The technique belongs to a family known as zero-watermarking. Instead of embedding a watermark into the image, the scheme extracts robust features from the picture and associates them with a binary message to form a reference signature, which is stored externally. During verification, features are extracted from a potentially marked image and used to confirm the watermark’s presence or recover its full content. The image itself never changes, so its visual integrity remains intact by design. What has historically limited zero-watermarking, however, is the fragility of the features it depends on. If a picture is rotated slightly or squeezed through JPEG compression, handcrafted descriptors and even pretrained deep features can shift enough to break the association with the stored signature, causing watermark recovery to fail.

Recent deep learning approaches have tried to sidestep this problem by borrowing feature extractors from self-supervised models such as SimCLR, BYOL, and DINO, assuming that representations trained on large-scale classification or contrastive tasks offer sufficient invariance to distortions. The InvZW team, led by Abdullah All Tanvir, Frank Y. Shih, and Xin Zhong, argues that this assumption is fundamentally flawed. Self-supervised models learn invariance only as a byproduct of their training objectives, typically through predefined augmentations, and are not explicitly optimized to suppress the distortion-specific variability that breaks watermark consistency. Their answer is to train a feature extractor specifically for the job, using a noise-adversarial scheme that forces the network to produce representations indistinguishable between clean and corrupted images.

The framework’s first module is a three-way adversarial game built on Vision Transformer architectures. A feature extractor divides an input image into patches, projects them into a latent space with learnable linear transformations and positional encodings, and processes them through stacked Transformer blocks containing multi-head self-attention and feed-forward layers. Both an original image and a distorted version pass through this extractor. A discriminator, itself a ViT-based classifier, is trained to determine whether a given feature representation came from a clean or corrupted image. The extractor is trained adversarially to fool the discriminator, a minimax interaction that pushes the two feature distributions toward alignment. In theory, this setup echoes the domain-adversarial learning paradigm, treating the distortion process as inducing a domain shift between related image populations that share semantic structure but differ in nuisance factors.

Adversarial alignment alone, however, invites a degenerate shortcut. The extractor could satisfy the discriminator by outputting a constant, trivial representation—say, all zeros—regardless of input. Such features are perfectly invariant and perfectly useless. To prevent this collapse, the team introduces a reconstructor module, an autoencoder-like network with convolutional encoder and decoder paths that must rebuild the original image from the extracted features. The reconstruction loss combines mean squared error with the Structural Similarity Index, applied to both clean and distorted inputs. This constraint can be read through the Information Bottleneck principle: the representation should retain information about the underlying image content while reducing sensitivity to distortion-specific detail. If features collapse, reconstruction fails with high error, and the model is penalized, effectively discouraging degenerate solutions.

The second module turns these invariant features into a working multibit watermarking scheme. For each image-watermark pair, a reference signature matrix is optimized by gradient descent so that the inner products between the signature and the feature vector align with the target binary message, with a sigmoid activation and binary cross-entropy loss enforcing the soft margin between bits. An L2 penalty regularizes the signature to prevent overfitting. Crucially, this optimization happens in feature space, not image space, and involves no updating of the image or the feature extractor. The team notes that the approach enables a natural one-to-many mapping: a single image can be linked to multiple watermark identities, each defined by a distinct reference signature, with storage scaling linearly with the number of assigned watermarks. During verification, only the correct signature produces a successful match, supporting user-specific ownership or multi-level authorization.

The experimental results are striking. The feature extractor was trained on 40,000 MSCOCO images using only geometric distortions—rotation, translation, shear, zoom—yet at test time it demonstrated strong invariance to a much broader spectrum of unseen attacks, including Gaussian blur, JPEG compression, salt-and-pepper noise, and solarization. Cosine similarity between features of original and distorted images remained consistently high, reaching 0.93 or above under blur and compression across all evaluated datasets, with Flickr30k and ImageNet showing resilience up to 0.96 under pixel-level attacks. Reconstruction quality stayed high as well, with PSNR values frequently exceeding 30 dB under most geometric transformations. When compared against five self-supervised baselines—SimCLR, BYOL, Barlow Twins, VICReg, and VIbCReg—the proposed method consistently achieved the highest feature invariance, with cosine similarities up to 0.98 under Gaussian blur and JPEG compression.

