Source-linked AI summary
MarkSec: Capability-Aware Evaluation of Adversarial Attacks Against LLM Watermarks
Kairong Li, Zhikun Zhang, Xiao Ren, Yunjun Gao
TL;DR
LLM watermark attacks are difficult to compare because studies often isolate attack types, use inconsistent evaluation protocols, and separate effectiveness from text quality. MarkSec unifies stealing, scrubbing, and spoofing under shared reporting and a quality-constrained success metric. Results show that quality constraints, watermark families, attack generality, and capability assumptions can change which attack appears strongest.
Problem
Watermark attack studies often lack shared calibration, metrics, reporting protocols, and joint evaluation of attack success with text quality.
Method
MarkSec provides a unified, capability-aware framework for evaluating stealing, scrubbing, and spoofing with common reporting and quality-constrained attack success.
Results
SIRA leads mean removal on C4, but LLMP leads mean Prometheus-gated joint success across watermark families and remains ahead under stricter gates.
Takeaways & Limitations
Apparent attack winners depend on text-quality constraints, attack generality, watermark family, and the capabilities required to perform the attack.
Takeaways & Limitations
Interpretation depends on explicit capability assumptions, query budgets, runtime costs, artifact provenance, and run-specific measurement coverage.
Abstract
from arXiv · showhide
LLM watermarking helps trace the origin of generated text, but faces stealing attacks that recover watermark information, scrubbing attacks that remove watermark signals, and spoofing attacks that forge text accepted as watermarked. These attacks are often studied in isolation, leaving their connections unclear. Evaluations also often lack shared detector calibration, metric definitions, and reporting protocols. Moreover, measuring attack success and text quality separately makes it difficult to identify attacks that are both effective and quality-preserving. We propose MarkSec, a general framework that unifies analyses of stealing, scrubbing, and spoofing. We evaluate attacks under a common reporting protocol and introduce a quality-constrained attack success metric to assess effectiveness and text quality jointly. Experiments across representative watermark families, attacks, LLMs, and datasets reveal three findings. First, attacks that appear strongest by watermark removal alone can fall behind general rewriting when success also requires acceptable text quality. Second, general rewriting remains a strong baseline across watermark families, while its advantage over other scrubbers varies by family. Third, in a case study of one watermark family, stealing-based scrubbers often underperform the best general-scrubbing baselines when text quality is required. These results show that apparent attack winners depend on text-quality constraints, attack generality, and capability assumptions.
1 Introduction
MarkSec addresses fragmented and inconsistent evaluation of stealing, scrubbing, and spoofing attacks against LLM watermarks. Its results show that attack rankings change when text quality, watermark family, and attacker capabilities are considered jointly.
- Motivation: MarkSec evaluates watermark attacks under shared calibration, metrics, and reporting while jointly considering attack success and text quality.Existing studies often vary models, watermark families, datasets, budgets, and reporting protocols, while measuring attack success and quality separately.
- Main Findings: SIRA leads raw watermark removal on C4, but LLMP leads quality-aware scrubbing, showing that removal alone can overstate practical attack strength.DIPPER remains a close quality-aware alternative in several cells.
- Main Findings: LLMP is the strongest quality-aware general-scrubbing baseline on C4, with the narrowest margins under UW and KGW.It achieves the highest mean QSR on C4 at all three Prometheus gates.
- Main Findings: In the KGW case study, B4 leads QSR@3 among stealing-based scrubbers, while DE-MARK-Sp reaches 98–100% detector acceptance and 47–64% QSSR@3 in spoofing.These findings illustrate that conclusions depend on the attack objective and capability assumptions.
2 Preliminaries
LLMs generate text autoregressively by converting prompts and prior tokens into next-token distributions. Inference-time watermarks alter logits, posterior distributions, or sampling while detectors test for key-dependent statistical evidence.
- LLM Generation: At each step, an LLM computes vocabulary logits, normalizes them into a probability distribution, and selects the next token using a decoding strategy.Generation repeats until an end-of-sequence token or maximum length is reached.
- Watermark Classes: Inference-time watermarks intervene at the logits, posterior, or sampling stage of next-token generation.These classes differ by where the key-dependent signal enters the generation pipeline.
- Logits-Based Watermarks: Logits-based schemes add key-dependent bias to candidate-token logits, increasing the sampling probability of favored tokens before detection tests their statistical overrepresentation.KGW-style watermarks use green and red token partitions and test whether green-token counts are significant.
