AGMark: Attention-Guided Dynamic Watermarking for Large Vision-Language Models

AI summary

Overview

Research area: Multimodal AI security and content provenance — specifically watermarking for Large Vision-Language Models (LVLMs), bridging computer vision, natural language processing, and digital rights management. Published at KDD 2026.

Technical level: Advanced. The paper assumes familiarity with transformer attention, auto-regressive decoding, logits-based watermarking (red/green vocabulary lists), token entropy, and nucleus sampling.

Scope: The paper proposes AGMark, a two-stage watermarking framework that dynamically selects visually grounded, semantically critical tokens at every decoding step and adaptively controls how many of them are protected, in order to embed a detectable watermark while preserving — and in places improving — the visual-semantic fidelity of LVLM outputs.

What This Paper Is About

Watermarking generated text lets providers trace who produced a piece of content, but existing methods designed for text-only language models apply vocabulary biases that ignore what the image actually shows, degrading generation quality. More recent LVLM-specific watermarks try to fix this by protecting visually important tokens, yet they estimate those tokens only once at initialization and ignore how concentrated the importance weights are, causing misalignment later in generation and the inclusion of low-quality long-tail tokens. AGMark's goal is to close that gap by re-deciding, at every single decoding step, which tokens matter visually and contextually, and how many of them to shield from the watermark's random bias.

Key Contributions

1. Attention-guided, per-step semantic evidence extraction. AGMark identifies key vision-grounded semantics at each decoding step using the model's attention weights over visual regions, and additionally accounts for contextual coherence in the ongoing discourse so that visual saliency is not accepted uncritically.

2. Adaptive vocabulary partitioning driven by two signals. The number of protected semantic-critical tokens is set by jointly considering uncertainty awareness (token entropy) and evidence calibration (the density of the weight distribution), rather than a fixed budget.

3. Empirical validation across three LVLMs and two datasets. The authors report consistent improvements in text quality and visual fidelity alongside detection performance of at least 99.36% AUC and accuracy of at least 96.22%, with attack resilience measured at 88.61% AUC under the hardest attack.

4. Public release of source code. The paper states the source code is available at https://doi.org/10.5281/zenodo.20339442.

Main Findings

• Text quality improves over all five baselines in most settings. On Llava-Next with AMBER, AGMark reaches a perplexity of 4.80 versus 4.98 for the second-best method, MorphMark, and a BLEU of 31.88% versus 26.92% — an improvement of 4.96 percentage points and a perplexity reduction of 0.18.

• AGMark is the only method exceeding 91% on both semantic alignment metrics in the Llava-Next / AMBER configuration, with BertScore 91.14 and STS 91.85.

• Detection stays strong. AGMark attains an AUC of at least 99.36% and accuracy of at least 96.22% across the three models and two datasets, and ranks among the top two methods by AUC in the vast majority of settings.

• Hallucination (CHAIR) is lowest. In the sample-wise analysis, AGMark achieves the lowest mean CHAIR at 6.2%, compared with 7.9% and 8.2% for the next two best methods (IE and SynthID), and also the lowest maximum value.

• Later-stage generation benefits most. Across response lengths from 60 to 200 tokens, AGMark maintains superior text quality and visual consistency, showing an exceptionally low rate of hallucination increase in the 120–200 token range. Baselines are length-sensitive: IE ranks second-best on visual-semantic alignment at 200 tokens but second-worst in the 80–100 token range.

• Every component matters, and attention guidance matters most. Removing attention guidance raises CHAIR from 6.20 to 8.50 (+2.30); removing the vision-critical weight yields 7.90 (+1.70); removing the context-critical weight yields 7.40 (+1.20); removing entropy gives 7.60 (+1.40); removing density gives 8.10 (+1.90); and using a fixed scale for semantic-critical tokens gives 8.40 (+2.20). BLEU drops hardest when vision or context weighting is removed (to 18.25 and 17.94, versus 31.88 for the full method).

