{"id":"e0f5bfd0-ffbf-43ae-9d83-611532aacb2e","arxiv_id":"2504.12229","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Conversational mimicry, especially reuse of prompt phrases, can make unwatermarked LLM text test positive for watermarks, and the paper argues current watermark configurations are too permissive.","lead":"Unwatermarked language models can start producing text that watermark detectors flag as watermarked after a conversation with a watermarked model, because they reuse phrases from the prompt. The paper argues that watermarking systems should mask repeated input and require much lower false-positive rates to remain reliable over time.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The de-duplication control and GPT-4o row suggest 'mimicry' is verbatim prompt copying limited to small models; the paper's proposed fix is not quantitatively supported.","rationale":"I agree with the CONDITIONAL verdict, but I identify a different load-bearing concern than the reader's weakest assumption. The reader focused on the human-mimicry variance interpretation in Section 4.2; that is a valid weakness of the human-side claim, which never involves a watermark. However, the title and central watermark contribution rest on the LLM-to-LLM experiments, and there the most load-bearing issue is whether the effect is only verbatim copying. The paper's own de-duplication control (Figure 8) reportedly removes the mimicry, which supports the proposed fix, but no de-duplicated numbers are provided, so we cannot assess residual effect sizes. Moreover, the GPT-4o results in Table 1 show no mimicry, directly limiting the practical scope. These two facts together mean the abstract's strong claim about LLMs in general is unsupported; the concrete evidence is confined to small open models and to prompt-repetition artifacts. I still would not reject the paper: the small-model results, baselines, and the identification of input repetition as the mechanism are real contributions. I would keep the CONDITIONAL verdict, with conditions requiring release of code/data, a quantitative de-duplicated control, and larger-model replication. My concern is therefore an additional condition rather than a change of verdict, hence UNCHANGED.","tokens_in":20041,"tokens_out":8062,"duration_ms":88025,"concrete_test":"Obtain or regenerate the authors' conversation logs and compute, for every configuration in Table 1, the P&R and P<R rates after removing from each unwatermarked response every 4-gram that appears verbatim in the watermarked prompt, matching the Figure 8 de-duplication protocol. Also run the same protocol on GPT-4o and on an open 70B-class model with 10 random watermark keys, reporting rates with confidence intervals. If the de-duplicated P&R falls to the 1% false-positive baseline in all conditions, the practical threat is fully explained by input repetition and the abstract's broad mimicry claim should be scoped to small models or withdrawn; if residual rates remain above baseline, the title's proposed input-repetition masking is insufficient.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that unwatermarked LLMs mimic watermark signals is supported only for Guanaco-7B/13B. The paper's own GPT-4o results in Table 1 show response watermark rates at the 1% false-positive baseline (e.g., for ngram=4, Aaronson P&R is 0.1% and Kirchenbauer P&R is 0.6% at #R=1), meaning no mimicry in a capable model. The mechanism is identified as verbatim input repetition, but the key control in Figure 8 is not quantitatively reported: no de-duplicated P&R/P<R rates, test statistics, or error bars are given, and the three subpanels are indistinguishable. If de-duplication truly removes the effect, then the observed behavior is not adaptive mimicry of the watermarking signal but straightforward copying of prompt n-grams, which input-repetition masking would fully neutralize. The abstract and introduction nevertheless claim generally that 'LLMs exhibit mimicry, even for the watermarks in settings where the detection probability is low,' without the small-model-only scope and without reporting the de-duplicated numbers that would validate the title's proposed remedy. The authors' own Limitations section acknowledges the few keys, small models, and uncertain larger-model behavior, and no code or data are provided to verify the main table.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces the concept of conversational 'mimicry' of LLM watermarks and machine-text detectors. In model-model experiments, a Guanaco model watermarked with either the Aaronson or Kirchenbauer scheme produces prompts, and an unwatermarked Guanaco model responds; the paper reports that unwatermarked responses are watermarked at rates above the random baseline (e.g., Table 1: Kirchenbauer P&R reaches 18.2% with five concatenated responses for the 7b(w)-vs-13b pair). The authors report that GPT-4o does not exhibit this behavior, and a de-duplication control (Figure 8) is said to remove the observed mimicry, supporting input repetition as the mechanism. In human experiments, the paper uses Binoculars scores and claims that the variance of human scores increases over long dialogues, which it interprets as humans becoming more LLM-like. The paper recommends lower false-positive thresholds, longer n-grams for watermark seeding, and input repetition masking to mitigate the effect.","tokens_in":20287,"tokens_out":6545,"duration_ms":66061,"significance":"If