Research map / Large language models / Language, safety and interpretability
Black-Box Detection of Language Model Watermarks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes black-box statistical tests that detect whether an LLM is watermarked with Red-Green, Fixed-Sampling, or Cache-Augmented schemes using only textual outputs and a limited number of queries.
Problem
Whether popular LLM watermarks (especially distribution-preserving ones assumed undetectable) can be detected by a client with only black-box textual access and no control over sampling parameters or log-probabilities.
Approach
Exploits family-level properties: Red-Green watermarks create context-dependent logit biases detectable via a permutation test over prompts; Fixed-Sampling watermarks reduce output diversity, detected via a rarefaction-curve Mann-Whitney test; Cache-Augmented schemes reveal the true distribution when the cache is probed, detected via Fisher's exact test between cache-conditioned choice frequencies
Key results
- Red-Green, Fixed-Sampling, and Cache-Augmented tests reject the null (p<0.05) only when the matching scheme family is applied, across seven open-source instruction-tuned models and no false positives on unwatermarked models.
- Fixed-Sampling test gives p-values around 1e-105 to 1e-125 for ITS/EXP watermarks with n_key=256 on Mistral-7B and Llama2 models.
- Estimated cost per detection test is below $3 for Red-Green, $0.3 for Fixed-Sampling and $0.1 for Cache-Augmented on GPT-4o pricing; tests on GPT-4, Claude 3 and Gemini 1.0 Pro did not reject the null.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply the Red-Green detection test to Red-Green-watermarked models | Red-Green test · Mistral-7B, Llama2-13B, and Llama2-70B with LeftHash/SelfHash variants | p-value: 0.000; 0.020 | Helped |
| Apply the Fixed-Sampling detection test to Fixed-Sampling-watermarked models | Fixed-Sampling test · Mistral-7B, Llama2-13B, and Llama2-70B, n_key=256 or 2048 | p-value: 3.7e-105; 1.8e-06; 8.1e-122; 1.5e-07; 4.5e-125; 1.7e-08 | Helped |
| Apply the Cache-Augmented detection test to Cache-Augmented-watermarked models | Cache-Augmented test · Mistral-7B, Llama2-13B, and Llama2-70B with DiPmark/γ-reweight or δ-reweight | p-value: 2.4e-4; 2.1e-3; 5.6e-27; 1.8e-2; 5.3e-3; 6.7e-32; 1.5e-3; 4.4e-3; 5.8e-28 | Helped |
Surprising findings
- Current distribution-preserving schemes are detectable in black-box settings, contrary to the implied undetectability.
- Cache-Augmented schemes can be detected without the cache by exploiting the underlying Red-Green mechanism.
Limitations
- Tests restricted to three scheme families; no theoretical power guarantees, only empirical evidence.
- Assumptions such as symmetric error terms, perfect sampling and distinct red-green splits may not hold for all models.
- Estimation of alpha and gamma is unreliable for some settings; detection on deployed models yielded no rejections so presence could not be concluded.
Experimental setup
Metrics: median p-value test power query cost
Baselines: Fixed-Sampling test Cache-Augmented test Red-Green test
Builds on: Kirchenbauer et al. red-green watermark Kuditipudi et al. ITS/EXP watermark DiPmark delta-reweight and gamma-reweight cache-augmented watermarks SynthID-Text
Closest papers by meaning
- PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.92)
- Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach (NeurIPS 2025 · similarity 0.92)
- Provable Robust Watermarking for AI-Generated Text (ICLR 2024 · similarity 0.91)
- GaussMark: A Practical Approach for Structural Watermarking of Language Models (ICML 2025 · similarity 0.90)
- BiMark: Unbiased Multilayer Watermarking for Large Language Models (ICML 2025 · similarity 0.90)
- Unbiased Watermark for Large Language Models (ICLR 2024 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.