Text Watermarks: Methods & Challenges

• Text watermarks are imperceptible signals embedded in digital texts to verify ownership, authenticate sources, and trace content provenance.
• They employ varied embedding techniques such as format manipulation, lexical substitution, and logit biasing to inscribe hidden patterns while preserving text quality.
• Current challenges include ensuring robustness against attacks like paraphrasing and translation, balancing detectability, and integrating watermarking into LLM workflows.

Text watermarks are imperceptible signals embedded in digital text to enable ownership verification, authentication, traceability, or detection of machine or human authorship. They serve as a foundational technology for protecting intellectual property, proving data provenance, content moderation, and mitigating the misuse of LLMs. The following sections detail the taxonomy of text watermarking methods, evaluation criteria, attacks and robustness issues, practical and special-purpose schemes, and evolving research challenges, as documented in recent technical literature.

1. Classification of Text Watermarking Approaches

Text watermarking methods are broadly classified according to how and where the watermark is embedded:

1.1 Format-Based Watermarking

• Whitespace and Formatting: Embeds signals by altering spaces or control characters. An example is the replacement of ASCII space (U+0020) with visually identical Unicode codepoints (e.g., U+2004 in Easymark (Sato et al., 2023)). Print-oriented variants may modulate ligature presence or subtle spatial offsets.
• Character Shaping/Feature Modification: Leverages script-specific features such as kashida, diacritics, and alternate Unicode forms (notably in Arabic (Alotaibi et al., 2015)). Methods include insertion of kashidas to encode bits or modulation of diacritic presence/placement.
• Font-Based Techniques: Watermark is embedded by modifying hidden style features in the font’s latent space, allowing high capacity and robustness across transmission types (e.g., FontGuard (Wong et al., 4 Apr 2025)).

1.2 Lexical and Syntactic Watermarking

• Lexical/Synonym-Based: Substitutes contextually appropriate synonyms to encode bits. DeepTextMark (Munyer et al., 2023) uses Word2Vec and sentence encoding to optimize for semantic similarity. Black-box LLM methods also employ context-aware synonym mapping with hash-based bit assignments (Yang et al., 2023).
• Syntactic/Rewriting-Based: Alters sentence or phrase structure (e.g., switching active/passive, rearranging adjuncts (Alotaibi et al., 2015)). These are highly imperceptible for readers but have low payload and may impact semantic fidelity.

1.3 Generation-Embedded Watermarks

• Logits Modification During Generation: Pseudorandomly divides the vocabulary into “green/red” lists and biases the probability of the “green” set at each token generation step. Detection involves statistical hypothesis testing on the frequency of green tokens (e.g., KGW family, widespread in recent work (Gu et al., 2023, Ajith et al., 2023, Zhu et al., 12 Mar 2024)).
• Sampling Strategy Alteration: Nonlinear sampling schemes (such as Gumbel-max or contrastive search (Zhu et al., 12 Mar 2024)) modify the choice of token directly during output generation, injecting a hidden pattern traceable with knowledge of the random seed or secret key.
• Dual/Composite Watermarks: Duwak (Zhu et al., 12 Mar 2024) combines both logit modification and contrastive search-based sampling to increase detection efficiency and robustness.

1.4 Semantic and Structural Schemes

• Sentence-Structure-Based Watermarking: PersonaMark (Zhang et al., 15 Sep 2024) assigns watermarks based on the output of a personalized hash function applied to the dependency-parse structure of each sentence, supporting per-user traceability at scale.
• Adaptive and Semantic-Contextual Watermarks: Schemes modulate which tokens are eligible for modification based on distribution entropy, context-derived semantic embeddings, or dynamically learned selectors, balancing security and text fidelity (Liu et al., 25 Jan 2024).

1.5 Evaluation and Benchmarking Frameworks

• Unified Evaluation Criteria: Frameworks such as CEFW (Zhang et al., 24 Mar 2025) aggregate performance along five key axes: detectability, text quality (BLEU, PPL), embedding cost, robustness to attacks (e.g., paraphrasing), and imperceptibility (anti-forgery).
• Task-Specific Benchmarks: For document images, bespoke datasets with synthetic watermarks (e.g., K-Watermark (Krubiński et al., 10 Jan 2024)) and models using variance minimization and hierarchical attention are established.

