WaterSeeker: Pioneering Efficient Detection of Watermarked Segments in Large Documents

TL;DR

WaterSeeker tackles the challenge of detecting watermarked segments embedded in long documents by introducing a coarse-to-fine, two-stage pipeline that first localizes suspicious regions and then performs targeted full-text watermark verification. The method is grounded in a theoretical Gold Index framework showing that maximizing the z-score occurs when the window size matches the ground-truth segment length, guiding a low-complexity localization step followed by precise local detection. Empirical results show WaterSeeker significantly outperforms full-text detectors and operates with far lower runtime than WinMax, while achieving comparable localization accuracy and robustness to text edits. The work contributes a practical detector for segment-level watermarking with localization, enabling more interpretable AI detection in real-world document workloads and laying groundwork for scalable, transparent detection systems.

Abstract

Watermarking algorithms for large language models (LLMs) have attained high accuracy in detecting LLM-generated text. However, existing methods primarily focus on distinguishing fully watermarked text from non-watermarked text, overlooking real-world scenarios where LLMs generate only small sections within large documents. In this scenario, balancing time complexity and detection performance poses significant challenges. This paper presents WaterSeeker, a novel approach to efficiently detect and locate watermarked segments amid extensive natural text. It first applies an efficient anomaly extraction method to preliminarily locate suspicious watermarked regions. Following this, it conducts a local traversal and performs full-text detection for more precise verification. Theoretical analysis and experimental results demonstrate that WaterSeeker achieves a superior balance between detection accuracy and computational efficiency. Moreover, its localization capability lays the foundation for building interpretable AI detection systems. Our code is available at https://github.com/THU-BPM/WaterSeeker.

Figures (6)

• Figure 1: While full-text detection methods effectively differentiate between fully watermarked and non-watermarked texts, they often struggle with watermarked segment detection due to the dilution effect. To address this, WaterSeeker employs a "first locate, then detect" strategy, which narrows the detection range before conducting local traversal for further verification.
• Figure 2: Expected z-score and the corresponding threshold $z^*$ across various $W$, $\alpha=10^{-6}, \gamma=0.5, \gamma_1=0.75$.
• Figure 3: A detailed comparison of WinMax and WaterSeeker regarding their detection performance and time cost, as well as their performance across varying text lengths.
• Figure 4: Robustness of WinMax, FLSW, and WaterSeeker against text edit attacks. The detection F1 score is reported for no attack, random word deletion attack (ratio = 0.3), and random word substitution attack (ratio = 0.3), along with the time cost for processing one sample.
• Figure 5: Case study: Impact of varying window sizes on watermark intensity calculation in the KGW algorithm.