Logit-Based Watermarking Overview

• Logit-based watermarking is a technique that uses full logit vectors or next-token distributions to embed hidden watermark signals for model verification and text provenance.
• It employs keyed perturbations, such as biasing green-token logits in LLMs, to modify statistical signatures while preserving main task performance.
• The approach navigates trade-offs between detectability and distortion, addressing robustness against attacks like fine-tuning, paraphrasing, and pruning.

Searching arXiv for papers on logit-based watermarking and closely related LLM/model watermarking schemes. Logit-based watermarking denotes a family of watermarking methods that treat logits—or probability distributions derived from logits—as the primary carrier of watermark information. In discriminative settings, this means embedding watermark signals into the geometry of the output logit vector rather than only into predicted labels; in autoregressive LLMs, it means modifying next-token logits in a secret, structured manner so that generated text carries a detectable statistical signature. Across recent work, the topic spans model ownership verification for classifiers, zero-bit provenance watermarking for LLMs, and multi-bit payload embedding, with recurring concerns about detectability, imperceptibility, robustness, and the detectability–distortion trade-off (Hu et al., 2024, Wang et al., 6 Jul 2026).

1. Definition, scope, and threat models

In classifier watermarking, logit-based watermarking is the idea of treating the full logit vector $f(X)$—not just the predicted class—as the carrier of watermark information, and designing both the embedding and verification procedures around this richer signal (Hu et al., 2024). The formulation in "On the Weaknesses of Backdoor-based Model Watermarking: An Information-theoretic Perspective" explicitly distinguishes three parties: the model owner, who has training data $D$ and a secret credit $T$ and runs an embedding algorithm $\mathcal{E}(D,T)$; the authority, which runs a verification algorithm $\mathcal{V}(f,T)$; and the adversary, which attempts to steal or sanitize the model using an attack $\mathcal{A}(f,D_{\text{aux}})$, where $D_{\text{aux}}$ is auxiliary in-distribution data (Hu et al., 2024).

In LLMs, logit-based watermarking operates at the next-token sampling stage. Given a context, the model outputs logits over the vocabulary, these logits are modified according to a keyed rule, and sampling proceeds from the modified distribution. The most common formulation partitions the vocabulary into keyed subsets such as green and red lists, then biases green-token logits upward by a fixed amount $\delta$, producing a slightly higher rate of green tokens than would occur by chance (Wang et al., 6 Jul 2026). This keyed, token-level perturbation differentiates logit-based watermarking from metadata-based provenance schemes and from post hoc stylometric detectors that do not rely on a secret key (Wang et al., 6 Jul 2026).

Threat models are correspondingly diverse. In classifier watermarking, attacks include knowledge distillation, fine-tuning, and pruning, all of which explicitly alter logits or the representations that generate them (Hu et al., 2024). In LLM watermarking, the relevant perturbations include paraphrasing, re-generation, manual editing, truncation, and low-entropy decoding regimes such as code generation and mathematical reasoning, where next-token distributions are sharply peaked and small logit biases may have little effect (Gu et al., 24 Apr 2026, Gu et al., 20 May 2025). A recurring practical distinction is between black-box access, where only outputs can be queried, and gray-box or white-box settings, where logits or computation graphs are available for verification (Hu et al., 2024).

2. Core statistical mechanism: logits as watermark carriers

The central mechanism is a controlled perturbation of the model’s output geometry. In LLMs, if $L_n \in \mathbb{R}^{|\mathcal{V}|}$ denotes the base logits and $P_n=\mathrm{softmax}(L_n)$ the next-token distribution, then a canonical green-list watermark replaces $D$0 by

$D$1

and samples from $D$2 (Gu et al., 24 Apr 2026). If $D$3 is the pre-watermark probability mass assigned to the green set, then after biasing the green logits by $D$4, the green mass becomes

$D$5

This dependence on $D$6 is fundamental: when $D$7 is near $D$8 or $D$9, the induced shift is small, whereas moderate $T$0 yields a stronger watermark signal (Gu et al., 24 Apr 2026).

For classifier models, the signal need not be tied to the argmax class at all. "On the Weaknesses of Backdoor-based Model Watermarking" formalizes the model as $T$1 with logits $T$2, and then introduces redundant logits: if $T$3 is the set of top-$T$4 logit indices, any $T$5 with $T$6 is redundant (Hu et al., 2024). The paper states the information-theoretic approximation

$T$7

which motivates using non-top-$T$8 logits as watermark channels because manipulating them barely affects the main-task loss or prediction (Hu et al., 2024).

