---
title: 'DynaMark: Adaptive Watermarking & Marker Systems'
url: https://www.emergentmind.com/topics/dynamark
type: topic
---

# DynaMark: Adaptive Watermarking & Marker Systems

DynaMark encompasses a set of technical systems and algorithms that enable dynamic watermarking or marker adaptation, primarily in the domains of secure machine learning, industrial control, and robotics. Across these domains, DynaMark (or DynaMarks, DERMARK, Dynamic Markers) refers to adaptive methods that provide resilience, efficiency, or robustness in information embedding or fiducial tracking. This article summarizes the principal DynaMark systems as represented in recent research, highlighting their distinct methodologies, mathematical underpinnings, and application domains [2502.05213][2207.13321][2508.21797][1709.04981].

## 1. Dynamic Multi-bit Watermarking in Large Language Models

Dynamic watermarking for Large Language Models (LLMs), as implemented by DERMARK (and referred to as DynaMark), addresses the challenge of embedding multi-bit watermarks efficiently in generated text. The core contribution is a theoretical and practical protocol that adapts the watermark segment size at generation time to maximize capacity and resilience, as opposed to fixed-length segment embedding. The approach relies on the following mechanisms [2502.05213]:

- **Logit-based token manipulation:** At each generation step $t$, token probabilities are computed from logits $L^{(t)}$, and the vocabulary is partitioned into two color groups, green ($G$) and red ($R$). To encode a bit $m_k$, a constant bias $\delta$ is applied to $G$ or $R$ as appropriate, shifting the token distribution.
- **Normal approximation and optimality criterion:** The expected proportion $T = X/N$ of "matching" tokens (correct color for the bit) in $N$-token segments is modeled as Gaussian, with parameters
  $$
  \mu_T = \frac{1}{N} \sum_{t=1}^N \mathbb{E}[P'^{(t)}],\quad
  \sigma_T^2 = \frac{\sum_{t=1}^N \mathbb{E}[P'^{(t)}] - \sum_{t=1}^N (\mathbb{E}[P'^{(t)}])^2}{N^2}.
  $$
  A formal inequality
  $$
  \Phi^{-1}(1-\alpha) \le \frac{\mu_T - 1/2}{\sigma_T}
  $$
  ensures sufficient reliability for decoding each bit.
- **Adaptive segmentation:** Tokens are generated with biased logits until the above inequality is first satisfied, at which point the segment stops and the next bit segment begins.
- **Extraction:** Extraction involves dynamic programming over possible segmentations, optimizing a combined segmentation and color loss. Bit values are decoded by majority token color within each segment.

Empirically, DERMARK achieves ≈20% reduction in tokens per embedded bit and ≈50% reduction in embedding time compared to fixed-length baselines, while maintaining robustness under editing and erasure attacks [2502.05213].

## 2. Dynamic Watermarking for Model Extraction Defense

DynaMarks [2207.13321] is a black-box watermarking protocol designed to counter deep learning model extraction attacks in scenarios where the only interface to a model is its API. The protocol does not alter the training process or require trigger data; instead, it operates entirely at inference, dynamically altering the model's output softmax vector under secret, randomized rules:

- **Watermark embedding at inference:** For each query $x$ to the model, if the predicted class confidence $p_x^i$ falls within a secret window $(\alpha_i, \beta_i)$, a random amount of probability mass $\Delta p$ is transferred from $p_x^i$ to a randomly selected alternative class $j$, according to a secret distribution $\mathbf{V}_i$.
- **Transfer to surrogate models:** An adversary performing model extraction and training a surrogate on these perturbed API outputs inadvertently learns the watermark signature.
- **Verification:** Ownership is established by comparing Jensen–Shannon divergence (JSD) between the distribution of outputs from the original, altered, and suspect models over a held-out verification set, using the statistic
  $$
  \eta = \frac{\delta^{org}_{sm}}{\delta^{alt}_{sm}}
  $$
  where $\delta^{org}_{sm}$ and $\delta^{alt}_{sm}$ are summed JSDs.
- **Fidelity preservation:** Perturbations are low-magnitude and only applied to high-confidence predictions, hence the post-watermark model's accuracy matches the original exactly in experiments on Fashion MNIST, CIFAR-10, and ImageNet(10-class).

This method achieves full accuracy preservation, watermark transfer across surrogate architectures, and resilience to pruning, averaging attacks, and architecture conversion [2207.13321].

