DenMark: Robust Semantic Watermarking for Diffusion Language Models
Abstract Overview
DenMark is a semantic watermarking framework designed for diffusion language models, where text is generated through iterative denoising rather than left-to-right token emission. The method partitions output into fixed token regions and, for each local update, uses temporary rollouts to estimate the eventual semantics of an incomplete region before choosing the candidate with the highest key-dependent semantic watermark score. For detection, it scans calibrated candidate unit sizes so that watermark evidence can still be recovered when paraphrasing or other semantic edits shift token boundaries. The paper evaluates the approach across four diffusion language models, three datasets, and multiple semantic and token-level attacks, with a focus on watermark detectability after meaning-preserving edits.
Novelty
The paper introduces a semantic watermarking method tailored to the decoding dynamics of diffusion language models, addressing a setting where prior semantic watermarking approaches for autoregressive models do not directly apply. Its distinctive elements are rollout-guided local candidate selection during denoising and boundary-shift-robust detection via calibrated scanning over unit sizes.
Results
Across four diffusion language models, three datasets, and four semantic attacks, DenMark reports the best detection results in all 48 backbone-dataset-attack combinations under the reported metrics. Averaged over these attacked settings, it achieves 63.55%, 71.89%, and 87.45% TPR at 0.5%, 1%, and 5% FPR, respectively, with an AUC of 0.9693, compared with the strongest baseline at 35.16%, 41.90%, 61.80%, and 0.8915 AUC. The paper also reports strong robustness under open-source paraphrasers and token attacks, while noting additional generation overhead from candidate scoring and rollouts.
Key Points
- DenMark injects semantic watermark signals directly into diffusion language model denoising by using rollout-based lookahead to score local candidate updates within fixed token regions.
- Its detector uses calibrated scanning over multiple candidate unit sizes to remain robust when semantic attacks alter token lengths or shift region boundaries.
- Empirically, the method outperforms the evaluated baselines across semantic attack conditions and maintains high detectability under several token-level perturbations, albeit with higher generation cost than clean decoding.