Newest papers

A Unified Attack Framework against Statistical Generative Watermarks for Large Language Models

Romina Omidi, Nima Naderloui, Yuan Hong, Binghui Wang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27653 · cited by 0 works (OpenAlex) · open-access PDF

French

Dans ce travail, nous avons identifié une faiblesse partagée à travers une large classe de méthodes de marquage de l'eau LLM populaires, y compris KGW (et ses variantes), GumbelSoft, DipMark, ITS, et SynthID. Nous montrons que ces schémas montrent un lien fondamental entre leurs scores de détection et les changements de probabilité de jetons qu'ils introduisent au cours de la génération. Ce lien, que nous appelons l'alignement du ratio de score, permet à un attaquant avec une seule requête en boîte noire d'accéder au modèle - et aucune connaissance des clés secrètes ou des poids de modèle - de produire un texte qui évit la détection tout en restant fluide et naturel. Nous prouvons que l'

Machine translation (Meta M2M100); the English original follows.

Abstract

Watermarking has emerged as a key tool for identifying text generated by large language models (LLMs), with current schemes embedding statistical signals into the generation process to enable later detection. In this work, we identify a shared weakness across a broad class of popular LLM watermarking methods, including KGW (and its variants), GumbelSoft, DipMark, ITS, and SynthID. We show that these schemes exhibit a fundamental link between their detection scores and the token probability shifts they introduce during generation. This link, which we call score-ratio alignment, allows an attacker with only black-box query access to the model--and no knowledge of secret keys or model weights--to produce text that evades detection while remaining fluent and natural. We prove that the resulting attack is optimal across all covered watermark families, and show that the weakness is intrinsic: any watermark designed to maximize statistical detection power necessarily induces the very structure that attackers can exploit. We evaluate our attack on seven popular generative LLM watermarking schemes, three LLMs, and tasks, which reduce detection rates to at most 0.05 across all settings while preserving text quality. Our findings show that current watermarking methods can be reliably defeated under realistic attack conditions, highlighting the need for fundamentally different watermarking designs that decouple detection scores from token probability shifts.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Digital watermarking, Watermark, Security token, Computer science, Key (lock), Embedding

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange