CORE-BREW: LLR-Based Soft Decoding for Robust Multi-Bit LLM Watermarking

2026-06-23 · Source: Takara TLDR - Daily AI Papers · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, medium

Summary

CORE-BREW is a novel multi-bit watermarking technique designed to ensure reliable provenance for Large Language Model (LLM) outputs, maintaining robustness against editing while controlling false positives. Unlike existing ECC-based LLM watermarks that often discard token-level reliability information through hard-decision decoding, CORE-BREW employs a Constant-hit-Rate Embedding (extension of block-wise BREW) approach. It calibrates the watermark channel by targeting a fixed hit rate, p-star, which yields closed-form per-token log-likelihood ratios (LLRs) for principled soft-decision decoding. The system supports two detection modes: Strict-Safe, preserving a bounded-distance designated-codeword acceptance region, and FPR-Calibrated, which uses likelihood-based scoring and lightweight list decoding to characterize the false-positive rate (FPR) and true-positive rate (TPR) trade-off. Experiments on open-source LLMs demonstrate CORE-BREW's superior low-FPR discrimination and robustness against token-level edits and paraphrasing, all while preserving comparable semantic quality.

Key takeaway

For AI Security Engineers tasked with ensuring reliable provenance for LLM-generated content, you should evaluate CORE-BREW as a robust multi-bit watermarking solution. Its LLR-based soft-decision decoding significantly improves detection accuracy and resilience against common text edits and paraphrasing compared to prior methods. This approach allows for precise control over false-positive rates, crucial for maintaining trust and accountability in AI outputs. Consider integrating CORE-BREW to enhance the verifiability and integrity of your LLM applications.

Key insights

CORE-BREW employs LLR-based soft decoding for robust multi-bit LLM watermarking, enhancing detection and resilience to text modifications.

Principles

• Soft-decision decoding utilizes token-level reliability information.
• Calibrating watermark channels to a fixed hit rate improves decoding.
• Multi-bit watermarks enable richer provenance information.

Method

CORE-BREW calibrates the watermark channel to a fixed hit rate "p-star" to derive per-token log-likelihood ratios (LLRs), enabling principled soft-decision decoding. It supports Strict-Safe and FPR-Calibrated detection modes.

In practice

• Implement LLR-based soft decoding for robust LLM watermarking.
• Utilize FPR-Calibrated mode for flexible FPR-TPR trade-off analysis.
• Integrate multi-bit watermarks for detailed content attribution.

Topics

• LLM Watermarking
• Multi-bit Watermarking
• Soft-Decision Decoding
• Log-Likelihood Ratios
• Text Provenance
• FPR Control

Code references

• lancopku/codable-watermarking-for-llm
• lilakk/PostMark
• XuandongZhao/Unigram-Watermark
• xiaojunxu/learning-to-watermark-llm
• xiaojunxu/multi-bit-text-watermark

Best for: Research Scientist, AI Scientist, NLP Engineer, AI Security Engineer

Related on AIssential

• Mind the Unseen Mass: Unmasking LLM Hallucinations via Soft-Hybrid Alphabet Estimation — SHADE improves LLM uncertainty quantification by adaptively fusing missing-mass extrapolation and spectral graph analysis, especially with few samples.
• Highly Efficient and Effective LLMs with Multi-Boolean Architectures — Direct finetuning LLMs in the Boolean domain with multi-kernel parameters enhances efficiency and performance.
• LLM Self-Recognition: Steering and Retrieving Activation Signatures — LLMs can reliably self-recognize their outputs, a capability enhanced by sparse internal activation steering for robust attribution.
• HarDBench: A Benchmark for Draft-Based Co-Authoring Jailbreak Attacks for Safe Human-LLM Collaborative Writing — LLMs are vulnerable to draft-based jailbreaks in co-authoring, necessitating new safety benchmarks and alignment methods.
• AlgoVeri: An Aligned Benchmark for Verified Code Generation on Classical Algorithms — Vericoding LLM performance varies significantly across formal verification systems and problem complexity, with frontier models excelling at iterative repair.
• From Tokens to Steps: Verification-Aware Speculative Decoding for Efficient Multi-Step Reasoning — SpecGuard enhances LLM reasoning by verifying entire steps using internal model signals, improving accuracy and reducing latency.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Takara TLDR - Daily AI Papers.