Product

XAMMY

Watermarking and provenance for large language models

Every serious LLM deployment will soon need to answer two questions: did our model write this, and can we prove it? Existing token-bias watermarks answer neither once the text has been paraphrased. XAMMY watermarks the semantic core of generated text, the part a paraphrase has to keep, and attaches a signed, error-corrected provenance record that can be verified independently of the model.

Detector view

Our engineers found that the proposed design reduces latency without increasing cost.

SignalStrong
SignedVerifiableJournaled
Illustration: the reader sees ordinary text; the detector sees where the signal lives. Values shown are not detector output.

Runtime

vLLM sampling-stage integration on NVIDIA CUDA; MLX on Apple Silicon

Provenance

BCH + Reed-Solomon payloads (LDPC, Raptor available), ML-DSA-65 signatures

Detection

PSI / GII fusion with confidence scores and an append-only audit ledger

Status

Working system, pre-release

How it works

Semantic-space watermarking

A GPU-built teacher synonym cache lets the sampler steer choices among meaning-equivalent tokens rather than surface tokens, so synonym substitution and restructuring leave the signal intact. Phase dithering on near-tie logits and coprime-period Weyl seeding keyed with Blake2b make the pattern statistically hard to infer and cryptographically hard to forge.

Signed provenance

The AIWM layer canonicalizes the output, encodes a payload with BCH + Reed-Solomon (LDPC and Raptor available), and signs it with ML-DSA-65, a NIST post-quantum standard. The attestation travels with the content and verifies without access to the generating model.

Detection you can defend

The detector fuses statistical and semantic features into a Paraphrase Stability Index and a Graph Invariance Index, reports confidence rather than a bare yes/no, and journals every decision to an append-only audit ledger (EventStoreDB) with Prometheus metrics and Kafka event streams for compliance reporting.

Alignment as a side effect

The same sampler-guided masking that carries the watermark disrupts gradient-free jailbreak optimizers. In our AutoDAN harness it cut the median misalignment rate from 63.2% to 12.9%. This is a measured side effect, not a safety guarantee.

Runs where you run

NVIDIA GPUs are the production target. Cached-teacher mode starts in under 100 ms with roughly 30 MB of memory. Deploy in your own cloud, on-premises, or air-gapped.

Production

NVIDIA CUDA

vLLM integration at the sampling stage. The teacher synonym cache is built on GPU; the semantic conditioning stack runs under PyTorch/CUDA.

Development

Apple Silicon

MLX backend with automatic dispatch, so the same configuration runs on a laptop and on a CUDA cluster.

Constrained

CPU-only / air-gapped

REST client or minimal MLX deployment at reduced throughput, for environments that cannot host the full runtime.

Built by people who break things

XAMMY ships with its own red-team program. Results are published as they are produced, and only numbers with artifacts behind them are quoted.

  • Paraphrase and back-translation sweeps
  • LLM-rewrite attacks
  • AutoDAN and GCG jailbreak harnesses
  • Removal-attack matrix: paraphrase repeats × ECC scheme × interleave depth
  • Baseline comparison against Kirchenbauer et al. (in progress)

Status

Working system, pre-release: vLLM (CUDA) and MLX backends, CLI and REST surfaces, detection pipeline, removal-attack evaluation harness, and a production observability stack. We are taking on a small number of design partners in publishing, financial services and legal.

contact@security-objectives.com

Pilots run on your own traffic and produce the survival and detection numbers your buyers will ask for.