Source-linked AI summary
Bypassing LLM Watermarks with Color-Aware Substitutions
Qilong Wu, Varun Chandrasekaran
TL;DR
The paper studies whether logit-perturbation watermarks remain robust to post-hoc edits, a question prior attacks address with unconstrained changes or methods that struggle under reasonable edit budgets. It introduces SCTS, which prompts the watermarked LLM to infer token colors and substitutes green tokens. The authors report improved evasion, including removal of watermarks from arbitrarily long text, while noting limits in efficiency, color information, and watermark coverage.
Problem
Whether logit-perturbation watermarks withstand realistic post-hoc editing with a reasonable number of edits that preserve generated information remains an open question.
Source: §1 · p. 1Method
Results
SCTS is reported to evade detection for arbitrarily long text within a reasonable edit-distance budget and to outperform previous methods under the same edit-distance budget.
Source: §1 · p. 2Takeaways & Limitations
Prompting can expose and exploit private watermarking information to evade detection without using external LLMs.
Source: §8 · p. 12SCTS is currently limited to UMD and its variants such as Unigram, and its efficiency and color-information accuracy can be improved.
Source: §7.1 · p. 11
Abstract
from arXiv · showhide
Watermarking approaches are proposed to identify if text being circulated is human or large language model (LLM) generated. The state-of-the-art watermarking strategy of Kirchenbauer et al. (2023a) biases the LLM to generate specific (``green'') tokens. However, determining the robustness of this watermarking method is an open problem. Existing attack methods fail to evade detection for longer text segments. We overcome this limitation, and propose {\em Self Color Testing-based Substitution (SCTS)}, the first ``color-aware'' attack. SCTS obtains color information by strategically prompting the watermarked LLM and comparing output tokens frequencies. It uses this information to determine token colors, and substitutes green tokens with non-green ones. In our experiments, SCTS successfully evades watermark detection using fewer number of edits than related work. Additionally, we show both theoretically and empirically that SCTS can remove the watermark for arbitrarily long watermarked text.
1 Introduction
The paper asks whether logit-perturbation watermarks withstand realistic post-hoc editing, where edits are limited and should preserve generated information. It introduces SCTS, which uses prompted color information to replace green tokens, and reports stronger evasion than prior methods under reasonable edit budgets.
1 Introduction
- Prior robustness studies use unconstrained edits or dedicated paraphrasing and prompting, unlike the paper’s setup of reasonable edits that retain generated information.The paper argues that prior color-agnostic attacks dilute rather than erase watermarks and require more edits for erasure.Source: §1 · pp. 1–2
- SCTS prompts the watermarked LLM for targeted generations, infers token colors from output frequencies, and substitutes green tokens with non-green ones.The substitutions neutralize the excess green tokens in preserved fragments without using an unwatermarked LLM.Source: §1 · p. 2
- The paper theoretically argues that color-agnostic methods cannot evade detection for sufficiently long watermarked text and empirically finds they fail within reasonable edit-distance budgets.The authors describe SCTS as the first color-aware attack and report that it reduces AUROC below 0.5 across settings on two LLMs and two watermarking schemes.Source: §1 · p. 2
- SCTS is more effective than previous methods at evading watermarks under the same edit-distance budget, evaluated on Vicuna-7B and Llama-2-7B with different hashing strategies.The authors also report that SCTS can evade detection for arbitrarily long text segments within a reasonable edit-distance budget.Source: §1 · p. 2
2 Background and Related Work
The background describes a watermark that biases token selection toward hash-defined green tokens and reviews attacks that replace text or guide generation. It then sets a threat model with API access to the watermarked model and limited knowledge of watermark parameters.
2.1 Background: Text Watermarking
- The watermark hashes preceding context tokens to divide the vocabulary into green and red lists, boosts green-token logits, and tests whether generated text exceeds the expected green-token count.The context size c is the number of preceding tokens used to seed the hash.Source: §2.1 · p. 3
2.2 Attacks against Watermarks
- Paraphrasing and prompting are two attack strategies; the paper focuses on recursive paraphrasing and SICO as representative baselines.The paper characterizes both as color-agnostic: added fragments have the human-text green-token ratio while many mostly-green original fragments remain, and their AUROC stays ≥0.86 at a 0.5 normalized edit distance.Source: §2.2 · p. 3
2.3 Threat Model
- The threat model assumes API access to the watermarked model, knowledge of context size c, and no knowledge of other watermark hyperparameters such as γ, temperature, or δ.It also assumes an instruction-following aligned model and access to a model that can generate substitution candidates; the latter may itself be watermarked.Source: §2.3 · p. 4
3 The Building Blocks
The section relates watermark strength to effective text length, then uses that relationship to explain why color-agnostic weakening and post-processing fail to erase detection on sufficiently long text when original fragments remain.
