To Reviewer CfYA

W1&W2: Performance may degrade for low-entropy/specialized domains

We greatly appreciate the reviewer's insightful question regarding the structural assumptions and generalizability. To systematically assess the impact of this design on text generation quality across different domains (especially specialized fields), we evaluated our method against the KGW-Min baseline using the LLAMA2-7B model. The evaluation was performed on various datasets, including general, news, biomedical, legal, and financial texts. We compared the PPL (using LLAMA2-7B as the oracle model, which represents the original unwatermarked generation logic), as shown in the table below:

In response to the reviewer’s concern, we also conducted experiments on well-established low-entropy text datasets, specifically for code generation tasks (HumanEval, MBPP), using the StarCoder2-7B model. The results are summarized below:

By consistently outperforming or matching the baseline across the vast majority of domains, these results provide strong empirical evidence that our approach generalizes effectively without compromising semantic coherence.

Q1: How robustness trade-off varies with window size.

We thank the reviewer for this important and practical question. Below, we present our parameter discussion on how the SEEK trade-off varies with window size.

Specifically, the difficulty of spoofing attacks increases exponentially with h, while erasure robustness is positively correlated with the expected collision rate (as detailed in Proposition 4.1/4.2). Our core design principle is as follows: use a sufficiently large h to resist spoofing attacks, while adjusting d to achieve the desired hash collision probability, thereby enhancing erasure robustness.

Our core design principle is as follows: use a sufficiently large h to resist spoofing attacks, while adjusting d to achieve the desired hash collision probability, thereby enhancing erasure robustness. Specifically, the difficulty of spoofing attacks increases exponentially with h, while erasure robustness is positively correlated with the expected collision rate (as detailed in Proposition 4.1/4.2). Since the UNIGRAM scheme represents an extreme case of our method, we explicitly advise against such extreme configurations. The paper configuration of (h=6, d=6) represents a choice based on this principle.

First, the primary role of increasing the window size h is to exponentially increase the statistical complexity for spoofing attacks. A larger h forces an attacker to learn a vastly larger mapping from context to output, dramatically raising the cost of an attack. As the table below illustrates, the number of probability vectors required to reproduce a statistical attack grows explosively with h. When reproducing a statistical attack with h > 8 in the experiment, the number of required probability vectors exceeds 180 million, which exceeds the cache capacity of our current hardware.

Additionally, we conducted experiments and employed the LLAMA2-7B model to generate text sequences on C4-Eval, applied a scrubbing attack using GPT (TP@1%), and conducted a spoofing attack using statistical methods (FPR@0.1%).

We conducted additional experiments and employed the LLAMA2-7B model to generate text sequences of at least 200 tokens on C4-Eval, applied a scrubbing attack using GPT (TP@1%), and conducted a spoofing attack using statistical methods (FPR@0.1%).

Future work will include further parameter ablation studies and attempts to mathematically prove

The results provide evidence that the number of probability vectors an attacker must learn expands dramatically with h, rendering large-scale statistical spoofing attacks computationally infeasible.

Q2：Generalization Across Model

To empirically validate this, we conducted a new set of experiments across three models of varying scales (0.5B, 7B, and 32B). We evaluated robustness against ChatGPT attacks. The results (AUROC / TP@1% / TP@5% ) are summarized below:

As the table demonstrates, SEEK exhibits strong and consistent robustness on both the 0.5B, 7B, and 32B models, confirming its scalability. The slightly lower performance on the 0.5B model is attributed to the lower intrinsic coherence of its generated text. This content is more susceptible to substantial rewriting when subjected to a scrubbing attack by a vastly more powerful model (ChatGPT, >175B), which can more easily disrupt the watermark's structure.

W3& Q3：Comparison with Related Work.

We sincerely thank the reviewer for this insightful question regarding the scope of our baselines. Our work is specifically focused on addressing the scrubbing-spoofing trade-off within the dominant paradigm of token-level watermarking. We therefore prioritized direct comparisons with the most representative methods in this category, namely the KGW-family. Here we discuss other related excellent works you mentioned:

1. UNIGRAM: We agree on UNIGRAM's relevance and have already included it as a baseline in our analysis (see Figure 1). UNIGRAM can be considered a special case of KGW (h=0). However, it completely sacrifices spoofing resistance for scrubbing robustness and has been shown to be highly vulnerable to in multiple studies [1, 15, 17, 23].

2. CATER: This method represents an earlier traditional technical paradigm based on deterministic, rule-based substitution. It relies on predefined synonym rules and linguistic triggers rather than modifying the model's probabilistic output, as KGW-family methods do. Its primary threat model involves an adversary reverse-engineering and removing these rules, and it does not address spoofing attacks.

