How Good is Post-Hoc Watermarking With Language Model Rephrasing?

Pierre Fernandez, Tom Sander, Hady Elsahar, Hongyan Chang, Tomáš Souček, Valeriu Lacatusu, Tuan A. Tran, Sylvestre-Alvise Rebuffi, Alexandre Mourachko
Proceedings of the 43rd International Conference on Machine Learning, PMLR 306:30799-30824, 2026.

Abstract

Generation-time text watermarking embeds statistical signals into text for traceability of AI-generated content. We explore post-hoc watermarking where an LLM rewrites existing text while applying generation-time watermarking, to protect copyrighted documents, or detect their use in training or RAG via watermark radioactivity. Unlike generation-time approaches which are constrained by how LLMs are served, this setting offers additional degrees of freedom for both generation and detection. We thus investigate how allocating compute (through larger rephrasing models, beam search, multi-candidate generation, or entropy filtering at detection) affects the quality-detectability trade-off. Among our findings, the simple Gumbel-max scheme surprisingly outperforms more recent alternatives under nucleus sampling, and achieves strong detectability and semantic fidelity on open-ended text such as books. Moreover, most methods benefit significantly from beam search, and we counterintuitively find that smaller models outperform larger ones. However, our solutions struggles when watermarking verifiable text such as code. This study reveals both the potential and limitations of post-hoc watermarking, laying groundwork for practical applications and future research.

Cite this Paper

BibTeX
@InProceedings{pmlr-v306-fernandez26b, title = {How Good is Post-Hoc Watermarking With Language Model Rephrasing?}, author = {Fernandez, Pierre and Sander, Tom and Elsahar, Hady and Chang, Hongyan and Sou\v{c}ek, Tom\'{a}\v{s} and Lacatusu, Valeriu and Tran, Tuan A. and Rebuffi, Sylvestre-Alvise and Mourachko, Alexandre}, booktitle = {Proceedings of the 43rd International Conference on Machine Learning}, pages = {30799--30824}, year = {2026}, editor = {Zhang, Tong and Dudik, Miroslav and Jaggi, Martin and Agarwal, Alekh and Li, Sharon and Schuurmans, Dale and Zhu, Jerry and Berkenkamp, Felix and Dong, Hanze and Bietti, Alberto}, volume = {306}, series = {Proceedings of Machine Learning Research}, month = {06--11 Jul}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v306/main/assets/fernandez26b/fernandez26b.pdf}, url = {https://proceedings.mlr.press/v306/fernandez26b.html}, abstract = {Generation-time text watermarking embeds statistical signals into text for traceability of AI-generated content. We explore post-hoc watermarking where an LLM rewrites existing text while applying generation-time watermarking, to protect copyrighted documents, or detect their use in training or RAG via watermark radioactivity. Unlike generation-time approaches which are constrained by how LLMs are served, this setting offers additional degrees of freedom for both generation and detection. We thus investigate how allocating compute (through larger rephrasing models, beam search, multi-candidate generation, or entropy filtering at detection) affects the quality-detectability trade-off. Among our findings, the simple Gumbel-max scheme surprisingly outperforms more recent alternatives under nucleus sampling, and achieves strong detectability and semantic fidelity on open-ended text such as books. Moreover, most methods benefit significantly from beam search, and we counterintuitively find that smaller models outperform larger ones. However, our solutions struggles when watermarking verifiable text such as code. This study reveals both the potential and limitations of post-hoc watermarking, laying groundwork for practical applications and future research.} }
Endnote
%0 Conference Paper %T How Good is Post-Hoc Watermarking With Language Model Rephrasing? %A Pierre Fernandez %A Tom Sander %A Hady Elsahar %A Hongyan Chang %A Tomáš Souček %A Valeriu Lacatusu %A Tuan A. Tran %A Sylvestre-Alvise Rebuffi %A Alexandre Mourachko %B Proceedings of the 43rd International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2026 %E Tong Zhang %E Miroslav Dudik %E Martin Jaggi %E Alekh Agarwal %E Sharon Li %E Dale Schuurmans %E Jerry Zhu %E Felix Berkenkamp %E Hanze Dong %E Alberto Bietti %F pmlr-v306-fernandez26b %I PMLR %P 30799--30824 %U https://proceedings.mlr.press/v306/fernandez26b.html %V 306 %X Generation-time text watermarking embeds statistical signals into text for traceability of AI-generated content. We explore post-hoc watermarking where an LLM rewrites existing text while applying generation-time watermarking, to protect copyrighted documents, or detect their use in training or RAG via watermark radioactivity. Unlike generation-time approaches which are constrained by how LLMs are served, this setting offers additional degrees of freedom for both generation and detection. We thus investigate how allocating compute (through larger rephrasing models, beam search, multi-candidate generation, or entropy filtering at detection) affects the quality-detectability trade-off. Among our findings, the simple Gumbel-max scheme surprisingly outperforms more recent alternatives under nucleus sampling, and achieves strong detectability and semantic fidelity on open-ended text such as books. Moreover, most methods benefit significantly from beam search, and we counterintuitively find that smaller models outperform larger ones. However, our solutions struggles when watermarking verifiable text such as code. This study reveals both the potential and limitations of post-hoc watermarking, laying groundwork for practical applications and future research.
APA
Fernandez, P., Sander, T., Elsahar, H., Chang, H., Souček, T., Lacatusu, V., Tran, T.A., Rebuffi, S. & Mourachko, A.. (2026). How Good is Post-Hoc Watermarking With Language Model Rephrasing?. Proceedings of the 43rd International Conference on Machine Learning, in Proceedings of Machine Learning Research 306:30799-30824 Available from https://proceedings.mlr.press/v306/fernandez26b.html.

Related Material