3 The Building Blocks
- The analysis assumes left hashing and independent green events with γ<p<1; effective length is T−c, and critical length is where E[z]=zth.A c+1-gram is the token being tested plus the preceding c tokens; average green probability q is defined over those tested c+1-grams.Source: §3 · p. 4
3.1 Theorem: Watermark Strength
- E[z] is proportional to √Te; under independence, detection tends toward “watermarked” for q>γ and away from it for q<γ.For q≠γ, the independent, identically distributed case has tighter bounds than the independent case; at q=γ, the probability of an “unwatermarked” detection converges to a constant determined by zth.Source: §3.1 · pp. 4–5
3.2 Why Existing Methods Fail For Long Text
- Weakening green probability to p′>γ or retaining a non-zero fraction of original c+1-grams leaves color-agnostic attacks detectable as text grows.For post-processing, the leaked original fragments have green probability p, while new fragments have probability γ; the probability of evading detection converges exponentially to zero.Source: §3.2 · p. 5
4 Our Approach: Self Color Testing
SCTS prompts the watermarked LLM to infer token colors from output frequencies, then substitutes green tokens with red candidates. Its analysis predicts watermark evasion under stated conditions and characterizes expected call scaling.
4 Our Approach: Self Color Testing
- SCT prompts the model at temperature 0 for deterministic, seemingly random strings and infers color from output frequencies, classifying pairs as GR, RG, or same-color.For the “kernel includes” and “kernel contains” test, the stated deterministic behavior gives perfect recall on GR and RG cases.Source: §4 · p. 6
- SCTS tests substitution candidates and replaces a green token with a red one; after success, it advances by two as a heuristic to avoid less promising adjacent substitutions.With left hash c=1, substituting a word also changes the next word’s green list, which the authors assume is then green with probability γ rather than p.Source: §4 · p. 6
4.1 Analysis
- For q(Te)<γ, the probability of failing to evade detection converges exponentially to zero; expected calls scale as O(1) in k and O(Te) in Te.The analysis states q(Te)<γ holds for sufficiently large k and/or Te.Source: §4.1 · p. 7
5 Experimental Setup
The setup specifies normalized word-level edit budgets and compares paraphrasing and substitution baselines across selected models and watermarking schemes.
5 Experimental Setup
- Edit budgets range from 0.05 to 0.5 of the watermarked text’s word count, in increments of 0.05.Source: §5 · p. 7
5.1 Baseline Methods
- The baselines include recursive paraphrasing (RP), constrained SICO paraphrasing, and RB substitution using candidates without SCT.RP uses up to five recursive paraphrasing cycles; SICO-para includes only samples compliant with the edit constraint.Source: §5.1 · pp. 7–8
5.2 Models
- The watermarked models are vicuna-7b-v1.5-16k and Llama-2-7b-chat-hf; distilroberta-base generates five substitution candidates per word.Source: §5.2 · p. 8
5.3 Watermarking Scheme
- The setup tests UMD with left and self hash across context sizes 1, 2, 4, and 8, plus Zhao et al.’s unigram variant.UMD uses zth=4, γ=0.25, and δ=2; the unigram variant uses zth=4, γ=0.5, and δ=2, and the SCT χ2-test threshold is 0.01.Source: §5.3 · p. 8
6 Experiment Results
Across the tested settings, SCTS outperforms prior attacks, preserves semantics, and succeeds with lower edit budgets. Its effectiveness varies with watermark configuration and model instruction-following.
