{"paper":{"title":"Watermarking Should Be Treated as a Monitoring Primitive","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Even zero-bit watermarking enables entity attribution when observers aggregate signals across multiple outputs under multi-key conditions.","cross_cats":["cs.AI","cs.CY","cs.LG"],"primary_cat":"cs.CR","authors_text":"Jie Zhang, Nils Lukas, Toluwani Aremu","submitted_at":"2026-05-13T07:10:04Z","abstract_excerpt":"Watermarking is widely proposed for provenance, attribution, and safety monitoring in generative models, yet is typically evaluated only under adversaries who attempt to evade detection or induce false positives at the level of individual samples. We argue that watermarking should be treated as a monitoring primitive, and that internal monitoring is unavoidable given per-entity attribution keys and messages, as well as detector access. We introduce an observer-based threat model in which observers can aggregate watermark signals across outputs to infer entity-level information, showing that ev"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"Even zero-bit watermarking enables attribution under multi-key settings through observer aggregation of watermark signals across outputs.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That observers have sustained access to the detector and can collect sufficiently many outputs from the same entity to make statistical aggregation reliable.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"Watermarking enables entity-level attribution and monitoring through signal aggregation even in zero-bit designs, creating an unavoidable dual-use tension between attribution and surveillance.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Even zero-bit watermarking enables entity attribution when observers aggregate signals across multiple outputs under multi-key conditions.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"dde822b95a6584156554adae7df84d3e5bec14d8d9d46364722d919dda86e6b1"},"source":{"id":"2605.13095","kind":"arxiv","version":2},"verdict":{"id":"d47e2928-8828-4629-bb58-c694c49c92b8","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-15T05:53:58.423820Z","strongest_claim":"Even zero-bit watermarking enables attribution under multi-key settings through observer aggregation of watermark signals across outputs.","one_line_summary":"Watermarking enables entity-level attribution and monitoring through signal aggregation even in zero-bit designs, creating an unavoidable dual-use tension between attribution and surveillance.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That observers have sustained access to the detector and can collect sufficiently many outputs from the same entity to make statistical aggregation reliable.","pith_extraction_headline":"Even zero-bit watermarking enables entity attribution when observers aggregate signals across multiple outputs under multi-key conditions."},"references":{"count":24,"sample":[{"doi":"","year":null,"title":"GPT-4 Technical Report","work_id":"b928e041-6991-4c08-8c81-0359e4097c7b","ref_index":1,"cited_arxiv_id":"2303.08774","is_internal_anchor":true},{"doi":"","year":null,"title":"K. Arabi, B. Feuer, R. T. Witter, C. Hegde, and N. Cohen. Hidden in the noise: Two-stage robust watermarking for images.arXiv preprint arXiv:2412.04653,","work_id":"153786cc-f205-44c0-a7c7-49f092cf83eb","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":null,"title":"Mitigating Watermark Forgery in Generative Models via Randomized Key Selection","work_id":"5bbdc012-5ae5-421d-9727-4e299537395d","ref_index":3,"cited_arxiv_id":"2507.07871","is_internal_anchor":true},{"doi":"","year":null,"title":"T. Aremu, D. Ognev, S. Poppi, and N. Lukas. Robust safety monitoring of language models via activation watermarking.arXiv preprint arXiv:2603.23171,","work_id":"fec98221-9502-4fb7-a3fe-9ad67b99d006","ref_index":4,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2023,"title":"URL https://www.reuters.com/technology/ openai-google-others-pledge-watermark-ai-content-safety-white-house-2023-07-21/. S. Bubeck, V . Chadrasekaran, R. Eldan, J. Gehrke, E. Horvitz, E. Kamar, P. Lee","work_id":"937c6ba5-8f92-4660-b785-f3d5839b5b2d","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":24,"snapshot_sha256":"abec8df8c199d09405f5fe878076555146c02e6629d7b69b5fd44608d26896a0","internal_anchors":5},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"}