PaperlayerView exact revision on arXiv

Source-linked AI summary

Could LLM Watermark Detection be Public?

Georgios Milis, Tom Sander, Tomáš Souček, Heng Huang, Pierre Fernandez

arXiv:2610.12106v1cs.CRcs.LG

TL;DR

Public LLM watermark detection could improve interoperability, but detector feedback may help attackers remove or forge watermarks. The paper proposes a split-key detector and a two-stage tampering test. Its defense lowers informed-attack success, though careful attackers who keep channel imbalance small remain harder to catch.

  • Problem

    Public verification could address fragmented watermark detection, but it is unknown how much detector access helps attackers, and robust, fast cryptographic public detection remains impractical.

    Source: §1 · pp. 1–2

  • Method

    The method exposes one of two watermark keys for public detection and combines a private fused-score verdict with a statistical test for public-private score imbalance.

    Source: §1 · p. 2, §6 · p. 10

  • Results

    The split-key defense lowers net informed-attack success: informed removal helps only at small edit budgets, while most successful strongest informed forgeries are caught.

    Source: §1 · p. 2, §6 · p. 10

  • Takeaways & Limitations

    Releasing part of a detector can support interoperability while retaining a private pipeline that identifies tampering with the released signal.

    Source: §1 · pp. 1–2

    The attacks require detector-query access and were evaluated only on the authors’ watermark implementations on open-weight models.

    Source: Ethics Statement · p. 11

Abstract

from arXiv · show

Watermarking large language models is popular for tracing chatbot and agentic outputs, yet detectors remain unreleased since exposing them could let attackers do targeted edits with the detector's feedback. However, watermarks are already vulnerable to uninformed tampering attacks. We thus first quantify whether a public detector would be an additional liability in a deployment setting at varying levels of access, from token-level scores to a binary verdict. Second, we introduce a split-key public-private watermarking method that exposes one key through a public detector while keeping the other for full verification and forensics. An informed attacker can only move the public signal, creating an imbalance between public and private scores. We introduce a statistical test for this imbalance, and combine it with the full key verdict in a two-stage mechanism. Third, we evaluate the split-key method on a wide range of removal and forgery attacks, comparing the uninformed to detector-informed settings. Public detection improves removal only at small edit budgets, since plain rephrasing already strips the watermark at a lower quality cost, but it does enable forgery, which the private pipeline can identify. Overall, releasing half of the watermark enables transparency and interoperability, and tampering with the released half stays detectable. This bounds the provider's liability and questions the need to keep detectors fully private.

1 Introduction

Public LLM watermark detectors could improve interoperability, but their feedback may help attackers remove or forge watermarks. The paper measures this added liability and proposes a split-key detector whose public-private score imbalance can reveal informed tampering.

1 Introduction

  • Releasing part of a detector could let other platforms integrate watermark detection, addressing fragmented verification for plain text.The passage contrasts this possibility with C2PA for multimedia, which does not apply to plain text.Source: §1 · p. 1
  • Detector sharing is considered risky because feedback may help remove watermarks at lower distortion or add signal to falsely attribute text.Both attacks are already possible without a detector, but often degrade text quality or require a watermarked sample or corpus.Source: §1 · p. 2
  • The study compares uninformed and detector-informed attacks across access levels, then splits the watermark across public and private keys and tests their score imbalance.The split-key method aims to keep the strongest informed attacks detectable without claiming unforgeability.Source: §1 · p. 2
  • Public detection carries bounded liability: informed removal helps only at small edit budgets, while most successful strongest informed forgeries are caught.The paper also reports that scores or p-values enable strong informed attacks, whereas a binary verdict can help removal by indicating when to stop.Source: §1 · p. 2

2 Background and Threat Model

This section introduces statistical LLM watermarking and the threat model, then describes removal and forgery attacks adapted to different levels of detector access.

