PMark: Semantic-Level Watermarking

• PMark is a semantic-level watermarking method that uses sentences as the fundamental carriers, leveraging proxy functions and balanced candidate partitioning.
• It enhances robustness by employing multiple channels and median-based thresholds to resist paraphrasing and token-level edits without distorting the output distribution.
• The online variant is theoretically distortion-free while the optimized offline variant improves sampling efficiency, as supported by empirical evaluations.

PMark is a semantic-level watermarking method for LLM output in which the sentence, rather than the token, is the fundamental watermark carrier. It was introduced to improve robustness against paraphrasing-style attacks while avoiding the distribution distortion associated with reject-sampling-based semantic watermarking. The method formalizes watermarking through a proxy function framework, uses median-based balanced partitions of sampled sentence candidates, and strengthens evidence by imposing multiple proxy-function constraints, called channels. In its online form, PMark is presented as distortion-free; the paper also introduces an empirically optimized offline variant that removes dynamic median estimation for better sampling efficiency (Huo et al., 25 Sep 2025).

1. Problem setting and conceptual scope

PMark is situated within semantic-level watermarking, where the next sentence is the unit of control and detection. Let $\Sigma^*$ denote the set of semantically complete sentences, and let the model induce the next-sentence distribution

$P_M(s_{n+1}\mid s_1,\dots,s_n).$

The watermarking objective is zero-bit: given a private key $k$, generate according to

$P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$

and later decide whether watermark evidence is present (Huo et al., 25 Sep 2025).

The motivation is that token-level watermarks are readily weakened by paraphrasing, whereas sentence-level methods operate in semantic space and are therefore better aligned with meaning-preserving rewrites. PMark’s starting point, however, is that prior semantic watermarking still had three weaknesses: weak or missing formal guarantees, fragility under edits because each sentence often carries sparse evidence, and distribution distortion caused by reject sampling over semantic regions. The paper places SemStamp, k-SemStamp, and SimMark in this class of earlier semantic methods and argues that a stronger theoretical and algorithmic framework is required (Huo et al., 25 Sep 2025).

A central formal notion is single-sentence distortion-free watermarking:

$$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$

where $\bm{\pi}=[s_1,\dots,s_n]$. This definition requires that, after averaging over keys, the watermarked distribution match the base model’s next-sentence distribution exactly (Huo et al., 25 Sep 2025).

2. Proxy functions and semantic channels

PMark’s main abstraction is the proxy function, a scalar-valued map on sentence space:

$\mathcal F:\Sigma^* \rightarrow \mathbb R.$

This abstraction is used to unify semantic watermarking schemes. In the paper’s analysis, SemStamp uses a locality-sensitive hashing map of the sentence embedding, k-SemStamp uses nearest-cluster assignment, and SimMark uses similarity to the previous sentence. PMark makes the proxy-function view explicit and then builds watermarking and detection around it (Huo et al., 25 Sep 2025).

Its own proxy function is defined from a sentence encoder $\mathcal T(s)\in \mathbb R^d$ and a pivot vector $v\in \mathbb R^d$:

$$\mathcal F_v(s)=\langle v,\mathcal T(s)\rangle = \frac{v\cdot \mathcal T(s)}{\|v\|\cdot \|\mathcal T(s)\|}.$$

Thus each sentence is projected onto a semantic direction, and the sign or relative position of that projection becomes the watermark carrier (Huo et al., 25 Sep 2025).

A channel is one such proxy function defined by one pivot vector. With $P_M(s_{n+1}\mid s_1,\dots,s_n).$0 orthogonal pivots $P_M(s_{n+1}\mid s_1,\dots,s_n).$1, PMark uses

$P_M(s_{n+1}\mid s_1,\dots,s_n).$2

for $P_M(s_{n+1}\mid s_1,\dots,s_n).$3. The significance of multiple channels is that each sentence can contribute several pieces of watermark evidence rather than one. The paper interprets this as increasing evidence density, which in turn improves robustness under paraphrasing, word deletion, and synonym substitution (Huo et al., 25 Sep 2025).

The paper also uses high-dimensional orthogonality as a practical prior for the offline variant. For random unit vectors $P_M(s_{n+1}\mid s_1,\dots,s_n).$4, the angle $P_M(s_{n+1}\mid s_1,\dots,s_n).$5 has density

$P_M(s_{n+1}\mid s_1,\dots,s_n).$6

This is used to motivate the empirical observation that $P_M(s_{n+1}\mid s_1,\dots,s_n).$7 is often concentrated near $P_M(s_{n+1}\mid s_1,\dots,s_n).$8, so the proxy-function median is frequently close to $P_M(s_{n+1}\mid s_1,\dots,s_n).$9 (Huo et al., 25 Sep 2025).

3. Generation procedure and the distortion-free theorem

PMark’s online generation algorithm begins by sampling a fixed candidate pool from the model’s natural next-sentence distribution. For a given sentence position, let

$k$0

with even $k$1. The method computes proxy-function scores $k$2, estimates their median $k$3, and partitions the candidates into balanced halves:

$k$4

A secret random bit chooses one half, and the output is then sampled uniformly from that half (Huo et al., 25 Sep 2025).

