SimKey: A Semantically Aware Key Module for Watermarking Language Models

TL;DR

SimKey introduces a semantic key module that binds watermark seeds to meaning by applying SimHash to semantic embeddings of prior context, producing a robust key that persists under paraphrase and translation. The method is designed to be plug-and-play with state-of-the-art mark modules such as ExpMin, SynthID, and WaterMax, and it includes a detection procedure that re-embeds context to recover candidate keys across multiple hash identities, selecting the best alignment cost and computing a $p$-value for watermark evidence. Empirical results show that SimKey matches standard hashing on unedited text, but offers substantially improved detectability under meaning-preserving edits while maintaining similar perplexity); unrelated edits degrade watermark attribution similarly to traditional approaches. Overall, semantic-aware keying via SimKey provides a practical, extensible direction for robust LLM watermarking with real-world applicability for provenance and safety.

Abstract

The rapid spread of text generated by large language models (LLMs) makes it increasingly difficult to distinguish authentic human writing from machine output. Watermarking offers a promising solution: model owners can embed an imperceptible signal into generated text, marking its origin. Most leading approaches seed an LLM's next-token sampling with a pseudo-random key that can later be recovered to identify the text as machine-generated, while only minimally altering the model's output distribution. However, these methods suffer from two related issues: (i) watermarks are brittle to simple surface-level edits such as paraphrasing or reordering; and (ii) adversaries can append unrelated, potentially harmful text that inherits the watermark, risking reputational damage to model owners. To address these issues, we introduce SimKey, a semantic key module that strengthens watermark robustness by tying key generation to the meaning of prior context. SimKey uses locality-sensitive hashing over semantic embeddings to ensure that paraphrased text yields the same watermark key, while unrelated or semantically shifted text produces a different one. Integrated with state-of-the-art watermarking schemes, SimKey improves watermark robustness to paraphrasing and translation while preventing harmful content from false attribution, establishing semantic-aware keying as a practical and extensible watermarking direction.

Figures (6)

• Figure 1: Common components in watermarking. The key module (left) generates a seed that guides watermarking, using options such as a fixed key (or a fixed set of keys), a hash of prior tokens, or a semantic SimHash of the context (ours). The mark module (right) modifies token sampling given the key. E.g., via tournament sampling (SynthID), exponential-min sampling (ExpMin), or selecting generations that maximize a hidden variable (WaterMax).
• Figure 2: Overview of our semantic watermarking method, SimKey.Generation (top): we embed the preceding context into a semantic vector $v$, project onto random directions, and take signs (SimHash), then hash the resulting bits to seed keys that modulate the LLM sampling (e.g., Gumbel/ExpMin sampling). Detection (bottom): we re-embed the context before each token, recompute SimKey, and use the mark module’s alignment cost to select the best-matching key per position.
• Figure 3: Per-token watermark detectability with SimKey and standard hashing. The $p$-value distributions by mark module (columns) and key module (rows). Shown from $10^0$ to $10^{-15}$, values below this are truncated. SimKey gives similar detectability to standard hashing on the original text. However, after watermarked text is translated to a second language and back, SimKey is more robust, since the key depends on the meaning of the text rather than a set of precise tokens.
• Figure 4: SimKey substantially improves detectability under translated token replacements. At a fixed false positive rate of 1%, SimKey substantially improves the true positive rate for ExpMin and WaterMax. At first glance, it may appear that SimKey is less effective for SynthID; however, SimKey actually reduces the median $p$-value of SynthID by several orders of magnitude.
• Figure 5: SimKey preserves detectability for unmodified text, and the distribution of watermarked text. (a) Detectability increases with sentence length for all mark modules, with SimKey and standard hashing performing similarly. (b) Perplexity depends on mark module: ExpMin is nearly indistinguishable from unwatermarked text, SynthID has higher perplexity, and WaterMax has the highest; with SimKey and standard hashing performing basically the same.

Theorems & Definitions (3)

• Lemma 2.1: SimHash Guarantee charikar2002similarity
• Lemma A.1: Exponential Minimum Sampling
• proof