2.1 LLM Watermarking

  • A watermark leaves a key-dependent statistical trace: Gumbel-max uses keyed randomness, while TextSeal routes tokens between two independent keys and fuses their scores for detection.The fused score is calibrated to a p-value using a moment-matched Gamma distribution.Source: §2.1 · pp. 2–3

2.2 Threat Model

  • The threat model ranges from no detector access to black-box verdicts, gray-box p-values, and white-box token scores; white-box is the most permissive setting.A binary verdict serves as a stopping rule for attacks, while white-box access is advantageous for forgery.Source: §2.2 · p. 3

2.3 Attacks on a Public Detector

  • Rephrasing and word-edit attacks use detector feedback to steer removal or forgery, with white-box edits targeting token scores and black-box attacks querying verdicts.Rephrasing can steer regeneration away from the watermark or try paraphrases of increasing strength; forgery adapts these objectives to raise the watermark score.Source: Figure 2 · p. 3, §2.3 · p. 4

3 Split-Key as a Defense Against Informed Attacks

The split-key defense exposes one watermark channel while retaining a fused private verdict. It tests public-private score imbalance to detect informed tampering.

3 Split-Key as a Defense Against Informed Attacks

  • The public detector scores one key, while the platform privately combines both keys’ scores for its full watermark verdict.Each channel carries only a fraction of the signal because routing sends a fraction of tokens to the public key.Source: §3 · p. 4
  • With equal routing, untampered texts have exchangeable channels; informed removal lowers the public score relative to the private score, while forgery raises it.Different h-gram contexts could make the channel gap more sensitive to edits, but the main experiments use equal contexts.Source: §3 · p. 5
  • A two-stage detector first tests the fused score for watermark presence, then tests channel balance for removal or forgery using the corresponding tail.The sign-flip permutation test calibrates the imbalance test; an attacker who changes the public signal enough to affect the fused verdict also enlarges the gap and may be caught.Source: §3 · p. 5

4 Experiments

The experiments compare detector access levels, test the split-key defense against removal and forgery, and extend it to other watermark schemes. Public access can aid attacks, but the two-stage test catches many informed attacks, with effectiveness depending on attack type and budget.

4.1 Experimental setup

  • The experiments use TextSeal with two keys on ELI5 data, and evaluate attacks across detector access tiers using success, detection, and text-distortion measures.The setup uses 1,000 samples, h=3 contexts per channel, and FPR 10^-3 for both tests.Source: §4.1 · p. 6

4.2 Vulnerability of Public Detection

  • White-box access enables far higher attack success than uninformed attacks; black-box feedback improves removal’s success-distortion tradeoff but does not directly enable forgery.The reported white-box forgery attack reaches up to 79% ASR on Maryland.Source: Table 1 · p. 6, §4.2 · p. 7

4.3 Evaluating the Split-Key Defense

  • Informed removal succeeds more often than no-box only at the smallest budgets, while strong informed forgery attacks are often caught by the tampering test.Public access still raises forgery success above the near-zero no-box baseline after both stages.Source: §4.3 · p. 7, Figure 4 · p. 7
  • As removal attacks strengthen, the public-private score gap grows because private scores fall more slowly for removal and stay fixed for forgery.Informed word edits can reach higher public success at lower distortion, but the tampering test catches many of them.Source: §4.3 · pp. 7–8

4.4 Adaptive Attacks

  • Adaptive white-box attacks can raise net success by reducing tampering-test rejections, while black-box adaptive attacks remain below no-box success.White-box forgery remains partial for edits and low for rephrasing; large overshoot can make attacks detectable again.Source: Table 2 · p. 8, §4.4 · p. 9
  • Offline corpus-learning attacks need no detector, but at the evaluated h=3 context length they achieve at most 3% ASR.They forge most carrier texts only at h=2, making this threat context-length dependent.Source: §4.4 · p. 9

4.5 Extension to Other Schemes

  • The split-key construction also works with Maryland and SynthID-Text, where the fused and tampering tests reject white-box attacks on the public detector.The variants route each position to the public key with probability α=0.5 and otherwise to the private key.Source: §4.5 · pp. 9–10

5 Related Work

Prior work spans watermark construction, public detectability, and removal or forgery attacks. This paper situates its approach among cryptographic and network-based alternatives, as well as attacks focused mainly on no-box settings.

Watermarking methods

  • LLM watermarking includes non-distortionary Gumbel-max and distortionary green-list methods, alongside inverse sampling, SynthID-Text, Permute-and-Flip, and TextSeal.The cited green-list method boosts selected logits, with later work scaling the bias for unbiased distributions.Source: §5 · p. 10

Public detectability

  • Public-detectability approaches include cryptographic signatures, independent embedding and detection networks, and co-embedded robust and fragile watermarks.The cited cryptographic methods are described as weakly robust or intractable for low-entropy text.Source: §5 · p. 10

Removal and forgery

  • Prior removal and forgery work includes corpus-stealing and fine-tuned paraphrasing attacks, while several studies focus on no-box scenarios.The authors position their plain paraphrasing and word-edit baselines as weaker attacks that are already close to informed attacks.Source: §5 · p. 10

6 Conclusion

The paper argues that public detection creates bounded but manageable watermark-tampering liability: the split-key pipeline catches most informed forgeries while removal stays close to what no-detector attacks already allow. Its experiments use the authors’ watermark implementations on open-weight models, with public models and datasets and no proprietary data.

6 Conclusion

  • The split-key construction and tampering test lower informed-attack success: removal stays close to no-detector attacks, while the private pipeline catches most informed forgeries that pass public detection.The conclusion cautions that a careful attacker can keep the channel imbalance small.Source: §6 · p. 10

Ethics Statement

  • The experiments cover only the authors’ watermark implementations on open-weight models, and the attacks require detector-query access unavailable in current private-detector deployments.The paper expects a positive overall impact, but notes that user-facing detection tools should communicate how watermarking and detection work.Source: Ethics Statement · p. 11
  • The public detector releases one of two watermark keys; a two-stage private test using both keys catches most informed forgeries that pass public detection.Informed removal remains close to what is already possible without a detector.Source: Ethics Statement · p. 11

Reproducibility Statement

  • The experiments use publicly available models and datasets, with no proprietary data; the authors say they will release experiment code under a permissive license for the camera-ready version.The work builds mainly on TextSeal, which has an Apache-2.0 license.Source: Reproducibility Statement · p. 11

A Discussion and Limitations

The discussion weighs public verification and interoperability against detector exploitation, and frames the evaluation as an upper bound for fully transparent access. The appendices review watermarking and attack methods, define distortion-free properties, and specify the evaluated attack procedures.

A Discussion and Limitations

  • A fully transparent detector is an upper bound on liability; public verification could support interoperability, but detector feedback can steer edits and channel-routing leakage remains a concern.The authors leave rate limits and randomized threshold responses for future work; they also note that an intuitive public platform matters because nontechnical users may misinterpret detection.Source: A Discussion and Limitations · p. 15

B.1 LLM watermarking

  • Generation-time watermarking includes non-distortionary sampling methods such as Gumbel-max and SynthID-Text, while TextSeal routes tokens randomly between two keys.Watermarking works better in high-entropy generations, and some methods address low-entropy settings.Source: §B.1 · pp. 15–16

B.2 Public detectability and unforgeable watermarks

  • Prior public-detection approaches include cryptographic signatures and independently embedded and detected signals; the cited cryptographic constructions are not yet practical as robust, fast public schemes.The concurrent split-signal works cited are not oriented toward public detection.Source: §B.2 · p. 16

B.3 Removal and forgery

  • Prior removal and forgery work includes detector-query attacks and learned paraphrasers; one cited removal approach evades tested watermarks without detector queries and with negligible quality loss.The review also describes attacks that reverse-engineer or steal watermarking schemes.Source: §B.3 · pp. 16–17

C.1 Distortion-free watermarking

  • Single-sequence non-distortion requires the full response distribution to match the original LLM, not merely each token’s marginal distribution.Repeated-context masking restores this property for schemes whose sliding-window seed would otherwise repeat deterministic choices.Source: §C.1 · p. 17

C.2 Attacks

  • The evaluated informed attacks use detector feedback at different access levels, including score-guided word edits and rephrasing that adjusts its bias using the running public p-value.In the black-box setting, the detector returns a binary verdict; word edits stop when the verdict flips or the edit budget is reached.Source: §C.2 · p. 18

C.3 Tampering Test

The two-stage pipeline tests watermark presence and public-private channel imbalance, with its error rates depending on whether texts are clean and watermarked or unwatermarked. The appendix also reports calibration and compares tampering-test choices across attack types.

C.3 Tampering Test

  • The tampering test’s empirical false-positive rate closely follows its nominal rate, supporting calibration under the channel-symmetry null.Figure 7 also presents null calibration for both tampering tests and watermark tests.Source: §C.3 · p. 18, Figure 7 · p. 19
  • At equal per-stage level η, the pipeline’s joint false-positive rate for unwatermarked texts can approach 2η; splitting the budget as η/2 per stage restores joint η with a small power cost.The tampering p-value is uniform conditional on the first-stage verdict when that stage reads the sum of the channels.Source: §C.3 · p. 19
  • Unwatermarked text can be flagged by either stage, giving an overall rate of roughly 2η; watermarked untampered text faces only the forgery-stage error rate.At η values of 0.05, 0.01, and 10^-3, that rate was 5.31%, 1.05%, and 0.17% across 5,992 untampered generations.Source: §C.3 · p. 19, Table 3 · p. 20
  • The permutation test is more powerful on concentrated forgery and word-edit attacks, while the binomial test is more powerful on rephrasing; the permutation test has the better reported worst case.The reported worst-case detection rates are 1.2% for permutation and 0.6% for binomial.Source: §C.3 · p. 20

C.4 Attack Examples

  • The appendix visualizes attack score distributions and examples of white-box edits for removal and forgery, but these passages do not report specific outcomes.Figure 8 compares attack goals in score space; Figures 9 and 10 show text edits.Source: §C.4 · p. 20

D.1 Extended Numbers of the Main Results

This section identifies the attack-level metrics and distortion measures reported in the extended results. It also states which tampering test performs better across attack types, without giving the table’s individual rates.

D.1 Extended Numbers of the Main Results

  • The removal and forgery tables report public, private, and fused median −log p scores, public and fused attack success rates, tampering detection rate, net attack success, and text distortion.The tables report rates unconditionally, whereas Figure 4 conditions its bar heights on public success; the views differ rarely.Source: §D.1 · p. 20
  • Attack distortion is measured with 1 − BERT-F1, MiniLM cosine distance, GPT-2 log-perplexity ratio, and word-overlap distance.The additional quality metrics are shown separately for removal and forgery sweeps.Source: §D.1 · pp. 20–21
  • The binomial test is more powerful on rephrasing, while the permutation test is more powerful on concentrated attacks, according to the table’s stated comparison.Table 5 reports attack detection rates at p < 10^-3 for symmetric (2, 2), white-box attacks, with 1,000 documents per row.Source: Table 5 · p. 21

D.2 Generalization to Other Models

Across other generator models, the two-stage defense retains its attack ordering when watermark signal is matched. Absolute removal rates are lower for the stronger SmolLM2 watermark.

D.2 Generalization to Other Models

  • Gemma-3-4B uses temperature 1.5 to match Qwen’s approximate watermark signal per 100 tokens before attacks.At the same temperature, Gemma is less entropic and starts with less signal to remove.Source: §D.2 · p. 21
  • The defense behaves similarly on Gemma-3-4B and Qwen once their starting watermark signal is matched, while SmolLM2 has lower absolute removal rates but the same attack ordering.Gemma’s rephrasing results differ because its proxy rewrites more heavily and begins behaving like an uninformed attack.Source: §D.2 · pp. 21–23

D.3 Watermark Strength Before Attack

These appendices examine watermark strength, attack transfer across tokenizers and access settings, flipping distortion, and watermark stealing. Detector feedback can improve removal in some settings, but the two-stage checks constrain attacks that create channel imbalance.

