Research map / Large language models / Language, safety and interpretability
No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choices
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that common LLM watermark design choices (robustness, multiple keys, public detection APIs) enable piggyback spoofing, multi-key watermark removal, and API-based removal/spoofing attacks, and proposes a differential-privacy-style detection defense against spoofing.
Problem
Common design choices in LLM watermarking (robustness to edits, multiple secret keys against stealing, public detection APIs) may make watermarks susceptible to removal and spoofing attacks.
Approach
Identifies that properties meant to improve watermarks (robustness, multi-key defense, public detection) can be exploited: piggyback spoofing via inserting toxic tokens into robust watermarked text, removal by estimating the unwatermarked distribution from multiple keyed queries, and removal/spoofing via detection-API feedback; proposes adding PRF-seeded Gaussian noise to detection scores as a DP-
Key results
- With 7+ keys, watermark-removal attacks reach ASR above 97% on KGW/LLaMA-2-7B while stealing ASR drops to near zero.
- Detection-API removal on KGW/LLaMA-2-7B yields median z-score 1.43 (threshold 4) with PPL 6.17 vs 6.28 for watermarked text, using about 2.4 queries per token.
- DP-style noise with sigma=4 drops spoofing ASR to 0% while detection accuracy falls only from 98.2% to 97.2%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Exploit the public detection API to select low-detection-score tokens | KGW watermark on LLAMA-2-7B · Detection API watermark removal | ASR: 1.00 | Helped |
| Exploit the public detection API to choose high-detection-score tokens | KGW watermark on LLAMA-2-7B · Detection API spoofing | ASR: 0.98 | Helped |
| Use multiple watermark keys instead of a single key | KGW watermark · Watermark stealing | ASR: 91% -> 13% | Hurt |
| Use more than 7 watermark keys | Multiple-key watermark · Watermark stealing | ASR: 91% -> close to zero | Hurt |
| Use more than 7 watermark keys | Multiple-key watermark · Watermark removal | ASR: higher than 97% | Helped |
| Insert toxic tokens into robustly watermarked text | Robust LLM watermarks · Piggyback spoofing | median inserted toxic-token portion: higher than 20% | Helped |
| Edit fewer than 3 words to make watermarked text inaccurate | KGW watermark on LLAMA-2-7B · Piggyback spoofing | z-score above threshold 4: 94.17% | Helped |
| Exploit the detection API to select low-confidence tokens | KGW watermark on LLAMA-2-7B · Watermark removal | median z-score: 1.43 vs. threshold 4 | Hurt |
| Exploit the detection API for watermark removal | KGW watermark on LLAMA-2-7B · Watermark removal | PPL: 6.28 -> 6.17 | No clear effect |
| Add sentence-specific pseudorandom DP noise with σ=4 | KGW detection on LLAMA-2-7B · Spoofing defense | spoofing ASR: 0% | Hurt |
| Add sentence-specific pseudorandom DP noise with σ=4 | KGW detection on LLAMA-2-7B · Detection utility | detection accuracy: 98.2% -> 97.2% | Hurt |
| Increase the number of watermark keys | Multiple-key watermark · Watermark removal | PPL | Helped |
Surprising findings
- Multi-key defense that blocks watermark stealing (more than 7 keys) makes removal attacks more effective, creating a direct trade-off.
- Robust watermarks allow inserting a median above 20% toxic tokens while keeping detection, with moderation confidence above 0.8.
Limitations
- DP defense is less effective against detection-API watermark-removal attacks, which remain feasible
- Evaluation limited to three PRF-based watermarks (KGW, Unigram, Exp) and two models
- Piggyback spoofing judged on only 100 manually checked samples
Experimental setup
Datasets: OpenGen
Benchmarks: OpenGen
Metrics: z-score p-value perplexity attack success rate accuracy number of queries
Baselines: KGW Unigram Exp watermark stealing attack
Builds on: KGW Unigram Exp watermark differential privacy
Closest papers by meaning
- PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.91)
- Watermark Stealing in Large Language Models (ICML 2024 · similarity 0.91)
- Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach (NeurIPS 2025 · similarity 0.91)
- Can Watermarked LLMs be Identified by Users via Crafted Prompts? (ICLR 2025 · similarity 0.90)
- Unbiased Watermark for Large Language Models (ICLR 2024 · similarity 0.90)
- Provable Robust Watermarking for AI-Generated Text (ICLR 2024 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.