SAEMark: Disambiguating Watermarking Methods

• SAEMark is an overloaded term describing two watermarking frameworks in ML, one for LLM text and one for agent memory attribution.
• The LLM approach embeds multi-bit watermarks via best-of-N inference-time selection, preserving text quality without logit manipulation.
• Empirical evaluations show high F1 scores and robustness, with trade-offs between compute budget and watermarking capacity across languages and code.

SAEMark is an overloaded term in recent machine-learning watermarking literature. In one usage, it denotes a post-hoc, multi-bit watermarking framework for LLM-generated text that operates through inference-time selection over naturally sampled outputs, without logit manipulation or retraining. In another, it denotes a state-evolution attribution paradigm for long-term agent memory systems, where ownership is embedded into latent memory-write decisions and later verified from final memory snapshots. These usages are technically unrelated, and they should also be distinguished from SAMark, a separate self-anchored text watermarking method (Yu et al., 11 Aug 2025, Zhang et al., 24 May 2026, Huo et al., 25 May 2026).

1. Terminological scope and disambiguation

Two distinct research lines use the label SAEMark.

Usage	Core mechanism	Representative paper
SAEMark for LLM text watermarking	Best-of-$N$ inference-time selection using deterministic semantic features	(Yu et al., 11 Aug 2025)
SAEMark for agent memory attribution	Keyed, distribution-preserving selection over latent memory-write decisions	(Zhang et al., 24 May 2026)
SAMark	Self-anchored semantic-level text watermark; unrelated to either SAEMark usage	(Huo et al., 25 May 2026)

The first SAEMark addresses black-box or API-only LLM deployment, multilingual generalization, and multi-bit user attribution. The second addresses forensic provenance for memory-backed agents in settings where logs, visible outputs, and trusted metadata may be absent. The shared name reflects a common concern with attribution, but the evidence channel, threat model, and statistical machinery differ substantially.

A common source of confusion is the proximity of the names SAEMark and SAMark. The literature explicitly identifies SAMark as a different, unrelated method, and the memory-watermarking literature independently uses SAEMark as an acronym for State-Evolution Attribution watermarking. This suggests that any technical discussion of SAEMark requires immediate disambiguation rather than assuming a single canonical method.

2. SAEMark as post-hoc multi-bit watermarking for LLM text

In the LLM setting, SAEMark is defined as a post-hoc, multi-bit watermarking framework that embeds a personalized message by selecting among naturally sampled outputs whose deterministic feature statistics align with key-derived targets. It is designed to work with black-box or API-accessible models, requires neither logit modification nor training of the base LLM, and aims to preserve text quality by sampling rather than perturbing token probabilities (Yu et al., 11 Aug 2025).

The method operates by segmenting output into domain-appropriate units, such as sentences for natural language or function blocks for code. For each unit, it computes a deterministic feature vector, reduces that vector to a scalar statistic, and normalizes the statistic through an empirical CDF so that the resulting value has approximately uniform behavior on natural text. A secret key $K$ and message $m \in \{0,1\}^b$ generate a target sequence $\mathbf{t} = g_K(m)$, and generation proceeds by best-of-$N$ selection: among $N$ candidate continuations, the method chooses the one whose normalized statistic is closest to the current target.

A central claim of this formulation is that it generalizes beyond English prose. The same framework is presented for English, Chinese, and code, with unit segmentation and normalization adjusted to domain. Because accepted segments are unmodified samples from the underlying model, the framework is positioned as compatible with closed-source deployment and as less intrusive than logit-based watermarks.

3. Statistical formalism and SAE-based realization

The framework is extractor-agnostic. For a text unit $u$, a deterministic extractor $\phi(u) \in \mathbb{R}^d$ yields a feature vector, and a scalar statistic $s(u) = g(\phi(u))$ is mapped through an empirical CDF $\hat F_S$ to a normalized score

$K$0

For a text $K$1 segmented into $K$2 units $K$3, the normalized statistic vector is

$K$4

Acceptance at unit $K$5 is formulated through

$K$6

where $K$7 is the key-derived target and $K$8 is a relative tolerance (Yu et al., 11 Aug 2025).

The practical instantiation uses Sparse Autoencoders (SAEs) on an anchor model rather than on the target generator. For hidden state $K$9 at layer $m \in \{0,1\}^b$0,

$m \in \{0,1\}^b$1

A masked unit-level aggregation is then defined by

$m \in \{0,1\}^b$2

where $m \in \{0,1\}^b$3 removes background features such as punctuation and ubiquitous grammar features. The paper’s principal statistic is the Feature Concentration Score (FCS),

$m \in \{0,1\}^b$4

with $m \in \{0,1\}^b$5 the deduplicated set of top features across tokens. Empirically, FCS is described as approximately normal across tasks and languages, with observed parameters $m \in \{0,1\}^b$6, $m \in \{0,1\}^b$7, and tolerance $m \in \{0,1\}^b$8.

