Reconciling Privacy with Provenance for Language Model Watermarks

Reconciling Privacy with Provenance for Language Model Watermarks

Authors Elise L. Han and Tatsunori Hashimoto argue that language-model watermarks can protect privacy while estimating aggregate usage, if watermarking aims to measure population frequencies rather than track individuals. They say users’ concerns about fine-grained tracking have encouraged evasion, including paraphrasing that can remove watermark signal. Their approach uses locally differentially private watermarks, which limit the evidence any individual text contributes to detection, and introduces the Red-Green Sequence (RGS) watermark. The authors report accurate frequency estimation at high privacy levels across various models, sample sizes and generation entropies. On C4 language modeling tasks, they report 0.0019 MSE and 0.0038 mean absolute bias at ε of 1; for an essay-writing task with 100 text samples, they report 0.0113 MSE and 0.004 mean absolute bias at ε of 2. These results concern the settings described in the abstract; they do not by themselves establish how the method performs in deployment. The proposal matters because it reframes watermarking from identifying individual use to estimating how common language-model use is, while limiting each text’s contribution to detection.

Publication: da9a9103-f2ba-4e4e-8e2c-117a6c90ac7d

attribution — pass: The reading correctly credits Elise L. Han and Tatsunori Hashimoto. It frames the reconciliation thesis, the RGS method and the numeric results as the authors' claims and reports, not as established fact.

Authors:Elise L. Han, Tatsunori Hashimoto

summary — uncertain: The reading is faithful but hard for a general reader to follow. It never says what a language-model watermark is (a hidden statistical signal in generated text). It leaves central terms unexplained: locally differentially private, ε (and that a lower ε means stronger privacy), MSE, mean absolute bias, C4 and generation entropies. That makes it hard to judge what 'high privacy levels' and the reported numbers mean. Smallest repair: add one plain-language line each for watermark and ε, and add tooltip entries for local differential privacy, MSE and C4. The title and question are faithful and substantive.

We develop locally differentially private watermarks which provably limit the evidence that any individual text can contribute to detection

date — pass: The originalPublished date of 2026-11-04 matches the arXiv v1 submission date. The 2026-11-05 feed date is correctly not used.

[Submitted on 4 Nov 2026]

support — pass: The claims, figures and conditions (ε of 1 on C4; ε of 2 for the 100-sample essay task) match the abstract. The draft adds a caveat about deployment, which appropriately tempers the authors' 'realistic deployment scenarios' framing. The paraphrasing question follows from the abstract's own statement about evasion and is not a leading claim. The limitation is accurate, since the abstract reports no robustness-to-paraphrasing results.

users engage in evasion strategies such as paraphrasing that can remove much of the watermark signal

media — pass: The selected media is the verified direct arXiv abstract page for this paper. It is the most direct way to reach the source.