Linguistic Holonomy and Statistical Watermarks:
Inner Geometry of Meaning-Preserving Transformations

The dominant construction is the green-list watermark of Kirchenbauer et al. [7]: at each step a pseudo-random subset of the vocabulary, of relative size $\gamma$, is declared green on the basis of a secret key and of the $h$ preceding tokens, and the logits of green tokens are raised by a bias $\delta_{b}$. Detection counts green tokens and reads off a $z$-score. Setting $h=0$ gives the Unigram scheme of Zhao et al. [15], whose robustness is provable. A different family, initiated by Aaronson and developed by Kuditipudi et al. [10] and by Christ, Gunn and Zamir [2], leaves the output distribution mathematically untouched and replaces instead the source of randomness in the sampler; these are the distortion-free schemes. A production deployment at scale, using tournament sampling, is described in [5]. A synoptic view is given in Table 1.

Against these constructions stands a literature of attacks. Krishna et al. [9] introduced a dedicated paraphraser; Sadasivan et al. [13] iterated it; a recent large-scale study [3] chains rewritings up to five deep and reports detection falling from $87.9\%$ on the original outputs to $4.86\%$ after five hops. Kirchenbauer et al. [8] had already observed, on empirical grounds, that a longer seeding context makes a watermark less robust to editing.

All of these studies share a habit of measurement. An attack is scored by its endpoint: by the semantic similarity between the original and the final text, and by a count of how many tokens or hops separate them. The intermediate states are treated as scaffolding.

This habit is not innocent. Consider two chains of rewritings that begin at the same text and end at texts of identical meaning. One proceeds directly; the other wanders through three languages and returns. By any endpoint measure they are the same attack. Are they?

To ask the question one needs a formalism in which the intermediate states are part of the object rather than part of the apparatus. Such a formalism exists. In [4] a linguistic loop was defined as a chain of transformations that move the signifier while preserving the semantic core, its semantic deficit was defined as the cosine distance between the first and last embedded states, and a rotation $\mathrm{R}_{\mathcal{U}}\in\mathrm{SO}(n)$ was associated with the entire chain by composing the minimal rotations between consecutive states. The signature of a quadratic form built from $\mathrm{R}_{\mathcal{U}}$ was proposed as the invariant of the loop, and the construction was compared, in the introduction of that paper, with the Wilson loop of lattice gauge theory.

We take up that formalism, and we find three things.

The first is that the proposed invariant collapses. The representing matrix $I_{n}-\mathrm{R}^{*}_{\mathcal{U}}$ is always positive semidefinite, so its Sylvester signature is $(2p,0,n-2p)$ and carries no more information than its rank. The negative index, which is where a signature normally keeps its content, is identically zero.

The second is that the analogy with the Wilson loop is not an analogy. The minimal rotation of [4] is parallel transport along the minimising geodesic of the unit sphere; $\mathrm{R}_{\mathcal{U}}$ is parallel transport along the geodesic polygon of the chain; and the quantity that the semantic deficit discards is precisely a holonomy, an element of $\mathrm{SO}(n-1)$ fixing the initial state. Endpoint and path separate canonically, and they are independent: neither constrains the other.

The third is that on the side of the detector there is an exact law, and it is not the law the field has been assuming. The residual statistic after an attack is proportional to the number of scored positions whose entire seeding window survived. When the edits are independent this gives $\rho^{h+1}$, which explains in closed form the trend reported in [8]. When they are not — and real edits never are — the retention rate $\rho$ does not determine the residual at all.

In this work we prove that the invariant of a linguistic loop factorises canonically as $\mathrm{R}_{\mathcal{U}}=\mathrm{R}_{\mathrm{dir}}H$ with $H$ in the stabiliser of the base point, that the semantic deficit depends only on the first factor, and that the two factors are functionally independent; we identify $H$ as the Riemannian holonomy of the geodesic polygon of the chain, which on the two-sphere is the area of the enclosed triangle; we show that the signature invariant of [4] degenerates to a rank and is superseded by the angle spectrum; and we prove the intact-window identity for green-list and exponential detectors, with its corollary that an adversary who knows the context width $h$ can annihilate the signal while retaining a fraction $1-1/(h+1)$ of the tokens. Every statement is verified numerically against exact detectors whose keys we hold, and the geometric machinery is applied to real chains of round-trip machine translation.

In Section 2 we recall, in a self-contained form, the apparatus of linguistic loops. In Section 3 we prove the degeneracy of the signature. Section 4 contains the factorisation, the identification with parallel transport and the Gauss–Bonnet corollary. Section 5 turns to the detector and proves the intact-window law. Section 6 reports the experiments, including a preregistered test whose outcome we report whichever way it fell. Section 7 discusses what the results do and do not license.

Fix a green-list scheme with green fraction $\gamma$, context width $h\geq 0$ and bias $\delta_{b}$, detecting a sequence $y_{0},\dots,y_{T-1}$ by

where $G$ counts the scored positions $t=h,\dots,T-1$ at which $y_{t}$ lies in the green list seeded by $(y_{t-h},\dots,y_{t-1})$. Let an attack replace the tokens at a set $E$ of positions without changing the length, and define the intact-window set

We assume, as is standard, that the hash behaves as a random oracle, so that green membership is an independent Bernoulli$(\gamma)$ across distinct pairs of seed and token; and that at each scored position of unattacked watermarked text the green indicator is Bernoulli$(\gamma_{w})$ with $\gamma_{w}>\gamma$, independently across positions. The second is a mean-field hypothesis and is the weaker of the two; we return to it below.

The identity is deterministic in $|I|$; no distribution over the edits has been assumed. It is only when one wishes to compute $|I|$ that a model of the attack becomes necessary, and the model the field has implicitly been using is the independent one.

Equation (5.5) is, in closed form, the trend that [8] reported empirically. It also explains a phenomenon familiar to anyone who has attacked such a scheme by hand: the signal falls considerably faster than the fraction of altered words, and it falls faster the longer the seeding context. Since $\mathbb{E}[z_{0}]$ grows as $\sqrt{T^{\prime}}$, one obtains at once the length required for detection at a fixed threshold $z^{*}$,

which grows like $\rho^{-2(h+1)}$ and quantifies the published warning that short passages carry no reliable signal.

Real edits are not independent. A translator rewrites clauses, not tokens; a human editor works on paragraphs. The following is therefore not a curiosity but the typical case.

The consequence is worth stating without euphemism. An adversary who knows $h$ — and $h$ is a published design parameter, not a secret — can reduce the expected detector statistic to zero while retaining a fraction $1-1/(h+1)$ of the tokens. For the common choice $h=1$ this means editing one token in two; for $h=3$, one in four. Nothing in the attack requires knowledge of the key. This is not a new attack so much as an exact accounting of a known design tension [8, 11], but we have not found it written down in this form, and its corollary — that a robustness table indexed by retention rate or by endpoint similarity is under-specified — appears not to have been drawn.

It is worth being explicit about what has not been proved. Theorem 5.1 concerns substitutions that preserve length. Insertions and deletions shift the indices, and the correct generalisation replaces $I$ by the set of positions whose window survives as a contiguous block of the attacked text; the identity then holds only approximately. The mean-field hypothesis on $\gamma_{w}$ is false in real text, where entropy varies strongly with content, so that (5.3) is an upper bound on what survives in the wild. And nothing here concerns any undisclosed production scheme: the deployment recalled in the introduction motivates the question and is not an object of measurement.

Over $300$ pseudo-random chains in each of the dimensions $n\in\{8,16,64,384\}$, with chain lengths in $\{2,3,4,6,8\}$, the worst deviations observed were: minimum eigenvalue of $I_{n}-\mathrm{R}^{*}_{\mathcal{U}}$ equal to $-6.1\times 10^{-15}$; negative index $n_{-}=0$ in every case; $|n_{+}-2p|=0$ in every case; $\|H\hat{v}_{0}-\hat{v}_{0}\|=3.3\times 10^{-12}$; and $\|\mathrm{R}_{\mathrm{dir}}H-\mathrm{R}_{\mathcal{U}}\|=5.9\times 10^{-12}$. This is Propositions 3.1 and 4.2 at machine precision.

Independence, part (iv) of Proposition 4.2, is exhibited directly. A family of chains with a prescribed common endpoint, wandering through an increasing number of extra dimensions, gives a semantic deficit constant at $0.12241744$ with spread exactly zero, while the holonomy energy runs from $0$ to $1.0465$ (Table 2).

Corollary 4.3 is verified on random geodesic triangles of the two-sphere: for the $159$ of $200$ triangles of area at most $\pi$, the holonomy angle and the spherical excess agree to better than $1.8\times 10^{-9}$; the remainder agree after reduction to the principal branch, as the corollary says they must. Finally, the blindness of the signature is visible in the data: among random chains sharing the signature $(8,0,56)$, the rotation energy ranges over $[0.937,1.464]$ and the holonomy energy over $[0.365,0.791]$.

To test Theorem 5.1 one needs a detector whose key one holds and a generator whose entropy one controls. We therefore emit from a Zipf distribution over a vocabulary of $4000$ with a freshly permuted support at each step, which fixes the entropy by construction, and watermark it with our own implementations of the green-list scheme at $h\in\{0,1,2,3\}$ and of the context-seeded exponential scheme, using $\gamma=0.25$ and $\delta_{b}=2.0$. Sequences are $400$ tokens long and each condition is averaged over $120$ of them.

Under independent edits, the mean absolute deviation between the observed ratio and $\rho^{h+1}$, over the seven values of $\rho$ from $1$ down to $0.5$, is $0.0023$, $0.0023$, $0.0022$ and $0.0021$ for $h=0,1,2,3$, and $0.0011$ for the exponential scheme. At $\rho=0.5$ the observed ratios are $0.499$, $0.247$, $0.125$ and $0.065$ against the predicted $0.500$, $0.250$, $0.125$ and $0.063$. Corollary 5.2 is confirmed across two decades of the ratio and across both families.

The consequence of Proposition 5.3 is more striking, and is collected in Table 3. At one and the same retention rate, the residual signal depends only on where the edits fall. At $\rho=0.5$ with $h=1$, the same half of the tokens survives in all three columns and the residual statistic is one half of the original, one quarter of it, or nothing at all.

The two experiments reported so far measure objects that we ourselves built. The third measures text.

From thirty open-ended prompts spread over five domains we generate, with a $0.5$B instruction-tuned model at temperature one, one hundred and eighty new tokens under each of the three schemes: the green-list scheme at $h=1$, the unigram scheme at $h=0$, and the context-seeded exponential scheme. The keys are ours, so every detector statistic below is exact and not an estimate. The ninety passages so obtained have median $z_{0}$ equal to $9.62$, $9.30$ and $19.05$ respectively, and every single one of them is detected above $z=4$: they are the population on which an attack can be said to do anything at all.

Each passage then travels six chains of round-trip machine translation, sentence by sentence, through the Opus-MT models: three single round trips, through German, French and Spanish; two chains of two pivots, one through German and then French and one through German twice; and a three-pivot detour through French, German and Spanish. Every return to English is a waypoint at which the exact detector is run, and every waypoint — the German, French and Spanish ones included — is embedded by a multilingual encoder of dimension $384$, so that the invariants of Sections 3 and 4 are computed along the chain as it is actually traversed and not along its English shadow. The retention rate $\rho$ and the intact-window fraction $|I|/T^{\prime}$ are not modelled but measured, by longest-common-subsequence alignment on the tokenizer’s own token ids, which are the objects the detector sees. Consecutive waypoints never come near to being antipodal — over all $540$ chains the smallest cosine similarity between neighbours is $0.148$ — so the minimal rotation of Section 2 is everywhere well defined.

Table 4 collects what the chains do. Of the $540$ attacked passages, $464$ are still detected above $z=4$ — $173$ of the $180$ unigram chains, $165$ of the exponential ones and $126$ of the green-list ones — so round-trip translation at this depth is an erosion and not an erasure. It is worth seeing where it does erase. The green-list scheme carried through French, German and Spanish has a median residual $z$ of $3.98$, which is below the threshold, while the same three pivots leave the unigram scheme at $5.88$ and the exponential one at $8.90$; but the exponential scheme starts from a much higher $z_{0}$, so the honest comparison is between fractions, and there the context-free scheme retains $0.685$ of its statistic against $0.509$ and $0.601$ for the two schemes that seed on a context. That is the ordering Corollary 5.2 demands: what cannot be broken is a window of one.