The watermarking benchmarks are equally compelling. Evaluated with 30-bit binary messages across 1,000 test images per distortion setting, the framework achieved bit error rates ranging from 0.05 percent to a maximum of 8 percent across six common distortions. Against embedded watermarking schemes such as HIDDEN and an adversarial variant, standardized so that marked images maintained approximately 40 dB PSNR for fair comparison, the proposed method reached an average bit accuracy of 96.5 percent, compared with 76.5 and 86.8 percent for the baselines. The gaps were widest under color-related distortions: at a hue adjustment of 0.6, the baselines collapsed to 18.1 and 42.4 percent accuracy while the proposed method held 99.1 percent. Under severe Gaussian noise at 0.10 intensity, it achieved 95.3 percent accuracy versus 63.2 and 89.5 percent for the alternatives. Even under non-differentiable transformations like screenshots, the method preserved 98 percent bit accuracy.

Ablation studies confirm that both core components are essential. Removing the reconstructor dropped linear classification accuracy from 81.67 to 63.31 percent and watermark bit accuracy from 96.7 to 68.1 percent, with feature heatmaps showing uniformly high pairwise similarity—clear evidence of collapse. Removing adversarial training similarly degraded both metrics, from 81.67 to 69.45 percent linear accuracy and from 96.7 to 74.3 percent bit accuracy. The full framework, comprising a roughly 9-million-parameter feature extractor, a 14-million-parameter discriminator, and a 7-million-parameter reconstructor, was trained on a single Nvidia RTX 4090 GPU in approximately 46 hours, operating on relatively small inputs. At inference time, only the feature extractor is required, keeping deployment costs comparable to standard feature extraction pipelines.

The team acknowledges that their study focused on simulated digital distortions, and future work will evaluate the framework under real-world perturbations such as camera-captured compression artifacts, sensor noise, and degradations from mobile or embedded devices. They also plan to extend the approach to video watermarking and real-time applications, and to test robustness under more extreme and semantic distortions such as style transfer and image enhancement. For now, InvZW demonstrates that the path to protecting images without altering them runs not through better handcrafted descriptors or borrowed pretrained models, but through training networks explicitly to learn invariance—an adversarial pursuit in which a discriminator and a reconstructor, working at cross purposes, together produce features stable enough to carry a secret message through almost anything an image might endure.

Subject of Research: InvZW: invariant feature learning via noise-adversarial training for robust image zero-watermarking

Article Title: InvZW: invariant feature learning via noise-adversarial training for robust image zero-watermarking

Article References: Tanvir, A. A., Shih, F. Y., & Zhong, X. (2026). InvZW: invariant feature learning via noise-adversarial training for robust image zero-watermarking. Frontiers in Signal Processing, 6, Article 1812987. https://doi.org/10.3389/frsip.2026.1812987

Image Credits: AI Generated

DOI: 10.3389/frsip.2026.1812987

Keywords: zero-watermarking, adversarial training, invariant feature learning, image protection, deep learning, Vision Transformer, copyright protection, InvZW, invariant, feature, learning, noise-adversarial

The team, led by Abhijit Patil of K J Somaiya Institute of Technology in Mumbai, together with Ramesh Shelke of S. S. Jondhale College of Engineering and Dilendra Hiran of Pacific Academy of Higher Education and Research University, set out to fix a specific weakness in earlier watermarking research. Many existing schemes process audio in overlapping segments when embedding a watermark, which drives up computational cost without necessarily improving security. Overlapping windows are a standard tool in signal processing because they smooth transitions between frames, but in the watermarking context the authors argue that the redundancy they introduce is largely wasted effort. Their system instead guarantees non-overlapping segmentation from the very first stage, trimming the computational overhead that has plagued previous approaches.

