Pith. sign in

REVIEW 4 major objections 5 minor 76 references

One character edit can beat a word-level edit at removing LLM watermarks

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 19:39 UTC pith:C7HBOUC5

load-bearing objection Character-level attacks are a real, under-appreciated threat to LLM watermarks, but the central attack-range claim is only tested at h=1 and the GA hyperparameters look test-set tuned; still deserves a serious referee. the 4 major comments →

arxiv 2509.09112 v2 pith:C7HBOUC5 submitted 2025-09-11 cs.CR cs.AI

Character-Level Perturbations Disrupt LLM Watermarks

Zhaoxi Zhang , Xiaomei Zhang , Yanjun Zhang , He Zhang , Shirui Pan , Bo Liu , Asif Qumer Gill , Leo Yu Zhang This is my paper
classification cs.CR cs.AI
keywords LLM watermarkwatermark removal attackcharacter-level perturbationattack rangetokenizationhomoglyph substitutiongenetic algorithmreference detector
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that current LLM watermarks are much easier to remove than prior attack evaluations suggest. The central claim is that character-level edits—typos, deletions, swaps, zero-width insertions, and homoglyph substitutions—are the most efficient removal tool under realistic black-box constraints, because a single character change can split one token into multiple subwords and also alter the watermark keys of following tokens. Under a strict threat model with no access to the detector, these perturbations outperform token-level synonym replacement and sentence-level paraphrasing at the same editing budget. Under a limited-query setting, the paper shows that a reference detector trained on that query budget can guide a genetic algorithm to target removal-relevant positions, and that an adaptive compound character-level attack can bypass fixed defenses such as spell-checking and OCR. If correct, the paper implies that watermark robustness is substantially overestimated and that defenses need to address tokenization-level disruptions.

Core claim

The paper's central discovery is that the effectiveness of a watermark-removal edit is governed by its attack range—the number of tokens whose watermark scores change—and that character-level edits have a structurally larger range than token-level edits. For a watermark with context length h, replacing one token changes that token's score plus the keys of the next h tokens: range h+1. Replacing a single character (e.g., a homoglyph in the middle of a word) splits the token into at least three subword units during tokenization, so the edit touches three tokens directly plus the keys of the next h tokens: range h+3. Under the most restrictive threat model, where the adversary has only the wate

What carries the argument

The central mechanism is the attack-range calculation: a character-level edit can split a token into multiple subword tokens, giving a range of h+3 versus h+1 for a token-level edit. Supporting machinery includes a lightweight regression reference detector that approximates the original detector's global watermark score from limited queries; a gradient-free genetic algorithm that uses that reference detector to select a minimal subset of character-level perturbation positions while filtering high-gradient tokens, using a two-stage objective and a convergence threshold; and an adaptive compound attack that chooses combinations of character edits minimizing edit distance after a defense transf

Load-bearing premise

The guided-attack results assume the watermark detector returns a continuous confidence score rather than a binary accept/reject label; with only binary responses, the regression reference detector cannot be trained the same way and the genetic algorithm loses its guidance signal.

