SemField: a training-free semantic watermark with an average true positive rate of 88.2% to 90.4% under paraphrase attacks

How to turn sentence semantics into a stable, calibratable document-level watermark signal, so that generated text can still be recognized by the key holder after paraphrase and structural changes, while rarely misclassifying independent text as its own watermark.

• Scenario: The authors state that LLM-generated text is increasing, and providers need to determine whether text was generated by their own model for attribution. The watermark should maintain high true positives and low false positives after local edits or full-document paraphrase, without degrading text quality.
• Existing limitations: The authors state that early token watermarks bias sampling by a secret key, and rewriting can replace tokens while preserving meaning. Semantic watermarks place evidence in sentence representations, adjacent-sentence relations, or structured encodings, but still need to turn sentence meaning into a stable and well-calibrated document-level signal.
• Core idea: The authors explore whether continuous signals in embedding space can be accumulated at the document level. The Gaussian direction is symmetric, so the polarity can be locked by the first sentence, then continuously reinforced along that direction.
• Proposed content: A training-free SemField and its polarity-locked variant SemField-PL. A shared key defines a Gaussian direction, and each sentence selects a candidate that makes the cumulative document aggregate more aligned with that direction; at detection, the normalized aggregate is projected onto the same direction and compared with a standard normal.
• Threat model:
  • Goal: Zero-bit detection, determining whether a document was generated by the watermarking process corresponding to key K, for attribution, rather than recovering a multi-bit message.
  • Knowledge: The detector holds the document and key K. Paraphrase and structure attacks only receive clean watermarked text, without the key or the detector.
  • Capability: At generation time, the provider's language model samples candidate sentences and selects among them. The attacker can rewrite wording, or insert, delete, dilute, or reorder sentences.
  • Target: What is identified is the provider model's generated text. Human text or other generation independent of that key process should be treated under H0.

The paper divides related work into three categories and places itself on training-free continuous semantic fields.

Token watermarks

• KGW (Kirchenbauer et al., 2023): Uses a key to partition the vocabulary so that selected tokens appear more often than in unwatermarked generation.
• EXP and distortion-free sampling: Aaronson (2023) uses keyed pseudorandom values for exponential sampling. Kuditipudi et al. (2024) use inverse transform and exponential minimum sampling for distortion-free watermarks, and use alignment detection to handle token edits.
• SynthID (Dathathri et al., 2024): Uses keyed tournament sampling and aggregates token-level scores at detection.

Semantic watermarks

• SemStamp and k-SemStamp (Hou et al., 2024a;b): Use locality-sensitive hashing and learned semantic clusters, respectively, to select candidates with watermark evidence among semantically related rewrites.
• Relations, constraints, and encoding: SimMark uses relations between adjacent representations; PMark uses context-dependent semantic constraints; AliMark encodes sentence-embedding projections into short binary codes and aggregates them over the document; SAMark constructs self-anchored semantic regions that do not depend on the previous sentence.
• Smaller units and post-hoc modification: SwordStamp and k-SwordStamp (Diaa et al., 2026) switch to smaller semantic units and introduce order-robust aggregation. PostMark (Chang et al., 2024) makes semantically selected word-level modifications on an already generated document without needing model logits.

Learned watermarks

• SIR (Liu et al., 2024): Learns semantic transformations that map similar contexts to similar vocabulary biases.
• Joint training: Xu et al. (2025) jointly train a language model and a detector with reinforcement learning. Zhang et al. (2024) use encoder–decoder embeddings and recover multi-bit messages.
• PRO (Xue et al., 2025): Aimed at open-source models where decoding-time control cannot be assumed after release, jointly optimizes the watermark strategy and the language model, and uses regularization to handle fine-tuning and model merging.

Baselines and data

• Baseline methods: KGW, EXP, SynthID, SIR, SemStamp, k-SemStamp, SimMark, PMark, AliMark, SAMark, SwordStamp, k-SwordStamp. The parameters required by each baseline's original implementation are kept unchanged.
• Benchmark: 500 documents from the C4-RealNewsLike subset; the first sentence serves as the generation prompt, and the rest serve as human continuation references.