- Posterior-Based Watermarks: Posterior-based schemes transform the normalized next-token distribution with a watermark key while aiming to preserve overall generation quality.The detector applies the corresponding keyed rule to test consistency with the watermarked distribution.
- Sampling-Based Watermarks: Sampling-based schemes leave the probability distribution largely unchanged but use a key-dependent sampler, whose output is evaluated through a corresponding detection statistic.SynthID exemplifies this class through tournament sampling.
- Watermark Detection: Across watermark classes, detection is a key-dependent hypothesis test whose score measures evidence for watermarked generation against ordinary generation.The score may be a green-token count, distributional consistency score, or sampling statistic.
3 Attacks Against LLM Watermarks
MarkSec organizes watermark attacks by whether they recover reusable information, remove signals from marked text, or forge detector-accepted text. It separates directly comparable scrubbing from stronger stealing-dependent paths according to attacker capabilities.
- Threat Model: Attacker capabilities vary from black-box access to watermarked generation APIs to access to prompts, generated text, or victim-side probabilities, logits, and top-k scores.The framework assumes no model-parameter, secret-key, hidden-system-prompt, or proprietary-template access.
- Attack Objectives: Stealing recovers reusable watermark information, scrubbing removes signals from marked text, and spoofing forges text accepted as watermarked.Spoofing targets false attribution, whereas scrubbing targets removal robustness.
- Comparison Boundary: Direct scrubbing is the main comparable setting because it rewrites given watermarked text without first recovering a reusable artifact.Stealing-based scrubbing and spoofing are analyzed separately because they require additional recovery steps or artifacts.
- Evaluation Organization: MarkSec uses capability tables to keep general scrubbing comparable while still reporting stronger attack paths that rely on recovered information or reusable artifacts.The taxonomy records stealing sources, recovered artifacts, downstream uses, and scrubbing capability questions.
- Stealing Attacks: SCTS-St infers a hidden token-color map through adaptive black-box queries, while MIP-St formulates green-list recovery as mixed-integer optimization.Recovered artifacts can guide later targeted token replacement or scrubbing.
- Scrubbing Attacks: General scrubbing attacks differ in side information and rewriting resources, including text-only paraphrasing, prompt context, proxy signals, suspicious-span localization, and iterative search.All direct scrubbers in the study are detector-free.
4 MarkSec
MarkSec is a modular toolkit that evaluates stealing, scrubbing, and spoofing attacks under explicit capability assumptions and a shared reporting pipeline. It standardizes generation, attack execution, detection, metrics, and analysis so results are comparable across watermark methods and attack settings.
- MarkSec jointly evaluates stealing, scrubbing, and spoofing while separating direct scrubbing from attacks that recover reusable watermark artifacts.This separation makes capability assumptions and downstream attack use explicit.
- The toolkit standardizes watermark-specific inputs, generation records, and metadata so downstream attacks and metrics use a common format.The input and generation module records prompts, watermarked text, configurations, and decoding metadata.
- Attack orchestration records prompts, victim-side scores, helper models, recovered artifacts, and other capability assumptions at execution time.Direct scrubbing and stealing-based attacks therefore have explicit comparison boundaries.
- MarkSec normalizes detector score directions, supports shared threshold calibration, and computes detection, attack-success, text-quality, and quality-constrained metrics.These components enable comparisons that account for both watermark removal and output quality.
- MarkSec preserves per-sample records, run summaries, metric details, aggregate exports, and full configurations for common reporting and large-scale analysis.The reporting layer supports reproducible tracking and extension to new methods, models, datasets, and metrics.
5 Experimental Setup
The experiments compare six watermark schemes across three prompt datasets using calibrated detectors, standardized attack metrics, and automatic quality measures. General scrubbing forms the main comparison surface, while stealing- and spoofing-related methods are separated because they require additional capabilities.
- Six representative watermark schemes span logits-based KGW, Unigram, and SIR; posterior-based UW and DIP; and sampling-based SynthID.The study uses fixed local checkpoints and distinguishes DIP from the DIPPER paraphraser attack.
- Experiments use 100 prompts each from C4, Dolly-15K, and MMW BookReport, with the canonical C4 slice emphasized in the main text.The additional datasets examine dataset dependence.
- Detector calibration targets an FPR of 1%, while score directions are normalized so reported detection and removal results share one interpretation.The 1% value is a calibration target rather than a separately measured test-set FPR.
- Quality-constrained success requires available detector and quality evidence, with QSR@3 as the default joint-success metric.ASR uses before-positive samples with both detector states observed, whereas QSR includes available cells even when no detected inputs exist.
- General scrubbing is the main comparison surface, while stealing and spoofing methods are reported separately because they require extra access, budgets, artifacts, or generation control.This design compares attacks with a shared downstream objective without conflating their capability assumptions.
6 Experimental Results
Under a shared evaluation protocol, attack rankings depend on whether success means watermark removal alone or removal that also preserves quality. LLMP generally leads quality-aware scrubbing, while stealing-based and spoofing results vary with capability and evaluation conditions.
- RQ2: Quality-aware rankings are less fragmented than raw removal suggests: LLMP leads every C4 watermark family, with its margin narrowest under UW and KGW.SynthID shows the widest LLMP lead, while Unigram, SIR, and DIP fall between the narrow- and wide-margin cases.
- RQ2: For SynthID, model-level exceptions show that SIRA can edge out LLMP on Qwen while LLMP remains stronger on Llama and in the family average.SIRA records QSR@3 = 0.87 versus 0.85 for LLMP on the Qwen cell, while the corresponding Llama values are 0.43 and 0.85.
- RQ1–RQ3: LLMP achieves the highest mean QSR@3 on C4 at all three Prometheus gates, while SIRA achieves the highest mean ASR.LLMP also retains the largest fraction of its QSR under stricter thresholds; SIRA’s quality-aware success drops as the utility gate tightens.
- RQ5: Spoofing feasibility differs sharply by method: DE-MARK-Sp reaches 98–100% detector acceptance and 47–64% QSSR@3, whereas JSV-Sp achieves 0–1% acceptance and zero QSSR@3.Each of the eight spoofing runs contains 100 outputs, and natural-generation detector acceptance is zero in every run.
- RQ5: In the KGW stealing case study, B4 leads stealing-based QSR@3 in all four settings, but its advantage over general scrubbing is inconsistent.B4 exceeds the best general-scrubbing comparator by 0.13 and 0.03 in two settings, but trails by 0.03 and 0.02 in the other two.
7 Related Work
Existing watermark toolkits and benchmarks improve reproducibility and robustness evaluation, but they primarily organize analysis around watermark methods rather than attack methods. MarkSec addresses this gap by making attack behavior under explicit capability assumptions a first-class benchmark dimension.
- Prior frameworks: Existing frameworks improve reproducibility, aligned watermark comparison, robustness testing, and multidimensional watermark assessment.Examples include MarkLLM, WaterBench, WaterPark, CEFW, and Mark-MyWords.
- Prior frameworks: Prior systems mainly treat attacks as robustness tests, quality–robustness factors, or components of composite watermark scores.WaterPark broadens robustness evaluation but remains focused on watermark resilience rather than attack-method benchmarking.
- MarkSec: MarkSec makes attack methods a first-class benchmark dimension by evaluating their behavior under explicit capability assumptions.It separates general scrubbing from stronger stealing and spoofing analyses and reports attack effectiveness together with text quality.
8 Conclusion
MarkSec provides a unified protocol that separates comparable general scrubbing from stronger stealing-based attacks requiring additional access or recovered artifacts. Across the evaluation matrix, attack rankings depend on evaluation axes, watermark family, quality gating, and capability assumptions.
- Conclusion: MarkSec separates comparable general scrubbing from stronger stealing-based attacks requiring additional access, recovered artifacts, or attack-side control.This preserves shared-protocol comparisons while exposing escalation risks that text-only evaluation could hide.
- Conclusion: There is no universal attack winner across all evaluation axes, because family-specific behavior can distinguish broad baselines from narrow specialists.Overall averages can hide whether an attack generalizes broadly or excels only for a particular watermark family.
- Conclusion: SIRA leads mean removal on C4, whereas LLMP leads mean Prometheus-gated joint success across watermark families and under stricter gates.Supplementary output screening preserves LLMP’s lead in dataset-level mean QSR@3.
