Position-Allocation Multi-bit Watermark (MPAC)

• Position-Allocation Multi-bit Watermark (MPAC) is a watermarking scheme that embeds multi-bit signatures in generative AI outputs by allocating watermark constraints based on finalized neighboring tokens.
• It leverages local green-set construction and logit bias allocation, operating efficiently with minimal overhead in both autoregressive and non-sequential decoding settings.
• Empirical results demonstrate over 99% true positive detection at a 1% false positive rate, confirming the method’s robustness and practical applicability even under minor text perturbations.

A Position-Allocation Multi-bit Watermark (MPAC) is a family of watermarking schemes for @@@@1@@@@ models—most notably LLMs—that enables robust, multi-bit, inference-time embedding and detection of digital signatures in generated text or other discrete sequences. MPAC methods, as exemplified by schemes such as Left-Right Diffusion Watermarking (LR-DWM), operate by modulating token selection conditional on both local sequence context and cryptographically derived keys, supporting efficient, highly detectable, and low-distortion watermarking in both autoregressive and non-sequential generation settings (Raban et al., 18 Jan 2026).

1. Theoretical Foundations and Motivation

Traditional watermarking methods for LLMs often assume a strictly left-to-right, autoregressive (AR) decoding protocol, where the next token is selected based on previous tokens, and watermark signals are injected via logit biasing or resampling conditioned solely on past sequence information. However, diffusion LLMs (DLMs) and other non-sequential decoders update tokens in an iterative, non-sequential refinement process, requiring watermark mechanisms that remain agnostic to the global generation schedule. The Position-Allocation Multi-bit Watermark (MPAC) design philosophy addresses this by allocating watermark constraints and embedding signals based on the finalized status and identities of both left and right neighboring tokens, ensuring both locality and permutation invariance in the watermark signal (Raban et al., 18 Jan 2026).

The MPAC paradigm is motivated by the need for:

• High statistical detectability (even under minimal perturbation budgets)
• Compatibility with non-sequential generative protocols
• Position-level decoupling of watermark signal (enabling multi-bit capacity and robustness)

2. Algorithmic Structure: LR-DWM as Canonical Instance

LR-DWM is a concrete instantiation of position-allocation watermarking for DLMs. At diffusion step $s$ in generating sequence $y = (y_1, ..., y_T)$, only a subset $I_s$ of positions are refined. For a position $i\in I_s$:

1. Local green-set construction: For each of the immediate neighbors, $y_{i-1}$ (left) and $y_{i+1}$ (right), if already finalized, a keyed hash function $H(\cdot, k_{L/R})$ deterministically partitions the vocabulary $V$ into two equally sized subsets: a "green pool" $G_L^{(i)}$ (left) or $G_R^{(i)}$ (right).
2. Logit bias allocation: Letting $l$ be the model's raw logits at position $i$, additive watermark bias is applied:

$$l'_v = l_v + \delta \cdot 1\{v \in G_L^{(i)}\} + \delta \cdot 1\{v \in G_R^{(i)}\}$$

where $\delta$ is the bias strength.

1. Sampling: The token is then sampled from $\mathrm{softmax}(l'_v)$.

This two-sided allocation ensures that tokens matching both neighbors' green-pool constraints receive maximal bias, while others receive less or no bias depending on which (if any) constraints apply.

Detection protocol and multi-bit recovery

For detection, after obtaining a candidate sequence $y$, the test reconstructs for position $i$ the green sets $G_L^{(i)}, G_R^{(i)}$ based on the sequence context and keys. For each token, two match indicators are computed, and a ternary score $s_i$ is derived:

$s_i = m_L^{(i)} + m_R^{(i)} - 1 \in \{+1, 0, -1\}$

The global detection statistic is the normalized sum $Z = \left(\sum_{i=1}^T s_i\right)/(\sigma\sqrt{T})$, with $\sigma^2$ empirically estimated from human text. This statistic is compared to a Gaussian threshold (e.g., threshold $\tau = 2.33$ for 1% false positive rate) (Raban et al., 18 Jan 2026).

The local, context-dependent keying and allocation of bits in MPAC (choosing different green-pools per position and possibly per neighbor) provides a multi-bit channel: each position can encode two bits (left and right), at negligible interference.

