DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling

2026-08-04

AI Summary

This work addresses the limitations of existing large language model watermarking schemes, which either rely on private keys—hindering public auditability—or lack robustness against common text perturbations such as editing and truncation. To overcome these challenges, the authors propose DHMark, a novel public-key-based watermarking framework that adapts the Diffie-Hellman key exchange principle to watermark embedding. By leveraging a rejection sampling mechanism, DHMark decouples authorized payloads from noisy textual evidence and integrates registry binding with equation voting to enable statistically aggregated verification. Requiring only publicly available information, the method allows third-party validation and achieves an effectiveness rate of at least 0.967 under eight types of editing perturbations in a 32-bit configuration, while maintaining a false positive rate of 0.000 across three negative sample categories, thereby substantially enhancing the robustness and reliability of public watermarking.

Abstract

Large language model (LLM) watermarking provides an important mechanism for tracing the provenance of generated text. Existing statistical watermarks are often effective and robust, but most of them rely on private detection keys, which centralizes verification and complicates public auditing. Recent public or publicly verifiable watermarking schemes improve key management, yet many of them rely on exact recovery of embedded cryptographic strings, making them fragile under token edits, truncation, copy-paste, and low-entropy generation. This paper introduces DHMark, a public-key watermarking framework for LLM-generated text. The key idea is to separate payload authorization from noisy textual evidence. An issuer signs a short registry payload bound to a public context, and the payload is expanded into many one-bit equations. During generation, a Diffie-Hellman-guided token-labeling interface assigns each candidate token a public equation vote, and the sampler softly or selectively promotes candidates whose votes agree with the authorized payload. During verification, third-party verifiers use public information to extract token votes, aggregate them into equation-level evidence, and score only signed registry records. This design avoids exact recovery of a long embedded signature and instead treats watermark detection as registry-aided statistical evidence aggregation. We formalize the public-verification setting, analyze label pseudorandomness, registry-backed soundness, and sampling distortion, and evaluate a prototype under truncation, substitution, copy-paste, wrong-context, and plain-generation attacks. In the default 32-bit configuration, DHMark maintains at least a 0.967 valid rate across eight edit conditions while yielding a 0.000 acceptance rate on three negative controls.

Problem

• LLM watermarking
• public-key verification
• text provenance
• robustness to edits
• cryptographic fragility

Innovation

• public-key watermarking
• Diffie-Hellman
• rejection sampling
• statistical evidence aggregation
• LLM-generated text