D.3 Watermark Strength Before Attack

  • Before attacks, the fused p-value is lower than either channel’s, and the full-length fused test flags 98.3% of untampered watermarked texts at the same threshold.The cited strength measurements use the first 100 tokens; full generations average 360 tokens.Source: §D.3 · pp. 23–24

D.4 Cross-Tokenizer Rephrasing

  • Cross-tokenizer rephrasing steers effectively when proxy and generator tokenization overlap; little overlap reduces it to uninformed paraphrasing, which the tampering test cannot detect.A proxy that tokenizes similarly can steer the score more effectively, but the tampering test flags it.Source: §D.4 · pp. 24–26

D.5 Adaptive Black-Box Attacks

  • Informed removal reaches near-100% public ASR, but attacks that widen the public-private gap are flagged, limiting net success, especially at larger edit budgets.Informed attacks outperform no-box attacks only at the smallest budgets; at larger budgets, the tampering test rejects the imbalance.Source: §D.5 · p. 27, §D.6 · p. 28
  • Black-box attackers use the binary verdict only to decide when to stop; adaptive attacks slightly improve the ASR-distortion tradeoff without triggering the tampering test.At a 5% budget, different stopping rules are equivalent because the attack reaches its budget before the verdict flips.Source: §D.5 · pp. 26–27

D.6 Distribution of Flipping Distortion

  • For removal, informed rephrasing barely improves on uninformed rephrasing, while informed word edits approach 100% public ASR but reach only about 40% net success.The reported flipping-distortion CDF gives the share of texts flipped by each distortion budget; net success also requires passing the tampering test.Source: §D.6 · p. 28

D.7 A Gray-Box Public Detector

  • Gray-box attacks infer a token’s score from two detector queries, but require numerous queries that can be practically constrained with rate-limiting.Word-edit probing also requires removing a token and comparing the overall p-value.Source: §D.7 · pp. 28–29

D.8 Watermark Stealing

  • Detector supervision accelerates watermark stealing but yields very low net attack success because it targets only the public channel and creates score imbalance.Uninformed stealing draws information from both channels and is more advantageous for reverse-engineering the watermark.Source: §D.8 · p. 29

D.9 Other Datasets

The two-stage defense remains effective on CaLMQA, a multilingual question-answering dataset, though per-language rates are noisier because each language has fewer than 100 documents.

D.9 Other Datasets

  • Each language has fewer than 100 documents, so its attack rates are expected to be noisier than the main experiments.The 1,000 questions are divided across languages.Source: §D.9 · p. 29
  • The forgery evaluation uses unwatermarked generated responses as carrier text because CaLMQA has no human-written reference answers.Removal attacks target watermarked responses.Source: §D.9 · p. 29
  • The split watermark construction and tampering test remain effective in low-resource languages on CaLMQA.The attack evaluation uses white-box word edits at 20%.Source: §D.9 · p. 29, Table 12 · p. 30

E Asymmetric Contexts

Using unequal contexts makes the public-private score gap sensitive to edits, but the resulting forensic signal does not compensate for lost fused detection. Equal contexts yield better net results at every tested text size.

E Asymmetric Contexts

  • A wide public context decays faster under edits because its seeding (h+1)-gram survives with probability q_h = (1 − ρ)^(h+1), making uninformed editing move the channel gap.This unequal-context design is presented as a negative result for improving the defense.Source: E Asymmetric Contexts · p. 30
  • The channel gap adds forensic evidence of rephrasing, but does not improve net detection because the wide public channel carries half the fused score.The contrast reaches z = −24.3 on removed text, versus −0.6 for the control.Source: E Asymmetric Contexts · pp. 30–31
  • The wide context belongs on the public key so an edit’s score loss and reseeding effects affect the same channel.Reversing the placement sends the reseeding effect to the private channel, where it cancels part of the score loss.Source: E Asymmetric Contexts · p. 30
  • Equal contexts give better net results at every tested text size because rephrasing destroys the wide public channel and the tampering test recovers less than the fused test loses.Table 13 reports ASRnet with both tests run over all scored tokens.Source: E Asymmetric Contexts · p. 31, Table 13 · p. 31
Loading 2610.12106v1…