Tokenization-Invariant watermarking secures text with byte-level scoring
Tokenization-Invariant Watermarking: A Byte-Local Method for LLM Text
Cryptography and SecurityComputation and Language
Summary
Detecting if a text was created by a language model is tricky because different ways of splitting words can change the hidden signals. The authors present a way to hide a secret mark in text by looking directly at the underlying bytes of characters instead of word tokens. This approach makes the mark harder to remove or alter, even if some changes are made to the text. However, it does not guarantee perfect detection or full protection against all attacks.
What this means in practice
- •For content moderation teams: Verify if generated text retains hidden identification marks despite common text edits.
- •For digital rights managers: Embed detection signals into AI-generated text that survive typical text transformations for tracking content origin.
Authors
Tung-Ling Li
Abstract
We introduce Tokenization-Invariant Watermarking (TI-WM), a method that embeds a watermark during token generation but keys and scores it on canonicalized UTF-8 bytes. The detector does not invoke the tokenizer. Canonicalizer-preserving edits leave its score unchanged; other localized canonical-byte edits affect a bounded number of scoring windows. Across three fixed keys and 128 prompts per key and model, a deterministic white-box attack at a 5% word-edit budget leaves mean attacked-AUC 0.530 on Qwen3-8B and 0.664 on Gemma 4 E4B, compared with 0.410 and 0.489 for Unigram with detection-side deletion. These operating points are not jointly matched on quality and clean detectability. Bias sweeps show model-dependent distortion costs, and shared-rule controls support a locality interpretation without establishing a unique advantage of bytes. Visible insertion outside the canonicalizer's deletion set defeats the default design. Alphabetic filtering closes that channel but does not resolve source shift or calibrated detection power. TI-WM thus provides a concrete construction with local scoring guarantees and measured attack-ranking gains, not a general robustness or low-false-positive-rate deployment guarantee.