Constitution-Guided Watermarking
cs.CR, cs.CL, cs.LG
Submitted: 2026-10-07
Updated: 2026-10-07
Comments: Working paper (under review)
License: http://creativecommons.org/publicdomain/zero/1.0/
The gist: Watermarking enables language model providers to identify text generated by their models.
Abstract
Watermarking enables language model providers to identify text generated by their models. However, its desired properties can conflict (stronger watermark signals can degrade text quality), while designs that resist editing may also facilitate forgery. Providers address these trade-offs by choosing configurations that balance competing objectives or prioritize particular properties. Either approach imposes a shared operating point on requests with different requirements, potentially sacrificing quality where wording preservation matters or robustness where reliable attribution is essential. To allow flexible and adaptable designs, we introduce Constitution-Guided Watermarking, a framework that selects request-appropriate trade-offs from provider requirements, listed as natural-language principles. Offline, a pretrained reasoning agent examines constitutional rules alongside watermark implementations and iteratively refines rule-specific configurations using empirical feedback. At deployment, a separate monitor identifies applicable rules and retrieves the corresponding policy, including watermarking exemptions, without modifying the serving model. Furthermore, our framework supports offline parallel optimization and refinement of rule-specific configurations based on evolving provider requirements without affecting deployment, and binds each deployed configuration to its evaluation evidence, making deployment decisions auditable. In a proof-of-concept evaluation using KGW and a five-rule constitution, our framework selects configurations responsive to provider priorities and improves post-paraphrase detection on robustness-prioritized requests by up to 14 percentage points over fixed configurations, while matching or exceeding all baselines in aggregate quality and clean detection at a nominal 0.1% false-positive rate.
Sources
- A Gentle Introduction to Conformal Prediction and Distribution-Free Uncertainty Quantification
- Mitigating Watermark Forgery in Generative Models via Randomized Key Selection
- Watermarking Should Be Treated as a Monitoring Primitive
- Constitutional AI: Harmlessness from AI Feedback
- Discovering Spoofing Attempts on Language Model Watermarks
- Self-Refine: Iterative Refinement with Self-Feedback
- MarkLLM: An Open-Source Toolkit for LLM Watermarking
- Mark My Words: Analyzing and Evaluating Language Model Watermarks
- Reflexion: Language Agents with Verbal Reinforcement Learning
- MorphMark: Flexible Adaptive Watermarking for Large Language Models
- SoK: Watermarking for AI-Generated Content
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs