---
title: 'DMark: Dynamic Multi-bit Watermarking for LLMs'
url: https://www.emergentmind.com/topics/dmark
type: topic
---

# DMark: Dynamic Multi-bit Watermarking for LLMs

DMark most directly denotes **DERMARK**, a **Dynamic, Efficient and Robust Multi-bit Watermark for Large Language Models** that addresses a specific failure mode in prior multi-bit LLM watermarking: fixed-length segmentation can mismatch the actual watermarking capacity of generated text, causing embedding failures when segments are too short or too low-entropy to carry a bit reliably [2502.05213]. In adjacent literature, closely related names denote distinct mechanisms in watermarking, fingerprinting, tracking, and marker removal, including **De-mark** for watermark removal in large language models, **dgMARK** for watermarking discrete diffusion language models, **DeMark** for black-box attacks on deepfake watermarking defenses, **DeepMarks** for DNN fingerprinting, **DM-DCF** for RGB-D tracking, and **Echo-DM** for ultrasound marker removal [2410.13808] [2601.22985] [2601.16473] [1804.03648] [1802.09227] [2606.09378].

## 1. Terminological scope and disambiguation

The most direct mapping of **“DMark”** in the present context is to **DERMARK**, but the label is not unique across arXiv-indexed research. A concise disambiguation is therefore necessary.

| Term | Paper | Research focus |
|---|---|---|
| DERMARK | [2502.05213] | Multi-bit watermarking for LLM-generated text |
| De-mark | [2410.13808] | Watermark removal in large language models |
| dgMARK | [2601.22985] | Decoding-guided watermarking for discrete diffusion language models |
| DeMark | [2601.16473] | Query-free black-box attack on deepfake watermarking defenses |
| DeepMarks | [1804.03648] | Digital fingerprinting framework for deep neural networks |
| DM-DCF | [1802.09227] | Depth-aware RGB-D object tracking |
| Echo-DM | [2606.09378] | Ultrasound marker removal |

Within this naming landscape, **DERMARK** is the only method explicitly described as **also written “DMark” in the prompt** [2502.05213]. A plausible implication is that “DMark” functions less as a uniquely standardized acronym than as a recurrent naming pattern attached to several technically unrelated methods.

## 2. Formal problem setting of DERMARK

DERMARK formulates multi-bit watermarking as a segmentation-and-embedding problem over an autoregressively generated token sequence
$$
\mathbf{s}=\{s^{(0)}, s^{(1)}, \ldots\},
$$
conditioned on a prompt $\mathbf{x}^p$. At generation step $t$, the model emits logits
$$
\mathbf{L}(\mathbf{x}^p, \mathbf{s}^{:t-1})=\{l_1^{(t)},\ldots,l_{|V|}^{(t)}\},
$$
which are mapped by softmax to
$$
\mathbf{P}(\mathbf{x}^p,\mathbf{s}^{:t-1})=\{P_1^{(t)},\ldots,P_{|V|}^{(t)}\}.
$$
The watermark message is
$$
m \in \{0,1\}^K,
$$
with one bit assigned per segment [2502.05213].

The framework decomposes multi-bit watermarking into two stages. First, the generated text is divided into consecutive segments $S_1,\ldots,S_K$. Second, each segment $S_k$ carries one watermark bit $m_k$. This decomposition is central: DERMARK treats the segmentation problem, rather than the one-bit embedding primitive itself, as the main source of failure in prior methods [2502.05213].

The one-bit primitive follows the standard green/red-list construction. The vocabulary $V$ is partitioned into
$$
G = \{s_1,\ldots,s_{|V|/2}\}, \qquad R = \{s_{|V|/2+1},\ldots,s_{|V|}\}.
$$
To embed bit $m_k$, the method adds bias $\delta$ to green logits if $m_k=1$, and to red logits if $m_k=0$; extraction then determines the bit by checking whether the segment contains more green or red tokens [2502.05213].

A common misconception in this area is that one can embed one bit per fixed-length segment without regard to local token statistics. DERMARK rejects that assumption explicitly: different generated texts, and even different parts of the same text, have different watermarking capacities [2502.05213].

## 3. Capacity-aware dynamic segmentation

DERMARK’s defining contribution is its formalization of **watermarking capacity** from the model’s logits and token-color probabilities. For a given step $t$, the pre-watermark green and red masses are
$$
P_G^{(t)} = \frac{\sum_{s_i \in G} e^{l_i^{(t)}}}{\sum_{s_i \in V} e^{l_i^{(t)}}}, \qquad
P_R^{(t)} = \frac{\sum_{s_i \in R} e^{l_i^{(t)}}}{\sum_{s_i \in V} e^{l_i^{(t)}}}.
$$
After watermarking, if the embedded bit requires green tokens, then
$$
P_G'^{(t)} = \frac{e^\delta \cdot P_G^{(t)}}{e^\delta \cdot P_G^{(t)} + (1 - P_G^{(t)})},
$$
and analogously for red tokens,
$$
P_R'^{(t)} = \frac{e^\delta \cdot P_R^{(t)}}{e^\delta \cdot P_R^{(t)} + (1 - P_R^{(t)})}.
$$
Let $P'^{(t)}$ denote the probability that the next token belongs to the color required by the current bit. Its expected value is
$$
\mathbb{E}[P'^{(t)}] = P(m_k=1)P_G'^{(t)} + P(m_k=0)P_R'^{(t)}. \tag{1}
$$
[2502.05213]

