Selective Disclosure Watermarking for Large Language Models

Watermarking methods embed imperceptible and verifiable signals into text generated by large language models (LLMs). Existing approaches include zero-bit schemes for distinguishing synthetic text from human writing and multi-bit schemes for embedding metadata. However, current multi-bit watermarking methods do not allow selective disclosure: verifying any part of the watermark requires revealing the entire embedded message. This lack of control leads to unnecessary information exposure and raises privacy concerns. We propose Hierarchical Vocabulary Routing (HeRo), a watermarking framework that enables selective disclosure of embedded metadata. The method recursively partitions the vocabulary and distributes watermark information across hierarchical layers, so that different verifiers can decode only the portions of the payload corresponding to their access level. We show that the proposed scheme preserves the unbiasedness of the underlying sampling process and thus maintains text quality. Experiments demonstrate that our framework supports fine-grained access control while achieving high detection accuracy and low latency. Code is available at \url{https://github.com/xuyangc03/hero-watermark}.

As AI generated text becomes increasingly common, watermarking offers a promising way to verify its origin by embedding imperceptible statistical signals that can later be decoded to reveal metadata such as the model that produced the text, the generation time, or the associated user. Existing methods, however, are all-or-nothing: verifying any part of the payload exposes everything, which is a problem when different parties should only see what they are authorized to. We propose HeRo, a framework for selective disclosure in large language model watermarking. HeRo recursively partitions the model's vocabulary - the set of words and subwords the model can generate - and distributes message bits across hierarchical layers during generation. Our approach enables fine-grained access control over embedded metadata so each verifier decodes only their permitted portion. This makes watermarking more practical for real world auditing scenarios where verifiers have different levels of authority. To help other researchers explore the idea and better contribute to the community, we have released our code.