- https://arxiv.org/pdf/2306.04634.pdf
- Source: arxiv
TL;DR
This paper stress-tests LLM watermarking schemes — including the Kirchenbauer green-token watermark — against practical attacks and shows that LLM-based paraphrasing reliably removes the signal below detection thresholds, exposing a fundamental robustness-quality tradeoff.
Summary
Watermarking LLM outputs is proposed as a provenance signal, but how robust are these schemes against adversarial removal? This paper evaluates the green-token watermark and related schemes against paraphrasing, translation, emoji insertion, and synonym substitution. LLM-based paraphrasing is the most effective attack, defeating watermarks with moderate quality loss. The paper quantifies the robustness-quality tradeoff — stronger watermarks degrade output quality; weaker ones are easy to remove — and proposes adversarial evaluation protocols as a standard that watermark claims must meet to be credible.
Key contributions
- Demonstrates that the green-token watermark is fragile under LLM-based paraphrasing, which removes the signal below detection thresholds.
- Systematically evaluates multiple attack vectors — paraphrasing, translation, emoji insertion, synonym substitution — against watermark detection.
- Quantifies the fundamental robustness-quality tradeoff inherent to LLM watermarking schemes.
- Proposes adversarial evaluation protocols as a required standard for future watermark reliability claims.
When to cite
- When evaluating the robustness of LLM watermarking schemes against realistic adversarial removal attacks.
- When arguing that LLM-based paraphrasing is a low-cost, widely accessible watermark removal attack that any scheme must address.
- When discussing the robustness-quality tradeoff inherent in content provenance techniques for LLM outputs.
- When proposing or critiquing adversarial benchmarks for evaluating watermark reliability in the literature.