• Hyperparameters sit on a detectability–fidelity trade-off. Larger α (base proportion of semantic-critical tokens) and larger τ (cumulative importance threshold) improve generation quality and reduce hallucinations but weaken detectability: at α = 0.29, perplexity falls to 4.78 and CHAIR to 5.90%, while accuracy drops to 98.88%. The ω (fusion strength) effect is non-monotonic, with quality degrading at both extremes (perplexity 5.17 at ω = 0.30 and 4.82 at ω = 0.60; CHAIR 6.70% and 6.80% respectively). The identified optimum is ω = 0.50, α = 0.27, τ = 0.98.

• Robustness under attack is the strongest among LVLM watermarks. AGMark achieves 88.61% AUC under paraphrasing — the largest drop of 11.28 percentage points across all attack settings — while for other attack types the drop is at most 0.87 percentage points under synonym attacks. By comparison, VLA-Mark, MorphMark, and IE drop by 3.34, 2.08, and 3.55 percentage points under synonym attacks, and by 26.36, 16.46, and 13.25 percentage points under paraphrasing attacks. AGMark also outperforms KGW under paraphrasing attacks.

• Cost is small but non-zero. The weight extraction module adds only a small number of matrix operations, resulting in a slight and acceptable increase in computational overhead; a detailed inference latency comparison is reported in Appendix B.

Methodology in Plain English

AGMark treats watermarking as a per-step decision problem nested inside the normal decoding loop, and it has two stages.

Stage one — deciding which tokens matter. At every decoding step, the model has an attention distribution over the visual tokens of the image. AGMark uses those attention weights to compute a vision-critical score for each vocabulary token: it takes the cosine similarity between visual token embeddings and the candidate word's embedding, and weights those similarities by how much attention each visual region is receiving. Separately, it computes a context-critical score by comparing the last-layer hidden state against each vocabulary token's embedding, which captures whether a word fits the sentence so far. Because the two score distributions differ in scale, each is standardized (z-scored), combined with a convex combination controlled by ω, and then min–max normalized into the range [0, 1]. Sorting the vocabulary by this fused score produces a priority list, whose top entries are the semantic-critical tokens.

Stage two — deciding how many to protect. The vocabulary is split into green and red lists by hashing the prefix with a secret key, as in standard logits-based watermarking. AGMark then swaps the highest-priority tokens out of the red list and into the green list, but the number swapped is not fixed. It is governed by two signals. The first is normalized token entropy: when the model is confident (low entropy), AGMark protects more tokens, because protecting them is unlikely to disturb a decision the model has essentially already made. The second is weight density: AGMark finds the smallest prefix of the sorted vocabulary whose cumulative normalized importance reaches a threshold τ, and measures what fraction of the vocabulary that prefix occupies. A dispersed distribution means many tokens carry real importance, so more should be protected; a concentrated one means only a few tokens matter, and the long tail can be left exposed to the watermark bias. These two signals combine multiplicatively into a ratio η, which determines exactly how many top-ranked tokens are swapped into the green list. A positive bias is then added to green-list logits to produce the watermarked sampling distribution, optionally gated by a margin threshold and a per-step cap to prevent oscillation.

How it was tested. The authors evaluated three 8B LVLMs (Llava-Next-Llama3, Qwen3-VL, InternVL-3.5) on AMBER and MS-COCO, with Llava-Next-Llama3 and AMBER as defaults. They compared against KGW, SynthID, IE, MorphMark, and VLA-Mark, mostly using the MarkLLM repository. Metrics covered detectability (AUC, Accuracy), visual consistency (CHAIR), linguistic quality (perplexity, BLEU), semantic alignment (BertScore, STS), and robustness against five attacks: random word insertion, deletion, synonym substitution, paraphrasing, and translation.

Why This Matters

Impact on research. The paper reframes LVLM watermarking as a dynamic, evidence-calibrated problem rather than a static weighting problem. It argues directly against the static one-shot importance estimation used by prior LVLM watermarks such as VLA-Mark, and demonstrates that per-step attention guidance plus weight-density calibration is what delivers the fidelity gains — with the ablation study isolating attention guidance as the single most important component. It also establishes that the preservation–detection trade-off is tunable rather than fixed, since adaptive partitioning expands protection under low entropy and dispersed weights and contracts it otherwise.

