← Back to all news
arXiv Machine Learning

Could LLM Watermark Detection be Public?

The paper investigates whether releasing a public detector for large language model (LLM) watermarks is safe. It first assesses the risk of a public detector at different access levels, then proposes a split-key watermarking scheme that publishes one key for public detection while keeping a second key private for full verification. Experiments show that public detection only slightly improves watermark removal under limited edit budgets but enables forgery, which the private pipeline can detect, suggesting that releasing half of the watermark can provide transparency without significantly increasing liability.

Related stories

arXiv AI
Oct 5

Mitigating Watermark Forgery in Generative Models via Randomized Key Selection

The paper proposes a defense against watermark forgery in generative models by randomizing the selection of watermark keys for each query and accepting content only if exactly one key detects a watermark. This approach provides a sample‑count‑independent upper bound on forgery success for blind attackers while preserving model utility. Experiments show a dramatic drop in forgery success rates—from 87% to 1% with four keys for text and from 100% to 2% for images—without significant computational overhead.

By Toluwani Aremu, Noor Hussein, Munachiso Nwadike, Samuele Poppi, Jie Zhang, Karthik Nandakumar, Neil Gong, Nils Lukas
rag
More like this →
arXiv Machine Learning
Jul 8

Multi-Channel Spread-Spectrum Code Watermarking

arXiv:2607. 06009v1 Announce Type: cross Abstract: Attributing code to the large language model that produced it is essential for provenance, licensing, and misuse accountability, yet no deployed watermark meets this need.

By Soohyeon Choi, Debin Gao, Yue Duan
llmsrag
More like this →
arXiv Computation and Language
Sep 16

Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs

The paper examines how open‑weight language models expose the control tokens used in chat templates, allowing attackers to forge turn boundaries that the model treats as legitimate. An audit of 256 deployed tokenizers shows all are vulnerable, and the commonly recommended flag fails to protect 56.6% of cases. The authors introduce nameless tokenization, which removes surface strings for control identifiers while preserving their internal representation, achieving identical token streams on clean data and significantly improving accuracy on delimiter‑bearing text.

By Kisu Yang, Yoonna Jang, Heuiseok Lim
llmsagentsnlp
More like this →
arXiv Computation and Language
Aug 31

Semantic Watermarking with Order-Robust Detection over Sub-sentence Units

The paper introduces an adaptive embedding displacement attack (EDA) that exploits rewording, reordering, and resegmentation to remove semantic watermarks from text, achieving a 32.6%–47.9% success rate across four watermarking schemes. To counter this, the authors propose k‑SwordStamp, a semantic watermarking method that uses order‑robust detection over sub‑sentence units, significantly reducing vulnerability to structure‑based edits. Experiments show that EDA remains effective against k‑SwordStamp, but with a lower success rate (10.8%) compared to its performance on other schemes.

By Abdulrahman Diaa, Jonathan Petit, Florian Kerschbaum
rag
More like this →
arXiv Computation and Language
4d ago

Black-Box Forensics for Conversational LLM Agents

The paper presents methods for black-box forensic analysis of conversational large language model (LLM) agents, focusing on two tasks: attribution—identifying the base model powering a chatbot—and fingerprinting—detecting identical system prompts across different endpoints. Attribution classifiers achieve 98% accuracy using only a few non‑adversarial conversation turns, while a cross‑encoder fingerprinting approach attains an AUC of 0.768 and an F1 of 0.703 on unseen prompts, improving to 0.943 AUC when aggregating 50 interactions. These techniques enable investigators to trace AI‑enabled scams back to their underlying models and link related scams through shared system prompts.

By Isadora White, Yasaman Jafari, Taylor Berg-Kirkpatrick
llmsagentssafety
More like this →