← Back to all news
arXiv Machine Learning By Georgios Milis, Tom Sander, Tom\'a\v{s} Sou\v{c}ek, Heng Huang, Pierre Fernandez

Could LLM Watermark Detection be Public?

Read the original on arXiv Machine Learning →

The paper investigates whether releasing a public detector for large language model (LLM) watermarks is safe. It first assesses the risk of a public detector at different access levels, then proposes a split-key watermarking scheme that publishes one key for public detection while keeping a second key private for full verification. Experiments show that public detection only slightly improves watermark removal under limited edit budgets but enables forgery, which the private pipeline can detect, suggesting that releasing half of the watermark can provide transparency without significantly increasing liability.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv Machine Learning.

Related stories

arXiv AI
Oct 5

Mitigating Watermark Forgery in Generative Models via Randomized Key Selection

The paper proposes a defense against watermark forgery in generative models by randomizing the selection of watermark keys for each query and accepting content only if exactly one key detects a watermark. This approach provides a sample‑count‑independent upper bound on forgery success for blind attackers while preserving model utility. Experiments show a dramatic drop in forgery success rates—from 87% to 1% with four keys for text and from 100% to 2% for images—without significant computational overhead.

By Toluwani Aremu, Noor Hussein, Munachiso Nwadike, Samuele Poppi, Jie Zhang, Karthik Nandakumar, Neil Gong, Nils Lukas
rag
More like this →
arXiv Machine Learning
Jul 8

Multi-Channel Spread-Spectrum Code Watermarking

arXiv:2607. 06009v1 Announce Type: cross Abstract: Attributing code to the large language model that produced it is essential for provenance, licensing, and misuse accountability, yet no deployed watermark meets this need.

By Soohyeon Choi, Debin Gao, Yue Duan
llmsrag
More like this →
arXiv Computation and Language
Sep 16

Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs

The paper examines how open‑weight language models expose the control tokens used in chat templates, allowing attackers to forge turn boundaries that the model treats as legitimate. An audit of 256 deployed tokenizers shows all are vulnerable, and the commonly recommended flag fails to protect 56.6% of cases. The authors introduce nameless tokenization, which removes surface strings for control identifiers while preserving their internal representation, achieving identical token streams on clean data and significantly improving accuracy on delimiter‑bearing text.

By Kisu Yang, Yoonna Jang, Heuiseok Lim
llmsagentsnlp
More like this →