Newest papers

A Unified Attack Framework against Statistical Generative Watermarks for Large Language Models

Romina Omidi, Nima Naderloui, Yuan Hong, Binghui Wang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27653 · cited by 0 works (OpenAlex) · open-access PDF

Russian

В этой работе мы идентифицируем общую слабость в широком классе популярных методов водяного знака LLM, включая KGW (и его варианты), GumbelSoft, DipMark, ITS и SynthID. Мы показываем, что эти схемы демонстрируют фундаментальную связь между их результатами обнаружения и сдвигами вероятности токенов, которые они вводят во время генерации. Эта связь, которую мы называем уравнением соотношения баллов, позволяет атакующему с единственным запросом в черном ящике получить доступ к модели - и без знаний о секретных ключах или весах модели. Мы показываем, что эти схемы демонстрируют фундаментальную связь между их результатами обнаружения и сдвигами вероятности токенов, которые они вводят во время генерации. Эта связь

Machine translation (Meta M2M100); the English original follows.

Abstract

Watermarking has emerged as a key tool for identifying text generated by large language models (LLMs), with current schemes embedding statistical signals into the generation process to enable later detection. In this work, we identify a shared weakness across a broad class of popular LLM watermarking methods, including KGW (and its variants), GumbelSoft, DipMark, ITS, and SynthID. We show that these schemes exhibit a fundamental link between their detection scores and the token probability shifts they introduce during generation. This link, which we call score-ratio alignment, allows an attacker with only black-box query access to the model--and no knowledge of secret keys or model weights--to produce text that evades detection while remaining fluent and natural. We prove that the resulting attack is optimal across all covered watermark families, and show that the weakness is intrinsic: any watermark designed to maximize statistical detection power necessarily induces the very structure that attackers can exploit. We evaluate our attack on seven popular generative LLM watermarking schemes, three LLMs, and tasks, which reduce detection rates to at most 0.05 across all settings while preserving text quality. Our findings show that current watermarking methods can be reliably defeated under realistic attack conditions, highlighting the need for fundamentally different watermarking designs that decouple detection scores from token probability shifts.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Digital watermarking, Watermark, Security token, Computer science, Key (lock), Embedding

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange