Newest papers

A Unified Attack Framework against Statistical Generative Watermarks for Large Language Models

Romina Omidi, Nima Naderloui, Yuan Hong, Binghui Wang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27653 · cited by 0 works (OpenAlex) · open-access PDF

Korean

워터마킹은 대형 언어 모델 (LLMs)에 의해 생성 된 텍스트를 식별하기위한 핵심 도구로 등장했으며, 현재 체계는 나중에 탐지 할 수 있도록 생성 과정에 통계 신호를 삽입합니다. 이 작업에서 우리는 KGW (그리고 그 변형), GumbelSoft, DipMark, ITS 및 SynthID를 포함한 대중적인 LLM 워터마킹 방법의 광범위한 클래스에서 공유된 약점을 식별합니다. 우리는이 체계가 감지 점수와 그들이 생성하는 토큰 확률 변화 사이의 근본적인 연관성을 보여줍니다. 이 링크는 우리가 점수 비율 조정이라고 부르는이 링크는 단지 블랙박스 쿼리를 가진 공격자가 모델에 액세스 할 수 있습니다

Machine translation (Meta M2M100); the English original follows.

Abstract

Watermarking has emerged as a key tool for identifying text generated by large language models (LLMs), with current schemes embedding statistical signals into the generation process to enable later detection. In this work, we identify a shared weakness across a broad class of popular LLM watermarking methods, including KGW (and its variants), GumbelSoft, DipMark, ITS, and SynthID. We show that these schemes exhibit a fundamental link between their detection scores and the token probability shifts they introduce during generation. This link, which we call score-ratio alignment, allows an attacker with only black-box query access to the model--and no knowledge of secret keys or model weights--to produce text that evades detection while remaining fluent and natural. We prove that the resulting attack is optimal across all covered watermark families, and show that the weakness is intrinsic: any watermark designed to maximize statistical detection power necessarily induces the very structure that attackers can exploit. We evaluate our attack on seven popular generative LLM watermarking schemes, three LLMs, and tasks, which reduce detection rates to at most 0.05 across all settings while preserving text quality. Our findings show that current watermarking methods can be reliably defeated under realistic attack conditions, highlighting the need for fundamentally different watermarking designs that decouple detection scores from token probability shifts.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Digital watermarking, Watermark, Security token, Computer science, Key (lock), Embedding

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange