Selective Watermarking: Secure Multi-Task Attribution of Language Model Output

Watermarking for language models answers a binary question – was this text machine-generated? – yet a single model now serves many pipelines and tenants, where the operative questions are which task produced a text and whether auditing one task leaks information about another. We introduce Selective Watermarking, which upgrades detection to secure multi-class attribution: distinct cryptographic keys and heterogeneous embedding channels are routed to disjoint compartments of a single document, and a fail-closed rule attributes a text to a task key or abstains. Our system, SAFIZ, composes an undetectable cryptographic in-sampling core with a zoned lexical channel and a global, invertible orthographic channel, fusing calibrated per-channel $p$-values by Fisher's method. The guarantee is exact: under the pseudorandomness of the keyed function, every compartment's detection score follows a $\mathrm{Gamma}(\ell ,1)$ law under any non-matching key, giving a family-wise false-attribution rate of at most $\alpha$ with no distributional approximation and no fusion weights to tune. The post-hoc channels supply evidence precisely where no undetectable scheme can embed – short, low-entropy outputs – at the declared cost of system-level undetectability. Across six models, three tasks and $8,100$ documents, SAFIZ attributes $99.2\%$ with zero misattributions, and $872,310$ null trials stay within the bounds ($0.050\%$ family-wise, $0.053\%$ per key). The cryptographic core leaves text quality untouched: under a third-party model, paired perplexity differences between watermarked and unwatermarked generations is balanced in sign on every model. A controlled base/instruct pair further shows instruction tuning doubling the share of documents on which the undetectable core lacks entropy to embed. Under signal-removal attacks, the system degrades to abstention rather than error: soundness and isolation hold even where recoverability is lost.