The medians agree; the scatter chain by chain does not vanish, and it should not, since the mean-field hypothesis of Section 5 is false in real text, where entropy varies from one sentence to the next. One caution about the instrument is due here: the intact-window count is read off the longest common subsequence of the two token strings and does not verify that a surviving window is still contiguous in the attacked text, so $|I|/T^{\prime}$ is an upper bound on the number of intact windows the detector really meets. Both green-list schemes do come out just below it. The exponential scheme comes out above, which we record without explaining: its statistic is a sum of continuous scores and not a count of successes, and the mean-field hypothesis bites differently there. What is more interesting is a sign. Pooled over all chains, the correlation between the intact-window fraction and the residual is $+0.51$ for the green-list scheme and $+0.67$ for the exponential one, but $-0.21$ for the unigram scheme — as though, for the one scheme where the law is simplest, retaining more of the text destroyed more of the mark. It does not. A pooled correlation compares passages with one another, and passages differ in entropy, in length, and in how much watermark was ever in them; the law speaks about one passage carried along attacks of differing severity. Computed within each passage, across the six chains that passage travels, the correlation is $+0.73$ for the green-list scheme and $+0.68$ for each of the other two, and it is positive in $28$, $28$ and $29$ of the thirty passages. The anomaly is an instance of Simpson’s paradox, and we report it because the pooled number, taken by itself, would have been read as evidence against a theorem which the same data in fact support.

One family of chains deserves to be named rather than averaged away. In nine chains the residual $z$ falls below $-3$, and in two more the exponential $p$-value underflows to one, which sends its normal-equivalent statistic to $-\infty$ and removes those two from the regressions below. All but one of the eleven show the text expanding, in the extreme case from $180$ tokens to $881$, and they come from only five of the ninety passages: the translator has fallen into repetition. Repetition is exactly the circumstance in which the random-oracle hypothesis fails outright, since one repeated pair of context and token is scored again and again and the effective number of independent positions collapses. Such chains are reported and not trimmed.

We would rather state the result at its strongest defensible level than at its most flattering one. The six chains of a scheme are applied to the same thirty passages, so the observations are clustered and the classical standard error is optimistic. Clustered on the passage, the unigram coefficient stands at $p=8.2\times 10^{-4}$ and the green-list one moves to $p=3.5\times 10^{-2}$, which is significant at five per cent and not at the corrected one. Absorbing the passage altogether — so that each chain is compared only with the other five chains of the same text, which is the comparison this whole article is about — the coefficient on $\eta$ becomes $-0.11$ for the green-list scheme, $-0.14$ for the unigram one and $-0.13$ for the exponential one: all negative, and now of one size, with $p$ equal to $2.5\times 10^{-2}$, $2.1\times 10^{-4}$ and $0.13$ respectively. The honest summary is this. With the passage held fixed, a chain that wanders further destroys more of the mark at equal retention and equal endpoint, by an amount which is stable across all three schemes; the evidence that this is not chance is decisive for the context-free scheme, good for the green-list scheme and inconclusive for the exponential one; and thirty clusters are few.

One further number belongs in the reader’s hands before the result is weighed. In this corpus the two geometric quantities are far from independent: the correlation between $\delta_{\mathcal{U}}$ and $\eta(\mathcal{U})$ is $+0.85$ for the green-list scheme, $+0.91$ for the unigram one and $+0.90$ for the exponential one, and within a passage it is scarcely lower, at $+0.86$, $+0.89$ and $+0.80$. Round-trip translation lengthens the path and moves the endpoint together; Proposition 4.2(iv) says that the two data are free, but this corpus does not exercise that freedom, and a family of chains engineered to hold the one while varying the other — a larger experiment than this one — would be the natural next step. Two consequences follow. The separate coefficients of Table 6 are not separate effects: two nearly collinear predictors entering with opposite signs are a suppression pair, and that is what produces the positive coefficient on the semantic deficit in the unigram row — a coefficient which survives absorbing the passage, and which we can describe but not explain. And the preregistered test is a demanding one, since once $\delta$ is held only a fifth to a quarter of the variation of $\eta$ is left to carry any effect at all; that it is significant nonetheless, in two schemes of three, is the fact worth taking away.

The matched-delta strata, which are the design the criterion was written for, tell the same story from the other side. Within the four bands of semantic deficit the rank correlation between the holonomy energy and the residual is negative in all four for the green-list scheme, at $-0.46$, $-0.46$, $-0.23$ and $-0.53$. And among the ninety-five chains whose semantic deficit lies between $0.05$ and $0.07$ — as matched an endpoint as this instrument can deliver — the holonomy energy ranges over a factor of nearly three, from $0.053$ to $0.146$, while the residual runs from $0.285$ to $0.998$. Two chains may bring a text to the same meaning and leave, the one of them, essentially the whole mark, and the other, less than a third of it.