SAEMark also provides a worst-case success bound for best-of-$m \in \{0,1\}^b$9 embedding. If the pre-normalized statistic satisfies $\mathbf{t} = g_K(m)$0, then the probability of finding at least one candidate within tolerance of target $\mathbf{t} = g_K(m)$1 is bounded below by

$\mathbf{t} = g_K(m)$2

At the worst-case target $\mathbf{t} = g_K(m)$3,

$\mathbf{t} = g_K(m)$4

This makes inference-time scaling explicit: larger $\mathbf{t} = g_K(m)$5 improves embedding success exponentially at the unit level.

Verification recomputes normalized statistics from the observed text, derives candidate target sequences from keys, and applies alignment filters before a Student’s $\mathbf{t} = g_K(m)$6-test. The alignment filters require range similarity

$\mathbf{t} = g_K(m)$7

with $\mathbf{t} = g_K(m)$8 and $\mathbf{t} = g_K(m)$9, and overlap rate

$N$0

with $N$1. After filtering, the detector forms $N$2 and computes

$N$3

Detection is then a verifier-held hypothesis test over candidate keys.

4. Empirical profile of the LLM-watermarking SAEMark

The reported empirical results span C4 for English completions, LCSTS for Chinese summarization, MBPP for Python code, and PandaLM for instruction following. At $N$4 FPR, SAEMark reports $N$5 F1 on English C4, $N$6 F1 on Chinese LCSTS, and $N$7 F1 on MBPP code. The paper further reports that it outperforms the multi-bit baseline Waterfall and even exceeds the code-specific single-bit baseline SWEET on MBPP, with $N$8 versus $N$9 F1 (Yu et al., 11 Aug 2025).

For multi-bit attribution, the framework reports robust recovery above $N$0 accuracy up to 10 bits, corresponding to approximately 1,024 users, and approximately $N$1 accuracy at 13 bits, corresponding to approximately 8,192 users, at fixed text lengths. Inference-time scaling is directly visible in the candidate budget: $N$2 yields $N$3 F1 in English, $N$4 yields $N$5, and $N$6 yields $N$7; for Chinese, $N$8 yields $N$9 and $u$0 yields $u$1.

Text quality is reported as competitive with unwatermarked generation because the method selects among native samples rather than manipulating logits. On PandaLM, SAEMark attains a top quality score of $u$2 in pairwise evaluation. On BIGGen-Bench, it is reported as the best among watermarks across backbones; one example is Qwen2.5-7B, where unwatermarked text scores $u$3, SAEMark $u$4, and KGW $u$5. Latency at $u$6 is described as approximately $u$7 baseline while achieving about $u$8 F1, versus $u$9 for KGW and $\phi(u) \in \mathbb{R}^d$0 for DIP.

The main limitations are also explicit. Performance depends on the semantic fidelity and stability of the extractor; short outputs have limited capacity for robust multi-bit embedding; and low compute budgets reduce per-unit success and overall capacity. The work emphasizes verifier-held detectability rather than cryptographic forgery resistance under known keys, and it does not introduce explicit error-correcting codes.

5. SAEMark as state-evolution attribution for long-term agent memory

In the agent-memory literature, SAEMark denotes State-Evolution Attribution watermarking: a paradigm that ties ownership attribution to latent memory-write decisions rather than to visible text, tool logs, or trusted metadata. The core idea is to embed a keyed, distribution-preserving signal into which admissible internal candidate is selected at each memory update. Because these decisions alter the persistent memory graph or note store itself, attribution can remain recoverable even when only a final memory snapshot survives (Zhang et al., 24 May 2026).

The threat model centers on the snapshot-only R3 setting, in which verification receives only the final memory snapshot $\phi(u) \in \mathbb{R}^d$1. All prompts, logs, tool traces, and provenance fields may be absent or adversary-controlled. The method assumes backend reproducibility and deterministic re-elicitation of candidate sets and preference scores at the LLM-call boundary: the same model, enumeration temperature, and adapter must reproduce the same admissible candidate set and normalized distribution. Under those assumptions, the verifier can reconstruct the decision points and replay the keyed selection rule.

At time $\phi(u) \in \mathbb{R}^d$2, the backend adapter exposes a candidate set $\phi(u) \in \mathbb{R}^d$3, a semantically admissible subset $\phi(u) \in \mathbb{R}^d$4, and model scores $\phi(u) \in \mathbb{R}^d$5, yielding a backend preference distribution

$\phi(u) \in \mathbb{R}^d$6

In MemMark, the reported defaults are $\phi(u) \in \mathbb{R}^d$7, $\phi(u) \in \mathbb{R}^d$8, and $\phi(u) \in \mathbb{R}^d$9. The carrier types are update-target, link-target, and semantic-realization, corresponding respectively to which existing note or fact is modified, which prior object is connected, and which semantically equivalent realization is stored.