The pipeline begins with a technique borrowed from classical spectral analysis: the FlatTop window. Windowing functions are mathematical tapers applied to short stretches of a signal before further processing, and each shape trades off different properties. FlatTop windows are prized for their exceptionally flat passband, which means they measure the amplitude of frequency components with minimal distortion, at the cost of a wider main lobe. In RAWS-SBS, the FlatTop window slices an incoming audio signal into frames that do not overlap, establishing a clean, computationally frugal foundation for everything that follows. This choice matters because every subsequent operation, from transform to embedding to extraction, operates on these frames, so inefficiency at the segmentation stage multiplies through the whole system.

Once segmented, the frames undergo a decomposition step using what the authors term a Polar Cartesian-based Discrete Wavelet Transform, or PC-DWT. The discrete wavelet transform is a workhorse of modern signal processing, breaking a signal into components that capture both frequency content and where in time that content occurs, unlike the plain Fourier transform, which discards timing information. The polar Cartesian variant reformulates this decomposition, and the transformed coefficients are then arranged into matrices from which features are extracted. These features feed the next critical decision: where, exactly, inside the audio should the watermark bits live? Placing a watermark carelessly makes it audible to listeners or fragile under compression and filtering; placing it too timidly makes it easy to destroy.

To answer that placement question, the researchers developed an optimization method they call Gamma Functional Energy Valley Optimization, or GFEVO. Optimization algorithms of this family search a large space of candidate solutions for the one that best balances competing objectives, and here the objective is finding embedding locations that maximize robustness while preserving perceptual quality. The reported results suggest the search paid off: the GFEVO stage achieved a Perceptual Evaluation of Speech Quality score of 4.256, a metric on a scale where values near 4.5 indicate quality nearly indistinguishable from the original. In practical terms, a listener hearing the watermarked audio would be very hard pressed to notice that anything hidden inside it at all.

Security enters the pipeline through the most colorful component of the system: Blancmange Curve Cryptography. The Blancmange curve, also known as the Takagi curve, is a fractal defined as an infinite sum of sawtooth-like functions. It is famous in mathematics for being continuous everywhere yet differentiable nowhere, a jagged, self-similar shape that never smooths out no matter how closely you zoom in. The authors harness this fractal’s irregular, deterministic complexity to encrypt the watermark image before embedding, converting the encrypted bits into a vector bit stream. An attacker who extracts the embedded payload without the key would face data scrambled according to the curve’s fractal arithmetic, adding a cryptographic layer on top of the steganographic one. It is a striking example of pure mathematics, a curve named after a wobbly pudding, finding duty in applied security engineering.

Embedding, however, is only half the problem. A watermark is useless if the legitimate owner cannot reliably pull it back out of an audio file that may have been compressed, filtered, resampled, or otherwise degraded on its journey through the digital world. For extraction, the team deployed a deep convolutional neural network with two distinctive design elements. The first is a spatial-and-cross architecture, which lets the network correlate information across different spatial regions of the transformed audio representation rather than treating each location in isolation. The second is a Scaled Gaussian Error Linear Unit, or SGELU, an activation function that governs how signals pass between network layers. Activation functions shape what a neural network can learn, and the Gaussian-error variant blends a smooth probabilistic weighting into the familiar rectified linear unit, potentially giving the extractor a richer response to the subtle statistical traces a watermark leaves behind.

The experimental numbers are where the system makes its case. The proposed method achieved a minimum Bit Error Rate of 0.03232, meaning that when the hidden watermark was extracted, fewer than four bits in every hundred came back wrong, a low error rate that translates directly into more reliable ownership verification. On overall watermarking accuracy, the system reached 97 percent. The authors benchmarked this against several established deep learning baselines, reporting improvements of 3.2 percent over a standard DCNN, 4.3 percent over a conventional CNN, 7.8 percent over a deep belief network, and 11.5 percent over a plain deep neural network. Those margins may look incremental, but in a field where a few percentage points of accuracy can determine whether a copyright claim holds up, they are meaningful.

