Research map / Adversarial robustness and security / Attacks on text and graphs
Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SIRA, a black-box paraphrasing attack that masks high self-information tokens (likely watermark green tokens) and fills them via an LLM guided by a reference paraphrase, removing watermarks from seven schemes at near 100% success for low cost.
Problem
Text watermarks embedded in high-entropy tokens can be removed by paraphrasing attacks; existing paraphrase attacks are untargeted, costly, and fail against newer schemes like SIR. The paper asks how to build an efficient, transferable black-box attack for evaluating watermark robustness.
Approach
Use a surrogate LLM to compute per-token self-information, mask tokens above a percentile threshold (treated as likely green-list tokens), and have the LLM fill the blanks guided by a separately generated paraphrase reference, turning untargeted paraphrasing into a targeted fill-in-the-blank task.
Key results
- SIRA-Large achieves 100% or near-100% attack success rate on all seven watermarks (e.g., 98.8% on SIR, 99.8% on EXP), versus at most 82.2%-99.8% for prior paraphrasers.
- SIRA-Small costs about $0.88 per million tokens versus about $20 estimated for GPT-4o paraphrasing.
- On Unigram, the reference paraphrase alone reaches 64% attack success rate while the final SIRA text reaches 94%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SIRA-Large instead of the strongest reported paraphrasing baseline | watermark removal attack · C4 watermarked with Unigram | attack success rate: 45.6% -> 100% | Helped |
| Use SIRA-Large instead of the strongest reported paraphrasing baseline | watermark removal attack · C4 watermarked with UPV | attack success rate: 71.9% -> 99.6% | Helped |
| Use SIRA-Large instead of the strongest reported paraphrasing baseline | watermark removal attack · C4 watermarked with EWD | attack success rate: 90.8% -> 100% | Helped |
| Use SIRA-Large instead of the strongest reported paraphrasing baseline | watermark removal attack · C4 watermarked with SIR | attack success rate: 63.6% -> 98.8% | Helped |
| Use SIRA-Large instead of the strongest reported paraphrasing baseline | watermark removal attack · C4 watermarked with EXP | attack success rate: 82.2% -> 99.8% | Helped |
| Use SIRA-Large instead of the strongest reported paraphrasing baseline | watermark removal attack · C4 watermarked with DIP | attack success rate: 99.8% -> 100% | No clear effect |
| Use SIRA-Large instead of GPT Paraphraser | watermark removal attack · C4 watermarked with KGW-1 | attack success rate: 100% -> 100% | No clear effect |
| Increase the self-information threshold from 0.30 to 0.65 (ablation) | SIRA on UPV · C4 watermarked with UPV | attack success rate: 94% -> 58% | Hurt |
| Replace self-information masking with random masking at mask ratio 0.7 (ablation) | SIRA on Unigram · C4 watermarked with Unigram | attack success rate: 96% -> 80% | Hurt |
| Replace the two-step SIRA rewrite with iterative paraphrasing (ablation) | SIRA on Unigram · C4 watermarked with Unigram | attack success rate: 94% -> 56% | Hurt |
| Use the paraphrased reference alone instead of the final targeted rewrite (ablation) | SIRA on Unigram · C4 watermarked with Unigram | attack success rate: 94% -> 64% | Hurt |
| Replace SIRA-Tiny with SIRA-Large | SIRA on SIR · C4 watermarked with SIR | attack success rate: 75.0% -> 98.8% | Helped |
Surprising findings
- A random mask at the same ratio yields much lower attack success (52%-82%) than self-information masking (80%-100%), and iterative paraphrasing alone reaches only 56%.
Limitations
- The paper's theoretical justification for self-information tracking green tokens is heuristic and relies on approximations.
- The comparison with informed watermark attacks (watermark stealing, random walk) is excluded due to different threat models.
- The attack is evaluated mainly on C4 with OPT-1.3B generation and fixed hyperparameters (epsilon=0.3), with semantic preservation scores varying across methods.
Experimental setup
Datasets: C4
Benchmarks: C4
Metrics: attack success rate true positive rate at 1% and 10% FPR best F1 perplexity Sentence-BERT similarity GPT semantic judge score
Baselines: Word deletion Synonym substitution GPT Paraphraser DIPPER-1 DIPPER-2
Builds on: KGW watermark DIPPER Random Walk attack
Closest papers by meaning
- On the Reliability of Watermarks for Large Language Models (ICLR 2024 · similarity 0.90)
- Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.89)
- Optimizing Adaptive Attacks against Watermarks for Language Models (ICML 2025 · similarity 0.89)
- Adaptive Text Watermark for Large Language Models (ICML 2024 · similarity 0.88)
- Discovering Spoofing Attempts on Language Model Watermarks (ICML 2025 · similarity 0.88)
- A Semantic Invariant Robust Watermark for Large Language Models (ICLR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.