PURA: Provably Unbiased and Robust Multi-Bit Watermarking for AI-Generated Text Attribution

• URL: http://arxiv.org/abs/2608.22218v2
• Date: Tue, 25 Aug 2026 03:57:46 GMT
• Title: PURA: Provably Unbiased and Robust Multi-Bit Watermarking for AI-Generated Text Attribution
• Abstract summary: We present PURA, a provably unbiased and robust multi-bit watermarking method for text attribution.<n>Instead of perturbing token probabilities directly, PURA embeds payloads in the latent sampling space via keyed inverse transform sampling.<n>We show that PURA substantially outperforms existing unbiased baselines in the high-payload regime.
• Score: 83.66032773976904
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Fine-grained attribution of AI-generated text is becoming increasingly important for accountability and auditing, yet existing multi-bit watermarking methods still struggle to simultaneously preserve the base generation distribution, support high-capacity payloads, and remain recoverable after editing. We present PURA, a provably unbiased and robust multi-bit watermarking method for text attribution. Instead of perturbing token probabilities directly, PURA embeds payloads in the latent sampling space via keyed inverse transform sampling, and recovers them by treating observed tokens as soft interval evidence and aggregating such evidence across the sequence. This design preserves the base generation distribution exactly while substantially improving recovery stability under post-editing and channel perturbations. Building on this recovery paradigm, we further develop a unified robustness analysis and show that, under bounded attack strength, the per-bit error probability decays exponentially with sequence length. Extensive experiments show that PURA substantially outperforms existing unbiased baselines in the high-payload regime. For example, when embedding 36 bits in 200 tokens, PURA achieves a 91.7\% message match rate, more than three times that of the strongest unbiased baseline, while preserving text quality and remaining statistically close to unwatermarked text, and incurring only millisecond-level verification overhead. Our code is available at

Related papers

• A Locally Tokenized Generative Model for Robust Time-Series Watermarking [12.477366787279747]
  We show that existing detectors, which rely on globally coupled re-encoding, suffer from bidirectional drift of the null distribution under post-editing attacks.<n>We propose L-VQVAE, a generative model in which each discrete token is produced from a short contiguous window, and LVQMark, a watermarking method over this token space.
  arXiv  Detail & Related papers  (2026-08-20T07:25:41Z)
• Efficient Online LLM Watermark Detection via Rao-Blackwellized E-Processes [3.2639022787260266]
  We develop an efficient online watermark detection framework with anytime-valid inference based on Rao-Blackwellized e-processes.<n> Simulations and experiments on real-generated text demonstrate efficient online detection with rigorous anytime-valid guarantees.
  arXiv  Detail & Related papers  (2026-07-24T04:10:36Z)
• Block-wise Codeword Embedding for Reliable Multi-bit Text Watermarking [1.534847923698733]
  We present textbfBREW (Block-wise Reliable Embedding for Watermarking), a framework shifting the paradigm to emphdesignated verification.<n>Our framework is model-agnostic and theoretically grounded, providing a scalable solution for reliable forensic deployment.
  arXiv  Detail & Related papers  (2026-05-01T02:14:38Z)
• Alignment Imprint: Zero-Shot AI-Generated Text Detection via Provable Preference Discrepancy [51.887915969023965]
  We show that modern Large Language Models (LLMs) undergo alignment, leaving a measurable distributional imprint.<n>To mitigate the instability in high-entropy regions, we introduce Log-likelihood Alignment Preference Discrepancy (LAPD)<n>LAPD is a standardized information-weighted statistic based on alignment imprint.
  arXiv  Detail & Related papers  (2026-04-18T09:12:24Z)
• CORE: Context-Robust Remasking for Diffusion Language Models [51.59514489363897]
  We propose Context-Robust Remasking (CORE), a training-free framework for inference-time revision.<n>Rather than trusting static token probabilities, CORE identifies context-brittle tokens by probing their sensitivity to targeted masked-context perturbations.<n>On LLaDA-8B-Base, CORE delivers consistent improvements across reasoning and code benchmarks, outperforming compute-matched baselines and improving MBPP by up to 9.2 percentage points.
  arXiv  Detail & Related papers  (2026-02-04T00:12:30Z)
• Analyzing and Evaluating Unbiased Language Model Watermark [62.982950935139534]
  We introduce UWbench, the first open-source benchmark dedicated to the principled evaluation of unbiased watermarking methods.<n>Our framework combines theoretical and empirical contributions.<n>We establish a three-axis evaluation protocol: unbiasedness, detectability, and robustness, and show that token modification attacks provide more stable robustness assessments than paraphrasing-based methods.
  arXiv  Detail & Related papers  (2025-09-28T19:46:01Z)
• An Ensemble Framework for Unbiased Language Model Watermarking [60.99969104552168]
  We propose ENS, a novel ensemble framework that enhances the detectability and robustness of unbiased watermarks.<n>ENS sequentially composes multiple independent watermark instances, each governed by a distinct key, to amplify the watermark signal.<n> Empirical evaluations show that ENS substantially reduces the number of tokens needed for reliable detection and increases resistance to smoothing and paraphrasing attacks.
  arXiv  Detail & Related papers  (2025-09-28T19:37:44Z)
• PMark: Towards Robust and Distortion-free Semantic-level Watermarking with Channel Constraints [49.2373408329323]
  We introduce a new theoretical framework on watermark-leveling (SWM) for large language models (LLMs)<n>We propose PMark, a simple yet powerful SWM method that estimates the median next sentence dynamically through sampling channels.<n> Experimental results show that PMark consistently outperforms existing SWM baselines in both text quality and paraphrasing.
  arXiv  Detail & Related papers  (2025-09-25T12:08:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.