Selection is keyed but distribution-preserving. A PRF $s(u) = g(\phi(u))$0 derives

$s(u) = g(\phi(u))$1

where $s(u) = g(\phi(u))$2 canonically encodes event identifiers, dialogue or session identifiers, decision type, prompt hash, and the previous commitment. The admissible distribution $s(u) = g(\phi(u))$3 is discretized into integer masses $s(u) = g(\phi(u))$4 over $s(u) = g(\phi(u))$5, and a payload index $s(u) = g(\phi(u))$6 is shifted by $s(u) = g(\phi(u))$7. The selected candidate is

$s(u) = g(\phi(u))$8

Because the shift is pseudorandom, the marginal selection probabilities are preserved: $s(u) = g(\phi(u))$9 This is the method’s central invariance property: payload embedding is coupled to selection, but backend choice frequencies remain unchanged in distribution.

The paradigm also defines a commit–reveal evidence layer. In the MemMark instantiation, each decision is committed through

$\hat F_S$0

and the session is sealed by

$\hat F_S$1

The commitments form a Merkle tree, and verification checks both keyed replay and Merkle inclusion under the signed root.

6. MemMark as the principal instantiation of state-evolution SAEMark

MemMark is the concrete instantiation of SAEMark evaluated on A-Mem and Graphiti, using the LoCoMo benchmark and three LLM backbones: DeepSeek-V4-Pro, Qwen3.6-flash, and GLM-5. Its central empirical claim is that snapshot-only attribution is feasible without surviving traces or trusted metadata while preserving memory utility. Overall F1 retains $\hat F_S$2 of the unwatermarked baseline, moving from $\hat F_S$3 to $\hat F_S$4, and BLEU-1 changes by $\hat F_S$5, from $\hat F_S$6 to $\hat F_S$7 (Zhang et al., 24 May 2026).

Carrier capacity is quantified through mean per-decision entropies: $\hat F_S$8 For a payload $\hat F_S$9, recovery under bit error rate $K$00 is analyzed through

$K$01

In the reported R3 setting, $K$02 and a full 40-bit payload is recovered from final snapshots, so $K$03 bits. Wrong-key verification remains near chance, with observed wrong-key bit recovery approximately $K$04.

Detection is formulated as a bit-match test. If $K$05 is the number of matching bits between the embedded and recovered payloads, then under the wrong-key null $K$06,

$K$07

whereas under the correct-key alternative $K$08,

$K$09

with $K$10. For $K$11, keyed runs produce $K$12, while wrong-key runs produce $K$13. The paper gives the illustrative threshold $K$14 for $K$15, implying strong separation with only tens of bits.

Robustness is evaluated under nine memory-lifecycle attacks spanning content tampering, leaf removal, and synthesis or restructuring. Verification surfaces either commitment_fail or missing_leaves, which allows attack diagnosis as well as detection. Representative outcomes include, for A-Mem, content edits reducing mean recovery from approximately $K$16 at strength $K$17 to approximately $K$18 at $K$19, and poisoning at $K$20 retaining recovery approximately $K$21 with $K$22. For Graphiti, content attacks yield mean recovery approximately $K$23, $K$24, and $K$25 at $K$26, $K$27, and $K$28, while compaction at $K$29 is more damaging than additive poisoning.

The principal limitations are also explicit. Snapshot-only verification can fail if model drift or nondeterminism breaks deterministic re-elicitation; collusion across multiple writers or keys remains open; and larger memory lifecycles involving compaction, migration, or summarization introduce new drift modes and may require new carriers and verification logic. A plausible implication is that SAEMark in this sense is best understood not as a conventional text watermark, but as a provenance protocol for reproducible agent-state evolution.

7. Conceptual relation between the two SAEMark usages

The two SAEMark usages share an attribution objective but place the watermark in different statistical objects. The LLM-text SAEMark embeds a multi-bit message into feature statistics of generated units by best-of-$K$30 inference-time selection; verification compares observed statistics to key-derived targets and uses alignment filters plus a $K$31-test. The state-evolution SAEMark embeds attribution into latent backend choices over memory writes; verification reconstructs admissible decision points, replays a keyed sampler, and checks cryptographic commitments and payload recovery (Yu et al., 11 Aug 2025, Zhang et al., 24 May 2026).

This difference has practical consequences. In the text setting, the dominant trade-off is between compute budget $K$32, attribution capacity, and output quality. In the agent-memory setting, the dominant trade-off is between backend reproducibility, carrier entropy, and robustness to lifecycle attacks. The former is extractor-centric and operates on externalized content; the latter is system-centric and operates on persistent internal state transitions.

A recurrent misconception is to treat all methods with similar names as variants of one family. The literature does not support that view. SAEMark for inference-time LLM watermarking, SAEMark for state-evolution attribution, and SAMark for self-anchored semantic watermarking address different evidence channels and different failure modes. The term therefore functions less as a single method name than as a namespace collision across adjacent watermarking subfields.