SemMark: Semantic Watermarking in LLMs

Updated 4 July 2026

SemMark is a family of semantic watermarking techniques that embed hidden attributions using semantic feature extraction and inference-time rejection sampling rather than modifying token logits.
It extends earlier methods like SemStamp by leveraging external feature extractors and statistical tests to enhance paraphrase robustness and maintain text quality.
SAEMark, a key instance within SemMark, achieves high detection accuracy and efficient inference scaling across modalities such as text, code, and audio.

SemMark is not introduced under that exact title in the supplied arXiv literature. In the most directly relevant work, the query term “SemMark” appears to refer to SAEMark, a post-hoc, multi-bit watermarking framework for LLMs that embeds personalized messages solely via inference-time, feature-based rejection sampling without altering model logits or requiring training; the closest related prior notion named in that paper is SemStamp, a sentence-level semantic watermark for paraphrastic robustness (Yu et al., 11 Aug 2025). In current usage, the term therefore most plausibly denotes a family of semantic marking or semantic watermarking methods in which attribution is tied to semantic representations, deterministic feature statistics, or semantics-preserving transformations rather than to raw token identities alone.

1. Terminology and scope

The textual literature surrounding SemMark is centered on methods that move watermarking from token space to semantic space or to deterministic semantic-feature statistics. In that lineage, SemStamp defines a sentence-level semantic watermark based on locality-sensitive hashing of sentence embeddings; k-SemStamp replaces random LSH partitioning with k-means clustering; SimMark uses similarity between consecutive sentence embeddings; SeqMark addresses constrained low-entropy generation with semantic differentiation; and SAEMark generalizes post-hoc multi-bit watermarking through external feature extractors and inference-time candidate selection (Hou et al., 2023, Hou et al., 2024, Dabiriaghdam et al., 5 Feb 2025, Le et al., 14 Jan 2026, Yu et al., 11 Aug 2025).

This suggests that “SemMark” functions less as a standardized method name than as a convenient label for a design family. The family is characterized by three recurring commitments: watermarking at the sentence/semantic level rather than the token level, reliance on rejection sampling or related selection mechanisms rather than compulsory token-logit distortion, and detection by a statistical test over semantic or feature-derived observables.

Within that family, SAEMark is the only work in the supplied corpus that explicitly identifies the query term as pointing to itself. For that reason, the most precise referent of SemMark in recent LLM watermarking is SAEMark, while SemStamp and its descendants constitute its immediate technical ancestry.

2. Semantic watermarking before SAEMark

The starting point for semantic watermarking in text is the critique that token-level watermarks are fragile under paraphrase. SemStamp addresses this by watermarking the semantic embedding of each sentence rather than the token stream. It computes a sentence embedding $v=\mathrm{Membd}(s)$ , partitions embedding space with random-hyperplane LSH, pseudorandomly divides the resulting regions into valid and blocked sets using the previous sentence’s signature, and accepts a candidate sentence only if its semantic hash lands in a valid region. Detection uses a one-proportion z-test over the number of valid sentences (Hou et al., 2023).

SemStamp’s robustness mechanism is explicitly semantic. Because paraphrasing often preserves meaning, the sentence embedding can remain close even when the surface form changes substantially. The method supplements this with a margin-based rejection constraint that avoids embeddings near LSH hyperplane boundaries, thereby increasing LSH consistency under paraphrase. Its empirical results show stronger robustness than token-level watermarking under Pegasus, Parrot, GPT-3.5, and a stronger bigram paraphrase attack (Hou et al., 2023).

k-SemStamp retains the sentence-level watermarking philosophy but replaces LSH’s arbitrary hyperplanes with k-means clustering fitted on domain-specific sentence embeddings. The motivation is that domains such as news or narrative text exhibit an inherent semantic structure, and clustering aligns regions more naturally with semantic neighborhoods than random partitions. Generation still relies on rejection sampling, with candidate sentences accepted only if their nearest-cluster assignment lies in the valid cluster set and satisfies a cluster-margin constraint. Detection again uses a sentence-level z-score. On BookSum, the method reduces the average samples per accepted sentence from 20.9 for SemStamp to 13.3, a 36.2% reduction, while keeping PPL, Ent-3, and Sem-Ent essentially unchanged relative to the non-watermarked baseline (Hou et al., 2024).

Later sentence-level methods generalize this trajectory in two directions. SimMark abandons explicit semantic partitions and instead constrains the similarity or distance between consecutive sentence embeddings to a valid interval $[a,b]$ , then applies a soft counting mechanism and a soft- $z$ -test for detection. It is explicitly post-hoc, does not require logits, and is compatible with API-only models (Dabiriaghdam et al., 5 Feb 2025). SeqMark, by contrast, focuses on low-entropy constrained generation tasks such as machine translation, summarization, and code generation. Its core diagnosis is region collapse in prior sequence-level methods: the pseudorandom partition of semantic space can cause high-probability outputs to collapse into either valid or invalid regions. SeqMark therefore mean-centers the high-quality output manifold before LSH so that likely outputs are distributed more evenly across regions, improving detection while preserving quality (Le et al., 14 Jan 2026).