3. SemStamp/SIR (Sentence-Level Methods): Methods like SemStamp belong to another line of research: sentence-level watermarking. We did not select them as direct competitors for several key reasons:

   • Additional Overhead: They typically require an external encoder for both generation and detection, introducing significant computational costs.
   • Low Statistical Efficiency: Operating at the sentence level, they require impractically long texts to achieve acceptable detection performance (e.g., SemStamp has an FPR of ~1%), and their z-score p-value approximation is only accurate with a large number of sentences, a condition rarely met in practice.
   • Vulnerability to Fragment Attacks: They are not robust against paragraph-level manipulations like copy-paste attacks (as shown in our Table 8).
   • The state-of-the-art spoofing attacks [17] used in our evaluation are specifically designed for token-level schemes.

   Therefore, while the methods you mentioned are all significant contributions, their different technical paradigms and threat models place them outside the scope of our direct comparative analysis. We will expand our Related Work section in the final manuscript to discuss these distinctions more thoroughly and better situate our contribution.

W4: Ablation Study.

We sincerely appreciate the reviewer's valuable suggestion. Although ablation analysis is not presented as a standalone section, the core structure of our paper is inherently organized as a step-by-step ablation study. We begin with the standard KGW method and initially introduce the "equivalent texture key" mechanism by reducing the hash space. The experimental results in Table 1 and Figure 2 demonstrate the effectiveness of this component in improving the trade-off. Next, we discuss the potential compromise in text generation quality introduced by this component. To address this issue, we introduce the "sub-vocabulary decomposition," which culminates in the final SEEK method. The results in Figure 3 further validate that this component successfully restores text quality.

Thank you for guiding us toward a clearer and more polished presentation!

To Reviewer kvdR

We sincerely thank you for your detailed and constructive feedback. Below, we address your questions and weaknesses.

Q1: How is the vocabulary partitioned into sub-vocabularies.

Sorry for the confusion. The sub-vocabulary partitioning depends on the key ξ, ensuring that, without the key, an attacker cannot predict the sub-vocabulary of any given token. To avoid potential ambiguity, we will provide further clarification in both the main text and the algorithm in a later version.

W2&Q2: An implicit trade-off exists and should be explicitly analyzed.

Thank you for pointing this out. We would first like to clarify that the trade-off between robustness to scrubbing and spoofing in our work reflects movement along a Pareto frontier.

We fully acknowledge that such a trade-off also exists within SEEK, and we do not claim otherwise in our paper. However, we would like to re-emphasize our key contribution: SEEK breaks the existing trade-offs observed in the KGW-family, which are widely believed to be governed by window size, and expands the boundary of the previous Pareto frontier.

Notably, SEEK with d=6,h=6 achieves strong performance on both fronts (about 0.98 AUROC against ChatGPT-scrubbing and about 0.1 FPR@0.1% against spoofing), which demonstrates that it is practically viable for real-world deployment scenarios.

As with any method, it is important to avoid arbitrary hyperparameter choices—in SEEK’s case, the parameters d and h play a critical role. The difficulty of spoofing attacks increases exponentially with h, while scrubbing robustness is positively correlated with the expected collision rate (as detailed in Proposition 4.1/4.2). Our core design principle is: use a sufficiently large h to resist spoofing attacks, while adjusting d to achieve the desired hash collision probability, thereby enhancing scrubbing robustness.

The perspective you raised in Q2-1 is correct. As we mentioned in the paper, UNIGRAM is an extreme case of our method. When the difference between d and h becomes too large (like d << h or d >> h), SEEK will degenerate into UNIGRAM. Therefore, we explicitly advise against such extreme configurations.

In practice, we generally offer the following recommendations for parameter settings:

1. Avoid Extreme Parameter Configurations: We do not recommend using excessively disparate h and d values, as this causes the SEEK design to degrade to h=0, losing its advantage in balancing both robustness types. A d ≈ h configuration is generally a more balanced starting point.
2. Prefer Larger h Values: A larger watermark window h exponentially increases the difficulty of statistical spoofing attacks. We recommend deploying the watermarking scheme with a larger h to significantly raise the cost for potential attackers.

We conducted additional experiments and employed the LLAMA2-7B model to generate text sequences of at least 200 tokens on C4-Eval, applied a scrubbing attack using GPT (TP@1%), and conducted a spoofing attack using statistical methods (FPR@0.1%).

The default parameter configuration of (h=6, d=6) mentioned in the paper is a reasonable experimental setting based on this principle. The table below demonstrates its generalizability across various datasets.