the small-model effect and the de-duplication causal claim hold, the paper identifies a concrete, previously underappreciated failure mode for current watermarking configurations in long conversational interactions, along with a sensible mitigation. The use of published watermark implementations, controlled baselines, and the de-duplication control are strengths; the paper also gives falsifiable measurements rather than deriving conclusions from fitted parameters. However, the significance as currently stated is much broader than the evidence: the GPT-4o rows show at most a weak effect, the human experiments never involve a watermark, and the de-duplication control is not quantitatively reported. The paper would be a useful contribution if its claims were re-scoped and the key control were quantified; in its present form, the abstract and introduction overstate the findings.","major_comments":[{"comment":"The paper's central claim that 'both humans and LLMs end up mimicking, including the watermarking signal' is not supported by the evidence for capable models. In Table 1, the GPT-4o rows for ngram=4 at the stated 1% false-positive threshold show P&R rates of 0.1% for Aaronson and 0.6% for Kirchenbauer at #R=1, and the text itself states that 'the mimicry observed for smaller models does not hold.' The abstract and introduction nevertheless make a general claim without quantifying this negative result or testing it against the 0.01% independence baseline with confidence intervals. Please re-scope the claims to small, weaker models, or reframe the conclusion so that the GPT-4o negative result is explicitly part of the central message.","section":"Abstract, §4.1, Table 1"},{"comment":"The human-mimicry result is inferred solely from an increase in the variance of Binoculars scores over conversation turns. The paper states that the detector is calibrated for a 1% false-positive rate but never reports the fraction of human turns that cross that fixed threshold, nor any significance test or error bars for the variance trend. A variance shift could be produced by topic drift, turn-length changes, or other confounds, none of which constitute mimicry. Moreover, the human conversations contain no watermark, so the abstract's claim that humans mimic 'the watermarking signal' is not operationalized in this experiment. Please report threshold-crossing rates and include a human baseline to validate the variance interpretation.","section":"§4.2, Figure 3"},{"comment":"The de-duplication control is the load-bearing evidence for input repetition as the mechanism and for the title's proposed remedy, but the figure reports no quantitative results: no de-duplicated P&R or P<R rates, no confidence intervals, and no test statistics are given in the text or caption. The three subpanels also appear visually indistinguishable, and the caption only asserts that de-duplication 'removes the observed mimicry behavior.' Without the de-duplicated numbers, the reader cannot tell whether the effect is fully eliminated, reduced to baseline, or merely attenuated. Please provide the corresponding Table 1 columns after masking n-grams shared between the watermarked input and the unwatermarked output.","section":"Figure 8, §4.1"},{"comment":"The recommendation to use longer word sequences for watermark seeding is not quantitatively supported as a mitigation in this paper. Figure 2 shows that response-side watermark rates decrease with n-gram length for the Guanaco pairs, but the paper does not report how the same n-gram lengths affect watermark robustness, such as detection power on genuinely watermarked text, in the same experimental setup. The claimed trade-off between reduced mimicry and reduced robustness is therefore not measured. Please add robustness numbers for the same n-gram values, or soften the recommendation accordingly.","section":"§5, Figure 2"}],"minor_comments":[{"comment":"The model name is spelled inconsistently as 'Guanco' and 'Guanaco'; please use a single spelling.","section":"Throughout"},{"comment":"Standard deviations are reported only for the GPT-4o rows; please provide variance estimates for all rows, since the text acknowledges large variance across the three hash keys.","section":"Table 1"},{"comment":"The y-axis label '% of text below given threshold (3 std.)' is not defined in the text; please clarify how the three-standard-deviation bands are computed and what the plotted quantity represents.","section":"Figure 3"},{"comment":"The original conversation prompt appears to be truncated in the extracted text; please include the complete prompt used in the experiments.","section":"Appendix B"},{"comment":"The paper does not state whether code, exact dataset versions, and detector configurations will be released; please add a reproducibility statement, as the main table depends on precise ThreeBricks settings and hash keys.","section":"Reproducibility"}],"recommendation":"major_revision","confidential_remarks":"The contribution is real but narrower than advertised. The GPT-4o negative result and the unquantified Figure 8 control mean the paper should be revised substantially before publication. The human-experiment section is currently too weak to support the abstract's broad claims; consider removing it or supplementing it with a fixed-threshold false-positive analysis."