What would settle it

A concrete test: take a watermarked text under a detector with context length h, apply one homoglyph to a token, and count how many tokens' computed watermark keys change. If the average affected count is not at least h+3—or is no larger than the h+1 achieved by replacing that token—the paper's core range claim fails. A second test: run the guided attack against a detector API that returns only a binary decision; if attack success collapses to the random baseline, the reference-detector assumption is load-bearing.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • At the same editing rate, character-level perturbations remove watermarks with higher attack success rate than token-level synonym replacement or sentence-level paraphrasing across five representative watermark schemes and two widely used LLMs.
  • The attack-range formula predicts that the gap widens for small editing budgets and larger context lengths h, because each character edit disrupts more watermark keys.
  • A reference detector trained from limited queries can guide a genetic algorithm that beats random best-of-N and an incremental greedy baseline under the same query budget.
  • Gradient-based transfer attacks from the reference detector are ineffective (attack success rate below 0.1), so gradient-free optimization is the working guidance mechanism.
  • Any fixed preprocessing defense—spell-checking, OCR, Unicode normalization, or anomalous-character deletion—can be bypassed by compound character-level perturbations, so watermark schemes cannot rely on such defenses alone.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The attack-range argument suggests that tokenization-based defenses, such as enforcing a fixed token vocabulary or character-level normalization before detection, could blunt the attack by preventing subword splits; this direction is not explored in the paper.
  • The paper's focus on English overlooks that many Latin-script languages have richer homoglyph sets, and the attack may generalize even better to those languages despite the additional French results.
  • Because the reference-detector training requires only a labeled watermarked/unwatermarked corpus, the guided attack scales to any watermark scheme that exposes a scalar score, including future schemes, as long as the detector's output is continuous.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper studies watermark removal attacks on LLM-generated text under two black-box threat models. It introduces the notion of attack range and argues that character-level perturbations (homoglyphs, typos, insertions, deletions) disrupt tokenization and thereby affect more tokens per edit than token-level synonym substitution. Under AC1 (no access to the watermark detector), a random character-level baseline outperforms token-level and sentence-level baselines across five watermarking schemes (KGW, DIP, SynthID, Unigram, Unbias) on OPT-1.3B and LLaMA-3-8B. Under AC2 (limited access to the watermark detector), the paper trains a BERT-based reference detector from queries to the original detector and uses a Genetic Algorithm to select perturbation positions; GA-based attacks exceed Best-of-N and Sand baselines. The paper also presents an adaptive compound character-level attack against four defenses and argues that any fixed defense can be bypassed.

Significance. If the empirical results hold, the paper makes a useful and somewhat counterintuitive point: standard robustness evaluations that use token- or sentence-level perturbations underestimate the ease of watermark removal, because character edits can have a super-token blast radius through tokenization. Strengths include the breadth of the benchmark (five schemes, two LLMs, multiple editing rates, text-length and cross-lingual checks), a human evaluation, a released artifact, and the clear separation of two threat models. The main caveats are that the analytic attack-range model is heuristic and does not fully match the actual detector statistics, and the guided attack assumes a confidence-scoring detector. Both points need tightening before the central claims can be taken as fully established, but the empirical contribution is substantial and reproducible in spirit.

major comments (4)
  1. [Section IV-A and Section II-C] The attack-range argument models each token as carrying a binary watermark score s_t that decreases when the token or its context key changes (Figure 2). This does not match the KGW/Unigram detectors described in Section II-C, where the global score is a z-test over green/token counts. A homoglyph split adds tokens to the denominator and may produce subwords that are themselves green, so the contribution of the edited position need not decrease; the sign is tokenizer- and hash-dependent. The h+3 range therefore does not by itself imply a larger drop in S_w. The empirical ASR tables support the conclusion, but the analytic motivation as stated is not established. Please either derive the expected score change under the actual detector statistics or explicitly label Section IV-A as a heuristic illustration.
  2. [Section IV-C1 and Section IV-A] The quantitative advantage of character-level edits over token-level edits is tied to the ratio (h+3)/(h+1), which decays from 2 at h=1 to 1.4 at h=4. The main KGW experiments fix h=1 ('For KGW, we set the context length h=1'), and no sensitivity sweep over h is reported. Since KGW is the canonical context-dependent scheme and the paper's headline claim concerns the 'most restrictive threat model', the reader cannot tell whether the char-vs-token gap persists at realistic context lengths. Please add ASR/WDR sweeps over h (e.g., 1, 2, 4, 8) for KGW, or justify why h=1 is the only relevant setting.
  3. [Section V-A1] The reference-detector-guided attack assumes the watermark detector returns a continuous confidence score (the global watermark score), citing [59] and real-world APIs. The threat model in Section III-B is phrased in terms of 'the detection result', and many deployed detectors expose only a binary accept/reject decision. In that case the regression objective and the GA's loss D_ref(X~) cannot be trained or evaluated in the same way, and the transfer claims in Table VII do not cover this scenario. Please either evaluate a binary-label variant (e.g., training a classifier on binary queries and using its output probability as the surrogate score) or state the continuous-score assumption as an explicit limitation in the threat model.
  4. [Section VI, Eq. (5)] The adaptive compound attack is defined by a two-level optimization, but the inner argmin over compound character perturbations C‡ is not specified: no candidate set, search procedure, or complexity is given, and Algorithm 1 is unchanged apart from the notational change. Table X reports only aggregate ASR; there is no ablation showing which compound perturbations were selected against SC, OCR, UN, or DE. As written, the adaptive attack is not reproducible. Please provide the inner-loop algorithm and a per-defense analysis.
minor comments (5)
  1. [Appendix B-A] The artifact appendix contains the editorial meta-note 'Our paper received a “Major Revision” decision...'. This sentence should be removed from the published version; it does not affect the technical content but is inappropriate for a submitted manuscript.
  2. [Various] Typos and wording: 'upper bond' should be 'upper bound' in Eq. (2) and Algorithm 1; 'withe space' should be 'white space' in Section II-D; 'rand' superscripts in Algorithm 1 are nonstandard.
  3. [Table II] The caption says the comparison is at 'comparable editing rates', but DIPPER/AuthorMist operate at ER≈0.61 or higher while token/char results are reported at ER=0.1 and 0.5. Please clarify how the comparison is budgeted, or add an ER-matched token/char condition at ER≈0.6.
  4. [Section V-C5] The query-cost accounting mixes original-detector queries used to train the reference detector (e.g., 50,000 for Ref-9) with per-sample reference-model evaluations used during the GA. Please clarify the AC2 per-input budget model under which these costs are incurred and how amortization is justified.
  5. [Section IV-D2 and Table IV] The text says text quality is evaluated on OPT-generated text, but Table IV also contains LLaMA rows. Please state which parts of the table correspond to which model, or avoid the ambiguity.