With the current parameter settings, we achieve a superior Pareto frontier by delivering a much better balance of robustness than the baseline. Future work will include further parameter ablation studies and attempts to mathematically prove the optimal solution under attacks.

We hope this detailed analysis and the additional experiments have addressed your concerns and clarified the contributions of our work.

W3&Q6 : Time Cost in Watermarking.

In watermark text generation, methods modifying logits directly (e.g., SEEK, KGW, SWEET) are highly efficient. And, the primary time cost of watermark deployment still arises from the forward propagation of the large language model itself. To validate this, we conducted empirical timing tests in the following environment:

• Hardware: NVIDIA A40-48GB
• Language Model: LLAMA2-7B
• Configuration: batch_size=1, temperature=1.0, torch_seed=42, num_beams=1, gamma=0.25
• Data: Averaged over 500 prompts from the C4 dataset

Q3-1: Clarification on P-SP Scores.

We sincerely appreciate your insightful question regarding the P-SP scores. We would like to clarify a key distinction regarding the context in which the P-SP scores are evaluated.

In the referenced work [29], the threshold "P-SP > 0.7" is applied in their work to evaluate the quality of human scrubbing attacks. Specifically, it compares (watermarked text) vs. (human-scrubbed text) to select more meaning-preserving attack samples, ensuring that the attack is high-precision.

In contrast, our experiment in Figure 6 is designed to measure whether there is a significant gap in the semantic deviation introduced by different watermarking schemes, which we assess by comparing (watermarked text) vs. (unwatermarked text). In fact, the study in [29] also conducts a similar experiment, as shown in Figure 11 [29], comparing P-SP scores between watermarked and non-watermarked texts. The results indicate that the P-SP scores are similarly well below 0.7 (typically <0.5), and decrease further with increasing watermark strength (z-score). Additionally, in Section A5 of [29], it is stated that "We note that the drift between human text and unwatermarked text can be estimated as just under 0.50 P-SP”. Even considering high-quality human-generated text, the P-SP score between such text and unwatermarked text is still below 0.7. Therefore, it is reasonable that watermarked texts cannot reach the threshold, and the P-SP scores reported in Figure 6 of our paper fall within a reasonable range.

W1&Q3-2: Concerns about the text quality evaluation.

Our choice of OPT-2.7B as the oracle model follows the experimental setup established in seminal prior work, such as KGW [28] (see Section 6) and WaterMax [16]. As noted in [16], “while absolute perplexity values may differ depending on the oracle model, the relative performance between different watermarking algorithms remains consistent. Using a common oracle like OPT-2.7B is therefore recommended to ensure comparability with state-of-the-art methods”.

To fully address your concern and provide even stronger evidence, we have included a new evaluation within our generalizability study that we evaluated our method against the KGW-Min using the LLAMA2-7B model to systematically assess PPL across different domains (using the base model as its own oracle provides the most direct measure of distributional shift). As shown in the table below:

In response to your concern, we also conducted experiments on well-established low-entropy text datasets like code generation tasks (HumanEval, MBPP), using the StarCoder2-7B model. The results are summarized below:

By consistently outperforming or matching the baseline across the vast majority of domains, these results provide strong empirical evidence that our approach generalizes effectively without compromising semantic coherence.

W4: Diversity Metric in SEEK.

Thank you for your question. The diversity metric for SEEK is already included in Figure 3 of the paper.

W5: Delta Parameter Settings.

We selected a larger value for δ in line with the parameter settings used by [26] for more challenging spoofing attacks on the victim’s watermark model M. As you correctly noted, a larger δ generates a stronger watermark signal, which creates a more favorable condition for the attacker, who can then learn the watermark pattern with fewer queries. We adopted this setting, which means our defense (the SEEK method) was evaluated under a more challenging and stringent scenario.

We agree that such a delta might not be the first choice in a practical deployment where text quality is the priority. However, it still ensures fairness in experimental comparisons as long as delta is kept consistent across all methods. And all experimental conclusions drawn remain valid.

As mentioned in our previous responses, we have already provided evaluations of text quality (PPL) for the more practical settings of δ=2 and δ=4.

If our responses address your concerns, we would be grateful if you would consider raising your final rating to a higher score.

We will amend the experiment setting section to explicitly state that h and d should be chosen dependently and give clear guidance for parameter selection to prevent degeneration.