The same general idea appears in multibit LLM watermarking, where watermark scores are added to token logits or to quantities equivalent to logits. "Every Bit, Everywhere, All at Once" defines per-token multibit scores $T$9 and uses transformations of the form

$\mathcal{E}(D,T)$0

or, in its main implementation, a Soft PPL rule that selects the token maximizing $\mathcal{E}(D,T)$1 (Gloaguen et al., 12 May 2026). This suggests a broad unification: logit-based watermarking is less about any specific green/red construction than about embedding keyed structure into the model’s output score landscape.

3. Information-theoretic foundations and design principles

Several papers give logit-based watermarking an explicitly information-theoretic interpretation. In classifier watermarking, a standard backdoor-style embedding objective,

$\mathcal{E}(D,T)$2

is shown to be equivalent to maximizing

$\mathcal{E}(D,T)$3

where $\mathcal{E}(D,T)$4 is an internal representation and $\mathcal{E}(D,T)$5 denote watermark trigger samples and labels (Hu et al., 2024). In this framing, robustness means that reducing $\mathcal{E}(D,T)$6 necessarily harms $\mathcal{E}(D,T)$7 enough to reduce utility, whereas vulnerability means the two can be decoupled (Hu et al., 2024).

This perspective yields an impossibility result for classical out-of-distribution trigger schemes. As

$\mathcal{E}(D,T)$8

there exist infinitely many functions $\mathcal{E}(D,T)$9 that are optimal for the main task yet satisfy $\mathcal{V}(f,T)$0, implying that an adversary can erase the watermark without sacrificing clean-task information (Hu et al., 2024). The paper therefore argues that robust watermarking should use in-distribution triggers and shared representations rather than separated out-of-distribution trigger manifolds (Hu et al., 2024).

In LLM watermarking, "Beyond Heuristic Tuning: Power-Calibrated LLM Watermarking" characterizes a different but related trade-off between detection power and distortion. Under its assumptions, the effective green-token probability under watermarking is

$\mathcal{V}(f,T)$1

and the per-token KL distortion is

$\mathcal{V}(f,T)$2

The resulting power approximation is

$\mathcal{V}(f,T)$3

which turns hyperparameter selection into a distortion-constrained optimization problem rather than heuristic tuning (Wang et al., 6 Jul 2026).

A different information-theoretic direction appears in "Covert Multi-bit LLM Watermarking: An Information Theory and Coding Approach", which models the LLM cover distribution through state variables $\mathcal{V}(f,T)$4 representing next-token probability vectors and derives a covert multi-bit capacity

$\mathcal{V}(f,T)$5

subject to a channel synthesis constraint preserving the marginal cover distribution (Guo et al., 15 May 2026). A plausible implication is that, in sufficiently rich state-aware settings, multi-bit logit-based watermarking can be understood as a rate-distortion-constrained communication problem over the model’s own probability simplex.

4. Representative schemes and architectural patterns

A useful way to organize the literature is by the structure of the carrier signal and the decoding objective.

Scheme family	Carrier structure	Detection target
Green/red zero-bit LLM watermarks	Keyed token subsets with logit bias $\mathcal{V}(f,T)$6	Watermarked vs unwatermarked text
Redundant-logit classifier watermarks	Non-top-$\mathcal{V}(f,T)$7 classifier logits	Model ownership verification
End-to-end neural LLM watermarks	Learned context-dependent logit perturbations	Neural watermark classifier
Multibit LLM watermarks	Payload-dependent token scores across bits	Message recovery
Low-entropy-aware schemes	Entropy-conditioned selective logit bias	More reliable detection in code/math

In classifier watermarking, the main concrete scheme in the provided material is In-distribution Watermark Embedding (IWE). It constructs a trigger set from normal images and their augmentations,

$\mathcal{V}(f,T)$8

and computes a binary watermark task from partitioned averages of redundant logits using a secret partition key $\mathcal{V}(f,T)$9 of size $\mathcal{A}(f,D_{\text{aux}})$0 (Hu et al., 2024). Only logits outside the top-$\mathcal{A}(f,D_{\text{aux}})$1 set are used for watermark probabilities, which are then fed into a cross-entropy watermark loss (Hu et al., 2024).

In LLM watermarking, the canonical line is the KGW-style keyed vocabulary partition. "SSG: Logit-Balanced Vocabulary Partitioning for LLM Watermarking" keeps the same basic injection rule but redesigns the vocabulary partition itself: it sorts tokens by logits, groups the top-$\mathcal{A}(f,D_{\text{aux}})$2 tokens into pairs, and assigns one token from each pair to the green set and one to the red set (Gu et al., 24 Apr 2026). This Sort-then-Split by Groups rule