Newest papers

A Unified Attack Framework against Statistical Generative Watermarks for Large Language Models

Romina Omidi, Nima Naderloui, Yuan Hong, Binghui Wang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27653 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

ウォーターマッキングは、大規模な言語モデル(LLMs)によって生成されたテキストを識別するための重要なツールとして現れ、現在のスケジュールは、後で検出を可能にするプロセスに統計信号を組み込んでいます。この作品では、私たちは、KGW(およびその変数)、GumbelSoft、DipMark、ITS、SynthIDなどの一般的なLLMのウォーターマッキング方法の広いクラスにわたって共有された弱点を特定しています。私たちは、これらのスケジュールは、検出スコアと、生成中に導入するトークン確率の変化の間の根本的なリンクを示していることを示しています。このリンクは、我々がスコア比率調節と呼ぶもので、

Machine translation (Meta M2M100); the English original follows.

Abstract

Watermarking has emerged as a key tool for identifying text generated by large language models (LLMs), with current schemes embedding statistical signals into the generation process to enable later detection. In this work, we identify a shared weakness across a broad class of popular LLM watermarking methods, including KGW (and its variants), GumbelSoft, DipMark, ITS, and SynthID. We show that these schemes exhibit a fundamental link between their detection scores and the token probability shifts they introduce during generation. This link, which we call score-ratio alignment, allows an attacker with only black-box query access to the model--and no knowledge of secret keys or model weights--to produce text that evades detection while remaining fluent and natural. We prove that the resulting attack is optimal across all covered watermark families, and show that the weakness is intrinsic: any watermark designed to maximize statistical detection power necessarily induces the very structure that attackers can exploit. We evaluate our attack on seven popular generative LLM watermarking schemes, three LLMs, and tasks, which reduce detection rates to at most 0.05 across all settings while preserving text quality. Our findings show that current watermarking methods can be reliably defeated under realistic attack conditions, highlighting the need for fundamentally different watermarking designs that decouple detection scores from token probability shifts.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Digital watermarking, Watermark, Security token, Computer science, Key (lock), Embedding

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange