💻 computer science

MirrorMark: A Distortion-Free Multi-Bit Watermark for Large Language Models

MirrorMark is a novel multi-bit watermarking technique for large language models that embeds robust, detectable messages without distorting the token probability distribution, thereby preserving text quality while significantly outperforming existing methods in accuracy and detection rates.

Original authors: Ya Jiang, Massieh Kordi Boroujeny, Surender Suresh Kumar, Kai Zeng

Published 2026-04-28

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ya Jiang, Massieh Kordi Boroujeny, Surender Suresh Kumar, Kai Zeng

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a baker who just invented a new, perfect recipe for bread. You want to make sure that if someone sells your bread under their own name, you can prove it's yours. But here's the catch: you can't just stamp a giant "MINE" on the loaf, because that ruins the look and taste. And you can't just whisper a secret code into the dough, because if someone cuts off a slice or adds a crumb, the whisper gets lost.

This is the problem MirrorMark solves for Large Language Models (LLMs)—the AI systems that write text for us.

Here is how MirrorMark works, broken down into simple concepts:

1. The Problem with Current "Watermarks"

Think of current watermarking methods as two types of flawed stamps:

The "Distorting" Stamp: Some methods try to change the recipe slightly to hide a secret. For example, they might force the AI to pick slightly different words than it normally would. This is like adding a weird spice to the bread to mark it. It works, but the bread tastes different (the text quality goes down).
The "Fragile" Stamp: Other methods try to hide the secret without changing the taste. But they are like a whisper in a crowded room. If someone edits the text (adds a sentence, deletes a word, or rephrases it), the whisper gets lost, and you can't prove the bread is yours anymore.

2. The MirrorMark Solution: "The Perfect Reflection"

MirrorMark is a new way to hide a secret message that is distortion-free (it doesn't change the taste of the bread) and robust (it survives editing).

It uses a clever trick called Mod-1 Mirroring.

The Analogy: Imagine the AI is choosing a word based on a roll of a dice that lands somewhere between 0 and 1.
The Trick: Instead of changing the dice roll, MirrorMark takes that number and "folds" it over a specific line (a mirror) depending on the secret message it wants to send.
The Magic: If you fold a piece of paper perfectly, the shape of the paper doesn't change; it just looks different from the other side. Similarly, MirrorMark rearranges the random numbers the AI uses, but the overall pattern of those numbers stays exactly the same.
The Result: The AI writes text that sounds 100% natural and high-quality, just like it would without a watermark. But hidden inside the specific choices of words is a multi-bit code (like a digital fingerprint) that can be recovered later.

3. The "Context-Anchored Balanced Scheduler" (CABS)

Even with a perfect mirror, there's a risk: What if someone cuts out a chunk of the text? If the secret message was spread out evenly, cutting a chunk might delete the whole message.

MirrorMark introduces a smart manager called CABS (Context-Anchored Balanced Scheduler).

The Analogy: Imagine you are hiding 100 tiny notes in a long book. If you hide them all in the first chapter, and someone rips out that chapter, you lose everything. If you hide them randomly, the notes might clump together, leaving other pages empty.
How CABS Works: CABS acts like a careful librarian. It looks at the text being written and ensures the secret notes are spread out evenly across the whole book.
The Safety Net: It also creates "frames" or chapters. If someone rips out a page, CABS ensures that the damage is contained to just that one frame. The rest of the book remains synchronized, so the hidden message can still be pieced together from the remaining notes. This makes the watermark very hard to destroy with copy-paste or deletion attacks.

4. What the Experiments Showed

The researchers tested MirrorMark against other top methods using AI models like LLaMA-2.

Quality: The text generated by MirrorMark was indistinguishable from normal AI text. It didn't sound robotic or weird.
Detection: It was much easier to detect MirrorMark than other methods. Even with a small amount of text (300 words), it could identify watermarked content with high accuracy.
Robustness: When attackers tried to "break" the watermark by deleting words, adding new ones, or copying and pasting parts of the text, MirrorMark survived much better than the competition.
Capacity: It can hide a lot of information (multi-bit), not just a simple "yes/no" signal. This means it can carry details like "Who made this?" or "When was it made?"

Summary

MirrorMark is like a ghost signature. It doesn't leave a visible mark on the text, it doesn't change the flavor of the words, and it doesn't break if you tear a page out of the book. It uses a mathematical "mirror" to hide a complex code inside the natural randomness of how an AI thinks, ensuring that the AI's output remains high-quality while still being traceable back to its source.

1. Problem Statement

As Large Language Models (LLMs) become ubiquitous in content creation, the need for reliable content attribution (provenance) has grown critical to combat misinformation and protect intellectual property. Existing watermarking techniques face a fundamental trade-off:

Distortion-Based Methods: Modify the token probability distribution (e.g., via logit biasing) to embed signals. While robust, these methods degrade text quality (increasing perplexity) and often only support binary (zero-bit) detection.
Distortion-Free Methods: Preserve the original token distribution to maintain text quality. However, existing distortion-free approaches often suffer from weak detectability, poor robustness against editing attacks (insertions/deletions), or lack the ability to embed rich metadata (multi-bit payloads).
The Gap: There is a lack of a method that simultaneously offers multi-bit embedding (for metadata like model ID or timestamp), distortion-free generation (preserving text quality), and high robustness against editing attacks.