For a segment $S$ of length $N$, if $X$ is the number of required-color tokens and
$$
T=\frac{X}{N},
$$
then the paper approximates $X$ as Poisson binomial and then uses a CLT-based normal approximation:
$$
T \sim \mathcal N\!\left(
\frac{\sum_{t=1}^N \mathbb E [P'^{(t)}]}{N},
\frac{\sum_{t=1}^N \mathbb E[P'^{(t)}]-\sum_{t=1}^N \mathbb E^2[P'^{(t)}]}{N^2}
\right).
$$
A segment can reliably embed one bit if the expected majority condition holds:
$$
T > \frac{1}{2}.
$$
With confidence level $\alpha$, the paper writes
$$
P\!\left(T>\frac{1}{2}\right) =
\Phi\!\left(
\frac{\frac{1}{2}-\mathbb E(T)}{\sqrt{\operatorname{Var}(T)}}
\right)
\ge 1-\alpha,
$$
which implies the formal embedding inequality
$$
\Phi^{-1}(1-\alpha) \le \frac{\frac{1}{2}-\mathbb E(T)}{\sqrt{\operatorname{Var}(T)}}. \tag{7}
$$
[2502.05213]

This inequality is the basis of DERMARK’s dynamic segmentation principle. Tokens continue to accrue in the current segment until Eq. (7) is satisfied; only then is the segment finalized and the next bit started. The significance is straightforward: high-capacity text gets shorter segments, low-capacity text gets longer segments, and equal-length segmentation is no longer assumed to be valid [2502.05213].

## 4. Embedding, extraction, and robustness mechanics

The embedding pipeline is incremental. Tokens are generated autoregressively; the vocabulary is partitioned into green and red sets; the current bit determines which color receives bias $\delta$; and after each token the segment statistics are updated until the capacity condition is met. If extra tokens remain after the full watermark message has been embedded, DERMARK uses them as **padding**, embedding the inverse of the last bit to make the padding distinguishable [2502.05213].

Extraction is more involved because edited text no longer preserves the original boundaries. DERMARK therefore reconstructs a segmentation rather than assuming the embedding-time segmentation is still present. The extraction pipeline colors each token with the same hashing rule, identifies padding, and then solves a dynamic-programming optimization over candidate segmentations. The total loss for a segmentation $\text{Seg}(\mathcal S)$ is
$$
\mathcal{L}(\text{Seg}) = \sum \left( \beta \cdot \mathcal{L}_s(j,i) + \mathcal{L}_c(j,i) \right), \tag{3}
$$
where the segmentation loss is
$$
\mathcal{L}_s(a,b) = \left( f(\mathbb E[P'^{(t)}]) - (\Phi^{-1}(\alpha))^2 - \epsilon_s \right)^2,
$$
with
$$
f(\mathbb E[P'^{(t)}]) =
\frac{
\left( \sum_{t=a}^{b-1}\mathbb E[P'^{(t)}] -\frac{b-a}{2} \right)^2
}{
\sum_{t=a}^{b-1}\mathbb E[P'^{(t)}] -
\sum_{t=a}^{b-1}\mathbb E^2[P'^{(t)}]
},
$$
and the color loss is
$$
\mathcal{L}_c(a,b) = \left| \frac{\min(G_{a:b},R_{a:b})}{b-a} - \epsilon_d \right|.
$$
The parameters $\epsilon_s$ and $\epsilon_d$ are updated iteratively, and the optimal segmentation is found in $O(N^2)$ time [2502.05213].

The robustness claim of this design is limited but concrete. Insertions and deletions perturb boundaries and color ratios; dynamic re-segmentation reduces the dependence on exact original boundaries. The framework is also described as compatible with stronger one-bit primitives, including **semantically unbiased watermarking** and **SIR-style semantic-invariant robust watermarking**, because DERMARK is primarily a segmentation framework rather than a new single-bit token-bias rule [2502.05213].

## 5. Empirical behavior, efficiency, and limitations

The reported evaluation uses **OPT-1.3B** and **GPT-2** on a news-like subset of **C4**, with prompt length **100 tokens**, multinomial sampling with repetition penalty **1.5**, and **Balance-Marking** as the baseline. The hyperparameters include $\alpha$ in **[0.8, 0.99]** and $\beta=14$ [2502.05213].