Circularity Check

0 steps flagged

No significant circularity: the attack-range analysis is independent, and the reference-detector-guided GA is evaluated against held-out original detectors rather than constructed to match them.

full rationale

I walked the derivation chain and found no step where a claimed prediction or first-principles result reduces by construction to its own inputs. The core attack-range argument (Section IV-A) is a standalone tokenization analysis: it derives h+1 for token edits and h+3 for character-level splits, independent of any experimental fit. The empirical ASR/WDR comparisons in Tables II and III are measured against the original watermark detectors using independently defined perturbation budgets; the character-level advantage is not enforced by the analysis. The reference detector in Section V-A1 is a standard learned surrogate trained on queried original-detector outputs, and the GA optimizes against that surrogate; final ASR is then reported on the original detector, which is a genuine transfer result. Indeed, the paper shows the surrogate is imperfect (Table VIII, Figure 5) and that gradient-based surrogate attacks fail (Table IX), so the GA's success is not a tautology. The threat-model assumption that detectors return a confidence score is attributed to prior external work [59] and is an assumption about the environment, not a circular use of the paper's own results. There are self-citations (e.g., [26,38,39,41] with overlapping authors), but none is load-bearing: they are contextual references to prior adversarial-NLP or watermark-stealing work, and the central attack-range and GA claims do not depend on them. The artifact-appendix note about a 'Major Revision' decision is a provenance statement and does not assert or create circularity. The restricted experimental scope (KGW at h=1 only) is a generalization/correctness concern, not circular reasoning. I therefore find no significant circularity.

Axiom & Free-Parameter Ledger

3 free parameters · 3 axioms · 0 invented entities

The main new component is the reference detector, a trained surrogate model, which is not an invented physical entity. Free parameters are the GA hyperparameters, some of which appear tuned per watermark scheme. The axioms are domain assumptions about detector API behavior and tokenization, plus an unproven adversarial-dilemma claim.