## 3. Reinforcement Learning for Dynamic Watermarking in Industrial Control

DynaMark [2508.21797] presents a reinforcement learning (RL) framework for dynamic watermarking in industrial machine tool controllers (MTCs). The method addresses detection of replay attacks by adaptively tuning the variance of Gaussian watermark signals injected into actuator commands:

- **MDP formalism:** Watermark selection is framed as an infinite-horizon Markov Decision Process with state $s_t = (y_t, d_t)$, where $y_t$ is the sensor reading and $d_t$ is the posterior attack probability, action $a_t = U_t$ is a watermark covariance matrix.
- **Bayesian detection:** The system observes alarm indicators from a $\chi^2$ change detector and updates $d_t = P(\sigma=1 | I_{1:t})$ recursively using Bayes' theorem. The $\chi^2$ test is performed on the residual $r_t = y_t - \widehat{y}_t$ between measured and predicted plant outputs.
- **RL policy and reward:** Deep Deterministic Policy Gradient (DDPG) is used to optimize watermark intensity $U_t$ to maximize a reward combining watermark energy cost, control error (distance from nominal), and detection confidence.
- **Empirical results:** On Siemens 828D digital twin, DynaMark reduces watermark energy expenditure by 70% relative to fixed high-variance baselines and maintains single-sample detection delay. Physical testbeds demonstrate rapid attack detection, energy savings, and control deviation containment.

This approach removes the need for precise system knowledge or assumption of constant watermark statistics, enabling adaptation to varying or proprietary dynamics [2508.21797].

## 4. Dynamic Fiducial Markers for Visual Servoing

DynaMark also refers to dynamic fiducial markers—markers whose appearance is algorithmically altered in real time to optimize machine vision tasks such as UAV landing [1709.04981]:

- **System architecture:** A dynamic marker comprises an electronic display (OLED/LCD/E-Ink) whose graphics are driven by a processor and command link to the robot.
- **Adaptive marker selection:** The system switches marker types and scales dynamically based on the camera–marker distance $z$. For long-range detection, a simple high-contrast circle (Whycon) marker is used; for close-range, a more information-rich Aruco board provides full 6-DOF pose.
- **Mathematical model:** The marker control logic implements a piecewise rule with a distance threshold $z_{th}$ and dynamically scales markers per
  $$
  m_{\text{size}}(z) = 2z\tan(\phi_{\max}s)
  $$
  to fit the field of view with safety margins.
- **Delay management:** The system models and compensates for the time delays involved in marker display switching, pose estimation synchronization, and command transmission.
- **Performance:** Over 50 UAV landings, mean planar accuracy is 4.8 cm RMS; dynamic markers achieve both greater range and precision than any static marker configuration, with robust transitioning between marker types in real time.

This method demonstrates the practical advantage of dynamically reconfigurable perception cues for closed-loop robotic control [1709.04981].

## 5. Comparative Summary

The DynaMark concept spans several technical paradigms:

| Domain                         | Core Mechanism                                 | Quantitative outcomes                             |
|---------------------------------|------------------------------------------------|---------------------------------------------------|
| LLM multi-bit watermarking      | Logit-based adaptive segment embedding         | −20% tokens/bit, −50% time, robust to editing [2502.05213] |
| DL model extraction defense     | Inference-time output perturbation             | Fidelity 100%, automatic watermark transfer [2207.13321] |
| Industrial MTC security         | RL-driven watermark covariance adaptation      | −70% energy, 1-sample detection delay [2508.21797] |
| Visual servoing/UAV landing     | Real-time fiducial adaptation and scaling      | 4.8 cm RMS landing error, full-range pose [1709.04981] |

Each approach is architected for its domain's attack surface and operational constraints: high-throughput text generation, black-box API exposure, safety-critical controls, or perception-driven autonomy.

## 6. Limitations and Prospects

Despite their efficacies, all DynaMark systems face domain-specific constraints:

- **DERMARK:** In extremely low-entropy text, watermarking capacity may be insufficient for desired bit rates; aggressive paraphrasing or token reordering may degrade detection. Overhead is low for embedding but quadratic in extraction, though still tractable for typical text lengths and watermark orders [2502.05213].
- **DynaMarks (DL security):** Advanced attackers who deduce watermark parameter distributions could theoretically mitigate or invert the watermark. The protocol remains robust under data and architecture constraints, but adaptive attacks remain an open area [2207.13321].
- **RL dynamic watermarking for MTCs:** Only zero-mean, i.i.d. Gaussian watermarks are considered; extending to frequency-shaped or state-dependent processes is a plausible direction. Safe RL constraints for actuator protection and on-the-fly “recovery” controls after attack detection are suggested as future work [2508.21797].
- **Dynamic Markers for vision:** Hardware and computation impose minimal but nonzero dead time on marker transitions. Dynamic marker approaches may generalize to other perception-action loops where optimal task performance requires environmentally adaptive cues [1709.04981].

A plausible implication is that the DynaMark paradigm—real-time adaptation of embedded signatures, statistical cues, or information carriers—will persist as a critical substrate in domains requiring robust provenance, ownership, or control certification amid adversarial manipulation or dynamic operating environments.

Source: https://www.emergentmind.com/topics/dynamark