Real-world applications:

• Content provenance and attribution. Platforms and model providers can verify whether a caption or description was produced by a specific LVLM and by whom, which supports source attribution and traceability.

• Intellectual property protection for model providers. Watermarks embedded in outputs give providers a mechanism to detect unauthorized use of their models, addressing the risk of malicious misuse the paper raises.

• Detection of synthetic or manipulative image descriptions. Because hallucination scores are lowest for AGMark (6.2% CHAIR mean), the approach is relevant to pipelines where inaccurate visual descriptions carry real cost, such as accessibility captioning or media monitoring.

• Watermark persistence through downstream editing. The robustness results are directly relevant to real deployment, where text is routinely paraphrased, translated, or word-substituted, and where prior LVLM watermarks lose 13–26 percentage points of AUC under paraphrasing attacks.

Industry relevance. Any organization deploying multimodal assistants, image-search captioning, or visual question answering has an interest in provenance without quality loss. The paper's emphasis on preserving inference efficiency, with only a slight and acceptable overhead, targets production viability. The trade-off between detectability and fidelity exposed by the hyperparameter study is also the practical knob an operator would tune for different deployment risk profiles.

Future Directions

• Eliminating or further reducing the inference overhead. The paper notes a slight increase in computational overhead and points to Appendix B for latency details, leaving open whether implementation optimization or approximation can make the per-step weight computation cost-neutral.

• Making hyperparameter selection less manual. The optimum ω = 0.50, α = 0.27, τ = 0.98 was found by grid search on one model and dataset, and ω's effect is explicitly non-monotonic, raising the question of whether these settings transfer or need per-deployment tuning.

• Closing the paraphrasing gap. Paraphrasing produces the only large AUC drop (11.28 percentage points, down to 88.61% AUC), while other attacks cost at most 0.87 percentage points. This asymmetry marks paraphrase-style rewriting — including cross-lingual rewriting through translation — as the clearest remaining vulnerability.

• Extending the dynamic-evidence idea beyond the tested scope. Evaluation covers three 8B LVLMs and two datasets, and the related-work section notes that research on sampling-based watermarking is limited and that prior LVLM methods share the static-estimation design. Whether the attention-guided approach carries over to other modalities, larger models, or sampling-based paradigms is untested here.

Target Audience

Researchers and practitioners in AI security, content provenance, and digital rights management will get the most from this paper, particularly those working on watermarking for multimodal or text-generation models. It is also valuable for engineers building production LVLM systems who need provenance mechanisms that do not visibly degrade caption or description quality, and for NLP and computer vision researchers studying visual grounding and hallucination, since the ablation results connect attention-guided token selection directly to reduced hallucination. Readers need a working understanding of transformer attention and logits-based watermarking to follow the methodology in full.

Authors’ abstract

Watermarking has emerged as a pivotal solution for content traceability and intellectual property protection in large vision language models (LVLMs). However, vision-agnostic watermarks may introduce visually irrelevant tokens and disrupt visual grounding by enforcing indiscriminate pseudo-random biases. Additionally, current vision-specific watermarks rely on a static, one-time estimation of vision-critical weights and ignore the weight distribution density when determining the proportion of protected tokens. This design fails to account for dynamic changes in visual dependence during generation and may introduce low-quality tokens in the long tail. To address these challenges, we propose Attention-Guided Dynamic Watermarking (AGMark), a novel framework that embeds detectable signals while largely preserving visual-semantic fidelity. At each decoding step, AGMark first dynamically identifies semantic-critical evidence based on attention weights for visual relevance, together with context-aware coherence cues, resulting in a more adaptive and well-calibrated evidence-weight distribution. It then determines the proportion of semantic-critical tokens by jointly considering uncertainty awareness (token entropy) and evidence calibration (weight density), thereby enabling more reliable adaptive vocabulary partitioning to avoid irrelevant tokens. Empirical results consistently confirm that AGMark outperforms conventional methods, substantially improving generation quality and yielding particularly strong gains in visual semantic fidelity in the later stages of generation. Our framework maintains highly competitive detection performance (at least 99.36% AUC) and robust attack resilience (at least 88.61% AUC) without sacrificing inference efficiency, taking a significant step toward reliability-preserving multimodal watermarking.