free parameters (3)
  • alpha = 1 to 4 depending on watermark scheme (e.g., KGW best at alpha=3, DIP at alpha=2 or 3)
    Controls the threshold for filtering high-gradient tokens in the GA. Table XIV shows the optimal value varies by watermark scheme, and the paper reports results using the best-performing setting, indicating tuning on the test data.
  • lambda = Not reported
    Weight for the editing-rate term in the GA objective (Eq. 3 and Eq. 4). Its value affects the trade-off between watermark score reduction and edit budget; without a stated value, the objective is under-specified.
  • tau_l and delta_l = Not reported
    Thresholds in the two-stage objective and the convergence threshold in Algorithm 1. These are not specified numerically, but they likely influence GA performance.
axioms (3)
  • domain assumption The original watermark detector returns a continuous confidence score rather than only a binary decision.
    Invoked in Section V-A1 to justify training the reference detector as a regression model. If only binary labels are available, the approach may fail.
  • domain assumption A character-level edit, especially homoglyph substitution, splits a token into at least three subword tokens, yielding an attack range of h+3.
    Used in Section IV-A and Figure 2 to derive the central efficiency advantage. This depends on the tokenizer and the specific characters; not proven for all cases.
  • ad hoc to paper For any fixed defense, there exists a perturbation strategy that bypasses it.
    Stated as an 'adversarial dilemma' in Section VI and used to motivate the adaptive compound attack. The paper only demonstrates this against four specific defenses and provides no general proof.

pith-pipeline@v1.3.0-alltime-deepseek · 36269 in / 8501 out tokens · 101021 ms · 2026-08-04T19:39:25.561725+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Character-Level Perturbations Disrupt LLM Watermarks." pith.science (2026). https://pith.science/paper/C7HBOUC5

@misc{pith2026250909112,
  author       = {Pith},
  title        = {Pith review of: Character-Level Perturbations Disrupt LLM Watermarks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/C7HBOUC5}},
  note         = {Machine review of arXiv:2509.09112}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Large Language Model (LLM) watermarking embeds detectable signals into generated text for copyright protection, misuse prevention, and content detection. While prior studies evaluate robustness using watermark removal attacks, these methods are often suboptimal, creating the misconception that effective removal requires large perturbations or powerful adversaries. To bridge the gap, we first formalize the system model for LLM watermark, and characterize two realistic threat models constrained on limited access to the watermark detector. We then analyze how different types of perturbation vary in their attack range, i.e., the number of tokens they can affect with a single edit. We observe that character-level perturbations (e.g., typos, swaps, deletions, homoglyphs) can influence multiple tokens simultaneously by disrupting the tokenization process. We demonstrate that character-level perturbations are significantly more effective for watermark removal under the most restrictive threat model. We further propose guided removal attacks based on the Genetic Algorithm (GA) that uses a reference detector for optimization. Under a practical threat model with limited black-box queries to the watermark detector, our method demonstrates strong removal performance. Experiments confirm the superiority of character-level perturbations and the effectiveness of the GA in removing watermarks under realistic constraints. Additionally, we argue there is an adversarial dilemma when considering potential defenses: any fixed defense can be bypassed by a suitable perturbation strategy. Motivated by this principle, we propose an adaptive compound character-level attack. Experimental results show that this approach can effectively defeat the defenses. Our findings highlight significant vulnerabilities in existing LLM watermark schemes and underline the urgency for the development of new robust mechanisms.

Figures

Figures reproduced from arXiv: 2509.09112 by Asif Qumer Gill, Bo Liu, He Zhang, Leo Yu Zhang, Shirui Pan, Xiaomei Zhang, Yanjun Zhang, Zhaoxi Zhang.

