[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83939-en":3,"doc-seo-83939-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83939,1099514068035,"Ezra","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","Selective Disclosure Watermarking for Large Language Models","Watermarking methods embed imperceptible, verifiable signals into text produced by large language models, enabling detection and metadata embedding. Existing multi-bit schemes lack selective disclosure because verifying any part typically requires revealing the entire payload, causing unnecessary exposure and privacy risks. This work proposes Hierarchical Vocabulary Routing (HeRo), which recursively partitions vocabulary and distributes watermark information across hierarchical layers. Different verifiers decode only the payload portions matching their access level, preserving text quality via unbiased sampling. Experiments show fine-grained access control with high detection accuracy and low latency.","arXiv :2607 .05353v 1 [ cs .CR] 6 Jul 2026  \nSelective Disclosure Watermarking for Large Language Models  \nXuyang Chen 1 Xiang Li 1 Yangxinyu Xie 1 Qi Long 1  \nAbstract  \nWatermarking methods embed imperceptible and verifiable signals into text generated by large language models (LLMs) . Existing approaches include zero-bit schemes for distinguishing synthetic text from human writing and multi-bit schemes for embedding metadata. However, current multi-bit watermarking methods do not allow selective disclosure: verifying any part of the watermark requires revealing the entire embedded message. This lack of control leads to unnecessary information exposure and raises privacy concerns. We propose Hierarchical Vocabulary Routing (HeRo), a watermarking framework that enables selective disclosure of embedded metadata. The method recursively partitions the vocabulary and distributes watermark information across hierarchical layers, so that different verifiers can decode only the portions of the payload corresponding to their access level. We show that the proposed scheme preserves the unbiasedness of the underlying sampling process and thus maintains text quality. Experiments demonstrate that our framework supports fine-grained access control while achieving high detection accuracy and low latency. Code is available at [https://github.com/xuyangc03/hero-watermark](https://github.com/xuyangc03/hero-watermark).  \n1 Introduction  \nThe widespread adoption of large language models (LLMs) has fundamentally transformed content creation across many domains. Their ability to produce high-quality, human-like text at scale brings substantial benefits, but also introduces serious social risks [Bommasani et al., 2021, Weidinger et al., 2021], including academic dishonesty, harmful content generation, and misinformation [Ranade et al., 2021, Huang and Sun, 2023] . Early attempts to distinguish AI-generated text from human writing relied on post-hoc, content-based detectors [Mitchell et al., 2023] . However, these methods (e.g., GPTZero, OpenAI’s Detector) have shown limited effectiveness as LLMs continue to improve [Weber-Wulffet al., 2023] . At the same time, regulators are increasingly emphasizing provider-side content authentication mechanisms, such as transparency and machine-readable marking requirements in the EU AI Act [The European Parliament and the Council of the European Union, 2024, Laux et al., 2024] and emerging state-level regulations in California [California State Legislature, 2024] .  \n1 University of Pennsylvania. Correspondence to: Xuyang Chen \u003C[xuyangc@sas.upenn.edu](xuyangc@sas.upenn.edu) > .  \nWatermarking has emerged as a promising alternative by embedding algorithmically verifiable yet human-imperceptible signals directly into model outputs. A large body of prior work on LLM watermarking [Kirchenbauer et al., 2023, Aaronson and Kirchner, 2024, Zhao et al., 2024, Dathathriet al., 2024] focuses on zero-bit schemes, whose goal is to distinguish LLM-generated text from human writing. While effective for detection, it is essentially a binary classification problem, which is insufficient for many real-world provenance tracking and auditing applications.  \nTo address this limitation, multi-bit watermarking methods [Fernandez et al., 2023, Wang et al., 2024, Yoo et al., 2024, Jiang et al., 2025, Feng et al., 2025] allow providers to embed richer metadata into generated text, such as model versions, timestamps, or user and session identifiers. However, existing designs typically do not support partial verification: any party with access to the verification key can recover the entire embedded payload. In practice, this all-or-nothing disclosure creates a fundamental deployment challenge. Many real systems require two conflicting properties: (1) broad verifiability, so that the public can confirm coarse provenance information, and (2) restricted auditing, so that sensitive metadata can be accessed only by authorized parties. For exam","cbCaiksSIhS9F5Bk","https://ap.wps.com/l/cbCaiksSIhS9F5Bk","pdf",3651873,1,37,"English","en",105,"# Abstract\n# Introduction\n## Motivation: limitations of existing watermarking and detectors\n## Multi-bit watermarking needs fine-grained access control\n## Proposed solution: Hierarchical Vocabulary Routing (HeRo)","[{\"question\":\"Why do existing multi-bit watermarking methods fail to support selective disclosure?\",\"answer\":\"Because partial verification is not supported: any verifier who has access to the verification key must recover the entire embedded payload, leading to all-or-nothing disclosure.\"},{\"question\":\"What is Hierarchical Vocabulary Routing (HeRo) and how does it enable selective disclosure?\",\"answer\":\"HeRo recursively partitions the vocabulary and places watermark information across hierarchical layers. Verifiers decode only the payload portions corresponding to their access level, so deeper metadata remains concealed for lower-authority parties.\"},{\"question\":\"How does HeRo maintain text quality while embedding watermarks?\",\"answer\":\"The scheme preserves the unbiasedness of the underlying sampling process, which helps maintain generation quality even with the hierarchical watermarking structure.\"}]",1784191557,93,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"selective-disclosure-watermarking-for-large-language-models","",{"@graph":35,"@context":84},[36,53,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/selective-disclosure-watermarking-for-large-language-models/83939/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":61,"encodingFormat":60,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":4},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"Why do existing multi-bit watermarking methods fail to support selective disclosure?","Question",{"text":74,"@type":75},"Because partial verification is not supported: any verifier who has access to the verification key must recover the entire embedded payload, leading to all-or-nothing disclosure.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"What is Hierarchical Vocabulary Routing (HeRo) and how does it enable selective disclosure?",{"text":79,"@type":75},"HeRo recursively partitions the vocabulary and places watermark information across hierarchical layers. Verifiers decode only the payload portions corresponding to their access level, so deeper metadata remains concealed for lower-authority parties.",{"name":81,"@type":72,"acceptedAnswer":82},"How does HeRo maintain text quality while embedding watermarks?",{"text":83,"@type":75},"The scheme preserves the unbiasedness of the underlying sampling process, which helps maintain generation quality even with the hierarchical watermarking structure.","https://schema.org",{"og:url":51,"og:type":86,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":88,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,114,119,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},6,"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":105,"slug":137},19,"General","general"]