Context helps explain why this line of research is heating up. Audio watermarking has moved far beyond its original role of tagging music files for royalty tracking. Recent work in the field targets desynchronization-resilient schemes that survive time-stretching attacks, blind quantum watermarking, neural approaches with invertible dual embedding, and systems designed specifically to detect deepfake audio proactively. As generative models make synthetic speech and music indistinguishable from human-created recordings, the ability to embed a verifiable, tamper-evident signature inside audio is becoming a frontline defense. Watermarks that survive aggressive processing while remaining inaudible are the technical backbone for proving that a clip is authentic, or flagging one that is not.

The RAWS-SBS study, received by the journal in 2023 and published on 31 August 2026 after an unusually long revision cycle, reflects that broader urgency. Its authors report no funding source and no competing interests, and they state that the data generated in the study are available from the corresponding author on reasonable request. Whether fractal-based encryption and non-overlapping segmentation become standard ingredients of future watermarking systems remains to be seen, but the work illustrates a clear trend: the fight to authenticate digital audio is increasingly fought with hybrid tools, marrying signal processing classics like wavelet transforms and windowing functions to deep networks and, now, to the jagged elegance of nowhere-differentiable fractals. For an industry drowning in unattributable sound, every percentage point of extraction accuracy counts.

Subject of Research: A robust deep learning-based audio watermarking system using Blancmange curve cryptography for digital media security

Article Title: A robust audio watermarking system with SC-SGELU-DCNN and BCC algorithm for security

Article References: Patil, A., Shelke, R., & Hiran, D. (2026). A robust audio watermarking system with SC-SGELU-DCNN and BCC algorithm for security. Multimedia Tools and Applications, 85(9), Article 725. https://doi.org/10.1007/s11042-026-21865-8

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21865-8

Keywords: audio watermarking, deep learning, convolutional neural network, Blancmange curve cryptography, discrete wavelet transform, bit error rate, digital security, copyright protection, signal processing, SGELU activation, optimization, multimedia forensics

The study, published in the journal Discover Informatics, examined eight Ghanaian universities with operational institutional repositories, including the University of Ghana, Kwame Nkrumah University of Science and Technology, the University of Cape Coast, the University of Education Winneba, the University for Development Studies, Ashesi University, the Ghana Institute of Journalism, and the University of Professional Studies Accra. Led by De-Graft Johnson Dei and Karim Awudu, the research team surveyed 120 respondents drawn from ICT personnel, repository managers, academic librarians, systems librarians, and faculty members, then followed up with in-depth interviews with twelve senior experts. The design was a sequential explanatory mixed-methods approach, meaning the survey results shaped the questions asked in later interviews, and the two strands of evidence were triangulated during interpretation.

The headline finding is sobering. Forty percent of respondents said their institutions had no digital rights management mechanism in place at all. Access control was the most commonly implemented practice, appearing at 44.2 percent of institutions, while advanced techniques such as digital watermarking and encryption were implemented at only 9.2 percent. Usage tracking, copyright auditing, and automated licensing enforcement were similarly rare. Interview participants described repositories that upload content without defined rights policies, verify permissions manually, and have no idea who downloads what or where it ends up. One participant at the University for Development Studies put it bluntly: access matters more than protection. Another observed that if content is on the internet, people assume it is free to use, a presumption that puts author rights at risk.

Against this backdrop, blockchain technology has been proposed as a transformative tool. A blockchain is a distributed ledger in which transactions are recorded in cryptographically verified, time-stamped blocks linked to their predecessors, maintained across a network of nodes rather than a single central authority. Because no single party controls the record, entries cannot be quietly altered, and every change leaves a permanent, auditable trail. For digital rights management, this architecture offers several distinct functions: authorship verification through immutable timestamps and digital signatures, provenance tracking across the scholarly lifecycle, content integrity through cryptographic verification, and automated rights enforcement through smart contracts, which are self-executing programs that apply licensing terms without continuous administrative intervention.