2. Methodology: MirrorMark

MirrorMark addresses these challenges through three core components:

A. Mod-1 Mirroring (The Embedding Mechanism)

Instead of biasing token logits, MirrorMark manipulates the sampling randomness in a measure-preserving manner.

Mechanism: It utilizes the Gumbel-max trick (used in AA) or Tournament Sampling (used in SynthID). These methods generate a random value $u \sim \text{Uniform}(0,1)$ to determine the next token.
Transformation: To embed an $m$ -bit message $M$ , the system reflects the random value $u$ around a message-specific pivot $\psi_M = M / 2^{m+1}$ using a mod-1 mirroring operation:
$\Psi(u; \psi_M) = (2\psi_M - u) \mod 1$
Distortion-Free Guarantee: Mathematically, this transformation is a measure-preserving involution. If $u$ is uniformly distributed, the mirrored value $\Psi(u; \psi_M)$ remains uniformly distributed. Consequently, the token selection probability $p(x)$ remains unchanged, ensuring zero distortion to the text quality.
Hypothesis Separation: Unlike cyclic shift methods (e.g., ThreeBricks) which create symmetric hypotheses, mirroring creates complementary distributions. For the correct message, the transformed values are skewed toward 1; for incorrect messages, they are skewed toward 0. This maximizes the statistical separation between the true message and false hypotheses per token.

B. Context-Anchored Balanced Scheduler (CABS)

To handle multi-bit payloads robustly against editing (insertions/deletions), MirrorMark introduces CABS to manage how tokens are assigned to message positions.

Problem with Naive Allocation: Simple pseudorandom assignment can lead to uneven token distribution across message positions (some positions get no tokens) and desynchronization upon editing.
CABS Solution:
- Balanced Allocation: It maps tokens to message positions based on the context window, ensuring each position receives a sufficient number of tokens for reliable decoding.
- Context-Anchored Framing: The sequence is divided into "frames." A new frame starts when a hash of the context window meets a specific condition (e.g., lowest $f$ bits are zero).
- Robustness: If an insertion or deletion occurs, it only affects the current frame and potentially the boundary of the next. It prevents error propagation across the entire sequence, allowing the decoder to recover the watermark even if parts of the text are altered.

C. Decoding and Detection

Decoding: For each message position, the decoder aggregates the mirrored $u$ values from assigned tokens. It uses a score function (LogScore for Gumbel-max, WeightedMeanScore or BayesianScore for Tournament sampling) to determine the most likely symbol $M$ .
Detection: The decoded symbols are used to reconstruct the expected distribution. A global score is computed; if it exceeds a threshold, the text is identified as watermarked.

3. Key Contributions

Distortion-Free Multi-Bit Watermarking: MirrorMark is the first framework to extend distortion-free sampling paradigms (AA, SynthID) to multi-bit payloads without altering the LLM's output distribution.
Mod-1 Mirroring: A novel mathematical transformation that embeds information by reflecting sampling randomness, explicitly maximizing the contrast between correct and incorrect hypotheses while preserving the uniform distribution.
CABS Scheduler: A robust scheduling mechanism that balances token allocation across message positions and localizes the impact of editing attacks, significantly improving resilience to insertions and deletions.
Theoretical Analysis: The authors provide a theoretical characterization of the Equal Error Rate (EER), linking it to sequence entropy and token count, which aligns closely with empirical results.

4. Experimental Results

Experiments were conducted using LLaMA-2-7B and Gemma-7B-it on the C4 and ELI5 datasets.

Text Quality: MirrorMark achieves perplexity and GPT-4o quality scores indistinguishable from non-watermarked text. In contrast, distortion-based baselines (MPAC, RSBH) show significant perplexity degradation (e.g., RSBH perplexity ~32 vs. MirrorMark ~7.2).
Detectability:
- With 54 bits embedded in 300 tokens, MirrorMark improves bit accuracy by 8–12% compared to state-of-the-art methods.
- It correctly identifies up to 11% more watermarked texts at a 1% False Positive Rate (FPR) compared to baselines.
- Gumbel-max-based MirrorMark generally outperforms tournament-based variants in bit accuracy, while both maintain high AUC (~1.0).
Robustness:
- Copy-Paste Attacks: MirrorMark maintains high detection rates (AUC > 0.99) even with 40% of the text replaced by non-watermarked content.
- Paraphrasing: While bit accuracy drops (as expected for token-level dependencies), MirrorMark maintains strong AUC separation, outperforming zero-bit baselines in detection rates.
Comparison: MirrorMark significantly outperforms ThreeBricks (cyclic shift extension) in bit accuracy due to better hypothesis separation. It outperforms RSBH and MPAC in text quality while matching or exceeding their robustness.

5. Significance

MirrorMark represents a significant advancement in AI content provenance. By decoupling detectability from text distortion, it enables the embedding of rich metadata (multi-bit) without compromising the fluency or naturalness of the generated text. This is crucial for real-world deployment where high-quality text generation is paramount. Furthermore, the introduction of CABS addresses the critical vulnerability of existing watermarks to editing attacks, making the technology viable for protecting content in dynamic, user-edited environments. The theoretical grounding of the EER provides a predictable framework for tuning watermark parameters based on sequence entropy and length.