Linguistic Holonomy and Statistical Watermarks: Inner Geometry of Meaning-Preserving Transformations
arXiv:2608.193692026-08-21
For AI text watermarks, where you edit matters more than how much you edit
Statistical watermarks that mark AI-generated text work by picking among near-synonymous words, which makes them vulnerable to paraphrasing or translation that changes wording but keeps meaning. Prior work judged such attacks only by the endpoint similarity between original and rewritten text, but this paper proves that measure is the wrong one. Using a geometric formalism, the author shows the surviving watermark signal depends on where edits land, not just how many, and confirms this to three decimal places.
What they did
- The paper models chains of meaning-preserving rewrites (translation, paraphrase, etc.) as 'linguistic loops' and shows that even when a text returns to its original meaning, the path it wandered through leaves a separate, measurable trace
- A previously proposed invariant called the 'signature' is proven to collapse into a single number (a rank), while the real information lives in a quantity called 'holonomy' -- how much a direction rotates after being carried along the path on a sphere, mathematically equivalent to the Wilson loop from lattice gauge theory
- The paper proves an exact identity: for green-list, unigram, and exponential watermark detectors, the residual detection statistic is proportional to how many positions still have their full 'seeding window' (the preceding tokens used to decide the mark) intact
- Experiments confirm that at the same overall edit rate, the surviving watermark signal can be one half, one quarter, or exactly zero of the original, depending only on how the edited positions are arranged (errors of 0.3-0.8%)
- In real round-trip translation chains generated with a 0.5B instruction-tuned model (90 passages), two chains ending at nearly identical meaning retained 99.8% and 28.5% of the watermark signal respectively
Table 1: Synoptic table of the families of text watermarks. The last column is the one that matters for this article: in every family except the Unigram scheme, an edit damages not only the position it touches but every position that used it as seeding context. It is this asymmetry which the geometry of Section 4 and the identity of Section 5 make precise.| Family | Mechanism | Context h | Output law | What an edit destroys |
|---|
| Green list [7] | logit bias | ≥1 | perturbed | token and its h predecessors |
| Unigram [15] | logit bias | 0 | perturbed | the token alone |
| Exponential [10, 2] | sampling rule | ≥0 | exact | token and seeding context |
| Tournament [5] | sampling rule | ≥1 | exact | token and seeding context |
| Semantic [6] | sentence partition | — | perturbed | the sentence embedding |
Table 2: This table summarizes the independence of the endpoint and path data, in dimension n=64. All seven chains share the same first and last state, so the semantic deficit is constant to the last recorded digit; the holonomy energy is not. Note also that the signature, in the last column, moves in steps and is constant on pairs of rows, exactly as Proposition 3.1 predicts it must.| detours | δ𝒰 | η(𝒰) | sign(In−R𝒰∗) |
|---|
| 0 | 0.12241744 | 0.0000 | (2,0,62) |
| 1 | 0.12241744 | 0.2454 | (2,0,62) |
| 2 | 0.12241744 | 0.5190 | (4,0,60) |
| 3 | 0.12241744 | 0.6898 | (4,0,60) |
| 4 | 0.12241744 | 0.8260 | (6,0,58) |
| 5 | 0.12241744 | 0.9427 | (6,0,58) |
| 6 | 0.12241744 | 1.0465 | (8,0,56) |
Table 3: Residual detector statistic, as a fraction of the original, for the green-list scheme with h=1 under three edit patterns of identical retention rate. Counting the intact-window set directly from each edit pattern, Theorem 5.1 predicts 0.947,0.897,0.797,0.697,0.597,0.496 for the middle column and 0.902,0.802,0.602,0.401,0.201,0.000 for the right-hand one. The largest discrepancy is 0.008 and the typical one 0.003, over 120 sequences per cell; and the periodic pattern at ρ=0.5 is predicted to give exactly zero, and does.| ρ | independent | contiguous block | periodic |
|---|
| 0.95 | 0.904 | 0.947 | 0.903 |
| 0.90 | 0.806 | 0.897 | 0.802 |
| 0.80 | 0.637 | 0.795 | 0.595 |
| 0.70 | 0.492 | 0.697 | 0.399 |
| 0.60 | 0.362 | 0.594 | 0.196 |
| 0.50 | 0.247 | 0.488 | −0.005 |
Table 4: The six chains; medians over the ninety passages of the three schemes, except the last column, which counts the chains still detected above z=4. Ordered by semantic deficit, every column moves monotonically: the meaning drifts, the path lengthens, the surface is retained less and the mark fades, all together. That is precisely why the endpoint alone cannot be read as a measure of attack strength, and why the test below holds it fixed.| chain | L | δ𝒰 | η(𝒰) | ρ | |I|/T′ | residual | detected |
|---|
| Spanish | 2 | 0.064 | 0.083 | 0.767 | 0.679 | 0.680 | 84/90 |
| German | 2 | 0.071 | 0.092 | 0.733 | 0.651 | 0.633 | 83/90 |
| French | 2 | 0.073 | 0.094 | 0.722 | 0.616 | 0.625 | 82/90 |
| German twice | 4 | 0.082 | 0.101 | 0.692 | 0.598 | 0.591 | 82/90 |
| German, French | 4 | 0.109 | 0.118 | 0.644 | 0.531 | 0.554 | 67/90 |
| French, German, Spanish | 6 | 0.116 | 0.129 | 0.594 | 0.501 | 0.496 | 66/90 |
