WaterSearch: A Quality-Aware Search-based Watermarking Framework for Large Language Models

TL;DR

WaterSearch addresses the tension between watermark detectability and text quality in LLM outputs by introducing a sentence-level, seed-pool driven framework that enables parallel generation and joint optimization of distribution fidelity and watermark strength. It links token-level watermarking objectives to a tractable sentence-level objective and introduces a robust chi-square-based detection with Fisher's method for aggregate significance. Across three LLMs and ten tasks, WaterSearch yields substantial improvements over baselines, with strong resilience to insertion, synonym substitution, and paraphrase attacks, and favorable scaling with parallel search. The approach offers practical benefits for secure attribution and content integrity in real-world AI generation pipelines.

Abstract

Watermarking acts as a critical safeguard in text generated by Large Language Models (LLMs). By embedding identifiable signals into model outputs, watermarking enables reliable attribution and enhances the security of machine-generated content. Existing approaches typically embed signals by manipulating token generation probabilities. Despite their effectiveness, these methods inherently face a trade-off between detectability and text quality: the signal strength and randomness required for robust watermarking tend to degrade the performance of downstream tasks. In this paper, we design a novel embedding scheme that controls seed pools to facilitate diverse parallel generation of watermarked text. Based on that scheme, we propose WaterSearch, a sentence-level, search-based watermarking framework adaptable to a wide range of existing methods. WaterSearch enhances text quality by jointly optimizing two key aspects: 1) distribution fidelity and 2) watermark signal characteristics. Furthermore, WaterSearch is complemented by a sentence-level detection method with strong attack robustness. We evaluate our method on three popular LLMs across ten diverse tasks. Extensive experiments demonstrate that our method achieves an average performance improvement of 51.01\% over state-of-the-art baselines at a watermark detectability strength of 95\%. In challenging scenarios such as short text generation and low-entropy output generation, our method yields performance gains of 47.78\% and 36.47\%, respectively. Moreover, under different attack senarios including insertion, synonym substitution and paraphrase attasks, WaterSearch maintains high detectability, further validating its robust anti-attack capabilities. Our code is available at \href{https://github.com/Yukang-Lin/WaterSearch}{https://github.com/Yukang-Lin/WaterSearch}.

Figures (9)

• Figure 1: The mechanism and advantage of WaterSearch. Though the baseline successfully injects a watermark, it compromises text truthfulness (Top Left). In contrast, WaterSearch first choose three seeds and then generate one standard and three watermarked predictions. After that, the best response is selected by a weighted selection metric to balance generation quality and statistical detectability (Bottom Left). For detection, seeds are recover to compute the watermark probability (Right).
• Figure 2: Frequency of token number in green list varying in different seeds under WaterSearch settings. Text without watermark shares a similar distribution with watermarked text in wrong seeds. While under correct seed shows a totally different distribution.
• Figure 3: Detection success rate under different types of watermark attacks: Insertion attack (left), Synonym substitution attack (middle) and Paraphrase attack (right). WaterSearch exhibits robustness to its counterpart among all the attacks.
• Figure 4: Scaling effect of parallel number $K$ of WaterSearch in Generation and Detection.
• Figure 5: Throughput and Peak Memory Usage in WaterSearch

Theorems & Definitions (1)

• Theorem 1