The researchers grounded their analysis in two complementary theoretical lenses. The Technology-Organization-Environment framework, developed by Tornatzky and Fleischer, examines how technological features, organizational capacity, and environmental conditions such as national policy shape whether institutions adopt an innovation. Diffusion of Innovations theory, articulated by Everett Rogers, explains how individual stakeholders perceive new ideas through the attributes of relative advantage, compatibility, complexity, trialability, and observability. Together, the frameworks allowed the team to assess both the structural readiness of Ghanaian universities and the attitudes of the people who would actually operate blockchain-enabled systems.

Awareness of blockchain turned out to be uneven. Overall, 62.5 percent of respondents had heard of the technology, but mean perceived understanding was low at 2.31 on a five-point scale. ICT personnel were far ahead, with 86.7 percent awareness and a mean understanding score of 3.82, while faculty members lagged at 33.3 percent awareness and a mean of 1.74. Interviews revealed persistent conceptual confusion, with some participants equating blockchain entirely with Bitcoin and others describing it as futuristic but unproven in a library context. Several respondents expressed a genuine appetite for training, noting that interest exists but workshops and webinars do not. According to Diffusion of Innovations theory, these conditions mark an early adoption stage characterized by low observability and high perceived complexity, yet also a latent receptiveness that targeted demonstration could convert into adoption.

Institutional readiness fared worse. The overall preparedness score was 2.25, rated as poor, and only 18.3 percent of respondents believed their infrastructure could support blockchain. A striking 81.7 percent said their digital library strategies made no mention of the technology. Funding was the dominant constraint, cited by 74.2 percent, followed by technical complexity at 74.2 percent, shortage of qualified staff at 72.5 percent, and absence of legal and regulatory frameworks at 68.3 percent. Participants described server capacity too limited to host current systems, ICT plans with no blockchain reference whatsoever, and donor projects that fund basic digital libraries but not cutting-edge infrastructure. In northern Ghana, unreliable internet and electricity compounded the problem, cited by 54.2 percent of respondents.

Yet the appetite for blockchain’s benefits was remarkably strong. Tamper-proof authorship verification topped the list, endorsed by 78.3 percent of respondents with a mean rating of 4.21, followed by improved content authenticity and integrity at 74.2 percent and transparent audit trails at 71.7 percent. Smart contract automation of copyright enforcement drew support from 66.7 percent, blockchain timestamping from 61.7 percent, and decentralized data control from 63.3 percent. Librarians interviewed for the study described repeated incidents of downloaded content being renamed and shared without credit, and saw in blockchain a way to safeguard the uniqueness of their researchers’ work. Others noted that precise access tracking could transform impact monitoring, and that smart contracts could enforce Creative Commons licenses without manual policing.

On strategy, stakeholders favored cautious, low-risk pathways. Staff training and capacity building was the most endorsed approach at 79.2 percent, followed by pilot blockchain repository modules at 76.7 percent and phased implementation at 74.2 percent. Open-source platforms such as Hyperledger attracted 72.5 percent support, reflecting a preference for affordable, flexible tools over commercial systems. Multidisciplinary task forces spanning librarians, attorneys, and IT professionals, donor and government funding, and regional consortia all received strong ratings, while alignment with national education policy goals ranked lowest at 60.8 percent, exposing a strategic disconnect between institutional action and frameworks set by the Ministry of Education and the Ghana Tertiary Education Commission.

The study concludes that blockchain-enabled digital rights management in Ghanaian repositories is a promising but still emerging innovation, transformative in potential yet constrained by infrastructure, funding, expertise, and policy. The authors recommend phased implementation, pilot projects beginning perhaps with postgraduate theses, open-source tools, interdisciplinary collaboration, and sustained investment in digital infrastructure and human capacity. They also caution that the findings rest on self-reported perceptions from eight universities and do not evaluate operational blockchain systems, leaving room for future work on prototypes, longitudinal adoption studies, and integration with technologies such as big data analytics and large language models. For now, the message is clear: Ghana’s repositories hold valuable scholarship that is largely unprotected, and while blockchain is no silver bullet, stakeholders across the country’s universities are ready to explore whether a decentralized ledger can finally give their research the trust and security it deserves.

