Technical Summary: A Survey on LLM Watermarking: Theory and Deployment

1. Problem Statement

The rapid proliferation of Large Language Models (LLMs) has introduced significant risks regarding content provenance, intellectual property (IP) theft, and the generation of harmful or misleading content. As LLMs increasingly mimic human writing, distinguishing between human-authored and machine-generated text has become difficult. This ambiguity facilitates "service stealing," where adversaries query proprietary APIs to fine-tune local models that mimic the original, and enables the spread of misinformation without clear attribution.

While various strategies exist to mitigate these risks, LLM watermarking—embedding invisible, machine-detectable signatures into model outputs—has emerged as a primary technical layer for attribution and auditing. However, the current literature is fragmented. Existing categorizations often mix orthogonal design choices, making it difficult to compare methods, reason about security guarantees, or translate research into deployable systems. Furthermore, there is a lack of systematic analysis regarding the trade-offs between watermark robustness, model utility, and vulnerability to adversarial attacks (e.g., paraphrasing, translation, and adaptive removal).

2. Methodology and Taxonomy

This survey provides a systematic, deployment-oriented review of LLM watermarking. Rather than a simple chronological list, the authors organize the space around core questions practitioners must answer:

• Embedding Location: Generation-time (in-processing) vs. Training-time; Token-level vs. Representation-level.
• Detection Authority: Public (anyone can verify) vs. Private (requires a secret key).
• Assumptions: Access to logits, sampling control, secret keys, or model ownership.
• Threat Models: Paraphrasing, translation, summarization, style transfer, token manipulation, and adaptive removal.

The paper synthesizes techniques into two primary families:

A. In-Processing Watermarking

These methods embed signals during the text generation process, typically requiring access to the model's internal logits or sampling mechanisms.

• Sampling Biasing: Early methods like KGW (Kirchenbauer et al., 2023) split the vocabulary into "green" and "red" lists using a secret key, biasing the model to prefer green tokens. Variants include Unigram-WM (fixed partitioning) and SIR (semantic space embedding).
• Adaptive and Semantic Approaches: Methods like Adaptive-WM apply bias only at high-entropy positions to preserve text quality. SemStamp and k-SemStamp enforce semantic consistency to survive paraphrasing.
• Distribution-Preserving: Techniques like Unbiased-WM and Undetectable-WM aim to maintain the original token distribution in expectation to avoid statistical detection, while SynthID uses tournament-style sampling for large-scale deployment.
• Self-Watermarking: Approaches like ModelShield embed signals to detect unauthorized model extraction or imitation.

B. Post-Processing Watermarking

These methods modify text after generation, making them suitable for black-box scenarios where model internals are inaccessible.

• Lexical Substitution: Methods replace words with synonyms or alter spellings (e.g., He et al., 2022; POSTMARK) to embed detectable patterns while preserving meaning.
• Context-Aware and Learning-Based: Approaches like DeepTextMark use deep learning to embed watermarks via synonym substitution, while SafeSeal uses context-dependent hashing to bias token selection without retraining.
• Reversible Watermarking: Some methods (e.g., Xiang et al., 2024) focus on identifying and replacing sensitive words, allowing for exact restoration of the original text.

3. Key Contributions

The paper makes five primary contributions to the field:

1. Structured Risk Overview: It provides a systematic overview of LLM risks, spanning technical robustness, IP rights, misinformation, and accountability.
2. Comprehensive Taxonomy: It introduces a detailed classification of watermarking techniques, delineating design principles, operational mechanisms, and effectiveness against specific attacks.
3. Adversarial Analysis: It analyzes adversarial threats, including removal attacks (paraphrasing, back-translation), spoofing (forgery), and adaptive attacks, examining their impact on reliability and downstream tasks.
4. Scenario Suitability: It identifies well-suited application scenarios for different watermark families, outlining limitations and comparing suitability across deployment contexts (e.g., white-box vs. black-box).
5. Trustworthiness Framework: It establishes a framework for evaluating watermarking based on Explainability, Fairness, Robustness, Security, Privacy, Accountability, and Reliability.

4. Key Results and Findings

Through extensive experiments and literature synthesis, the authors highlight three critical findings:

1. IP Protection Efficacy: Watermarks significantly enhance the uniqueness and distinctiveness of LLM outputs, proving effective in strengthening IP protection and reducing unauthorized usage in controlled settings.
2. Utility Trade-offs: The impact of watermarks on model utility (fluency, perplexity, and downstream task performance) ranges from moderate to significant. This impact varies based on the watermark type and LLM architecture, potentially limiting suitability for real-world applications where high-quality output is paramount.
3. Vulnerability to Attacks: Attacks targeting watermarks impose a notable cost on model utility. Simple edits, such as paraphrasing or translation, can drastically reduce detection accuracy (e.g., token-level watermarks dropping below 0.4 True Positive Rate after 40% paraphrasing).

Conclusion on Readiness: The paper concludes that due to unfavorable impacts on model utility and significant vulnerabilities to adaptive removal attacks, LLM watermarks are not yet ready for widespread real-world deployment.

5. Significance and Future Directions

The significance of this work lies in its shift from theoretical proposals to a deployment-oriented perspective. It clarifies that watermarking is a systems trade-off: stronger detectability and robustness typically demand greater control over decoding or training and may introduce distribution shifts, while low-perturbation designs preserve quality but often fail under adversarial conditions.

The paper identifies several open challenges and research directions necessary for reliable, accountable LLM deployment:

• Standardization: The need for standardized benchmarks, particularly regarding calibration and false-positive control.
• Robustness: Developing methods resilient to adaptive removal, cross-model transfer, and multi-stage pipelines.
• Governance: Addressing issues of key management, fairness (avoiding bias against specific languages or dialects), and the ethical implications of attribution.
• Integration: Creating unified frameworks to integrate watermarking into existing monitoring and legal workflows without prohibitive computational overhead.

Ultimately, the survey argues that while invisible signatures are a promising layer for trustworthy AI governance, realizing this potential requires overcoming current limitations in robustness and utility preservation.