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the paper demonstrates something real: a small unwatermarked model (Guanaco-7B/13B) conversing with a watermarked model will occasionally produce text that triggers the watermark detector, and the trigger is reuse of n-grams from the watermarked prompt. Second, the abstract oversells it. The GPT-4o results in Table 1 show the effect disappears with a larger model, and the human experiment never involves watermarks, so the claim that 'both humans and LLMs end up mimicking, including the watermarking signal' is not supported by the evidence.\n\nWhat is new here is the in-context demonstration. Prior contamination work (Gu et al., Sander et al.) required training on watermarked text; this paper shows the same type of false positive arising purely from conversation. That is worth knowing. The de-duplication control in Figure 8 cleanly isolates the mechanism, and the authors are honest in their Limitations section about the small models, the three keys, and the lack of code and data.\n\nSoft spots, in order of severity. The human experiment in Section 4.2 is the weakest part: increased variance in Binoculars scores over conversation turns is not a false-positive analysis. A fixed-threshold analysis would show whether the fraction of human turns crossing the 1% threshold actually rises, and the paper does not provide that. The abstract overstates the human result—those participants never saw a watermark. The GPT-4o rows in Table 1 actually show no mimicry; at the 1% false-positive baseline, the response watermark rates are at or below the expected false-positive level. So the 'LLMs exhibit mimicry' sentence is only true for the small models tested. Figure 8 is also under-reported: no de-duplicated P&R or P<R rates, no error bars, and the three subpanels look identical.\n\nThe proposed fix—masking shared n-grams between prompt and response—is sensible, and the authors correctly note it is already used in some schemes. The suggestion to use longer n-grams and lower false-positive thresholds is a real trade-off, not a free lunch, and the paper concedes as much.\n\nBottom line: this is a useful contribution for watermarking researchers thinking about false positives in multi-turn settings, and it deserves a serious referee. But I would expect major revision: narrow the claims to small models, either strengthen or drop the human experiment, report the de-duplicated numbers quantitatively, and share code and data. With those changes, it could be a solid paper.","headline":"Real but narrow false-positive mechanism (small models reusing watermarked prompt n-grams), wrapped in an abstract that oversells it as general 'mimicry'.","tokens_in":20804,"tokens_out":4692,"would_cite":true,"duration_ms":45619,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Through ordinary conversation, an unwatermarked model can begin producing text that watermark detectors attribute to the watermarked model, because it reuses n-grams from the prompt.","keywords":["LLM watermarking","mimicry","input repetition masking","conversational adaptation","synthetic text detection","Binoculars","false positives","n-gram repetition"],"falsifier":"For the human claim, count the fraction of human turns whose Binoculars score exceeds the calibrated 1% false-positive threshold across conversation length; if that fraction stays flat while raw score variance grows, the mimicry signal is not real. For the model claim, rerun the model-model conversations after removing every n-gram that appears in the watermarked prompt from the unwatermarked response; if watermarked detections persist, input repetition is not the whole mechanism.","tokens_in":19839,"feed_emoji":"💬","tokens_out":8634,"duration_ms":76730,"temperature":0.7,"pith_summary":"The paper tries to establish that LLM watermarking has a vulnerability that current evaluations overlook: conversation itself transfers the watermark. When an unwatermarked model responds to text produced by a watermarked model, it reuses chunks of that input, and those reused n-grams carry the watermark signal into otherwise unwatermarked output. Across multiple turns the effect grows, so an unwatermarked generator can produce responses that watermark detectors attribute to the watermarked model, and occasionally the response watermark is even stronger than the prompt's. The paper also reports that humans in long conversations with chatbots begin producing text that a state-of-the-art detector scores as more machine-like. If the claim is right, reliable watermarking needs input repetition masking and substantially lower false-positive thresholds.","feed_headline":"Unwatermarked models copy watermark signals from chat prompts","feed_subtitle":"Long conversations let smaller models inherit the watermark signal, threatening text attribution.","key_machinery":"The load-bearing mechanism is n-gram reuse: a response inherits a watermark when it reuses token sequences from a watermarked prompt, because the detector scores n-gram statistics against a secret key. The experiments use two standard watermarking schemes (a green/red-list sampling bias and a hash-based scheme), the Binoculars zero-shot synthetic-text detector, and a de-duplication step that strips n-grams shared between input and output to isolate the repetition effect.","core_discovery":"The central claim is that mimicry of watermark signals is real and is driven by input repetition. In model-to-model conversations using two standard watermarking schemes, a small