Figure 1
Figure 1. Figure 1: Illustration of threat models in watermark removal. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Comparison of attack range between token-level and [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: ASR and WDR of token- and character-level attacks at varying ER ∈ [0.05, 0.5], evaluated on 100-token texts. TABLE V: Performance of frequency-based zero-feedback watermark removal attacks in the AC1 setting. Token (OPT) Char (OPT) Token (LLaMA) Char (LLaMA) ER WDR(↑) ASR(↑) WDR(↑) ASR(↑) WDR(↑) ASR(↑) WDR(↑) ASR(↑) KGW 0.1 0.0880 0.0788 0.1542 0.3322 0.1003 0.1893 0.1340 0.2786 0.5 0.3457 0.9623 0.4045 0.… view at source ↗
Figure 4
Figure 4. Figure 4: ASR of five character-level perturbation types, including typos, deletions, swaps, insertions, and homoglyph substitutions, across five watermark schemes. The length of watermarked text is 100 tokens, and they are generated by OPT. TABLE VI: Human evaluation results for watermarked text and perturbed text from the three types of attacks. The table reports the average scores across all raters for each dimen… view at source ↗
Figure 5
Figure 5. Figure 5: Scatter plots comparing reference detector predictions [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: ASR of token-level and character-level watermark removal attacks under varying text lengths (from 50 to 200 tokens) with ER = 0.2. Solid lines represent character-level attacks, and dashed lines represent token-level attacks. watermark detector, their method relies on injecting substantial noise to ensure effectiveness. Stealing detailed information of watermark schemes is another option of guided removal … view at source ↗
Figure 7
Figure 7. Figure 7: ASR comparison under the Best-of-N attack with increasing N ∈ {1, 10, 50, 100} for five watermark schemes. Evaluated using Ref-9 as the reference detector and editing rate ER = 0.1. Solid lines represent character-level attacks; dashed lines represent token-level attacks. rate. This trend holds across both watermark schemes and text lengths. These findings are consistent with our observations on English da… view at source ↗
Figure 8
Figure 8. Figure 8: Scatter plots comparing predicted watermark scores from the reference detector (y-axis) against ground-truth scores [PITH_FULL_IMAGE:figures/full_fig_p017_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

76 extracted references · 1 canonical work pages

  1. [1]

    Opt: Open pre-trained transformer language models,

    S. Zhang, S. Roller, N. Goyal, M. Artetxe, M. Chen, S. Chen, and et al., “Opt: Open pre-trained transformer language models,”arXiv preprint arXiv:2205.01068, 2022

    Pith/arXiv arXiv 2022

  2. [2]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar,et al., “Llama: Open and efficient foundation language models,”arXiv preprint arXiv:2302.13971, 2023

    Pith/arXiv arXiv 2023

  3. [3]

    Openai chatgpt blog,

    Openai, “Openai chatgpt blog,” 2022. https://openai.com/blog/chatgpt

    2022

  4. [4]

    Deepseek terms of use,

    Deepseek, “Deepseek terms of use,” 2025. https://cdn.deepseek.com/p olicies/en-US/deepseek-terms-of-use.html (Last Update: January 20, 2025)

    2025

  5. [5]

    Gemini api additional terms of service,

    Google, “Gemini api additional terms of service,” 2025. https://ai.goo gle.dev/gemini-api/terms (Effective April 3rd, 2025)

    2025

  6. [6]

    Grammarly

    Grammarly, “Grammarly.” https://www.grammarly.com/ (Accessed: 2025-04-22)

    2025

  7. [7]

    Chatpaper

    Chatpaper, “Chatpaper.” https://chatpaper.com/chatpaper/ (Accessed: 2025-04-22)

    2025

  8. [8]

    Transforming the future of music creation

    Deepmind, “Transforming the future of music creation.” https://deepmi nd.google/discover/blog/transforming-the-future-of-music-creation/ (Accessed: 2025-04-22)

    2025

  9. [9]

    Quickstart: Generate and verify an image’s watermark using imagen text-to-image (console)

    Deepmind, “Quickstart: Generate and verify an image’s watermark using imagen text-to-image (console).” https://cloud.google.com/vertex-ai/g enerative-ai/docs/image/quickstart-image-generate-console (Accessed: 2025-04-22)

    2025

  10. [10]

    Self-supervised adversarial example detection by disentangled representation,

    Z. Zhang, L. Y . Zhang, X. Zheng, J. Tian, and J. Zhou, “Self-supervised adversarial example detection by disentangled representation,” in2022 IEEE International Conference on Trust, Security and Privacy in Com- puting and Communications (TrustCom), pp. 1000–1007, IEEE, 2022

    2022

  11. [11]

    Evaluating membership inference through adversarial robustness,

    Z. Zhang, L. Y . Zhang, X. Zheng, B. A. Hussain, and S. Hu, “Evaluating membership inference through adversarial robustness,”The Computer Journal, vol. 65, no. 11, pp. 2969–2978, 2022

    2022

  12. [12]

    Not all edges are equally robust: Evaluating the robustness of ranking-based federated learning,