3. Implementation Characteristics

MPAC schemes like LR-DWM offer several salient engineering advantages:

• Memory/computational efficiency: At every position, only two keyed hash operations and two (possibly masked) vector additions are required, yielding $O(|V|)$ runtime per position without extra overhead compared to conventional DLM decoding. Competing watermarks (e.g., DMARK, WM-DLM) require substantially higher per-position computational or memory cost.
• Stateless operation: No caching of large hash tables or bias matrices is required; only the two secret keys $k_L$ and $k_R$ must be maintained.
• Permutation agnosticism: The local context basis (neighbor-only) ensures correctness and robustness regardless of the global order in which positions are visited during diffusion denoising.
• No dependence on past hash inversion or schedule tracking: All logic is forward-only and compositional.

Empirically, GPU memory and wall-clock time are within 5% of the unmodified baseline for leading DLMs (LLaDA, DREAM), outperforming alternatives that may double memory or runtime (Raban et al., 18 Jan 2026).

4. Detection Fidelity, Error Rates, and Robustness

MPAC watermarks enable powerful statistical detection. In the LR-DWM empirical evaluation, for $T=300$ and $\delta \approx 3.2$:

• True positive rates exceeded 99% at a 1% false positive rate.
• The TPR-vs-perplexity curves exhibited a sharp phase transition: just a small decrease in text quality (ΔPPL ≈ 0.5) sufficed to escalate TPR from 90% to 99% at constant FPR.
• Robustness under light text perturbations is high: random deletion of 10% of tokens retains >98% TPR; heavy adversarial paraphrasing reduces TPR (~15%), reflecting sensitivity to destruction of local correlations, but is consistent with behavior of all token-level watermarks that depend on sequence-local statistics (Raban et al., 18 Jan 2026).

Detection is underpinned by a ternary token-level score, which has provable zero mean under the null (human text), and variance empirically calibrated on held-out human corpora, ensuring sound Type I error control.

5. Context and Significance in Watermarking Literature

Position-allocation multi-bit watermarking generalizes and subsumes red-green (single-bit) token allocation strategies used in earlier AR watermarking (e.g., KGW, DMARK) by supporting:

• Simultaneous, independent (multi-bit) watermarks at multiple positions.
• Context-adaptive application: each finalized token acts as local anchor for the next watermark constraint.
• Applicability to any generation order, supporting DLMs without reliance on left-right sequencing (Raban et al., 18 Jan 2026).

Unlike AR-optimized methods, which often fail or degrade on parallel or asynchronous schedule decoders, MPAC approaches are natively compatible with DLMs and other non-sequential frameworks.

6. Limitations and Research Directions

MPAC watermarks remain subject to overfitting risk if the adversary can access green-set construction or the secret keys, but standard cryptographic assumptions on keyed hashes used in $H(\cdot, k)$ mitigate this. Heavy paraphrasing attacks remain a challenge, as they break local context dependencies; combining MPAC with semantically adaptive or broader context-aware watermarks is an avenue for future improvement.

Ongoing work studies optimized multi-bit allocation scheduling, trade-offs in bias strength $\delta$, and the impact of MPAC strategies under intentional or inadvertent sequence reordering in downstream processing.

7. Representative Algorithmic Workflow

A typical LR-DWM-based MPAC embedding and detection regime follows:

function LR-DWM-Decode(prompt c, model M, keys k_L, k_R, bias δ): initialize y to a fully corrupted sequence for s = S ... 1 do I_s = positions selected by diffusion schedule for i in I_s do ℓ ← M.logits(y, i) if y_{i-1} finalized: ℓ += δ · 1_{v ∈ G_L^{(i)}} if y_{i+1} finalized: ℓ += δ · 1_{v ∈ G_R^{(i)}} y_i ∼ softmax(ℓ) end end return y

Detection is a Z-score aggregation over token-level $s_i$ statistics, compared to a calibrated threshold (Raban et al., 18 Jan 2026).

---

Position-allocation multi-bit watermarking establishes a highly efficient, context-local, key-driven framework for robust and multi-bit watermarking in both sequential and non-sequential generative models, notably enabling practical, near-constant-overhead watermarking with rigorous statistical guarantees for diffusion LLMs (Raban et al., 18 Jan 2026).