# GaussMark: A Practical Approach for Structural Watermarking of Language Models Source: [GaussMark: A Practical Approach for Structural Watermarking of Language Models]() Collection index: [llms.txt]() Data updated: 2025-10-26T04:00:18.171Z Authors: Adam Block, Ayush Sekhari, Alexander Rakhlin Published: 2025-01-17T22:30:08.000Z ## Abstract Recent advances in Large Language Models (LLMs) have led to significant improvements in natural language processing tasks, but their ability to generate human-quality text raises significant ethical and operational concerns in settings where it is important to recognize whether or not a given text was generated by a human. Thus, recent work has focused on developing techniques for watermarking LLM-generated text, i.e., introducing an almost imperceptible signal that allows a provider equipped with a secret key to determine if given text was generated by their model. Current watermarking techniques are often not practical due to concerns with generation latency, detection time, degradation in text quality, or robustness. Many of these drawbacks come from the focus on token-level watermarking, which ignores the inherent structure of text. In this work, we introduce a new scheme, GaussMark, that is simple and efficient to implement, has formal statistical guarantees on its efficacy, comes at no cost in generation latency, and embeds the watermark into the weights of the model itself, providing a structural watermark. Our approach is based on Gaussian independence testing and is motivated by recent empirical observations that minor additive corruptions to LLM weights can result in models of identical (or even improved) quality. We show that by adding a small amount of Gaussian noise to the weights of a given LLM, we can watermark the model in a way that is statistically detectable by a provider who retains the secret key. We provide formal statistical bounds on the validity and power of our procedure. Through an extensive suite of experiments, we demonstrate that GaussMark is reliable, efficient, and relatively robust to corruptions such as insertions, deletions, substitutions, and roundtrip translations and can be instantiated with essentially no loss in model quality. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Watermark Detectability on C4 RealNewsLike Dipper-2 (test)](): Watermark Detectability; C4 RealNewsLike Dipper-2 (test); AUC: 79.5. - [Watermark Detectability on C4-RealNewsLike Dipper-1 (test)](): Watermark Detectability; C4-RealNewsLike Dipper-1 (test); AUC: 0.915. - [Watermark Detectability on C4-RealNewsLike Translate (test)](): Watermark Detectability; C4-RealNewsLike Translate (test); AUC: 94.8. - [Watermark Detectability on C4 RealNewsLike (Sub-0.5) (test)](): Watermark Detectability; C4 RealNewsLike (Sub-0.5) (test); AUC: 77.5. - [Text Generation Quality and Watermark Detectability on ELI5](): Text generation quality and watermark detectability; ELI5; AUC: 97.9. - [Text generation quality and watermark detectability on C4 RealNewsLike](): Text generation quality and watermark detectability; C4 RealNewsLike; AUC: 98.3. - [Watermark Detectability on C4 RealNewsLike (Del-0.5) (test)](): Watermark Detectability; C4 RealNewsLike (Del-0.5) (test); AUC: 62.2. - [Watermark Detectability on C4 RealNewsLike (Del-0.2) (test)](): Watermark Detectability; C4 RealNewsLike (Del-0.2) (test); AUC: 91.9. ## Original sources and implementation [Original paper]() [PDF]()