You should also emphasize this when introducing the algorithm—e.g., by including a remark. This dependency is essential for SEEK to remain robust against spoofing and scrubbing attacks. For example, the statement on line 191, "On the other hand, reducing the hash space size does not influence the watermark window size, thereby maintaining similar spoofing resistance," is potentially misleading as we discussed. Please revise this in Section 4 to clarify the interaction between these parameters and the robustness of the method.

using the base non-watermarked model as the oracle I am not suggesting using the non-watermarked model as the oracle. Rather, you should use a fixed, strong model—such as LLaMA2-13B—as the oracle for all evaluations to ensure consistency and fairness.

For the diversity results, please include them in the experimental section as well.

Overall, I believe the rebuttal adequately addresses my concerns, and I will increase my score. Please incorporate these changes into the final version of the paper.

To Reviewer 8aZQ

W1: Explanation of the tradeoff may confuse readers.

Thank you for your valuable feedback, and your understanding is indeed correct. One perspective presented in [26] is that once the watermark is stolen, the attacker can perform spoofing and then use the stolen watermark for assisted scrubbing attacks. However, the scrubbing attacks in [26] are not as effective as those from LLMs like ChatGPT. If strong spoofing is not achieved, the scrubbing process becomes less efficient and thus unsuitable as a robust scrubbing method. Due to limitations in paper length and computational resources, we primarily used [26] as a spoofing test method in the earlier version of our paper. To address any potential for confusion, we will revise the manuscript introduction section to articulate the explanation of [26] and our core motivation more clearly.

Q1&W2: What parameter choices are obviously bad.

Thank you for your valuable feedback. Here, we present our design philosophy for parameter guidance.

Specifically, the difficulty of spoofing attacks increases exponentially with h, while erasure robustness is positively correlated with the expected collision rate (as detailed in Proposition 4.1/4.2). Our core design principle is: use a sufficiently large h to resist spoofing attacks, while adjusting d to achieve the desired hash collision probability, thereby enhancing erasure robustness.

The insight you raised in W2 is indeed correct. As we mentioned in the paper, UNIGRAM is an extreme case of our method. When the difference between d and h becomes too large(like d >> h), SEEK will degenerate into UNIGRAM. If an attacker has access to the actual parameters of the watermarking scheme, they could exploit the degenerated watermark in the same way as attacking UNIGRAM. As with any method, it is important to avoid arbitrary hyperparameter choices. Therefore, we explicitly advise against such extreme configurations.

In summary, we offer the following recommendations：

1. Avoid Extreme Parameter Configurations: We do not recommend using excessively disparate h and d values, as this causes the SEEK design to degrade to h=0, losing its advantage in balancing both robustness types. A d ≈ h configuration is generally a more balanced starting point.
2. Prefer Larger h Values: A larger watermark window h exponentially increases the difficulty of statistical spoofing attacks. We recommend deploying the watermarking scheme with a larger h to significantly raise the cost for potential attackers. Additionally, when reproducing a statistical attack with h > 8 in the experiment, the number of required probability vectors exceeds 180 million, surpassing the cache capacity of our current hardware.

We conducted additional experiments and employed the LLAMA2-7B model to generate text sequences of at least 200 tokens on C4-Eval, applied a scrubbing attack using GPT (TP@1%), and conducted a spoofing attack using statistical methods (FPR@0.1%).

While the principles above provide a framework for tuning, deriving a single parameter set that is provably optimal across all datasets, domains, and evolving attack models is a formidable theoretical challenge. Future work will include further parameter ablation studies and attempts to mathematically prove the optimal solution under attacks. The parameter configuration of (h=6, d=6) mentioned in the paper is a reasonable experimental setting based on this principle. The table below demonstrates its generalizability across various datasets.

We hope these additional experiments and clarifications address your concern.

Q2：FPR Metric in Figure 2.

Thank you for your question. In Figure 2, the vertical axis uses FPR@1e-3 to represent the success rate of the spoofing attack. We are uncertain where the value "1e-2" you refer to appears. Could you please give more information?

Q3: Other Writing Improvements.

Thank you for your feedback. We will make the following revision to the paper:

• We will change "1e-2" to "1%" in the next version.
• The spoofing robustness gains were calculated by comparing SEEK against KGW-MIN (h=4) under statistics-based spoofing attacks, using the FPR@0.1% metric. We acknowledge that the basis for the scrubbing robustness gains was not clearly specified. To rectify this and improve clarity, we will revise this claim in the final manuscript. The gain will be defined as the improvement of SEEK over KGW-MIN (h=4) on the TP@1% metric under the DIPPER-I attack. Based on Table 2, this will update the abstract to: "achieving scrubbing robustness gains of +10.8% on WikiText, +13.4% on C4, and +8.6% on LFQA, respectively."

We recognize that there are some inaccuracies and errors in the article, which will be corrected in subsequent editions. Thank you for guiding us toward a clearer and more polished presentation!