unwatermarked model (Guanaco-7B or 13B) responding to a watermarked prompt produced a watermarked response in a measurable fraction of cases — up to about 13% of five-response blocks in one configuration and more in some cross-size settings — and the effect grew with conversation length. Crucially, when the authors removed (de-duplicated) the n-grams shared between the watermarked prompt and the unwatermarked response, the mimicry disappeared, which identifies repetition of input tokens as the mechanism. In human-chatbot conversations, they observed that the variance of Binoculars detector scores increased over turns for humans, which they interpret as humans adapting toward LLM-like language; the same analysis shows the opposite trend for the LLM side. The paper concludes that watermarking schemes must assume lower false-positive rates and longer seeding sequences, and that repetition masking should be extended to prompts.","pith_inferences":["If input repetition is the mechanism, then a straightforward attack is to ask an unwatermarked model to paraphrase or echo a watermarked sample; any token-level watermark that survives copying becomes a false-attribution channel.","The de-duplication result implies a cheap detector-side fix: ignore n-grams already present in the prompt or conversation context before computing the watermark score, which would suppress this class of false positives without altering generators.","The human result could be tested cleanly by measuring the fraction of human turns crossing a fixed detector threshold; if that fraction stays flat while score variance rises, the practical risk to third-party detectors may be smaller than the paper's variance-based reading suggests.","Conversation logs may act like training data: if chat transcripts containing watermarked text are later used for fine-tuning, the watermark statistics could propagate further, extending the paper's in-context finding to fine-tuning pipelines."],"forward_implications":["An unwatermarked model can be falsely attributed as the source of watermarked text after only a few turns of conversation, so real-world false-positive rates may be much higher than academic watermarking evaluations suggest.","Because the effect grows as more responses are concatenated, long conversations are where misattribution risk concentrates.","Removing shared n-grams between prompt and response eliminates the observed mimicry in the tested setups, making input repetition masking a direct defensive measure.","Longer n-grams reduce mimicry but weaken watermark robustness, so watermark designers face a trade-off rather than a free fix.","Larger, more capable models showed little or no mimicry in the tested setting, suggesting the vulnerability is most pressing for smaller or less capable deployed models."],"supporting_citations":[{"why":"Supplies one of the two watermarking schemes tested; its green/red-list token bias shows the stronger mimicry effect.","marker":"Kirchenbauer et al. (2023)"},{"why":"Supplies the second watermarking scheme tested, used to show mimicry appears across scheme families.","marker":"Aaronson and Kirchner (2023)"},{"why":"Supplies the Binoculars detector used to score human and LLM turns in the conversation experiments.","marker":"Hans et al. (2024)"},{"why":"Introduces repetition masking in watermarking, the mechanism the paper proposes extending to prompts.","marker":"Hu et al. (2023)"},{"why":"Provides the implementation used to run the watermarking schemes in the experiments.","marker":"Fernandez et al. (2023)"},{"why":"Provides evidence of conversational linguistic adaptation that motivates the mimicry hypothesis for humans.","marker":"Chang et al. (2012)"},{"why":"Shows that learning from watermarked text produces watermarks, the training analogue of the in-context mimicry the paper demonstrates.","marker":"Gu et al. (2024)"}],"fun_headline_variants":[],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The human-mimicry conclusion rests on interpreting a widening spread of detector scores as humans becoming more machine-like, without showing that more human turns actually cross the detector's false-positive threshold.","fun_headline_variants_meta":{"error":"DeepSeek 429: {\"error\":{\"message\":\"Too many requests. Your current concurrency is 158, which exceeds your concurrency limit of 117 based on your remaining balance. Please top up your balance to restore your concurrency.\",\"type\":\"rate_limit_error\",\"param\":null,\"code\":\"invalid_request_error\"}}"},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:34:27.350174+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For the human claim, count the fraction of human turns whose Binoculars score exceeds the calibrated 1% false-positive threshold across conversation length; if that fraction stays flat while raw score variance grows, the mimicry signal is not real. For the model claim, rerun the model-model conversations after removing every n-gram that appears in the watermarked prompt from the unwatermarked response; if watermarked detections persist, input repetition is not the whole mechanism.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the second watermarking scheme tested, used to show mimicry appears across scheme families."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides evidence of conversational linguistic adaptation that motivates the mimicry hypothesis for humans."}],"review_version":1}