3. SAEMark as the direct referent of SemMark

SAEMark defines watermarking as a selection problem rather than a token-reweighting problem. For each text segment, the base LLM generates several natural candidates; a deterministic feature extractor $\phi$ is applied to each candidate; the extracted features are reduced to a scalar statistic $s(u)=g(\phi(u))$ ; and that statistic is normalized through an empirical CDF so that natural text behaves approximately uniformly, $z(u)=\hat F(s(u))$ . A watermark key $k$ seeds a PRNG that produces a sequence of target values $\{\tau_i\}_{i=1}^M$ . During generation, the model samples $N$ candidate continuations for each unit and selects the candidate minimizing the target deviation (Yu et al., 11 Aug 2025):

$x^* = \arg\min_{x\in \mathcal{X}} \left| \hat F(s(\phi(x))) - \tau_i \right|.$

The framework is deliberately general with respect to segmentation. It operates on units such as sentences for natural language or functions / blocks for code, and it never edits tokens after generation. Instead, it repeatedly samples from the base model until a naturally produced candidate matches the watermark target closely enough. Because the chosen output is always an ordinary model output, the method is presented as preserving quality while remaining compatible with closed-source/API models (Yu et al., 11 Aug 2025).

Detection reverses the generative process. The observed text is segmented; the same normalized statistics $[a,b]$ 0 are computed; target sequences are regenerated for each candidate key; an alignment check is performed; and a Student’s t-test decides whether the text matches a key or is unwatermarked. The detector returns the key with the highest significant t-statistic, otherwise $[a,b]$ 1. This contrasts with earlier semantic watermarks such as SemStamp and k-SemStamp, which detect via a one-proportion z-test over valid sentences. SAEMark thus shifts semantic watermarking from region-membership counting toward feature-target alignment in a normalized scalar space (Yu et al., 11 Aug 2025).

A defining property of SAEMark is that it does not manipulate the base model’s logits, weights, or decoding distribution. The feature extractor is external to the target LLM. This design separates watermarking from model internals and makes the framework compatible with black-box generation systems, a departure from both token-level logit-bias methods and earlier sentence-level methods that still presupposed a controlled generative loop over sentence candidates (Yu et al., 11 Aug 2025).

4. Feature design, alignment filters, and theoretical analysis

The concrete instantiation of SAEMark uses Sparse Autoencoders (SAEs) applied to an anchor model’s hidden states. The argument is that SAE activations are sparse, semantically interpretable, deterministic, and often approximately regular in distribution across domains and languages. The paper therefore treats them as suitable external features for watermarking based only on generated text (Yu et al., 11 Aug 2025).

Its principal scalar statistic is the Feature Concentration Score (FCS). Intuitively, FCS measures how much of the SAE activation mass is concentrated on the most salient features of a text after masking out background or common features. The appendix gives the form

$[a,b]$ 2

where $[a,b]$ 3 is the deduplicated set of top feature indices after applying a background mask $[a,b]$ 4. The mask is emphasized as important because ubiquitous features such as punctuation or basic grammar would otherwise dominate the score and reduce discrimination (Yu et al., 11 Aug 2025).

Theoretical analysis is given under a Gaussian assumption for the statistic. If $[a,b]$ 5 and targets are sampled from $[a,b]$ 6, then with $[a,b]$ 7 candidates the probability of finding at least one candidate within relative tolerance $[a,b]$ 8 of the target is bounded below by

$[a,b]$ 9

With empirical parameters $z$ 0, $z$ 1, and tolerance $z$ 2, the paper reports that $z$ 3 yields $z$ 4 per-unit success, $z$ 5 gives 85.32\%, and $z$ 6 gives 61\%. It also notes that end-to-end sequence success is higher because multiple units are generated and checked jointly (Yu et al., 11 Aug 2025).

Detection uses two additional safeguards before the t-test. The Range Similarity Filter requires the observed and target ranges to be similar, with typical settings $z$ 7 and $z$ 8. The Overlap Rate Filter requires the fraction of target values falling inside the observed range to exceed $z$ 9. These filters are presented as the main mechanism by which SAEMark keeps false positives low while still allowing high-capacity multi-bit encoding (Yu et al., 11 Aug 2025).

5. Empirical profile and comparative position

SAEMark is evaluated on four datasets: C4 for English completion, LCSTS for Chinese summarization, MBPP for Python code generation, and PandaLM for English instruction following. Detection is reported with Accuracy, Recall, and F1 at 1\% false positive rate, and text quality is measured primarily through GPT-4o pairwise win rates on PandaLM, with additional evaluation on BIGGen-Bench using an official judge model (Yu et al., 11 Aug 2025).

