CORE-BREW: LLR-Based Soft Decoding for Robust Multi-Bit LLM Watermarking

2026-06-23

AI Summary

This work proposes CORE-BREW, a method designed to enable reliable provenance tracing of large language model outputs that remains robust under editing perturbations while maintaining controllable false positive rates. Built upon a chunk-based BREW framework, CORE-BREW calibrates the watermarking channel by fixing the hit rate and computes log-likelihood ratios (LLRs) for each token. It further introduces a soft-decision multi-bit decoding mechanism, supporting two detection modes: Strict-Safe and FPR-Calibrated. Experimental results demonstrate that CORE-BREW significantly outperforms existing baselines under token-level editing and paraphrasing attacks, achieving superior watermark robustness and semantic fidelity without compromising strict control over false positive rates.

Abstract

Reliable provenance for LLM outputs requires multi-bit watermarks that remain robust under editing while maintaining strict false-positive control. Existing ECC-based LLM watermarks rely largely on hard-decision decoding, discarding token-level reliability information. We propose CORE-BREW, a Constant-hit-Rate Embedding extension of block-wise BREW for robust multi-bit watermarking. CORE-BREW calibrates the watermark channel by targeting a fixed hit rate p-star, yielding closed-form per-token log-likelihood ratios (LLRs) for principled soft-decision decoding. It supports two detection modes: Strict-Safe, which preserves the bounded-distance designated-codeword acceptance region, and FPR-Calibrated, which uses likelihood-based scoring and lightweight list decoding to characterize the FPR-TPR trade-off. Experiments on open-source LLMs under token-level edits and paraphrasing demonstrate improved low-FPR discrimination and robustness over prior multi-bit watermarking baselines while maintaining comparable semantic quality.

Problem

• LLM watermarking
• multi-bit watermarking
• false-positive control
• robustness
• soft decoding

Innovation

• soft-decision decoding
• log-likelihood ratio (LLR)
• multi-bit watermarking
• false-positive control
• CORE-BREW