- Conclusion: Under stronger recovered-information access, B4 achieves the highest QSR@3 among evaluated stealing-based scrubbers in all four KGW settings.DE-MARK-Sp achieves high detector acceptance but lower quality-gated spoofing success.
- Conclusion: MarkSec advocates reporting attacks with their assumptions, query budgets, runtime costs, and artifact provenance to support reproducible, interpretable security assessment.The framework is intended as a reusable protocol that others can inspect, rerun, and extend.
B Ethical Considerations
MarkSec frames adversarial watermark evaluation as necessary defensive stress testing with unavoidable dual-use risks. Its ethical approach separates high-capability threats, documents enabling assumptions, and limits interpretation to the supported scope of robustness claims.
- Ethical considerations: The benchmark has dual-use risk because the same infrastructure can lower barriers to watermark removal, stealing, or spoofing.The paper frames MarkSec as a defensive stress-testing benchmark rather than a claim that watermark removal should be operationalized.
- Ethical considerations: A realistic attack benchmark is necessary to prevent false confidence, identify failure modes before deployment, and expose defender-side trade-offs.Evaluating robustness only against weak or incomparable baselines can lead practitioners to overestimate watermark security.
- Ethical considerations: MarkSec reports capability-escalated stealing threats separately and documents access patterns, query budgets, runtime costs, and watermark-family alignment.This avoids collapsing materially different threats into a single leaderboard and keeps security interpretation contextualized.
- Ethical considerations: Public release should prioritize defender reproducibility while avoiding unnecessary concentration of turnkey high-risk assets.The paper recommends preserving artifact provenance, distinguishing infrastructure from third-party or recovered artifacts, and restricting use to authorized evaluation.
- Ethical considerations: Robustness depends on attacker capability, watermark family, deployment format, and whether manipulated outputs remain useful.Therefore, results should not be interpreted as evidence that watermarking is universally sufficient or universally futile.
D Implementation Details
The appendix introduces the concrete implementation choices behind MarkSec.
- Implementation Details: The appendix summarizes MarkSec’s concrete implementation choices.
D.1 Default Benchmark Configuration
The benchmark standardizes watermark attacks through a shared pipeline and reports full matrices across models, datasets, watermarks, and attack settings.
- The main removal benchmark uses Llama 3.1 8B Instruct, Qwen2.5 7B Instruct, and Mistral 7B Instruct on C4, Dolly-15K, and MMW BookReport.
- The shared pipeline covers data loading, generation, attack execution, detection, quality analysis, and result persistence through a MarkLLM-based interface.
- Protocol-separated analyses distinguish general scrubbers from stealing-based attacks and separately examine spoofing and recovered-watermark use.
- The appendix supplies full watermark–victim-model–attack matrices for canonical C4 and two external-validity datasets, including detection and attacked-text quality measures.
- Detailed appendix tables report detection metrics including pre-attack TPR, raw ASR, and QSR@3, alongside BERTScore, PSP, and Prometheus quality scores.
E.3 Content Validity of Attack Outputs
Attack-output validity is screened mechanically and by source–output inspection, with invalid outputs excluded from quality-gated successes but retained in denominators.
- Invalid outputs contribute zero to quality-gated success at every gate while remaining in the original denominator.
- 254 of 26,096 outputs were identified as invalid, including 2 empty, 17 punctuation-only, and 235 further observations flagged through inspection.
- Output invalidity does not alone establish attack-caused degradation because some source texts are themselves degraded.
- The validity check removes 20 successes at gate 3, 32 at gate 2, and 5 at gate 4 across the affected cells.
- After the check, LLMP remains the leader of dataset-level cell-macro QSR@3 averages, with unlisted groups retaining their gate-3 values.
F Cross-Watermark Quality-Gate Sensitivity
Quality-gate sensitivity is evaluated across watermark families on common Llama/Qwen support using calibrated dynamic detection and multiple attack rankings.
- The analysis covers 180 cells spanning three datasets, six watermarks, Llama and Qwen models, and five attacks.
- All 45 SynthID runs use dynamic detection calibrated to target FPR 0.01, with run-specific thresholds ranging from 0.5099 to 0.5228.
- Table 14 reports quality-gate sensitivity on common Llama/Qwen support, while rates are percentages and differences are percentage points relative to the highest-rate non-LLMP attack at each gate.
- The comparator is selected separately at each gate, and the result data provide per-cell denominators, model-specific rates, and all five attack rankings.