The authors position this paper as: using a continuous, linear, training-free keyed field, selecting sentences by the normalized expected document aggregate, and providing exact invariance under permutation of whole sentences, as well as upper bounds on score changes under insertion and deletion.

SemField places a key-dependent continuous linear field on unit sentence embeddings, and during generation greedily selects candidate sentences that maximize the document's aggregate projection; SemField-PL first locks the positive or negative direction of the field, then reinforces along that direction. Neither trains watermark parameters.

Problem setup and keyed field

• Document: A generated document is a sequence of sentences. A pretrained encoder maps each sentence to a vector on the unit sphere. The encoder in the experiments is ALL-MPNET-BASE-V2.
• Testing: The detector receives the document and key K. H0 is that the document is independent of the watermark process keyed by K. When the p-value falls below a threshold chosen according to the target false positive rate, the document is judged to be watermarked.
• Field: The key yields a direction ω_K via a Gaussian pseudorandom generator, which under the ideal model follows a standard multivariate normal. The field value of a unit vector u is f_K(u)=ω_K^⊤u. The authors state that for fixed u this score follows a standard normal; the covariance of the field values of two fixed unit vectors equals their inner product, so nearby representations tend to receive nearby field values. Proposition 1 gives an upper bound on the continuity of field values with respect to embedding changes under a fixed key.

Document-level statistic

• Aggregation: Sentence vectors are summed to obtain A_T. The authors state that linearity makes the sum of sentence-level field values equal to the projection of this aggregate onto ω_K.
• Normalization: Assuming the aggregate is nonzero, the document statistic is Z_K=ω_K^⊤A_T/|A_T|₂. The authors state that dividing by the norm avoids treating repeated or highly correlated sentences as independent evidence; if all sentence embeddings are identical, repetition does not inflate the score.

Generation and polarity locking

• Candidates: After some sentences have been selected, the language model samples Q next sentences conditioned on the current document state. In the main experiments Q=64, temperature 0.7, top-p 0.95, repetition penalty 1.05.
• Selection: Candidate embeddings are added to the current aggregate, scored with the same normalized projection used in detection, and the one with the highest score is chosen. The authors state that this greedy rule increases the score used at detection at every step.
• PL: Plain SemField always moves in the positive direction. PL takes the candidate with the largest absolute score at the first step, and its sign becomes the fixed polarity thereafter; when the score is exactly 0, the positive sign is taken. Subsequent choices maximize the fixed sign times the score. The authors state that fixing the sign avoids cancellation in the final aggregate when sentences switch orientation.

Detection and structural properties

• One-sided detection: Sentence embeddings and the aggregate are recomputed to obtain the observed projection. The authors state that under the ideal key model, if the document is independent of the tested key and the aggregate is nonzero, the conditional distribution is standard normal. The p-value is the upper-tail probability of this score.
• Two-sided detection: The detector does not know which side was chosen during generation, so either a large positive or a large negative projection counts as evidence. The p-value is the sum of the two tail probabilities.
• Structural properties: The authors provide proofs and state that when sentence boundaries and each sentence embedding are unchanged, permutation does not change the aggregate or either score, so both detectors are exactly invariant to permutation of whole sentences. Under insertion or deletion, the score change has an upper bound determined by the perturbation size, the norms of the original and new aggregates, and the norm of the key vector; if the original score exceeds the threshold by more than this bound, the edit cannot flip a positive verdict. The formal statements are in Proposition 2 and Proposition 3. Appendix D gives the generation and detection procedures for both variants.

Appendix B discusses higher-order polynomial fields. The authors state that raising the order simultaneously amplifies the field-value differences of nearby candidates and the embedding shifts caused by rewriting, and increases the computation and storage of explicit features; the experiments in this paper use a linear field.