    Z. Gong, Y . Zhang, L. Y . Zhang, Z. Zhang, Y . Xiang, and S. Pan, “Not all edges are equally robust: Evaluating the robustness of ranking-based federated learning,” in2025 IEEE Symposium on Security and Privacy (SP), pp. 2527–2545, IEEE, 2025

    2025

  13. [13]

    When better features mean greater risks: The performance- privacy trade-off in contrastive learning,

    R. Sun, H. Hu, W. Luo, Z. Zhang, Y . Zhang, H. Yuan, and L. Y . Zhang, “When better features mean greater risks: The performance- privacy trade-off in contrastive learning,” inASIA CCS, 2025

    2025

  14. [14]

    Dynamic graph unlearning: a general and efficient post-processing method via gradi- ent transformation,

    H. Zhang, B. Wu, X. Yang, X. Yuan, and et al., “Dynamic graph unlearning: a general and efficient post-processing method via gradi- ent transformation,” inProceedings of the ACM on Web Conference, pp. 931–944, 2025

    2025

  15. [15]

    Unraveling privacy risks of individual fairness in graph neural networks,

    H. Zhang, X. Yuan, and S. Pan, “Unraveling privacy risks of individual fairness in graph neural networks,” inICDE, pp. 1712–1725, IEEE, 2024

    2024

  16. [16]

    On the risk of misinformation pollution with large language models,

    Y . Pan, L. Pan, W. Chen, P. Nakov, M.-Y . Kan, and W. Y . Wang, “On the risk of misinformation pollution with large language models,” in Findings of the EMNLP, 2023

    2023

  17. [17]

    Large language models can be used to effectively scale spear phishing campaigns,

    J. Hazell, “Large language models can be used to effectively scale spear phishing campaigns,”arXiv preprint arXiv:2305.06972, 2023

    Pith/arXiv arXiv 2023

  18. [18]

    Chatgpt for good? on opportunities and challenges of large language models for education,

    E. Kasneci, K. Seßler, S. K ¨uchemann, M. Bannert, D. Dementieva, F. Fischer, U. Gasser, G. Groh, S. G ¨unnemann, E. H ¨ullermeier,et al., “Chatgpt for good? on opportunities and challenges of large language models for education,”Learning and individual differences, vol. 103, p. 102274, 2023

    2023

  19. [19]

    A watermark for large language models,

    J. Kirchenbauer, J. Geiping, Y . Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” inICML, pp. 17061–17084, PMLR, 2023

    2023

  20. [20]

    Provable robust watermarking for AI-generated text,

    X. Zhao, P. V . Ananth, L. Li, and Y .-X. Wang, “Provable robust watermarking for AI-generated text,” inInternational Conference on Learning Representations, 2024

    2024

  21. [21]

    Unbiased watermark for large language models,

    Z. Hu, L. Chen, X. Wu, Y . Wu, H. Zhang, and H. Huang, “Unbiased watermark for large language models,” inInternational Conference on Learning Representations, 2024

    2024

  22. [22]

    A resilient and accessible distribution-preserving watermark for large language models,

    Y . Wu, Z. Hu, J. Guo, H. Zhang, and H. Huang, “A resilient and accessible distribution-preserving watermark for large language models,” inICML, 2024

    2024

  23. [23]

    Scalable watermarking for identifying large language model outputs,

    S. Dathathri, A. See, S. Ghaisas, P.-S. Huang, R. McAdam, and et al., “Scalable watermarking for identifying large language model outputs,” Nature, vol. 634, no. 8035, pp. 818–823, 2024

    2024

  24. [24]

    Robust distortion-free watermarks for language models,

    R. Kuditipudi, J. Thickstun, T. Hashimoto, and P. Liang, “Robust distortion-free watermarks for language models,”Transactions on Ma- chine Learning Research, 2024

    2024

  25. [25]

    Undetectable watermarks for language models,

    M. Christ, S. Gunn, and O. Zamir, “Undetectable watermarks for language models,” inThe Thirty Seventh Annual Conference on Learning Theory, pp. 1125–1139, PMLR, 2024

    2024

  26. [26]

    Bimark: Unbiased multilayer watermarking for large language models,

    X. Feng, H. Zhang, Y . Zhang, L. Y . Zhang, and S. Pan, “Bimark: Unbiased multilayer watermarking for large language models,” inICML, 2025