The main empirical claim is that DERMARK improves capacity matching and therefore wastes fewer tokens per embedded bit. Relative to the state-of-the-art baseline, the method reports **about 20% fewer tokens per bit** and **about 50% reduction in embedding time** [2502.05213]. The detailed results further state an average reduction of **2.26 fewer tokens** per bit versus SOTA overall; on the full evaluation set, DERMARK uses about **2 fewer tokens/bit on OPT-1.3B** and **1 fewer token/bit on GPT-2** at similar detection rates; and on the worst-performing **“poor” dataset**, it uses at least **4 fewer tokens/bit** at the same detection rate [2502.05213].

Quality is reported as broadly preserved. Measured by **PPL with OPT-2.7B**, text quality is similar between DERMARK and Balance-Marking across different $\delta$ values, which the paper presents as evidence that efficiency gains do not introduce a clear quality penalty [2502.05213]. Under **insertion attacks** and **deletion attacks** of **5% or 10%**, DERMARK achieves higher detection rates and lower tokens-per-bit than the baseline [2502.05213].

The limitations are explicit. DERMARK relies on the robustness of the underlying one-bit watermark primitive; its capacity derivation depends on a Poisson binomial approximation and then a normal approximation; it estimates
$$
P_t(m_k=1)=\frac{G_{a:b}+\lambda}{b-a+2\lambda}, \qquad
P_t(m_k=0)=\frac{R_{a:b}+\lambda}{b-a+2\lambda},
$$
which may be imperfect in highly noisy or heavily edited text; extraction is more expensive than naive decoding because of the $O(N^2)$ dynamic programming step; and the method does not claim perfect resistance to all paraphrase-style attacks [2502.05213].

## 6. Related methods using adjacent “DMark” names

The overloaded naming pattern is especially visible in watermarking and provenance research. **De-mark** studies the security of n-gram red-green-list watermarking in autoregressive LLMs and introduces **random selection probing** to infer the watermark structure, estimate $\delta$, recover the red/green list, and then either remove the watermark or exploit it on another model [2410.13808]. Its central finding is that local token-bias watermarking is practically inferable when token probabilities are exposed directly or can be approximated by repeated sampling [2410.13808].

**dgMARK** addresses a different generative regime: **discrete diffusion language models**. Rather than reweighting token probabilities, it uses the **decoding order itself** as the watermarking channel, steering the unmasking sequence toward positions whose candidate token satisfies a secret parity constraint under a balanced binary hash [2601.22985]. Detection is based on elevated parity-matching statistics and a sliding-window detector intended to improve robustness under insertion, deletion, substitution, and paraphrasing [2601.22985].

In image watermarking, **DeMark** is a **query-free, black-box attack framework** on deepfake watermarking defenses. It targets encoder–decoder watermarking schemes through latent-space sparsification motivated by image compressive sensing, using a CNN-based sparse encoder $\mathcal{T}_{\text{CNN}}$ and reconstruction module $\mathcal{R}_{\text{CNN}}$, optimized with
$$
\mathcal{L} = \alpha \mathcal{L}_{\text{SEL}} + \beta \mathcal{L}_{\text{SPL}},
$$
where $\mathcal{L}_{\text{SEL}}(\mathcal{Z})=\|\mathcal{Z}\|_1$ and $\mathcal{L}_{\text{SPL}}=\mathcal{L}_{\text{SSIM}}+\mathcal{L}_{\text{LPIPS}}$ [2601.16473]. Across eight watermarking schemes, it reports reducing average watermark detectability from **100% to 32.9% DetectAcc** while maintaining perceptual and structural realism appropriate for deepfakes [2601.16473].

A separate branch concerns model ownership. **DeepMarks** is a digital fingerprinting framework for DNNs that embeds user-specific identifiers in the **probability density function (pdf) of trainable weights** via an auxiliary loss
$$
\mathcal{L} = \mathcal{L}_0 + \gamma\, MSE(\mathbf{f_j} - \mathbf{X}\mathbf{w}),
$$
with orthogonal or BIBD-based anti-collusion codes [1804.03648]. The goal is not merely ownership proof but user-specific attribution and colluder tracing [1804.03648].

Outside watermarking, the naming collision extends to vision systems. **DM-DCF** denotes **Depth Masked Discriminative Correlation Filter**, an RGB-D tracker that uses depth segmentation for occlusion detection and adaptive spatial masking of the correlation filter, with the masked filter written as
$$
h_M = M \odot h
$$
[1802.09227]. **Echo-DM** denotes a mask-free ultrasound marker-removal framework built around an encoder–diffusion–decoder pipeline with a DiT-based conditional latent diffusion model and a **Region-Aware Fusion** module for preservation-aware refinement [2606.09378].

Taken together, these works show that “DMark” is not a single technical doctrine. In the narrowest sense it refers to DERMARK’s capacity-aware multi-bit watermarking for LLMs [2502.05213]. In the broader research literature, it indexes a cluster of problems around watermark embedding, watermark removal, provenance attacks, fingerprinting, masking, and marker removal across text, images, models, tracking, and medical imaging [2410.13808] [2601.22985] [2601.16473] [1804.03648] [1802.09227] [2606.09378].

Source: https://www.emergentmind.com/topics/dmark