Experimental Setup

• Models under test: Llama-3.2-1B, Qwen3-1.7B, OPT-1.3B. The three generation and detection runs are independent.
• Data: 500 documents from C4-RealNewsLike. The first sentence is the prompt; the rest are unwatermarked human references.
• Baselines and tools: The 12 baselines are KGW, EXP, SynthID, SIR, SemStamp, k-SemStamp, SimMark, PMark, AliMark, SAMark, SwordStamp, k-SwordStamp, with original implementations and unchanged parameters. The best-of-Q method is used with Q=64. The embedding model for semantic algorithms is ALL-MPNET-BASE-V2.
• Generation: temperature 0.7, top-p 0.95, repetition penalty 1.05. Each method uses its own key. The paper does not report the number of sentences generated per document.
• Attacks: sentence-level paraphrasing with PEGASUS and PARROT; document-level with DIPPER, and LLM-Rewrite using Qwen3.8-27B. Attacks only see clean watermarked text. There are also non-paraphrasing insertion, dilution, deletion, and reordering, with strength as the proportion of modified sentences, plotted up to 80% in Figure 1.
• Metrics: each condition reports AUROC, TPR@1% FPR, and TPR@5% FPR; the three are written in that order in the tables. Thresholds are interpolated from the empirical ROC at the target false positive rate. Average TPR covers clean plus four paraphrases. Quality uses Llama-3.1-8B to compute corpus perplexity and PPLRatio. MAUVE is against matched human continuations, averaged over three clustering seeds. Watermark detection is a normal tail probability, not an LLM judge. Except for MAUVE, the paper does not report the number of repetitions.

Main Results

Average metrics are from Tables 1–3. The strongest baseline is selected by that table's average TPR@1%.

Swipe horizontally to read the table

Model	SemField avg TPR@1%	PL avg TPR@1%	Strongest baseline avg TPR@1%	PL avg TPR@5%
Llama-3.2-1B	88.4%	88.2%	78.0% (k-SwordStamp)	96.6%
Qwen3-1.7B	88.6%	90.4%	78.2% (k-SwordStamp)	96.4%
OPT-1.3B	88.3%	88.2%	81.7% (SAMark)	96.4%

• The authors report that both variants are in the top two for average TPR@1% across the three tables. PL's average TPR@5% is 96.6%, 96.4%, 96.4%. SemField's average TPR@5% is 93.6% on Llama; the authors state it is 0.2 and 0.4 lower than the second-best in the same table on Qwen and OPT.
• LLM-Rewrite TPR@1%: PL is 66.4%, 76.0%, 69.2%; SAMark is 64.6%, 60.2%, 67.2% (middle entry of Tables 1–3). The authors state the gain on Qwen is +15.8. In the same column, SemField is 68.4%, 71.4%, 69.4%, higher than PL on Llama and OPT.
• The authors state that in the six model–attack comparisons for PEGASUS and PARROT, each variant exceeds the strongest baseline in five; PL's margin on PEGASUS is 2.6%–8.6%. The exception is OPT with PARROT: SwordStamp's TPR@1% is 95.0%, PL is 94.6%. Several token baselines are lower on that attack, e.g., KGW is 13.4% and EXP is 5.0% on Llama (Table 1).

Polarity Locking and Text Quality

• Table 5 gives average document scores before and after LLM-Rewrite, written as SemField/PL. Llama: clean 4.475/4.632, after rewrite 3.042/3.221, loss 1.433/1.411. Qwen loss is 1.346 for both. OPT loss is 1.329/1.363. The authors state the score drops are similar for both.
• The authors state that SemField uses only the positive tail to set the 1% threshold, while PL uses two-sided, with empirical thresholds about 2.81–2.83 for the latter and about 2.56 for the former. Thus, on Llama and OPT, PL's LLM-Rewrite TPR@1% is 2.0 and 0.2 percentage points lower, and on Qwen it is 4.6 percentage points higher. At 5%, PL is 8.4, 6.6, and 5.6 percentage points higher. The authors attribute the drop at 1% to the stricter two-sided threshold, not to less stable scores.
• Table 4: the median corpus perplexity of the 12 baselines is Llama 6.75, Qwen 9.00, OPT 6.85; the two variants are 6.8/6.9, 8.6/8.8, 6.3/6.4. Table 6: PL's MAUVE is 0.817, 0.656, 0.743; SemField's is 0.800, 0.584, 0.699; the authors state the strongest baseline per model is 0.472, 0.415, 0.559. PL's perplexity difference relative to the one-sided variant is at most +0.1. Averaged over the five conditions, PL improves TPR@5% by 3.0, 2.8, and 2.6 percentage points and improves TPR@1% in 10 of 15 groups.

