Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

2026-08-12

AI Summary

While existing watermarking methods for large language models enable source tracing, they fail to detect content tampering and are vulnerable to piggyback spoofing attacks. This work proposes the first dual-signal watermarking framework that simultaneously supports provenance attribution and integrity verification. The approach embeds two parallel signals within each generated token: a robust signal for source identification and a fragile signal for integrity validation. Differentiated sensitivity is achieved through independent cryptographic keys, complementary normalized text windows, and periodic signal assignment. To preserve the model’s output distribution, the method employs multi-round unbiased tournament reweighting. The framework enables three-state classification—intact, tampered, or unwatermarked—and formally defines “integrity.” Evaluated on two mainstream large language models and standard prompt datasets, it achieves state-of-the-art tampering detection performance while maintaining high tracing robustness and low perplexity.

Abstract

Watermarking LLM-generated text is an important task for tracing its provenance. Existing LLM watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution, a vulnerability known as piggyback spoofing. We introduce an innovative watermark that jointly provides provenance and tamper evidence. It co-embeds a robust signal and a fragile signal into each generated token. The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes. Multiple rounds of unbiased tournament reweighting preserve the expected generation distribution, while a periodic round-allocation pattern controls the trade-off between the two signals. At detection, their scores form a two-dimensional space supporting three decisions: Intact, Tampered, and No-Watermark. Across two large language models and two prompt datasets, our method demonstrates the highest tamper-detection rate among the evaluated methods while maintaining competitive attribution robustness and perplexity. Ablation studies show that reliable three-state detection requires a well-defined notion of intactness, co-embedding of the two signals, and complementary sensitivity to edits.

Problem

• provenance tracing
• tamper detection
• LLM watermarking
• piggyback spoofing
• content integrity

Innovation

• LLM watermarking
• provenance tracing
• tamper detection
• robust and fragile signals
• three-state verification