The paper presents a method for evading Knowledge-Guided Watermarking (KGW) by replacing token‑event evidence with ordinary phrase rewrites. It jointly selects LLM‑proposed alternatives, measures global token‑edit distance, and uses exact coverage search to maximize removal of original scored token pairs within a budget. Experiments on short passages show that about half of detected sources can be rewritten to pass a blinded detector with a moderate token‑edit cost, though the approach does not outperform simpler rewriting strategies.
arXiv:2606. 18430v1 Announce Type: new Abstract: Statistical watermarks help organizations attribute large language model (LLM) outputs, yet existing detectors often struggle when watermark signals are weak, texts are repetitive, or watermarks are edited.
arXiv:2608. 16852v1 Announce Type: new Abstract: Regulatory compliance monitoring in deployed language models is increasingly implemented as a legal and audit control, checking model outputs against written rules spanning data protection, healthcare, financial regulation, and platform policy.
The paper introduces "watermarkability," a metric that quantifies how compatible a language model is with a logit‑based watermark that boosts the probability of a specified token set during decoding. By measuring the expected minimum KL divergence needed to achieve a target probability mass, the authors can assess and compare models and watermark rules. They propose a two‑stage approach—first training a low‑rank adapter conditioned on the target set, then applying a minimal uniform logit bias—to reduce this cost, achieving significant perplexity reductions across multiple watermark schedules on OPT‑125M and Qwen3‑8B.
arXiv:2608.31016v1 Announce Type: cross Abstract: Ambient AI scribes draft clinical notes, and published audits find their dominant error is omission: information the encounter established that the n...
Behavioral watermarking embeds an owner identifier in an LLM agent's high-level action choices, giving provenance without touching output tokens. Prior agent watermarks break in two ways. First, all t...
arXiv:2607. 00224v1 Announce Type: cross Abstract: Watermarking promises a statistical trace of large language model (LLM) use, but real documents, after editing or paraphrasing, rarely arrive as purely human-written or purely machine-generated.
arXiv:2608. 05235v1 Announce Type: cross Abstract: Research agents increasingly conduct multi-round machine-learning experiments in industrial recommendation settings and retain the resulting trajectories to guide later decisions.
arXiv:2609.15657v1 Announce Type: cross Abstract: Keyed watermark detection tests dependence between observed tokens and pseudorandom variables reconstructed from a secret key. Building on the pivota...
arXiv:2610.08668v1 Announce Type: cross Abstract: Behavioral watermarking embeds an owner identifier in an LLM agent's high-level action choices, giving provenance without touching output tokens. Pri...
arXiv:2606. 05633v1 Announce Type: new Abstract: Retrieval-augmented QA pipelines often route retrieved passages through an LLM \emph{rewriter} before a smaller reader, lifting F1 by tens of points on multi-hop benchmarks; this gain is typically credited to improved evidence quality.
arXiv:2608. 10216v1 Announce Type: cross Abstract: Agent frameworks ship quality gates that compare text blocks by embedding-cosine similarity and decide at a fixed cutoff.
The study investigates how subtle changes in the presentation of a structured judging request can influence the behavior of an answer‑grading model. By adding a single colon to a candidate answer, the researchers found that the model’s false‑acceptance rate rose dramatically—from 1–3% to over 26%—across two benchmark datasets (DROP and GSM8K) and different grading configurations. The effect varied with the presentation format, showing that logically equivalent requests can lead to markedly different vulnerabilities.