Robust semantic watermarking method improves diffusion language model security
DenMark: Robust Semantic Watermarking for Diffusion Language Models
Computation and Language
Summary
Detecting hidden watermarks in sentences that preserve meaning is hard when text can be rewritten in many ways. The authors created DenMark, a new way to add hidden signals inside language models that generate text step-by-step in flexible orders. DenMark guesses what a sentence might become while it’s being formed and picks changes that keep the hidden signal strong. The approach works well on many different models, datasets, and attacks that try to hide these signals.
What this means in practice
- •For content moderation teams: Detect text generated by diffusion language models even after meaning-preserving edits to enforce content policies.
- •For digital forensics analysts: Trace the origin of suspicious synthetic text by detecting robust semantic watermarks that survive paraphrasing.
Authors
Tianhao Ma, Weihao Xuan, Dong-Dong Wu, Farshid Nooshi, Takashi Ishida, Gang Niu, Naoto Yokoya, Masashi Sugiyama
Abstract
Semantic text watermarks encode signals in meaning rather than surface token choices, offering robustness to paraphrasing and other semantic-preserving edits. Existing semantic watermarking methods are primarily designed for autoregressive language models (ARLMs), where completed candidate units can be generated and scored before generation proceeds. This paradigm does not naturally extend to diffusion language models (DLMs), where semantic units remain incomplete during intermediate denoising steps and tokens may be updated in flexible orders. We propose DenMark, a semantic watermarking framework that injects key-dependent signals directly into the DLM denoising process. DenMark partitions the output into fixed token regions and uses temporary rollouts as semantic lookahead: conditional completions estimate the eventual semantics of an incomplete region, enabling DenMark to select local updates with higher estimated semantic watermark scores. Repeating this procedure across denoising steps progressively accumulates watermark evidence in the final output. For detection, DenMark uses calibrated scanning over candidate unit sizes to remain robust to boundary shifts introduced by semantic attacks. Across four DLMs, three datasets, and four semantic attacks, DenMark achieves the best results across all reported detection metrics in all 48 backbone-dataset-attack combinations. These results demonstrate that DenMark provides an effective mechanism for robust semantic watermarking in DLMs.