    2025

  27. [27]

    A certified robust watermark for large language models,

    X. Feng, J. Liu, K. Ren, and C. Chen, “A certified robust watermark for large language models,”arXiv preprint arXiv:2409.19708, 2024

    Pith/arXiv arXiv 2024

  28. [28]

    Bypassing LLM watermarks with color- aware substitutions,

    Q. Wu and V . Chandrasekaran, “Bypassing LLM watermarks with color- aware substitutions,” inProceedings of the 62nd ACL (Volume 1: Long Papers), pp. 8549–8581, ACL, Aug. 2024

    2024

  29. [29]

    b 4: A black-box scrubbing attack on LLM watermarks,

    B. Huang, X. Pu, and X. Wan, “b 4: A black-box scrubbing attack on LLM watermarks,” inProceedings of the NAACL (Volume 1: Long Papers), pp. 9113–9126, ACL, Apr. 2025

    2025

  30. [30]

    De-mark: Watermark removal in large language models,

    R. Chen, Y . Wu, J. Guo, and H. Huang, “De-mark: Watermark removal in large language models,” inICML, 2025

    2025

  31. [31]

    Watermark smoothing attacks against language models,

    H. Chang, H. Hassani, and R. Shokri, “Watermark smoothing attacks against language models,”arXiv preprint arXiv:2407.14206, 2024

    Pith/arXiv arXiv 2024

  32. [32]

    Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense,

    K. Krishna, Y . Song, M. Karpinska, and et al., “Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense,” in NeurIPS, vol. 36, pp. 27469–27500, Curran Associates, Inc., 2023

    2023

  33. [33]

    On the reliability of watermarks for large language models,

    J. Kirchenbauer, J. Geiping, Y . Wen, M. Shu, and et al., “On the reliability of watermarks for large language models,” inInternational Conference on Learning Representations, 2024

    2024

  34. [34]

    Markmywords: Analyzing and evaluating language model watermarks,

    J. Piet, C. Sitawarin, V . Fang, N. Mu, and D. Wagner, “Markmywords: Analyzing and evaluating language model watermarks,” in2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pp. 68–91, 2025

    2025

  35. [35]

    Textbugger: Generating adversarial text against real-world applications,

    J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: Generating adversarial text against real-world applications,” inProceedings of the Network and Distributed System Security Symposium, 2018

    2018

  36. [36]

    Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp,

    J. Morris, E. Lifland, J. Y . Yoo, J. Grigsby, D. Jin, and Y . Qi, “Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp,” inProceedings of the EMNLP, pp. 119–126, 2020

    2020

  37. [37]

    Black-box generation of adversarial text sequences to evade deep learning classifiers,

    J. Gao, J. Lanchantin, M. L. Soffa, and Y . Qi, “Black-box generation of adversarial text sequences to evade deep learning classifiers,” in2018 IEEE Security and Privacy Workshops (SPW), pp. 50–56, IEEE, 2018

    2018

  38. [38]

    Exploring gradient-guided masked language model to detect textual adversarial attacks,

    X. Zhang, Z. Zhang, Y . Zhang, X. Zheng, L. Y . Zhang, S. Hu, and S. Pan, “Exploring gradient-guided masked language model to detect textual adversarial attacks,”arXiv preprint arXiv:2504.08798, 2025

    Pith/arXiv arXiv 2025

  39. [39]

    Masked language model based textual adversarial example detection,

    X. Zhang, Z. Zhang, Q. Zhong, X. Zheng, Y . Zhang, S. Hu, and L. Y . Zhang, “Masked language model based textual adversarial example detection,” inASIA CCS, p. 925–937, 2023

    2023

  40. [40]

    Watermark stealing in large language models,

    N. Jovanovi ´c, R. Staab, and M. Vechev, “Watermark stealing in large language models,” inICML, 2024

    2024

  41. [41]

    Stealing watermarks of large language models via mixed integer programming,

    Z. Zhang, X. Zhang, Y . Zhang, L. Y . Zhang, C. Chen, S. Hu, A. Gill, and S. Pan, “Stealing watermarks of large language models via mixed integer programming,” in2024 Annual Computer Security Applications Conference (ACSAC), pp. 46–60, IEEE Computer Society, Dec. 2024