Subject of Research: Blockchain adoption for digital rights management in Ghanaian university institutional repositories

Article Title: Evaluating blockchain adoption for digital rights management in institutional repositories

Article References: Johnson Dei, D.-G., & Awudu, K. (2026). Evaluating blockchain adoption for digital rights management in institutional repositories. Discover Informatics, 1(1), Article 5. https://doi.org/10.1007/s44564-026-00008-z

Image Credits: AI Generated

DOI: 10.1007/s44564-026-00008-z

Keywords: blockchain technology, digital rights management, institutional repositories, Ghana, higher education, scholarly communication, smart contracts, copyright protection, digital preservation, open access, TOE framework, Diffusion of Innovations

As large language models now produce everything from open-domain articles to executable code and step-by-step mathematical derivations, the need to verify authenticity, attribute sources, and protect copyright has grown urgent. Text watermarking has emerged as a leading countermeasure, typically by injecting small statistical biases into a model’s token-selection process during generation. The most influential example is the KGW scheme, which pseudorandomly partitions the vocabulary into “green” and “red” token lists and nudges the model toward green tokens, leaving behind a statistical footprint that a detector can later pick up. Google’s SynthID-Text has since demonstrated that such decoding-based watermarking can work at production scale.

The trouble, the researchers explain, is that most existing schemes assume a stable generation pattern. They rely on fixed or heuristic entropy thresholds to decide where the watermark should be applied. Token entropy—a measure of how uncertain the model is at a given step—matters enormously: in high-entropy contexts, such as creative prose, the model has many plausible choices, and biasing one direction barely changes the output. In low-entropy contexts, such as the syntax of a Python function or a symbolic derivation, the “correct” next token is nearly deterministic, and any perturbation risks breaking the code or corrupting the logic. A single fixed threshold inevitably misjudges one regime or the other, producing either redundant watermark injection in sensitive regions or noisy, unreliable detection statistics. Earlier attempts to adapt—SWEET, which applies strong bias only above a static entropy threshold, and CATMARK, which updates cluster centers online at considerable computational cost—only partially solve the problem.

GAMark’s central insight is that the semantic states traversed during generation are not uniform. The team draws on the manifold hypothesis: the high-dimensional logit distributions that a language model produces across diverse tasks do not fill their ambient space but cluster on a lower-dimensional structure corresponding to distinct latent semantic states—prose generation, code writing, formal reasoning. GAMark exploits this structure through a two-phase paradigm of offline semantic modeling and frozen online inference.

In the offline phase, the researchers collect logit-level representations from the target models and reduce them using Incremental Principal Component Analysis to a 50-dimensional subspace. They then fit a Gaussian Mixture Model with ten components, each capturing one characteristic semantic mode. In the online phase, the GMM parameters remain frozen: for each token position during generation, the current logit vector is projected and assigned soft, Bayesian posterior-weighted memberships across the semantic states. The adaptive entropy threshold is then synthesized by aggregating over those memberships, allowing the threshold to shift smoothly as the model transitions between, say, natural-language commentary and a code keyword. Only when the token’s entropy exceeds this dynamically computed threshold does the watermark gate open, biasing the green-listed tokens with strength δ while leaving deterministic tokens untouched.

Detection is handled with a matching procedure. Because the model parameters and the GMM are frozen, a detector can reconstruct the same semantic states and thresholds from the raw logits of a suspect text, recover the validity mask indicating which tokens were actually eligible for watermarking, and then compute an entropy-weighted Z-score. The weight assigned to each token scales with the excess of its entropy over the threshold, raising the exponent η to either 0 or 1. The resulting statistic follows, by the Central Limit Theorem, an approximate normal distribution under the null hypothesis, yielding a one-sided hypothesis test: a Z-score above 4.0 corresponds to a false-positive probability below 3.17 × 10⁻⁵. This weighting scheme suppresses the dilution caused by the many low-entropy, never-watermarked tokens that code and math text contain.