2. Evaluation Criteria and Trade-Offs

Multiple quantitative and qualitative metrics are used to assess text watermarks:

Evaluation Dimension	Measurement	Remarks
Detectability	AUCROC, Z-score, p-value	Statistical separation between watermarked/clean text
Text Quality	BLEU, PPL, ROUGE	Should remain unaffected (e.g., Whitemark (Sato et al., 2023))
Embedding Cost	Latency, Memory	Minimal additional runtime or memory footprint (e.g., CEFW)
Robustness	AUC after Attack	Maintains detection after paraphrase, deletion, translation
Imperceptibility	Mimic/STEAL attacks	Resistance to spoofs or forgeries without knowledge of key
Capacity	Bits/token, BPC	Amount of data embeddable, varies by technique

Trade-offs are inherent: increasing detectability via stronger perturbations may degrade text quality or increase the risk of detection by adversaries. Highly robust schemes (e.g., orthogonal function embedding with n-gram redundancy in Frostwort (Lau et al., 5 Jul 2024)) can maintain verifiability after aggressive attacks but require more sophisticated design and key management.

3. Robustness, Attacks, and Limitations

Text watermarks are evaluated under a range of adversarial post-processing and removal scenarios:

3.1 Paraphrasing and Translation Attacks

• Even advanced watermarking strategies can be dramatically weakened by cross-lingual translation, which tends to scramble token-level signatures (CWRA attack (He et al., 21 Feb 2024)). Solutions such as X-SIR use cross-lingual semantic clustering to improve retention across languages.

3.2 Synonymization, Deletion, and Polishing

• Lexical and feature-based watermarks (e.g., selection of Unicode forms, synonym substitution) are especially vulnerable to repeated synonym replacement or word deletion. Robust schemes employ redundancy (Frostwort’s repeated n-gram), context-aware candidate selection, or post-hoc statistical detection to mitigate signal loss (Yang et al., 2023, Lau et al., 5 Jul 2024).

3.3 Imitation and Forgery

• Impossibility theorems formally show that if a watermark is undetectable by humans (i.e., perfect quality), a computationally unbounded adversary can erase it with negligible loss, e.g., via round-trip translation (Sato et al., 2023).
• Public-detection watermarking schemes must balance public verifiability and unforgeability, with semi-private keying or signature-based extensions as potential future directions (Liu et al., 2023).

3.4 Collisions, Overlap, and Scalability

• Overlapping or multiple watermarks can interfere if not designed with orthogonality and sufficiently large key space (Frostwort achieves ~10^130274 unique IDs (Lau et al., 5 Jul 2024)). Personalized and model-centric watermarking require special care to prevent collisions or overlap attacks.

4. Special-Purpose Techniques and Applications

4.1 Font-Based Watermarking

• FontGuard (Wong et al., 4 Apr 2025) encodes signals in the deep feature space of generative font models, giving high embedding capacity, robustness against real-world degradations (e.g., print-scan, compression), and generalization to unseen fonts.
• It employs CLIP-based contrastive decoding and noise simulation layers, supporting robust forensic analysis of physical and digital documents.

4.2 Watermarking for Data Provenance

• Frostwort/Waterfall (Lau et al., 5 Jul 2024) enables data-centric watermarking: by embedding client-specific signals into text datasets before LLM training, provenance can be established by querying black-box models and statistically verifying the presence of watermarks.

4.3 Personalized and Large-Scale User Attribution

• PersonaMark (Zhang et al., 15 Sep 2024) supports embedding per-user watermarks using hash functions over sentence-level syntactic features. It affords both model protection and user accountability with empirical scalability to 10^5 users.

4.4 Low-Entropy Regimes and Coding Theory

• SimplexWater and HeavyWater (Tsur et al., 6 Jun 2025) explicitly address code and other low-entropy generation tasks. Their design is guided by detection gap optimization via coding theory (Simplex code for binary scores; heavy-tailed continuous functions maximize detection gap for given min-entropy). Detection and quality trade-offs can be precisely tuned by tilting parameters.

5. Analytical Foundations and Optimization

Recent work formalizes the limits and optimal design of watermarking schemes:

• Detection Gap Optimization: Expressed as $$\Delta_\text{gap} = \max_{f} \min_{P_X} \max_{P_{X,S} \in \Pi_{P_X,P_S}} \left( \mathbb{E}_{P_{X|S}P_S}[f(X,S)] - \mathbb{E}_{P_X P_S}[f(X,S)] \right)$$ with the optimal $f$ often linked to code constructions (Simplex codes) and tailored for side information distributions.
• Distortion-Free and Training-Free Watermarks: Methods that rely solely on sampling modification maintain the LLM's output distribution unchanged in expectation and do not require model retraining (see (Fernandez, 4 Feb 2025)).
• Combinatorial and Statistical Detection: Dual/differential watermarks (BiMarker (Li et al., 21 Jan 2025)) compare counts between two poles, improving detection in low-variance regimes without increasing false positive risk.

