{"id":"https://openalex.org/W7204899298","doi":"https://doi.org/10.48550/arxiv.2608.29030","title":"Learning to Follow In-Context Watermark Instructions via Self-Distillation","display_name":"Learning to Follow In-Context Watermark Instructions via Self-Distillation","publication_year":2026,"publication_date":"2026-08-29","ids":{"openalex":"https://openalex.org/W7204899298","doi":"https://doi.org/10.48550/arxiv.2608.29030"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.29030","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.29030","pdf_url":"https://arxiv.org/pdf/2608.29030","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.29030","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5135954954","display_name":"Yepeng Liu","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yepeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124065789","display_name":"Tianyi Chen","orcid":"https://orcid.org/0009-0007-0006-824X","observed_orcids":["https://orcid.org/0009-0007-0006-824X"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Tianyi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137560313","display_name":"Xuandong Zhao","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Xuandong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135989871","display_name":"Dawn Song","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Song, Dawn","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5007990317","display_name":"Yuheng Bu","orcid":"https://orcid.org/0000-0002-3479-4553","observed_orcids":["https://orcid.org/0000-0002-3479-4553"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bu, Yuheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5019999742507935,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5019999742507935,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10388","display_name":"Advanced Steganography and Watermarking Techniques","score":0.3422999978065491,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.05739999935030937,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/self-distillation","display_name":"self-distillation","score":0.7730000019073486},{"id":"https://openalex.org/keywords/watermark-detectability","display_name":"watermark detectability","score":0.5830000042915344},{"id":"https://openalex.org/keywords/reinforcement-learning-from-human-feedback","display_name":"reinforcement learning from human feedback","score":0.6179999709129333},{"id":"https://openalex.org/keywords/llm-as-a-judge","display_name":"LLM-as-a-judge","score":0.7120000123977661}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6973999738693237},{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.6710000038146973},{"id":"https://openalex.org/C164112704","wikidata":"https://www.wikidata.org/wiki/Q7974348","display_name":"Watermark","level":3,"score":0.4584999978542328},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.44839999079704285},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.42010000348091125},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.36730000376701355},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.33079999685287476},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.32109999656677246},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3183000087738037},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3021000027656555},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.2953000068664551},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.29429998993873596},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.2921999990940094},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.2745000123977661},{"id":"https://openalex.org/C57098296","wikidata":"https://www.wikidata.org/wiki/Q12021746","display_name":"Interrogative","level":2,"score":0.27390000224113464},{"id":"https://openalex.org/C2780929884","wikidata":"https://www.wikidata.org/wiki/Q737460","display_name":"Blindness","level":2,"score":0.26980000734329224},{"id":"https://openalex.org/C71139939","wikidata":"https://www.wikidata.org/wiki/Q910194","display_name":"Modal","level":2,"score":0.25769999623298645}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.29030","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.29030","pdf_url":"https://arxiv.org/pdf/2608.29030","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.29030","doi":"https://doi.org/10.48550/arxiv.2608.29030","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.29030","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.29030","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.29030","pdf_url":"https://arxiv.org/pdf/2608.29030","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7140146796","https://openalex.org/W4402672097","https://openalex.org/W4416453496","https://openalex.org/W4392971839","https://openalex.org/W4412945637","https://openalex.org/W4413387654","https://openalex.org/W4415948536","https://openalex.org/W4413925208","https://openalex.org/W4412945330","https://openalex.org/W7208745206"],"abstract_inverted_index":{"In-context":[0],"watermarking":[1,27],"(ICW)":[2],"prepends":[3],"an":[4,148],"instruction":[5,47,72],"to":[6,12,36,165,185,200,205],"a":[7,14,26,66,109,118],"query":[8],"asking":[9],"the":[10,43,46,94,139,154,157,161,167,178,182],"model":[11,37],"embed":[13],"statistically":[15],"detectable":[16],"signal":[17],"in":[18],"its":[19],"response.":[20],"It":[21],"thus":[22],"equips":[23],"LLMs":[24,56,96],"with":[25,134,177],"interface":[28],"that":[29,91],"third":[30],"parties":[31],"can":[32],"invoke":[33],"without":[34,48],"access":[35],"internals.":[38],"Its":[39],"reliability":[40],"hinges":[41],"on":[42,76],"LLM":[44,142],"following":[45],"degrading":[49],"answer":[50,80],"quality,":[51],"yet":[52],"how":[53],"well":[54],"current":[55],"do":[57],"so":[58],"has":[59],"not":[60],"been":[61],"measured.":[62],"We":[63],"introduce":[64],"$\\mathsf{ICWBench}$,":[65],"benchmark":[67],"of":[68,93],"three":[69,102,195],"verifiable":[70],"ICW":[71,127,158,196],"families,":[73],"each":[74],"scored":[75],"both":[77,98,144,214],"detectability":[78],"and":[79,86,124,146,160,187,202,217],"quality.":[81],"Evaluating":[82],"14":[83],"frontier":[84],"proprietary":[85],"open-source":[87],"LLMs,":[88],"we":[89,107],"find":[90],"none":[92],"evaluated":[95],"achieves":[97],"objectives":[99],"across":[100,194],"all":[101],"families.":[103],"To":[104],"address":[105],"this,":[106],"propose":[108],"self-contained":[110],"two-stage":[111],"training":[112],"method,":[113],"requiring":[114],"no":[115,121,125],"distillation":[116],"from":[117,198,203],"stronger":[119],"model,":[120],"manual":[122],"annotation,":[123],"pre-existing":[126],"IF":[128],"ability.":[129],"The":[130,171],"first":[131],"stage,":[132],"self-distillation":[133],"logits":[135,151],"perturbation":[136,152],"(SDLP),":[137],"uses":[138],"same":[140],"base":[141],"as":[143,181],"teacher":[145,155],"student:":[147],"instruction-equivalent":[149],"decoding-time":[150],"makes":[153],"follow":[156],"instruction,":[159],"student":[162],"is":[163],"trained":[164],"match":[166],"teacher's":[168],"output":[169],"distribution.":[170],"second":[172],"stage":[173],"applies":[174],"reinforcement":[175],"learning":[176],"automatic":[179],"verifier":[180],"reward.":[183],"Applied":[184],"Qwen3-14B":[186],"GPT-OSS-20B,":[188],"our":[189],"method":[190],"raises":[191],"average":[192],"TPR@$1\\%$FPR":[193],"instructions":[197],"$0.100$":[199],"$0.974$":[201],"$0.337$":[204],"$0.968$,":[206],"respectively,":[207],"while":[208],"maintaining":[209],"high":[210],"response":[211],"quality":[212],"under":[213],"perplexity":[215],"evaluation":[216],"LLM-as-a-Judge.":[218]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-09-02T00:00:00"}