The experimental evaluation spanned two models—Qwen2.5-7B-Instruct and LLaMA3.1-8B-Instruct—across four benchmarks chosen for their diverse entropy profiles: C4 (RealNews) for high-entropy open-domain text, HumanEval’s 164 Python problems for functionality under strict syntax, MBPP for concise low-entropy code synthesis, and MATH-500 for interleaved natural-language and symbolic reasoning. Five baselines were compared under unified settings with a green-list ratio of 0.5 and a base logit bias of 2.0: KGW, SWEET, EWD, SynthID, and CATMARK.

The results show consistent gains on both sides of the quality–detectability trade-off. On C4, GAMark achieved a perplexity of 5.96, better than KGW (7.15), SWEET (6.65), and SynthID (6.10), indicating that the adaptive thresholds leave the generated prose nearly indistinguishable from unwatermarked output. On HumanEval, the contrast was starker: CATMARK had to suppress watermark signals to hold its Pass@1 correctness at 74.4%, paying for it with an AUROC of only 65.09% and a true positive rate of 15.85%. GAMark, by contrast, reached the highest Pass@1 of 76.2% while achieving 89.30% AUROC and 81.70% TPR—more than five times the detection sensitivity of CATMARK. On MATH-500, where entropy regimes switch within a single response, GAMark recorded 64.4% Pass@1 with 97.23% AUROC on Qwen2.5-7B-Instruct, and an AUROC of 99.27% with 97.60% TPR on LLaMA3.1-8B-Instruct.

Robustness testing under aggressive semantic attacks reinforced the picture. In a back-translation attack—routing text from English to Chinese and back via the DeepSeek API—the KGW baseline’s AUC collapsed from 0.812 to 0.650, while GAMark held at 0.910. Under full paraphrasing by Qwen2.5-7B-Instruct, most baselines shifted sharply toward false negatives, but GAMark’s AUC declined only from 0.972 to 0.880, well ahead of the second-best method, EWD, at 0.820. The researchers attribute this resilience to the fact that the watermark concentrates in semantically flexible, high-entropy regions that survive rewriting, rather than in brittle structural tokens.

Sensitivity analyses pinpointed the hyperparameters that matter. With too few GMM clusters, coarse semantic modeling fails to shield low-entropy regions; performance peaked at K = 10, beyond which quality declined slightly. The threshold scaling coefficient α governs the trade-off: α = 0.5 yields near-perfect detection (99.2% TPR on HumanEval) but crashes Pass@1 to 56.5% by mistakenly watermarking deterministic tokens, while α = 1.5 restores output quality but weakens detection below 40% TPR. The default α = 1.0 balances both, delivering 76.2% Pass@1 and 81.7% TPR on HumanEval.

Efficiency results were equally notable. Because all heavy manifold modeling is shifted offline, online inference requires only lightweight matrix projections and GMM posterior estimation. GAMark generated text at 35.92 tokens per second on HumanEval, outpacing CATMARK’s 33.13 tokens per second and even slightly exceeding the static SWEET baseline, with only 3.8% overhead compared to CATMARK’s 9.4%. An ablation study confirmed the necessity of each component: removing GMM clustering dropped Pass@1 by 7.7 points on HumanEval, and removing entropy-weighted detection cut AUROC by 7.15 points, showing that semantic state modeling preserves functionality while the weighted statistic filters the noise that unwatermarked low-entropy tokens would otherwise introduce.

The team concludes that GAMark offers a unified, practical answer for watermarking heterogeneous, cross-task generation environments—precisely the settings where modern LLMs are deployed. The researchers plan to extend the framework to more challenging adversarial settings and further optimize efficiency for large-scale deployment, work that could prove consequential as regulators, platforms, and publishers increasingly demand verifiable provenance for AI-generated content.