This balanced partition is the key distinction from reject-sampling semantic watermarking. The paper proves the following single-channel result: if $k$5 is sampled i.i.d. from the base model, the candidates are split into equal halves by the median rule, a key bit $k$6 selects one half, and the final sentence $k$7 is chosen uniformly within that half, then

$k$8

The intuition given is that, conditioned on $k$9, each candidate has probability $P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$0 after averaging over the secret bit, so the original distribution is recovered exactly (Huo et al., 25 Sep 2025).

Multi-channel PMark applies this halving sequentially. Starting from $P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$1, it sets

$P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$2

and then samples

$P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$3

The paper remarks that multi-channel PMark remains distortion-free because every candidate survives each channel with probability $P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$4, and the final selection is again uniform over the originally sampled set (Huo et al., 25 Sep 2025).

The same section provides a formal critique of earlier semantic methods. For a finite-range proxy function $P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$5, let

$P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$6

The paper shows that SemStamp-style rejection produces the base distribution conditioned on the chosen green set and derives a closed-form watermarked PMF. The resulting corollary is that such methods are distortion-free if and only if

$P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$7

that is, only when all proxy-function bins have equal natural mass. PMark is designed specifically to avoid this requirement (Huo et al., 25 Sep 2025).

The paper also presents an optimized offline PMark. This version removes dynamic median estimation, uses the prior threshold $P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$8, and scores candidates by accumulated channel evidence. The authors describe it as an empirical optimization rather than the fully proved distortion-free construction.

Variant	Core rule	Stated property
Online PMark	Dynamic median estimation from sampled candidates	Distortion-free
Offline PMark	Fixed threshold $P_M^w(s_{n+1}\mid s_1,\dots,s_n;k),$9 instead of dynamic medians	Better sampling efficiency

4. Detection and robustness guarantees

Detection for online PMark reconstructs the semantic test channel by channel. For each observed sentence $$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$0 and channel $$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$1, the detector resamples a candidate set from the same model context, computes proxy scores, and estimates the median using the Harrell–Davis median estimator:

$$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$2

It then compares the actual sentence score $$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$3 with the reconstructed threshold and the secret seed pattern (Huo et al., 25 Sep 2025).

To tolerate mismatch between the generator’s and detector’s median estimates, PMark uses a soft evidence score. For channel $$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$4 at sentence $$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$5,

$$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$6

Evidence is aggregated as

$$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$7

The detector then applies a soft-count $$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$8-test:

$$P_M(s_{n+1}\mid \bm{\pi})=\sum_{k\in K} P_K(k)\cdot P_M^w(s_{n+1}\mid \bm{\pi};k),$$9

and declares watermark presence when $\bm{\pi}=[s_1,\dots,s_n]$0 (Huo et al., 25 Sep 2025).

The theoretical robustness claim is phrased in terms of bounded semantic perturbation. If an attacker $\bm{\pi}=[s_1,\dots,s_n]$1 changes a watermarked sentence $\bm{\pi}=[s_1,\dots,s_n]$2 so that

$\bm{\pi}=[s_1,\dots,s_n]$3

then the probability of removing the channel evidence is bounded by

$\bm{\pi}=[s_1,\dots,s_n]$4

The interpretation is that a paraphrase can flip the watermark signal only when the original sentence score lies close to the median boundary. This gives PMark a formal semantic robustness statement absent from earlier sentence-level schemes (Huo et al., 25 Sep 2025).

A common misconception addressed implicitly by the paper is that any sentence-level watermark is automatically both robust and distortion-free. PMark’s analysis rejects that view: semantic-level watermarking may still distort the output distribution under reject sampling, and robustness depends on how densely evidence is distributed across sentences and channels, not merely on operating at the sentence level (Huo et al., 25 Sep 2025).

5. Empirical evaluation, efficiency, and ablations

The empirical study uses 500 samples each from C4 and BOOKSUM, with OPT-1.3B and Mistral-7B-v0.1 as backbone models. Baselines include token-level methods such as KGW, UPV, MorphMark, SIR, EXP, EXPGumbel, and SynthID, and semantic-level methods such as SemStamp, k-SemStamp, and SimMark. PMark uses all-mpnet-base-v2 embeddings without fine-tuning, $\bm{\pi}=[s_1,\dots,s_n]$5 channels, sample budget $\bm{\pi}=[s_1,\dots,s_n]$6, $\bm{\pi}=[s_1,\dots,s_n]$7, and $\bm{\pi}=[s_1,\dots,s_n]$8 (Huo et al., 25 Sep 2025).