6 Experiment Results
- SCTS is consistently more effective across c values, hashing schemes, and watermarking schemes while preserving semantics.The AUROC comparison for vicuna-7b-v1.5-16k shows SCTS as the only baseline crossing 0.5.Source: §6 · p. 9, Figure 3 · p. 9
- Normalized edit distance of 0.25–0.35 is sufficient for SCTS, while other attacks need more.Source: §6 · p. 9
6.3 Different Watermarked Models
- Attack success is higher on aligned, instruction-fine-tuned models, with vicuna-7b-v1.5-16k performing better than Llama-2-7b-chat-hf.Llama-2-7b-chat-hf is less affected by instruction-following problems than non-instruction-fine-tuned Llama-2-7b; those problems can reduce substitution success and make SCTS slower and less effective.Source: §6 · p. 9, §6.3 · pp. 10–11
6 Experiment Results
- Unigram is more robust than UMD but remains susceptible to SCTS.Source: §6 · p. 9
6.1 Is SCTS Effective?
- At a 0.35 budget, SCTS can reduce AUROC below 0.5, while SICO and RP generally remain detectable.SICO and RP AUROCs are reported in the 0.6–0.9 range; SCTS preserves semantics with mean cosine similarity 0.8832 and 0.8732 at a 0.4 budget for left and self hash, respectively.Source: §6.1 · p. 9
- SCT accuracy is at least 0.5, above the rough 0.33 random baseline for three-class classification.Source: §6.1 · p. 10, Figure 4 · p. 10
6.2 Attack Budget
- SCTS can evade detection at a normalized edit distance as low as 0.25, and it alone consistently reduces AUROC below 0.5.The trend holds across the c values considered, while SCTS saturates between 0.35 and 0.45 because the current implementation scans each sentence only once.Source: §6.2 · p. 10
- SCTS saturates between 0.35 and 0.45 because its current implementation scans each sentence only once.The authors leave techniques for repeated scans to future research.Source: §6.2 · p. 10
7 Discussion and Open Questions
The discussion identifies current constraints on SCTS, outlines possible efficiency and accuracy improvements, and notes the dual-use implications of watermark evasion.
7.1 Limitations
- SCTS is currently limited to UMD and variants such as Unigram; it assumes the attacker knows c and obtains only one color pair per query.The authors also identify limited SCT accuracy and efficiency as limitations.Source: §7.1 · p. 11
7.2 Open Questions
- Caching color information or testing more candidates per query could improve efficiency, but each approach has trade-offs.Caching risks accumulating incorrect results and requires space; more candidates add prompt complexity and reduce frequency counts per candidate.Source: §7.2 · p. 11
7.3 Harms
- The authors say watermark evasion has implications for spreading misinformation and dual use of LLMs.Source: §7.3 · p. 12
8 Conclusions
The paper presents SCTS as an algorithm for evading watermark detection without external LLMs. It reports that prompting can expose and exploit private watermark information, including for long texts.
8 Conclusions
- SCTS evades watermark detection without external LLMs and can eliminate watermarks from long texts.The authors present the approach as evidence that specific prompting can uncover and exploit private watermark information.Source: §8 · p. 12
A Proof of Theorem 1
The section derives watermark-detection behavior under stated color assumptions, then analyzes how SCTS substitutions affect green-token ratios, evasion probability, and LLM-call costs.
A Proof of Theorem 1
- E[z] is proportional to √Te under Theorem 1.The proof considers independent and i.i.d. color cases.Source: A Proof of Theorem 1 · p. 14
- For q < γ, detection as watermarked converges exponentially to zero; for q > γ, detection as unwatermarked does so.These bounds are stated for the independent-color case.Source: A Proof of Theorem 1 · p. 14
A.1 Case 1: i.i.d. case
- When q = γ, E[z] = 0 and Tc does not exist; separately, at zth = 4, the probability of being labeled “watermarked” converges to a positive constant, approximately 0.00003167.For q < γ, E[z] ∝ −√Te, and Tc does not exist.Source: §A.1 · p. 15
A.2 Case 2: Independent case
- At q = γ, E[z] = 0 and Tc does not exist; the probabilities of “not watermarked” and “watermarked” labels each converge to 0 exponentially with Te.Source: §A.2 · p. 15
B.2 Grouping
- For c = 1, substitutions can alter two token colors, so the analysis groups preserved 2-grams singly and substitution-linked adjacent 2-grams in pairs.The corner case of a substitution changing only one 2-gram is excluded.Source: §B.2 · p. 16
B.3 Expected Green Ratio
- The expected green ratio for old groups is below γ when k exceeds the stated threshold.The passage gives the condition as k > 1 + log_γ((1 − p)/(p(1 − γ))).Source: §B.3 · p. 16
B.4 Success probability bound
- For q < γ at sufficiently large k and/or Te, the probability that SCTS fails to evade watermarking converges exponentially to zero with Te.The bound is derived using Hoeffding’s inequality under the grouping analysis.Source: §B.4 · p. 17
C SCTS LLM Calls
- The analysis estimates expected LLM calls per c + 1-gram as Te and k grow, identifying call cost as a scalability consideration.The supplied example’s numerical value is incomplete.Source: C SCTS LLM Calls · p. 18
C.1 Derivation
The derivation simplifies the call-count analysis in a large-k limit; the appendix also specifies the dataset and budget procedure used in experiments.