The main reported results are 99.7% accuracy, 99.8% recall, and 99.7% F1 on C4; 99.2% accuracy, 99.6% recall, and 99.2% F1 on LCSTS; 74.5% accuracy, 50.2% recall, and 66.3% F1 on MBPP; and 86.6% quality score, 73.9% recall, and 84.6% F1 on PandaLM, together with a separate reported quality win-rate of 67.6%. The paper emphasizes 99.7% F1 on English and 99.2% on Chinese, interpreting this as strong multilingual behavior (Yu et al., 11 Aug 2025).

Quality claims are supported by BIGGen-Bench. On Qwen2.5-7B-Instruct, the official-judge scores are 4.13 for unwatermarked text, 4.05 for SAEMark, 3.97 for KGW, and 4.02 for Waterfall. On Llama-3.2-3B-Instruct, the corresponding scores are 3.69, 3.85, 3.56, and 3.62; on Gemma-3-4B-It, they are 4.26, 4.23, 3.98, and 4.19. The paper’s qualitative interpretation is that selecting among naturally sampled outputs yields substantially smaller quality degradation than logit-manipulation methods (Yu et al., 11 Aug 2025).

The compute study is central to SAEMark’s “inference-time scaling” claim. The conservative theoretical bound is reported as pessimistic relative to practice: with $\phi$ 0, SAEMark already reaches 98.0% F1 on English, and even $\phi$ 1 is described as usable. In the latency comparison, SAEMark with $\phi$ 2 achieves 99.5% F1 at 1.00× baseline latency, whereas some logit-manipulation baselines require around 3.24×–3.29× latency. The paper attributes this to parallel candidate generation, prefix caching, and optimized kernels (Yu et al., 11 Aug 2025).

With respect to capacity, SAEMark reports over 90% accuracy up to 10 bits and about 75% accuracy at 13 bits, corresponding to roughly 1,024 and 8,192 users respectively. In comparative positioning, it is contrasted with Waterfall, REMARK-LLM, CODEIP, and classic white-box methods such as KGW, EXP, DIP, Unbiased, and SynthID. The central distinction is that SAEMark uses feature-guided post-hoc selection over naturally produced candidates, whereas those methods largely depend on logits, additional model components, or task-specific structures (Yu et al., 11 Aug 2025).

The semantic-marking idea extends beyond LLM text. StreamMark adapts it to audio through a deep learning-based, semi-fragile audio watermarking system trained to be robust against benign, semantics-preserving conversions such as compression, noise, cropping, and style transfer, while remaining fragile to malicious, semantics-altering attacks such as TTS, voice conversion, and speech editing. It is explicitly positioned as an audio adaptation of the semantic marking idea used in image-forensics work such as FaceSigns and WaterLo (Liu et al., 13 Apr 2026).

A related image-forensics formulation is SepMark, a deep separable watermarking framework with one encoder and two decoders: a robust Tracer for source tracing and a semi-robust Detector that is selectively sensitive to malicious Deepfake distortions. The key notion is that provenance and tamper detection require distinct robustness profiles and therefore should not be collapsed into a single “always-robust” watermark (Wu et al., 2023). In diffusion-model IP protection, HMARK places a multi-bit watermark in the semantic-latent h-space of a diffusion model so that the watermark is radioactive, i.e., transferred into outputs of downstream models finetuned on the watermarked data (Li et al., 26 Nov 2025).

For code, semantic marking appears in both dataset and repository auditing. CodeMark embeds hidden associations into code corpora through adaptive semantic-preserving transformations, with validation via a black-box statistical test on code-model outputs (Sun et al., 2023). RepoMark constructs multiple semantically equivalent code variants per file and uses a ranking-based hypothesis test with a provable false detection rate bound to audit repository use in code LLM training (Qu et al., 29 Aug 2025). These works differ operationally from SAEMark, but they share the central principle that watermarking or auditing can be tied to semantically equivalent variation rather than overt artifacts.

The limitations of SAEMark delimit what SemMark can presently denote in the LLM setting. Its theoretical analysis assumes that the chosen feature statistic has a sufficiently regular distribution, roughly approximated as Gaussian; its effectiveness depends on the quality of the anchor model’s SAE; it is said to be best suited to open-ended generation rather than very short outputs such as multiple-choice answers; and it is not meant to provide cryptographic unforgeability if keys are compromised. A plausible implication is that current semantic watermarking methods remain attribution mechanisms rather than full cryptographic provenance systems (Yu et al., 11 Aug 2025).

Taken together, the literature presents SemMark not as a single fixed algorithm but as a maturing research direction. In text, the progression runs from SemStamp’s sentence-hash regions to k-SemStamp’s clustering, SimMark’s similarity intervals, SeqMark’s semantic differentiation, and SAEMark’s external-feature, multi-bit post-hoc selection. Across modalities, the same general idea reappears: a watermark should survive transformations that preserve meaning or source identity, and it should become unstable when the relevant semantics are materially altered.