Without attack, online PMark is reported as essentially perfect, often reaching $\bm{\pi}=[s_1,\dots,s_n]$9 TPR@1% FPR with ROC-AUC near $\mathcal F:\Sigma^* \rightarrow \mathbb R.$0. Under GPT paraphrasing on Mistral-7B, the paper highlights the following results. On BOOKSUM, SemStamp reaches $\mathcal F:\Sigma^* \rightarrow \mathbb R.$1 TP@FP1%, SIR $\mathcal F:\Sigma^* \rightarrow \mathbb R.$2, PMark online $\mathcal F:\Sigma^* \rightarrow \mathbb R.$3, and PMark offline $\mathcal F:\Sigma^* \rightarrow \mathbb R.$4. On C4, SemStamp reaches $\mathcal F:\Sigma^* \rightarrow \mathbb R.$5, SIR $\mathcal F:\Sigma^* \rightarrow \mathbb R.$6, PMark online $\mathcal F:\Sigma^* \rightarrow \mathbb R.$7, and PMark offline $\mathcal F:\Sigma^* \rightarrow \mathbb R.$8. The paper summarizes these as gains up to $\mathcal F:\Sigma^* \rightarrow \mathbb R.$9 and $\mathcal T(s)\in \mathbb R^d$0 over the best semantic baseline SemStamp on Mistral-7B under GPT paraphrasing for BOOKSUM and C4 (Huo et al., 25 Sep 2025).

The reported text-quality figures also favor PMark. The paper gives perplexity values of $\mathcal T(s)\in \mathbb R^d$1 to $\mathcal T(s)\in \mathbb R^d$2 for PMark and interprets them as lower than those of earlier semantic methods and, in some cases, better than the strongest token-level baselines. This is presented as empirical support for the claim that avoiding reject-sampling distortion improves text quality (Huo et al., 25 Sep 2025).

The robustness study extends beyond sentence-level paraphrasing. Under 15% word deletion and 15% synonym substitution on BOOKSUM with Mistral-7B, online PMark reaches $\mathcal T(s)\in \mathbb R^d$3 and $\mathcal T(s)\in \mathbb R^d$4 TP@FP1%, while offline PMark reaches $\mathcal T(s)\in \mathbb R^d$5 and $\mathcal T(s)\in \mathbb R^d$6. These results are used to support the paper’s argument that multiple channels increase evidence density and thereby make the watermark resilient not only to paraphrasing but also to token-level edits (Huo et al., 25 Sep 2025).

Efficiency is reported in terms of average token consumption per sentence. The paper gives: k-SemStamp $\mathcal T(s)\in \mathbb R^d$7, SimMark $\mathcal T(s)\in \mathbb R^d$8, SemStamp $\mathcal T(s)\in \mathbb R^d$9, PMark online $v\in \mathbb R^d$0, and PMark offline $v\in \mathbb R^d$1. Online PMark is therefore substantially cheaper than SemStamp, while offline PMark is cheaper than online PMark and slightly cheaper than k-SemStamp (Huo et al., 25 Sep 2025).

The ablations are consistent with the paper’s theoretical narrative. On OPT-1.3B and BOOKSUM, online PMark reaches $v\in \mathbb R^d$2 TP@FP1% even with $v\in \mathbb R^d$3 and $v\in \mathbb R^d$4, and approaches $v\in \mathbb R^d$5 as channel count and budget increase. The soft-$v\in \mathbb R^d$6 test is also validated empirically: relative to a hard-threshold $v\in \mathbb R^d$7-test, it improves attacked TP@FP1% by $v\in \mathbb R^d$8 on BOOKSUM and $v\in \mathbb R^d$9 on C4 (Huo et al., 25 Sep 2025).

6. Nomenclature, related uses, and scope boundaries

In the literature represented here, “PMark” refers exactly to the semantic-level watermarking method introduced in “PMark: Towards Robust and Distortion-free Semantic-level Watermarking with Channel Constraints” (Huo et al., 25 Sep 2025). It should not be conflated with “PromptMark,” the method proposed in “PromptMark: A Prompt-Guided Iterative-Feedback Framework for Source Code Watermarking.” That paper does not use the exact string “PMark,” does not introduce “PromptMark (PMark)” as an alias, and refers to its method as PromptMark only (Fahad et al., 18 Jun 2026).

The label is also distinct from unrelated uses in other areas. One separate line of work uses “PMark” in connection with “Parallel Markov Chain Monte Carlo,” where the term denotes a partition-and-recombination strategy for parallelizing MCMC across asynchronous processors rather than a language-model watermarking method (VanDerwerken et al., 2013). A further potential source of confusion is “PEMark,” which denotes a position-encoding watermark for API responses and is likewise unrelated in mechanism and problem setting (Zhou et al., 21 May 2026).

Within watermarking research specifically, PMark’s scope is semantic-level watermarking of LLM-generated text, with an online construction that is claimed to be distortion-free and an offline approximation optimized for efficiency. The paper is explicit that the offline variant lacks the same strict proof as the online construction, that sentence segmentation consistency remains an assumption, and that stronger notions such as sequence-level or $$\mathcal F_v(s)=\langle v,\mathcal T(s)\rangle = \frac{v\cdot \mathcal T(s)}{\|v\|\cdot \|\mathcal T(s)\|}.$$0-shot undetectability remain open problems (Huo et al., 25 Sep 2025).