SAMark: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustness

2026-05-25

AI Summary

This work addresses the vulnerability of existing semantic watermarking methods to paragraph-level paraphrasing attacks, which often exploit their reliance on sentence order and are thus disrupted by global structural modifications. To overcome this limitation, the authors propose a self-anchored text watermarking framework that constructs generation-agnostic “green regions” in semantic space, thereby eliminating dependency on sentence sequence. They further introduce a multi-channel hyperbolic scoring mechanism to amplify watermark signals while suppressing noise. Additionally, a diversity-aware filtering strategy combines hard filtering with soft regularization to break the trade-off between watermark robustness and text quality without compromising generation fidelity. Experimental results demonstrate that the proposed method achieves a 90.2% true positive rate at a 1% false positive rate under standard paragraph rewriting attacks—surpassing the strongest baseline by over 30%—while maintaining generation quality on par with watermark-free text.

Abstract

Semantic-level watermarking (SWM) improves robustness against text modifications by treating sentences as the basic unit. However, robustness to paragraph-level paraphrasing remains difficult because such attacks globally disrupt watermark signals by changing sentence order. In this work, we propose SAMark, a self-anchored watermarking framework that removes the dependency on sentence order by establishing a step-independent green region in semantic space. To improve detectability, we introduce a multi-channel hyperbolic scoring mechanism that amplifies watermark signals while suppressing noise from weakly aligned candidates. We further propose a diversity-aware filtering strategy that combines hard filtering with soft regularization, extending beyond simple n-gram repetition filters to address semantic redundancy. Experimental results show that SAMark achieves up to 90.2% TP@FP1% under typical paragraph-level paraphrasing attacks, outperforming the strongest prior baseline by more than 30% on average, while maintaining generation quality competitive with unwatermarked text and breaking the robustness-quality trade-off that limits prior methods.

Problem

• text watermarking
• paragraph-level paraphrasing
• robustness
• semantic-level watermarking
• sentence order

Innovation

• self-anchored watermarking
• paragraph-level paraphrase robustness
• semantic-space green region
• multi-channel hyperbolic scoring
• diversity-aware filtering