SAMark: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustness
2026-05-25 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceComputation and Language
AI summaryⓘ
The authors address the challenge of hiding watermarks in text that stays detectable even when paragraphs are heavily reworded or rearranged. They propose a new method called SAMark that doesn't rely on sentence order and uses special scoring to better spot the watermark signals while ignoring noise. Their approach also filters out repetitive or redundant information more effectively than before. Tests show SAMark is much better at detecting watermarks in tricky paraphrased texts without making the text quality worse than unmarked content.
Semantic-level watermarkingParagraph-level paraphrasingWatermark robustnessSemantic spaceHyperbolic scoringDiversity-aware filteringText generation qualityFalse positive rateN-gram repetition filteringSemantic redundancy
Authors
Jiahao Huo, Wenjie Qu, Yibo Yan, Kening Zheng, Jiaheng Zhang, Xuming Hu, Philip S. Yu, Mingxun Zhou
Abstract
Semantic-level watermarking (SWM) improves robustness against text modifications by treating sentences as the basic unit. However, robustness to paragraph-level paraphrasing remains difficult because such attacks globally disrupt watermark signals by changing sentence order. In this work, we propose SAMark, a self-anchored watermarking framework that removes the dependency on sentence order by establishing a step-independent green region in semantic space. To improve detectability, we introduce a multi-channel hyperbolic scoring mechanism that amplifies watermark signals while suppressing noise from weakly aligned candidates. We further propose a diversity-aware filtering strategy that combines hard filtering with soft regularization, extending beyond simple n-gram repetition filters to address semantic redundancy. Experimental results show that SAMark achieves up to 90.2% TP@FP1% under typical paragraph-level paraphrasing attacks, outperforming the strongest prior baseline by more than 30% on average, while maintaining generation quality competitive with unwatermarked text and breaking the robustness-quality trade-off that limits prior methods.