ML Security PapersWatermarking Diffusion Language Models
Thibaud Gloaguen , Robin Staab , Nikola Jovanović , Martin Vechev
Published on arXiv
2509.24368
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
Achieves >99% true positive rate with minimal text quality impact and robustness comparable to existing autoregressive LM watermarks.
We introduce the first watermark tailored for diffusion language models (DLMs), an emergent LLM paradigm able to generate tokens in arbitrary order, in contrast to standard autoregressive language models (ARLMs) which generate tokens sequentially. While there has been much work in ARLM watermarking, a key challenge when attempting to apply these schemes directly to the DLM setting is that they rely on previously generated tokens, which are not always available with DLM generation. In this work we address this challenge by: (i) applying the watermark in expectation over the context even when some context tokens are yet to be determined, and (ii) promoting tokens which increase the watermark strength when used as context for other tokens. This is accomplished while keeping the watermark detector unchanged. Our experimental evaluation demonstrates that the DLM watermark leads to a >99% true positive rate with minimal quality impact and achieves similar robustness to existing ARLM watermarks, enabling for the first time reliable DLM watermarking.
Key Contributions
- First watermarking scheme designed for diffusion language models (DLMs), which generate tokens in arbitrary order rather than sequentially
- Applies watermark signal in expectation over context even when some context tokens are undetermined at generation time
- Promotes tokens that strengthen the watermark signal when used as context for other tokens, without modifying the watermark detector
🛡️ Threat Analysis
Embeds detectable watermarks in diffusion language model TEXT OUTPUTS (not model weights) to trace AI-generated content provenance — canonical ML09 content watermarking for LLM outputs.