Structural Attacks

Figure 1 reports TPR@1% as attack strength goes from 0 to 80%. The text mainly compares against SAMark, SwordStamp, and k-SwordStamp.

• Insertion and deletion: at 80% insertion, PL is 70.4%–75.2%, SemField is 47.8%–62.2%; SwordStamp and k-SwordStamp are 91.5%–98.6% and 90.8%–93.8%, SAMark drops to 0%. At 80% deletion, PL is 79.2%–84.2%, SemField is 71.8%–80.6%; SwordStamp is 14.6%–27.8%, k-SwordStamp is 8.2%–10.8%, SAMark retains 20.6%–22.8%.
• Reordering and dilution: both variants' reordering curves stay at clean detection levels, SemField at 96.8%–98.0% and PL at 99.6%–100.0%. At 80% dilution, SemField is 37.4%–52.8%, PL is 21.4%–28.6%; SwordStamp is 23.6%–28.0%, k-SwordStamp is 10.4%–10.8%, SAMark is 0.2%. The authors state that both variants are fairly stable up to about 40% strength, after which the one-sided variant is higher.
• SimMark: at 80% dilution, TPR@1% rises to 99.8%–100.0%. The average score on 500 zero-watermark documents rises from 0.22 to 12.39. The authors state it detects adjacent sentence pairs, and dilution increases the number of pairs and raises the detection score, even without watermarks.

Fixed Thresholds and Cross-Key

• Tables 8–10 freeze thresholds in advance: on 10,000 C4 zero-watermark documents, the 1% cutoff is placed above the 101st highest score and the 5% above the 501st; then 2,000 held-out zero-watermark documents measure the actual false positive rate. The accompanying tables do not give the value of that actual false positive rate. The same thresholds are then used for all clean and paraphrase conditions. PL's average TPR@1% is 89.3%, 91.2%, 89.5%; SwordStamp is 72.5%, 73.4%, 76.8%; SemField is 87.1%, 87.8%, 87.1%. On LLM-Rewrite, PL is 68.6%, 78.0%, 71.8%; SAMark is 43.6%, 47.0%, 46.6%. PL's average TPR@5% is 96.8%, 96.7%, 96.6%.
• Cross-key uses 100 keys, each generating 500 documents with Llama-3.2-1B, for a total of 5 million document–key evaluations. The generating key is detected at 99.518%, and unrelated keys at 1.065%. Thresholds for each key are calibrated on the same batch of 10,000 zero-watermark documents at a nominal 1% false positive rate.

Other Ablations and Analysis

• Temperature is compared only on Llama-3.2-1B with SemField-PL (Table 7): at 0.7, average TPR@1% is 88.2% and corpus perplexity is 6.90 (PPLRatio 0.715); at 1.0, it is 97.4% and 34.66 (3.591). LLM-Rewrite TPR@1% goes from 66.4% to 91.8%.
• Candidate count is scanned only on 100 documents, Llama-3.2-1B, SemField-PL (Figure 2): average TPR@1% goes from 4.0% at Q=2 to 90.2% at Q=64, then to 95.2% at Q=128. At Q=64, clean is 100%, PEGASUS 94%, PARROT 97%, DIPPER 89%, LLM-Rewrite 71%. PPLRatio ranges from 0.637 to 0.743.
• The authors fit LLM-Rewrite TPR@1% against log2 Q, with slope 13.61 and R^2 of 0.994, and extrapolate that TPR@1% ≥ 90% for Q ≥ 182. This is the authors' fit, not a measured point in the table.
• The authors state that temperature 1.0 trades higher detection for higher perplexity; increasing Q is mainly constrained by computational cost, and PPLRatio does not show the monotonic improvement the authors claim with Q.