Three things this experiment does not establish. It does not establish that $\eta$ is causal: a chain that wanders further is also a chain that has been rewritten more, and nothing reported here separates the two. It does not transfer to learned paraphrasers, which choose their path adversarially where round-trip translation chooses it only incidentally. And it rests on a single embedder, so that $\delta$ and $\eta$ are both defined by one encoder’s idea of meaning; replication across encoders is the first thing we should do with more compute than this article had.

Everything described in this section is public, and lives in the repository https://github.com/DCorradetti/linguistic-holonomy; the paths below are paths within it.

The watermark keys are ours, so every detection statistic reported here is ground truth and not an estimate. A detector whose key one holds is nevertheless still an implementation, and an implementation deserves to be audited before it is believed; since the three schemes are re-implemented here rather than imported, there are no published numbers to reproduce, and what remains available is self-calibration. On $400$ token streams of length $400$ not produced with the key, the realised green fraction is $\gamma$ to within sampling error ($0.2475$, $0.2508$ and $0.2498$ for $h=1,2,3$ against $\gamma=0.25$); the null $z$-statistic has mean and standard deviation $(-0.11,0.99)$, $(0.04,0.97)$ and $(-0.01,1.03)$ in the same three conditions, at Kolmogorov–Smirnov distance $0.070$, $0.064$ and $0.056$ from the standard normal; and no stream in any condition reached $z=4$. Watermarked text scored with a key other than the one that produced it gives a mean $z$ of $-0.03$, $+0.03$ and $-0.29$ for the green-list, the unigram and the exponential scheme, with unit standard deviation and no false alarm, while the same text scored with the correct key is detected in every single case, at mean $z$ of $20.8$, $20.9$ and $37.0$. The $p$-values of the exponential scheme are uniform under the null (Kolmogorov–Smirnov $0.044$, $p=0.40$).

One asymmetry is worth recording, because it belongs to the scheme and not to our implementation of it. For $h=0$ the green list is fixed for the whole text, so the null is key-dependent by construction: the statistic is centred not on $\gamma$ but on the green fraction of the particular key, and that displacement has standard deviation $\sqrt{T/|V|}$ across keys. Over $24$ keys we measure $0.328$ against the predicted $0.316$. At the synthetic vocabulary of $4000$ used for the calibration the effect is plainly visible; at the vocabulary of a real tokenizer it is $0.03$ and negligible. The context-free scheme is thus marginally the harder of the two to calibrate, which is the reverse of the robustness ordering established in Section 5, and a small irony of the design space.

The models are open-weights and named in the manifests: a $0.5$B instruction-tuned generator, the Opus-MT sentence translators for the three pivot languages, and a multilingual sentence encoder of dimension $384$ for the embedding $\psi$. Generation is deterministic given the model revision, the seed and the key — very nearly, and the exception is worth a paragraph, since it is the sort of thing a reproducibility section usually asserts without looking. We looked. Regenerating all ninety stored completions from scratch and comparing them token by token, eighty-seven came back identical and three diverged, each after a long common prefix: $82$, $153$ and $173$ tokens of $180$. Regenerating the divergent ones again is instructive. Two of them diverge every single time, four attempts of four, and always at exactly the same token; the third reproduces itself four times of four, as does a fourth record which had diverged in an earlier sweep. Regeneration is therefore deterministic within a process and not across processes: the order in which a CPU kernel accumulates a sum depends on the state of the process it runs in, and a difference in the last bits of a logit is enough to move a multinomial sampling boundary, after which the continuation goes its own way. Two passages of the ninety sit close enough to such a boundary that the process which produced them cannot now be reproduced on this machine at all. Every number in this article is computed from the stored corpus, whose hash is in the manifest, and the audit says how faithfully that corpus regenerates — a weaker claim than bit-exact reproducibility, and the true one.

This is deliberately the small, CPU-sized version of the testbed: the scale-up to a larger generator and to learned paraphrasers is stated in Section 7 as work to be done, and is not claimed here. The scripts, the generated corpora, the run directories with their logs and manifests, and the derived measurements from which every number of this section is computed are all in the repository named at the head of this section; the manifests carry the hashes, so that a regeneration may be checked against what was actually run.