Research map / Adversarial robustness and security / Attacks on text and graphs
Optimizing Adaptive Attacks against Watermarks for Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that small open-weight paraphrasers adaptively tuned with preference optimization (DPO) on watermark-specific preference data can evade detection of LLM watermarks at negligible quality loss, at under ~$10 cost.
Problem
LLM content watermarks are tested only against non-adaptive attackers who do not know the watermarking algorithm, so their robustness against attackers who know the algorithm (adaptive attacks) is untested.
Approach
Curate preference datasets by best-of-N rejection sampling of paraphrases of watermarked text generated with surrogate keys, label paraphrases that evade detection while keeping quality as positives, and fine-tune an open-weight paraphraser with DPO to evade the watermark; the tuned attacks also transfer to unseen watermarks.
Key results
- Adaptive attacks achieve evasion rates of at least 96.6% against the surveyed watermarks (Exp, Dist-Shift, Inverse, Binary) on a Llama2-13b target.
- Tuned Qwen2.5-7b reaches 97.3% evasion at quality 0.846 against Llama2-13b-based watermarking, while non-adaptive model-based attacks such as vanilla Llama2-7b reach 61.8%.
- Dataset curation for 7,000 samples takes under 5 GPU hours and total attack cost is under $10 USD.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Adaptively fine-tune the paraphraser against a known watermark | Llama2-7b attack against Llama2-13b watermarked text · Surveyed watermarks | evasion rate: at least 96.6% | Helped |
| Train on Exp rather than the other surveyed watermark settings | Adaptive Llama2-7b attack · Surveyed watermarks | evasion rate: at least 97.0% | Helped |
| Train on all four watermarks instead of only Exp (ablation) | Llama2-7b attack · Surveyed watermarks | evasion rate: at least 97.0% -> at least 96.3% | Hurt |
| Train on all four watermarks instead of only Exp (ablation) | Llama2-7b attack · Surveyed watermarks | text quality: 0.901 -> 0.893 | Hurt |
| Tune Llama2-7b against a watermark in the non-adaptive setting | Llama2-7b attack against Exp · Exp, Llama3.1-70b target | evasion rate: 61.8% up to 86.1% -> 90.9% ... up to 97.6% | Helped |
| Use adaptive tuning instead of a vanilla Llama2-7b paraphraser | Llama2-7b attack · Watermark detection | expected p-value: 0.10 -> 0.4 | Helped |
| Increase Qwen2.5 paraphraser model size (ablation) | Adaptive attack against Exp · Exp watermark | text quality | Helped |
| Increase the number of paraphrases used for sampling (ablation) | Qwen2.5 paraphraser · Exp watermark | evasion rate | Helped |
| Increase paraphrase repetitions close to 16 (ablation) | Qwen2.5 paraphraser · Exp watermark | evasion rate | No clear effect |
| Set Dist-Shift bias beta to 8 rather than beta 4 (ablation) | Dist-Shift watermark · Dist-Shift | evasion rate: 0.95 -> 0.71 | Hurt |
| Set Dist-Shift bias beta to 8 rather than beta 4 (ablation) | Llama2-7b attack · Dist-Shift | evasion rate: 0.96 -> 0.92 | Hurt |
| Set Dist-Shift bias beta to 8 rather than beta 4 (ablation) | Llama2-7b-Exp attack · Dist-Shift | evasion rate: 0.94 -> 0.94 | No clear effect |
Surprising findings
- Adaptively tuned paraphrasers trained against one watermark transfer to unseen watermarks in the non-adaptive setting, with evasion rates of at least 94.3%.
- The optimized 7b paraphrasers outperform GPT-4o on the Pareto front for evasion rate versus text quality against several watermarks.
Limitations
- Only offline, no-box attackers were studied; online attacks with Verify access could be stronger.
- No adaptive defenses were evaluated.
- Quality is measured mainly with LLM-as-a-judge metrics that may not align with human judgment, and only text generation was studied.
Experimental setup
Datasets: synthetic prompt set generated with ChatGPT-4 (1,000 training prompts) 296 evaluation prompts from MarkMyWords
Benchmarks: MarkMyWords
Metrics: evasion rate LLM-Judge quality LLM-CoT LLM-Compare MAUVE perplexity
Baselines: DIPPER Translate Swap Synonym HELM GPT-3.5 GPT-4o
Builds on: Direct Preference Optimization KGW watermark DIPPER
Closest papers by meaning
- Leveraging Optimization for Adaptive Attacks on Image Watermarks (ICLR 2024 · similarity 0.92)
- Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.90)
- Adaptive Text Watermark for Large Language Models (ICML 2024 · similarity 0.90)
- A Semantic Invariant Robust Watermark for Large Language Models (ICLR 2024 · similarity 0.90)
- Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach (NeurIPS 2025 · similarity 0.90)
- On the Learnability of Watermarks for Language Models (ICLR 2024 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.