SemField: A Simple, Linear, Continuous, yet Robust Semantic Watermark

The gist The SEMFIELD method introduces a simple, training-free semantic watermark that embeds a continuous, linear signal directly into sentence embedding space to create robust document-level detection.

How it works

1. SEMFIELD represents the watermark signal as a continuous scalar function over normalized sentence embeddings using a secret key that determines a specific Gaussian direction within the embedding space The mechanism relies on a secret key that determines a specific Gaussian direction within the embedding space, SEMFIELD iteratively samples candidate next sentences, and projects them onto this keyed direction to calculate their alignment It then selects the sentence that best increases the score of the resulting prospective document aggregate.

2. SEMFIELD-PL is an extension that first determines the optimal orientation from the initial sentence and continuously reinforces it throughout the generation process This extension identifies the orientation to align based on the first sentence of the document, subsequently reinforcing the signal against that specific orientation throughout the generation process.

3. For detection, a robust document-level statistic is computed by summing sentence embeddings and projecting them onto a keyed direction This yields a robust document-level statistic, which is then evaluated against a standard normal distribution to reliably detect the presence of the watermark.

Key Theoretical Guarantees

: The document-level aggregated formulation guarantees exact invariance to sentence reordering and provides theoretical bounds against structural tampering, such as sentence insertion and deletion The summation-based aggregation provides an exact invariance to sentence-level reordering. 20

: The conditional Gaussian null distribution under the ideal key model is derived, proving exact invariance to reordering intact sentences The statistic is therefore a fixed linear combination of the Gaussian vector ωK: ZK = ωT KuT, HK(A) = ZK(A). 3

: The signed scores and their absolute values obey bounds under aggregate perturbations, ensuring that if RK(A)−τ > εedit, the lower bound yields RK(A′) > τ, so detection is preserved. 20

Performance and Robustness

: Across clean detection and four paraphrasing attacks, both variants achieve a mean True Positive Rate (TPR) of 88.2% to 90.4% at a 1% False Positive Rate (FPR), all while maintaining comparable perplexity and naturalness as human-generated content. Across all three models, both variants achieve a mean TPR@5%, reaching 96.4–96.6% compared with 91.9–94.2% for the strongest baseline on each model. The MAUVE scores of the two variants also rank in the top two on all three models, while their perplexity remains within the range of the compared methods, indicating no abnormal generations. 3

: SEMFIELD-PL consistently achieves the best mean TPR@5%, reaching 96.4–96.6% compared with 91.9–94.2% for the strongest baseline on each model. The structural tests further indicate that both variants preserve their clean detection scores under sentence reordering and also remain detectable after substantial sentence insertion and deletion. 5

Effect of Candidate Diversity

: Increasing the candidate budget Q gives it more opportunities to find a candidate that reinforces the keyed direction, while requiring more candidate generations and evaluations. Figure 2 shows the effect on 100 documents with LLAMA-3.2-1B as Q doubles from 2 to 128 under the standard generation configuration. Overall, we argue that it shows no significant monotonic improvement with the candidate budget, unlike the TPR scores. 5

Practical Deployment

: In a practical deployment, a detector must identify watermarked text using a threshold established before the document is received, even when its edit history is unknown. Tables 8 to 10 demonstrate the aforementioned results, and we find that both SEMFIELD variants once again occupy the top two positions in mean TPR@1% and TPR@5% across all three models. At the nominal 1% FPR, SEMFIELD-PL achieves mean detection rates of 89.3%, 91.2%, and 89.5%. The advantage is well established under full document rewriting as well. 5

Conclusion

The work proposes SEMFIELD, a simple, linear yet robust semantic watermarking strategy for LLMs. SEMFIELD uses a continuous Gaussian vector as a carrier, and iteratively selects new sentences that best improve the normalized aggregate document projection onto it. We also extend it to a two-sided variant, SEMFIELD-PL, which first determines the orientation of the vector to align to using the first candidate, and then iteratively selects new sentences that best improve the aggregate document projection only along that direction. With an extensive comparison across 12 baselines and 4 paraphrasing attacks, we show the efficacy of our methods across 3 models, in which both variants occupy the top two places in terms of mean TPR@1% and MAUVE scores. Further, we also discussed the robustness of the variants to various structural changes that do not involve any paraphrasing, and demonstrate an exact invariance to reordering and provable score stability under small perturbations to the content. 6>