Limitations and future directions noted by the authors

• The experiments target ordinary language modeling and base models; the authors say this is to align with the given baselines and their evaluations (Section 7).
• Built and tested only for English, and uses sentence structure; the authors give as an example that languages without clear sentence boundaries, such as Chinese, may not be feasible (Section 7).
• Tested on only three models. The embedding model and dataset remain fixed across all runs; the authors say most baseline implementations report this way, and the experiments have no special dependence on that choice (Section 7).
• 500 documents were chosen due to computational constraints; the authors say that with the attacks added, the evaluation cost is about 4 times that amount (Section 7).
• Future directions include strategies with lower sampling cost, and multidimensional candidate selection that also considers safety, usefulness, correctness, and low-entropy generation, such as math or code, as well as RLVR and thinking models (Section 7).
• The authors say they do not present this work as an overall SOTA across all methods, models, and uses, but as a proof of concept aligned with existing research (Section 7).

Experimental coverage

• Generation models are Llama-3.2-1B, Qwen3-1.7B, and OPT-1.3B; the embedding model is ALL-MPNET-BASE-V2; the main protocol is Q=64, temperature 0.7, top-p 0.95, repetition penalty 1.05 (Section 4).
• The data is 500 documents from C4-RealNewsLike. Paraphrase attacks are PEGASUS, PARROT, DIPPER, and LLM-Rewrite; structural attacks are insertion, dilution, deletion, and reordering, with Figure 1 plotted up to 80% strength (Sections 4–5).
• The comparison is against 12 watermark baselines. Quality metrics are Llama-3.1-8B corpus perplexity, PPLRatio, and MAUVE over three clustering seeds (Tables 1–6).
• The fixed threshold uses 10,000 C4 zero documents for calibration and 2,000 held out. Cross-key is 100 keys times 500 documents, done only on Llama-3.2-1B. Temperature and candidate count ablations are also reported only on that model, with the candidate count curve on 100 documents (Sections 5.3–5.4, Table 7, Figure 2).
• The paper does not report the number of generated sentences per document, does not report repetitions beyond the three MAUVE seeds, and does not report human naturalness scores. Detection uses normal tail probability or zero-document scores, not an LLM judge; the actual false positive rate on the held-out set is measured in the main text, but the accompanying Tables 8–10 do not give that rate.

SemField is a zero-bit semantic watermark that the provider embeds at generation time and the detector checks afterward with the key, used to identify the provider's own model text after paraphrase and sentence-level structural changes.

• Problem: The authors argue that token-level signals can be replaced by rewriting, while semantic watermarks still need a stable, well-calibrated document-level signal while controlling false positives and text quality.
• Method: The key determines a Gaussian direction in embedding space. At each step, the sentence is selected from candidates that maximizes the projection of the normalized document aggregate. SemField only reinforces the positive direction; SemField-PL locks polarity with the first sentence. Detection compares the aggregate projection with a standard normal. The authors state that full sentence reordering does not change the score, and the score changes from insertion and deletion have upper bounds.
• Main results: On 500 documents from C4-RealNewsLike, three 1B-scale models, and 12 baselines, the average TPR@1% for clean plus four paraphrases is 88.2%–90.4%. PL's average TPR@5% is 96.4%–96.6%. On LLM-Rewrite, PL's TPR@1% is 66.4%, 76.0%, 69.2%; SAMark in the same column is 64.6%, 60.2%, 67.2%. On Llama and OPT, the one-sided variant is higher than PL at the 1% operating point for that attack.
• Other results: Across the three models, both variants' MAUVE ranks in the top two among tested methods, with PL at 0.817, 0.656, 0.743; perplexity is near the median of the 12 baselines. At 80% deletion, PL's TPR@1% is 79.2%–84.2%; at 80% insertion, SwordStamp is higher; at 80% dilution, the one-sided variant is higher than PL. Under a fixed threshold, PL's average TPR@1% is 89.3%, 91.2%, 89.5%. Under 100 keys, the generated key is detected at 99.518%, and unrelated keys at 1.065%.
• Authors' conclusion: The authors state that both variants detect strongly under the tested paraphrase conditions, the score is unchanged under reordering, and generation quality is on the same order as comparison methods. They also limit it to a proof of concept on English, sentence-level, three base models, rather than an overall SOTA across all settings.