To Reviewer 7bZb

We sincerely thank you for your detailed and constructive feedback. Your comments have helped us identify key areas for clarification and improvement. Below, we address your questions and the noted weaknesses.

Q2&W1&W4: Could the authors provide an empirical study or qualitative examples across different domains?

To systematically assess the impact of this design on text generation quality across different domains, we compared our method with the KGW-Min baseline using the LLAMA2-7B model. The evaluation was performed on various datasets, including general, news, biomedical, legal, and financial texts. We compared the PPL (using LLAMA2-7B as the oracle model), as shown in the table below:

Furthermore, to address the concern about specialized, low-entropy text, we evaluated SEEK on code generation tasks (HumanEval, MBPP) using the StarCoder2-7B model. The results are summarized below:

By consistently outperforming or matching the baseline across the vast majority of domains, these results provide strong empirical evidence that our approach generalizes effectively without compromising semantic coherence.

Q1&W3: More advanced or adaptive spoofing strategies.

We understand your concerns regarding the robustness of SEEK against other attacks.

In our work, we adopted attack strategies that are widely recognized in the community. Specifically, for scrubbing attacks, we followed the setup of [29]; for spoofing attacks, we employed the statistical method [26] and the distillation-based method [17], both of which are considered among the most effective.

We opted not to include “token-level substitution” attacks, as prior work has shown them to be less effective compared to the attacks we considered (like LLMs or DIPPER, which even perform reorder attacks). Regarding “gradient-based spoofing”, we surveyed recent literature but did not find a standard, widely adopted attack of this nature that directly applies to our watermarking framework. We would be grateful for any specific references you might suggest, and we will gladly incorporate them into our work. Given the scope of this paper, we prioritized a thorough evaluation against the community's most well-defined threats.

Thank you for this valuable suggestion regarding additional attack strategies. Given the scope of this paper, we prioritized a thorough evaluation against the community's most well-defined threats due to space and computational constraints. We agree that exploring a broader range of attacks is a crucial next step, and we have noted this as a key direction for future work.

W2: The advancement is incremental rather than fundamentally transformative.

We concur with your observation that our work is built upon the KGW framework. Indeed, the KGW framework serves as the foundation for most watermarking techniques, such as UNIGRAM [52], which can be seen as a special case of KGW for h=0, and SWEET [32], which can be viewed as a variant of KGW for low-entropy tokens only. However, this does not diminish the significance of these contributions within the field. While our approach is rooted in KGW, its underlying insights provide a novel perspective.

W5：Provide guidance for selecting parameters in practice.

We thank you for this important and practical question. Below, we present our design philosophy for parameter guidance.

Specifically, the difficulty of spoofing attacks increases exponentially with h, while erasure robustness is positively correlated with the expected collision rate (as detailed in Proposition 4.1/4.2). Our core design principle is as follows: use a sufficiently large h to resist spoofing attacks, while adjusting d to achieve the desired hash collision probability, thereby enhancing erasure robustness.

As we mentioned in the paper, UNIGRAM is an extreme case of our method. When the difference between d and h becomes too large, SEEK degenerates into UNIGRAM. Therefore, we explicitly advise against such extreme configurations.

In summary, we offer the following recommendations：

1. Avoid Extreme Parameter Configurations: We do not recommend using excessively disparate h and d values, as this causes the SEEK design to degrade to h=0, losing its advantage in balancing both robustness types. A d ≈ h configuration is generally a more balanced starting point.
2. Prefer Larger h Values: A larger watermark window h exponentially increases the difficulty of statistical spoofing attacks. We recommend deploying the watermarking scheme with a larger h to significantly raise the cost for potential attackers. Additionally, when reproducing a statistical attack with h > 8 in the experiment, the number of required probability vectors exceeds 180 million, surpassing the cache capacity of our current hardware.

We conducted additional experiments and employed the LLAMA2-7B model to generate text sequences of at least 200 tokens on C4-Eval, applied a scrubbing attack using GPT (TP@1%), and conducted a spoofing attack using statistical methods (FPR@0.1%).

While the principles above provide a framework for tuning, deriving a single parameter set that is provably optimal across all datasets, domains, and evolving attack models is a formidable theoretical challenge. Future work will include further parameter ablation studies and attempts to mathematically prove the optimal solution under attacks. The parameter configuration of (h=6, d=6) mentioned in the paper is a reasonable experimental setting based on this principle. The table below demonstrates its generalizability（TP@1%/FPR@0.1%） across various datasets.

We hope these additional experiments and clarifications address your concern. Thank you for guiding us toward a clearer and more polished presentation!