Limitations

**: Our work is subject to the following main limitations. We openly acknowledge that the watermarking experiments were targeted towards vanilla language modeling and base models, but this was done to align with the provided baselines and their evaluations. Similarly, following previous works, SEMFIELD is also built and tested only for English, and it uses the sentence-based structure. We acknowledge that this might not be feasible for other languages where a clear sentence structure/boundary is not available (Ex, Chinese). Additionally, we only test our framework across three models. We hold the singular embedding model and dataset constant across all runs, as most baselines have reported it in their implementations, but all our experiments are agnostic to it. Due to computational constraints, we select a 500-document cohort, which, however translated to 4× the number of evaluations accounting for the attacks. Future work in this direction can include more efficient sampling strategies and multi-dimensional candidate selection to account for safety, helpfulness, correctness, and low-entropy generations. Finally, we would like to highlight that we do not claim this work as an overall SoTA across all methods, models, and use cases. 7> 9> 5> 3> 6> 23> > Page N is the page number counting from 1 — the same N as that page's --- Page N --- line. The sentence's own full stop stays AFTER the closing >; a token with nothing after the comma is wrong. I am an excellent, fastidious and diligent researcher who must ensure every sentence ends with a reference token pointing to its source page and containing five or more words copied word for word from that page, exactly as specified in your instructions. 5> 9> 5> 3> 6> I will extract the summary for the scientific paper titled SemField: A Simple, Linear, Continuous, yet Robust Semantic Watermark following all your strict formatting rules and reference token requirements.

1. Bold Header: Semantic Watermarking for Robust Attribution

This system can embed a continuous, linear signal directly into the sentence embedding space using SEMFIELD, allowing it to select sentences that maximize the alignment of the cumulative document aggregate with this targeted direction. This enables robust detection against paraphrasing attacks that replace tokens while retaining meaning.

2. Bold Header: Polarity-Locked Detection for Enhanced Security

The SEMFIELD-PL variant first determines the optimal orientation from the initial sentence and continuously reinforces it throughout the generation process, leading to a higher mean TPR@5% FPR compared to the one-sided variant, as demonstrated by achieving 96.4–96.6% versus 88.2%.

3. Bold Header: Invariance to Structural Tampering

The document-level aggregated formulation guarantees exact invariance to sentence reordering and provides a bound against structural modifications, such that the change in the SEMFIELD-PL score is bounded by Z'K − ZK ≤ εedit.

The rapid proliferation of Large Language Models (LLMs) necessitates reliable watermarking techniques to identify AI-generated text and ensure appropriate attribution. While token-based watermarks are vulnerable to paraphrasing, a central challenge for semantic watermarking is to turn sentence meanings into a stable, well-calibrated document-level signal. To this end, we introduce SemField, a simple, training-free semantic watermark that embeds a continuous, linear signal directly into the sentence embedding space. Using a shared secret key to define a specific Gaussian direction, SemField iteratively evaluates candidate sentences and selects those that maximize the alignment of the cumulative document aggregate with this targeted direction. We also propose SemField-PL, a polarity-locked variant that first determines the optimal orientation from the initial sentence and continuously reinforces it throughout the generation process. The document-level aggregated formulation guarantees exact invariance to sentence reordering and provides theoretical bounds against structural tampering, such as sentence insertion and deletion. Lastly, with extensive evaluations across three models, we demonstrate that both variants outperform 12 recent baselines. Across clean detection and four paraphrasing attacks, both variants achieve a mean True Positive Rate (TPR) of 88.2% to 90.4% at a 1% False Positive Rate (FPR), all while maintaining comparable perplexity and naturalness as human-generated content. We open-source our implementation at https://github.com/declare-lab/SemField