Table 5: Theorem 5.1 against the 538 chains whose statistic is finite; medians. The measured intact-window fraction predicts the median residual to within one hundredth for the context-free scheme, three for the green-list scheme and seven for the exponential one. The independent-edit corollary ρh+1, which needs no measurement of the attacked text at all, happens to fall closer for the green-list scheme and much further for the exponential one, where it is off by twelve hundredths; and chain by chain it is the measured fraction that follows the residual, correlating +0.67 with it against +0.54 for the retention rate. The median absolute error per chain is 0.083, 0.054 and 0.088, which the length correction of (6.1) moves to 0.086, 0.067 and 0.081: at this depth of translation the length is preserved in the median, and the correction has little to do.| scheme | h | ρ | ρh+1 | |I|/T′ | Tatt′/T0′ | (6.1) | observed |
|---|
| green-list | 1 | 0.700 | 0.490 | 0.542 | 0.972 | 0.553 | 0.509 |
| unigram | 0 | 0.694 | 0.694 | 0.694 | 0.972 | 0.708 | 0.685 |
| exponential | 1 | 0.692 | 0.478 | 0.531 | 0.978 | 0.535 | 0.601 |
Table 6: The preregistered regression. The predictors are standardised, so that the coefficients may be compared; the corrected threshold is 3.3×10−3. The last column is a robustness check which the clause did not ask for: the same coefficient with a standard error clustered on the base passages, of which there are only thirty, so that the check is a severe one. Under it the unigram scheme still clears the threshold and the green-list scheme no longer does.| scheme | n | R2 | βρ | βδ | βη | pη | clustered |
|---|
| green-list | 180 | 0.41 | +0.051 | −0.023 | −0.070 | 1.7×10−3 | 3.5×10−2 |
| unigram | 180 | 0.49 | +0.064 | +0.278 | −0.145 | 4.0×10−9 | 8.2×10−4 |
| exponential | 178 | 0.34 | +0.116 | −0.060 | −0.014 | 0.74 | 0.77 |
Table 7: Every numerical claim of Section 6 and the run that produced it. Directory names are the script name prefixed by run_ and suffixed by the stamp of the third column, under 7. Results/Article_LLW/. The corpus was built in three successive invocations, each carrying forward the chains of the one before, so that an interruption on a machine of this size would cost at most one of them; the stamp given is that of the last, whose manifest records the provenance of the other two. The final row is the targeted re-audit of the records which had failed to regenerate, discussed below.| result | script | run stamp |
|---|
| Props. 3.1, 4.2, Cor. 4.3 | exp_geometry_v1 | 20260819T135822 |
| Thm. 5.1, Cor. 5.2, Prop. 5.3 | exp_decay_v1 | 20260819T135047 |
| detector calibration | exp_detector_validation_v1 | 20260819T141737 |
| watermarked corpus and chains | exp_corpus_v1 | 20260819T154350 |
| loop invariants of the chains | exp_indicators_v1 | 20260819T161524 |
| the preregistered test | exp_analysis_v1 | 20260819T163238 |
| audit of the regeneration | exp_corpus_v1 | 20260819T174004 |
Why it matters
As AI-text labeling rules (like the EU AI Act's Article 50 disclosure requirement) take effect, showing that the standard way of measuring watermark robustness is flawed has direct implications for regulation and deployment. The finding that an attacker who simply knows the context window size can zero out detection while keeping most of the text intact exposes a structural weakness in currently deployed watermarking schemes.
Terms in this paper
- statistical watermark · a hidden, statistically detectable signal embedded in AI-generated text
- green-list scheme · a watermarking method that uses a secret key and preceding tokens to mark part of the vocabulary as 'green' and biases generation toward it
- seeding window · the span of preceding tokens used to determine whether the next token counts as green or not
- holonomy · the amount a direction is rotated after being parallel-transported around a closed loop on a curved surface, capturing the geometry of the path itself
- Wilson loop · a quantity from lattice gauge theory computed along a closed path, capturing path-dependent geometric information
Original abstract (English)
Statistical watermarks for language models live in the freedom of the signifier: they choose among tokens that are nearly equivalent in meaning, and they are therefore eroded by exactly those transformations which move the form of a text while leaving its content in place. The literature measures such transformations by their endpoint, through the semantic similarity between the original and the rewritten text. We show that the endpoint is the wrong statistic. Adapting the formalism of linguistic loops, we prove that the invariant of a chain of meaning-preserving transformations factorises canonically into an endpoint part and a holonomy in the stabiliser of the initial state, the second of which the semantic deficit cannot see; the loop rotation is parallel transport on the unit sphere of the embedding space, so that the analogy with the Wilson loop becomes a theorem rather than a figure of speech. On the side of the detector we prove an exact identity: the residual statistic is proportional to the number of positions whose seeding window survived intact, from which the decay law $\rho^{h+1}$ follows as the independent-edit corollary. The identity has a disconcerting consequence, which we confirm to three decimal places: at one and the same retention rate the surviving signal may be one half of the original, one quarter of it, or exactly nothing, according only to where the edits fall.
Authors · Daniele Corradetti
Read on arXiv