMs. Rather than reweighting token probabilities, it uses the decoding order itself as the watermarking channel, steering the unmasking sequence toward positions whose candidate token satisfies a secret parity constraint under a balanced binary hash (Hong et al., 30 Jan 2026). Detection is based on elevated parity-matching statistics and a sliding-window detector intended to improve robustness under insertion, deletion, substitution, and paraphrasing (Hong et al., 30 Jan 2026).

In image watermarking, DeMark is a query-free, black-box attack framework on deepfake watermarking defenses. It targets encoder–decoder watermarking schemes through latent-space sparsification motivated by image compressive sensing, using a CNN-based sparse encoder $$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$6 and reconstruction module $$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$7, optimized with

$$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$8

where $$\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.$$9 and $m \in \{0,1\}^K,$0 (Song et al., 23 Jan 2026). Across eight watermarking schemes, it reports reducing average watermark detectability from 100% to 32.9% DetectAcc while maintaining perceptual and structural realism appropriate for deepfakes (Song et al., 23 Jan 2026).

A separate branch concerns model ownership. DeepMarks is a digital fingerprinting framework for DNNs that embeds user-specific identifiers in the probability density function (pdf) of trainable weights via an auxiliary loss

$m \in \{0,1\}^K,$1

with orthogonal or BIBD-based anti-collusion codes (Chen et al., 2018). The goal is not merely ownership proof but user-specific attribution and colluder tracing (Chen et al., 2018).

Outside watermarking, the naming collision extends to vision systems. DM-DCF denotes Depth Masked Discriminative Correlation Filter, an RGB-D tracker that uses depth segmentation for occlusion detection and adaptive spatial masking of the correlation filter, with the masked filter written as

$m \in \{0,1\}^K,$2

(Kart et al., 2018). Echo-DM denotes a mask-free ultrasound marker-removal framework built around an encoder–diffusion–decoder pipeline with a DiT-based conditional latent diffusion model and a Region-Aware Fusion module for preservation-aware refinement (Wang et al., 8 Jun 2026).

Taken together, these works show that “DMark” is not a single technical doctrine. In the narrowest sense it refers to DERMARK’s capacity-aware multi-bit watermarking for LLMs (Lin et al., 4 Feb 2025). In the broader research literature, it indexes a cluster of problems around watermark embedding, watermark removal, provenance attacks, fingerprinting, masking, and marker removal across text, images, models, tracking, and medical imaging (Chen et al., 2024, Hong et al., 30 Jan 2026, Song et al., 23 Jan 2026, Chen et al., 2018, Kart et al., 2018, Wang et al., 8 Jun 2026).