WeaveMark: Robust and Scalable Multi-bit LLM Watermarking via Coded Payload Spreading
Gang-Hyun Park, Ju-Hyeong Lee, Hee-Youl Kwak, Dae-Young Yun
cs.CR · cs.LG
Quick verdict
Claims multi-bit LLM watermark gains via payload spreading, soft ECC, zero-bit layers; large reported wins over BiMark, but sample sizes and error bars absent.
Summary
WeaveMark is a multi-bit watermarking scheme for LLMs that embeds user-identifying payloads (up to 32 bits evaluated) into generated text. Building on BiMark's unbiased multilayer reweighting, it adds three components: (1) coded payload spreading, embedding κ bits per token (κ=10) with pseudorandom layer shuffling so token-level votes and layer reliability distribute evenly across ECC codeword bits; (2) soft-decision ECC decoding that feeds vote margins into maximum-likelihood correlation decoding instead of hard majority voting; and (3) dedicated zero-bit layers (ℓz=2 of ℓ=10) that make watermark-presence detection message-independent, avoiding the max-over-partitions threshold inflation of prior multi-bit schemes. Experiments on LLaMA-3-8B with C4 RealNewsLike report 89.8% exact-match rate for 32-bit messages at 200 tokens versus 20.8% for BiMark, and 86.0% versus 30.7% under 10% synonym substitution on 16-bit messages, with text quality near unwatermarked levels. Zero-bit TPR at FPR=1% exceeds KGW and SynthID in the pure setting. Limitations: no sample sizes, confidence intervals, or significance tests are reported; the robustness comparison is confounded by differing context window sizes (h=2 vs 1), acknowledged but not controlled; robustness is tested only against non-adaptive editing and DIPPER paraphrasing; text quality is slightly below unwatermarked on all six metrics; and evaluation covers only ~7–9B open models on English data.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Multi-bit-per-token payload spreading (κ=10) plus layer shuffling balances token-level votes and layer reliability, lifting 32-bit/200-token match rate from 20.78% (BiMark) to 89.84% under unbiased reweighting.
- Soft-decision ECC decoding on vote margins substantially raises exact recovery over hard majority voting (80.07% vs 18.94% for 32-bit at 200 tokens in the one-bit-per-token ablation on OpenGen).
- Dedicated zero-bit layers make presence detection message-independent, holding the FPR=1% z-threshold near 2.3 regardless of payload length where BiMark's threshold grows to 5.55 at 32 bits.
- Text quality stays close to unwatermarked levels (BERTScore 30.48 vs 30.54; BLEU 23.15 vs 25.24), unlike biased-reweighting baselines MPAC/Qu at δ=3.0 (26.53/27.45 BERTScore).
Strengths
Clean component ablation isolates each contribution
Table 2 (32-bit, 200 tokens) walks BiMark 20.78% → 24.00% (+multi-bit embedding) → 55.88% (+layer shuffling) → 89.84% (+soft ECC) on identical settings, and honestly reports that soft ECC lowers bit accuracy (96.67% → 90.51%) while raising match rate.
Soft-decision decoding is well-motivated and properly ablated
Vote-margin ML correlation decoding (Eq. 3) exploits per-bit reliability that hard majority discards; Appendix C compares hard/soft/LLR voting quantitatively (32-bit, 100 tokens: soft 61.80% vs hard 37.06%) and justifies the choice.
Zero-bit layers solve a real detection problem with strong evidence
Honest negative results and disclosure
Quality gap to biased baselines is large and consistent
Weaknesses
No statistical reporting at all
Acknowledged but uncontrolled confound in robustness comparison
Quality 'preserved' claim glosses a consistent small deficit
Narrow adversary and threat model for a security venue
Capacity and scalability claims are imprecise
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
WeaveMark — Preliminary Review
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is WeaveMark and how does it differ from BiMark?
WeaveMark is a multi-bit watermarking method for LLMs that embeds up to 32-bit user identifiers into generated text. Like BiMark it uses unbiased multilayer reweighting (the text distribution is preserved in expectation), but it adds multi-bit-per-token payload spreading with layer shuffling, soft-decision error-correcting decoding over vote margins, and dedicated zero-bit layers for presence detection. The paper reports 89.8% exact message recovery for 32-bit payloads at 200 tokens versus 20.8% for BiMark, at similar text quality.
Does WeaveMark watermarking degrade text quality?
According to the paper's Table 3, quality stays close to unwatermarked text (BERTScore 30.48 vs 30.54 on summarization; BLEU 23.15 vs 25.24 on translation) and is clearly better than biased baselines like MPAC and Qu et al. at their strong setting (BERTScore 26.53 and 27.45). There is a small consistent cost versus no watermarking on all six reported metrics, and the paper does not test whether these small drops are statistically significant.
Can WeaveMark detect whether a text is watermarked at all, not just decode a message?
Yes. It reserves 2 of its 10 layers as message-independent zero-bit layers, so presence detection uses a standard z-test with a stable threshold (about 2.3 at FPR=1%) instead of the inflated max-over-partitions statistic prior multi-bit schemes need (BiMark's threshold grows to 5.55 at 32 bits). In the pure zero-bit setting it reports higher true-positive rates than KGW and SynthID at all tested lengths (99.12% vs 98.71% and 98.0% at 200 tokens, FPR=1%).
Is code available for WeaveMark?
The paper states code is available at github.com/qkrrkd90-source/WeaveMark. All models (LLaMA-3-8B, Gemma-2-9B, Mistral-7B) and datasets (C4 RealNewsLike, CNN/DailyMail, WMT16 en→ro) are public, and full hyperparameters plus embedding/extraction algorithms are given in Appendix A. One practical gap: the paper never states how many evaluation samples underlie each reported number.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures appear in the extraction only as captions with partial axis-label text; per-point curve values cannot be independently verified, though the headline numbers are quoted in the prose and tables.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.