C.1 Derivation
- As k tends to infinity, Nold is geometric distributed.The passage says its mean is no = 1, but the displayed value is incomplete.Source: §C.1 · p. 19
D.1 Dataset
- Using C4 RealNewsLike training-set samples truncated to their last 500 tokens, the study uses 50 Vicuna-7b-v1.5-16k and 10 Llama-2-7b-chat-hf samples; watermarked text is LLM-generated.The first 100 tokens serve as the prompt and the remaining 400 as human-written text; watermarked generations are truncated to at most 400 tokens, and samples under 20 words are removed.Source: §D.1 · p. 21
D.2 Budgets
- One SCTS run yields outputs across budgets until saturation, whereas SICO runs only one budget per sample.SCTS returns the saturated output for higher budgets not reached.Source: §D.2 · p. 21
D.3 Metrics
The appendix defines attack and SCT evaluation measures and describes the prompts and training choices used for particular settings.
D.3 Metrics
- AUROC measures human-versus-LLM text discrimination, with lower values indicating a more effective attack and 0.5 corresponding to random guessing.ASR is the share of samples not detected at zth = 4, and higher values indicate a better attack.Source: §D.3 · p. 21
- LLM-call counts and running time measure attack efficiency, while semantic similarity tracks retained information and SCT accuracy and confusion matrices assess the color test.Fewer calls and shorter running time indicate greater efficiency; higher semantic similarity and a confusion matrix closer to the diagonal are preferred.Source: §D.3 · p. 21
D.4.1 Prompt
- SICO prompts specify a permitted word-change percentage adjusted to the allocated budget.For a budget of 0.5, the prompt allows changing at most 50% of words.Source: §D.4.1 · p. 22
D.4.2 Training
- For Llama-2-7b-chat-hf, the prompt from Unigram’s training is reused because the methods share training data and computational overheads.Source: §D.4.2 · p. 22
D.5 SCTS prompt for UMD Min-SelfHash c = 1 and Unigram
- For UMD Min-SelfHash c = 1 and Unigram, the adapted prompt asks for two words and a long uniformly random sequence of them.The prompt instructs that previous phrases should not influence future phrases.Source: §D.5 · p. 22
E Full Experiment Results
Across the reported watermark settings, SCTS is more effective than the comparison baselines at matched budgets, while requiring additional calls for color information.
E Full Experiment Results
- SCTS alone crosses AUROC 0.5 and has higher ASR than other baselines at the same budget for Vicuna with UMD watermarking.The table captions report these trends across c and hashing methods.Source: Table 2 · p. 24, Table 3 · p. 25
- SCTS takes longer because its color-aware attack uses more LLM calls for color information.The captions report consistent trends across c and hashing methods.Source: Table 4 · p. 26, Table 5 · p. 27
- SCTS preserves semantics in the Vicuna UMD experiments, with the trend consistent across c and hashing methods.Source: Table 6 · p. 28
- Unigram is more robust than UMD but remains susceptible to SCTS; the Unigram ASR results show the same susceptibility trend.Unigram’s unattacked ASR is higher than UMD’s.Source: Table 7 · p. 29, Table 8 · p. 29
- For Llama-2 with UMD, AUROC and ASR trends are consistent with Vicuna across c and hashing methods.Source: Table 12 · p. 31, Table 13 · p. 32