ML Security PapersQuantileMark: A Message-Symmetric Multi-bit Watermark for LLMs
Junlin Zhu , Baizhou Huang , Xiaojun Wan
Published on arXiv
2604.13786
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
Achieves improved multi-bit message recovery and detection robustness over vocabulary-partition baselines while maintaining message-symmetric quality across all embedded user IDs
QuantileMark
Novel technique introduced
As large language models become standard backends for content generation, practical provenance increasingly requires multi-bit watermarking. In provider-internal deployments, a key requirement is message symmetry: the message itself should not systematically affect either text quality or verification outcomes. Vocabulary-partition watermarks can break message symmetry in low-entropy decoding: some messages are assigned most of the probability mass, while others are forced to use tail tokens. This makes embedding quality and message decoding accuracy message-dependent. We propose QuantileMark, a white-box multi-bit watermark that embeds messages within the continuous cumulative probability interval $[0, 1)$. At each step, QuantileMark partitions this interval into $M$ equal-mass bins and samples strictly from the bin assigned to the target symbol, ensuring a fixed $1/M$ probability budget regardless of context entropy. For detection, the verifier reconstructs the same partition under teacher forcing, computes posteriors over latent bins, and aggregates evidence for verification. We prove message-unbiasedness, a property ensuring that the base distribution is recovered when averaging over messages. This provides a theoretical foundation for generation-side symmetry, while the equal-mass design additionally promotes uniform evidence strength across messages on the detection side. Empirical results on C4 continuation and LFQA show improved multi-bit recovery and detection robustness over strong baselines, with negligible impact on generation quality. Our code is available at GitHub (https://github.com/zzzjunlin/QuantileMark).
Key Contributions
- QuantileMark: a message-symmetric multi-bit watermark using equal-mass quantile bins in cumulative probability space
- Proof of message-unbiasedness ensuring base distribution recovery when averaging over messages
- Improved multi-bit recovery and detection robustness compared to vocabulary-partition baselines with negligible quality impact
🛡️ Threat Analysis
Embeds watermarks in LLM text outputs to verify content provenance and detect AI-generated text — this is output integrity and content authentication, not model IP protection.