Search papers, labs, and topics across Lattice.
This paper introduces PURA, a novel multi-bit watermarking method for AI-generated text that achieves unbiased and robust attribution by embedding payloads in the latent sampling space rather than directly perturbing token probabilities. The method ensures that the base generation distribution is preserved while significantly enhancing recovery stability against post-editing and channel perturbations. Experimental results demonstrate that PURA outperforms existing methods, achieving a 91.7% message match rate when embedding 36 bits in 200 tokens, while maintaining text quality and incurring minimal verification overhead.
PURA achieves over three times the message match rate of existing unbiased watermarking methods, all while preserving text quality and speed.
Fine-grained attribution of AI-generated text is becoming increasingly important for accountability and auditing, yet existing multi-bit watermarking methods still struggle to simultaneously preserve the base generation distribution, support high-capacity payloads, and remain recoverable after editing. We present PURA, a provably unbiased and robust multi-bit watermarking method for text attribution. Instead of perturbing token probabilities directly, PURA embeds payloads in the latent sampling space via keyed inverse transform sampling, and recovers them by treating observed tokens as soft interval evidence and aggregating such evidence across the sequence. This design preserves the base generation distribution exactly while substantially improving recovery stability under post-editing and channel perturbations. Building on this recovery paradigm, we further develop a unified robustness analysis and show that, under bounded attack strength, the per-bit error probability decays exponentially with sequence length. Extensive experiments show that PURA substantially outperforms existing unbiased baselines in the high-payload regime. For example, when embedding 36 bits in 200 tokens, PURA achieves a 91.7\% message match rate, more than three times that of the strongest unbiased baseline, while preserving text quality and remaining statistically close to unwatermarked text, and incurring only millisecond-level verification overhead. Our code is available at
