Research map / Adversarial robustness and security / Attacks on text and graphs

Enhancing LLM Watermark Resilience Against Both Scrubbing and Spoofing Attacks

NeurIPS 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes SEEK, a KGW-family watermark that uses sub-vocabulary decomposed equivalent texture keys to raise scrubbing robustness at large window sizes while keeping spoofing resistance and text quality.

Problem

LLM watermarks based on window-dependent green lists face a trade-off: small windows resist scrubbing (paraphrasing) but are easy to spoof via statistics-based attacks, while large windows resist spoofing but are easily scrubbed.

Approach

Exploit hash collisions within the watermark window so that multiple tokens independently act as "equivalent texture keys" (raising scrubbing robustness at large windows), and decompose green-list construction across d disjoint sub-vocabularies so that the number of distinct partitions grows as O(2^d), preserving text quality.

Key results

• SEEK improves spoofing robustness over KGW-Min^4 on Dolly-CW/MMW-BookReports/MMW-FakeNews by +88.2%/+92.3%/+82.0% (per abstract/intro claims), with lower FPR@1e-3 (0.10 vs 0.85 on Dolly-CW).
• On C4-RealNewsLike under ChatGPT-3.5 scrubbing, SEEK^6 reaches 92.6 TP@5% vs 86.5 for KGW-Min^4 (AUROC 98.4 vs 96.6).
• Under DIPPER-II on WikiText, SEEK^6 achieves 38.0 TP@1% vs 11.4 for KGW-Min^4.

Measured effects reported in the paper

Surprising findings

• Reducing hash space size d raises scrubbing robustness without hurting statistics-based spoofing resistance, contrary to the assumed trade-off.
• KGW-Left^1 shows better spoofing robustness than KGW-Min^3 despite a smaller window, attributed to higher z-scores of self-seeding giving the attacker a more informative corpus.

Limitations

• Smaller hash space alone degrades text quality (log diversity), motivating SEEK's decomposition.
• Excessively disparate h and d values degrade the design toward h=0.
• Evaluation of spoofing relies on a fixed attacker budget (30,000 responses) and specific attack implementations.

Experimental setup

Datasets: C4 WikiText LFQA C4-Eval Dolly-CW MMW-BookReports MMW-FakeNews FreeLaw PubMedQA

Benchmarks: C4-RealNewsLike WikiText LFQA Dolly-CW MMW-BookReports MMW-FakeNews C4-Eval FreeLaw PubMedQA

Metrics: AUROC TP@1% TP@5% FPR@1e-3 FPR@1e-2 z-score PPL P-SP log-diversity

Baselines: KGW-Min KGW-Sum KGW-Left UNIGRAM

Builds on: KGW SelfHash UNIGRAM watermark statistics-based spoofing distillation-based spoofing

Closest papers by meaning

• Watermark Stealing in Large Language Models (ICML 2024 · similarity 0.92)
• Discovering Spoofing Attempts on Language Model Watermarks (ICML 2025 · similarity 0.90)
• Optimizing Adaptive Attacks against Watermarks for Language Models (ICML 2025 · similarity 0.89)
• Black-Box Detection of Language Model Watermarks (ICLR 2025 · similarity 0.89)
• Can Watermarking Large Language Models Prevent Copyrighted Text Generation and Hide Training Data? (AAAI 2025 · similarity 0.88)
• Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.88)