FissionGuard: Testing Local Watermark Proportions with FDR Control
Abstract
A watermark detector can flag a text even when only a small fraction of its tokens are watermarked. We study sequential auditing to identify local passages whose watermark proportions exceed a prespecified threshold. Each alarm fixes a candidate passage's endpoint, while its start is chosen from earlier tokens. Reusing the same evidence to locate and test a passage can invalidate inference. We propose FissionGuard, which uses data fission to construct an alarm value and a validation value from each token-level p-value. The alarm values guide alarms and localization. The validation values yield passage-level p-values through partial conjunction, excluding as many of the strongest signals as the proportion null allows. These p-values are used to test the corresponding hypotheses at levels assigned by an online multiple-testing procedure. Under the stated watermark generation model, allowing dependence among token-level p-values at watermarked positions, we prove finite-sample false discovery rate (FDR) control among reported passages at every fixed finite horizon. We also derive a finite-sample lower bound on power for testing nonnull candidates. Experiments on synthetic streams and Mistral and Qwen generations across four marking layouts show gains in watermarked-token coverage over sample splitting, with empirical FDR below the target.
Related
- ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models
- Local dimension testing via quadratic obstructions
- Optimal Watermark Localization in Mixed-Source Large Language Model Texts
- CountScan: Simultaneous Lower Bounds on Historical Watermark Matches over All Text Intervals
- Predictive Likelihood Ratios for Language Model Watermark Detection
BibTeX
@misc{wei2026fissionguard,
title = {{FissionGuard: Testing Local Watermark Proportions with FDR Control}},
author = {Zijian Wei and Yajie Bao and Haojie Ren and Zhen Chen},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.11625},
eprint = {2610.11625},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.11625},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - FissionGuard: Testing Local Watermark Proportions with FDR Control
AU - Zijian Wei
AU - Yajie Bao
AU - Haojie Ren
AU - Zhen Chen
PY - 2026
DA - 2026/10/08
PB - arXiv
DO - 10.48550/arxiv.2610.11625
UR - https://arxiv.org/abs/2610.11625
AB - A watermark detector can flag a text even when only a small fraction of its tokens are watermarked. We study sequential auditing to identify local passages whose watermark proportions exceed a prespecified threshold. Each alarm fixes a candidate passage's endpoint, while its start is chosen from earlier tokens. Reusing the same evidence to locate and test a passage can invalidate inference. We propose FissionGuard, which uses data fission to construct an alarm value and a validation value from each token-level p-value. The alarm values guide alarms and localization. The validation values yield passage-level p-values through partial conjunction, excluding as many of the strongest signals as the proportion null allows. These p-values are used to test the corresponding hypotheses at levels assigned by an online multiple-testing procedure. Under the stated watermark generation model, allowing dependence among token-level p-values at watermarked positions, we prove finite-sample false discovery rate (FDR) control among reported passages at every fixed finite horizon. We also derive a finite-sample lower bound on power for testing nonnull candidates. Experiments on synthetic streams and Mistral and Qwen generations across four marking layouts show gains in watermarked-token coverage over sample splitting, with empirical FDR below the target.
ER -