6. Current Challenges and Future Directions

• Cross-Lingual Robustness: Ensuring that watermarks survive translation and language-specific rewriting remains an unsolved challenge. Cluster-based and semantic-invariant assignment are emerging approaches (He et al., 21 Feb 2024).
• Benchmarks and Open Evaluation: The need for standardized, multi-dimensional benchmarks is acute; CEFW (Zhang et al., 24 Mar 2025) and K-Watermark (Krubiński et al., 10 Jan 2024) present initial steps.
• Adaptive, Secure, and Dynamic Schemes: Enhancements include entropy-aware selection, semantic-based perturbations, and adaptive scaling for dynamic text environments (Liu et al., 25 Jan 2024).
• Impossibility and Erasure: No perfect, human-invisible watermark can survive all possible adversarial erasure. Watermarking is inherently a probabilistic and risk-managed technology (Sato et al., 2023).
• Integration into LLM Workflows: There is increasing movement toward training-free, scalable, and efficient watermarking applicable to both open-source and proprietary LLMs, as well as interest in hybrid embeddings (e.g., training data, weights, multi-modal content (Fernandez, 4 Feb 2025)).

7. Summary Table of Representative State-of-the-Art Techniques

Method / Family	Core Embedding Principle	Distinctive Features	Robustness/Capacity
KGW (Green List Bias)	Boosts logit for subset (“green”) per step	Statistical detection; established in LLM field	Tunable; subject to performance drop
Easymark	Unicode whitespace/codepoint substitution	Minimal impact, proves watermark impossibility	High imperceptibility, zero payload
Frostwort/Waterfall	n-gram logit perturb., paraphrasing, permuted	Highly scalable, robust to paraphrasing/overlap	AUROC >0.8 under attack, 10^130274 IDs
PersonaMark	Personalized hash of syntactic structure	User attribution and model protection	Robust to synonym replacement
FontGuard	Style feature perturb. in font manifold	High embedding capacity, robust to distortions	4× BPC, 52.7% ↑ in font quality
HeavyWater/SimplexWater	Code-based, optimal transport, heavy-tails	Minimax optimal for low-entropy, distortion-free	Superior in code/SW tasks

References to Key Papers

• "Arabic Text Watermarking: A Review" (Alotaibi et al., 2015)
• "Embarrassingly Simple Text Watermarks" (Sato et al., 2023)
• "Downstream Trade-offs of a Family of Text Watermarks" (Ajith et al., 2023)
• "On the Learnability of Watermarks for LLMs" (Gu et al., 2023)
• "A Survey of Text Watermarking in the Era of LLMs" (Liu et al., 2023)
• "Watermark Text Pattern Spotting in Document Images" (Krubiński et al., 10 Jan 2024)
• "Adaptive Text Watermark for LLMs" (Liu et al., 25 Jan 2024)
• "Can Watermarks Survive Translation?..." (He et al., 21 Feb 2024)
• "Duwak: Dual Watermarks in LLMs" (Zhu et al., 12 Mar 2024)
• "Waterfall: Framework for Robust and Scalable Text Watermarking..." (Lau et al., 5 Jul 2024)
• "PersonaMark: Personalized LLM watermarking..." (Zhang et al., 15 Sep 2024)
• "BiMarker: Enhancing Text Watermark Detection..." (Li et al., 21 Jan 2025)
• "Watermarking across Modalities for Content Tracing..." (Fernandez, 4 Feb 2025)
• "CEFW: A Comprehensive Evaluation Framework for Watermark..." (Zhang et al., 24 Mar 2025)
• "FontGuard: A Robust Font Watermarking Approach..." (Wong et al., 4 Apr 2025)
• "HeavyWater and SimplexWater: Watermarking Low-Entropy Text Distributions" (Tsur et al., 6 Jun 2025)

---

Text watermarking as a field has rapidly progressed from script-specific, post-hoc, and format-based techniques to deeply integrated, cryptographically and statistically sophisticated schemes designed for the complexities and scale of modern LLM ecosystems. Ongoing research balances detection power, robustness, capacity, and practical deployment constraints, anchored by a foundational understanding of both the theoretical limits and evolving adversarial landscape.