    2024

  42. [42]

    Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models,

    Z. He, B. Zhou, H. Hao, A. Liu, and et al., “Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models,” inProceedings of the 62nd ACL (Volume 1: Long Papers), pp. 4115–4129, ACL, Aug. 2024

    2024

  43. [43]

    On evaluating the performance of watermarked machine-generated texts under adversarial attacks,

    Z. Liu, T. Cong, X. He, and Q. Li, “On evaluating the performance of watermarked machine-generated texts under adversarial attacks,”arXiv preprint arXiv:2407.04794, 2024

    Pith/arXiv arXiv 2024

  44. [44]

    Silverspeak: Evading ai-generated text detectors using homoglyphs,

    A. Creo and S. Pudasaini, “Silverspeak: Evading ai-generated text detectors using homoglyphs,” inProceedings of the 1st Workshop on GenAI Content Detection (GenAIDetect), pp. 1–46, 2025

    2025

  45. [45]

    Watermarks in the sand: impossibility of strong watermarking for language models,

    H. Zhang, B. L. Edelman, D. Francati, D. Venturi, G. Ateniese, and B. Barak, “Watermarks in the sand: impossibility of strong watermarking for language models,” inICML, 2024

    2024

  46. [46]

    Watermark under fire: A robustness evaluation of llm watermarking,

    J. Liang, Z. Wang, L. Hong, S. Ji, and T. Wang, “Watermark under fire: A robustness evaluation of llm watermarking,”arXiv preprint arXiv:2411.13425, 2024

    arXiv 2024

  47. [47]

    Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders,

    T. Cong, X. He, and Y . Zhang, “Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications 14 Security (CCS), p. 579–593, Association for Computing Machinery, 2022

    2022

  48. [48]

    Entangled watermarks as a defense against model extraction,

    H. Jia, C. A. Choquette-Choo, V . Chandrasekaran, and N. Papernot, “Entangled watermarks as a defense against model extraction,” in30th USENIX Security Symposium, pp. 1937–1954, USENIX Association, Aug. 2021

    1937

  49. [49]

    Exploring the limits of transfer learning with a unified text-to-text transformer,

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y . Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,”Journal of Machine Learning Research, vol. 21, no. 140, pp. 1–67, 2020

    2020

  50. [50]

    Synthid

    Deepmind, “Synthid.” https://deepmind.google/technologies/synthid/ (Accessed: 2025-04-22)

    2025

  51. [51]

    Terms of use,

    Openai, “Terms of use,” 2024. https://openai.com/policies/row-terms- of-use/ (Published: December 11, 2024)

    2024

  52. [52]

    Optimizing adaptive attacks against content watermarks for language models,

    A. Diaa, T. Aremu, and N. Lukas, “Optimizing adaptive attacks against content watermarks for language models,” inThe 1st Workshop on GenAI Watermarking, 2025

    2025

  53. [53]

    Markllm: An open-source toolkit for llm watermarking,

    L. Pan, A. Liu, Z. He, Z. Gao, X. Zhao, Y . Lu, B. Zhou, S. Liu, X. Hu, L. Wen,et al., “Markllm: An open-source toolkit for llm watermarking,” inProceedings of the EMNLP: System Demonstrations, 2024

    2024

  54. [54]

    Software Framework for Topic Modelling with Large Corpora,

    R. ˇReh˚uˇrek and P. Sojka, “Software Framework for Topic Modelling with Large Corpora,” inProceedings of the LREC 2010 Workshop on New Challenges for NLP Frameworks, pp. 45–50, ELRA, May 2010. http://is.muni.cz/publication/884893/en

    2010

  55. [55]

    Authormist: Evading ai text detectors with reinforcement learning,

    I. David and A. Gervais, “Authormist: Evading ai text detectors with reinforcement learning,”arXiv preprint arXiv:2503.08716, 2025

    Pith/arXiv arXiv 2025

  56. [56]

    Bleu: a method for automatic evaluation of machine translation,

    K. Papineni, S. Roukos, T. Ward, and W.-J. Zhu, “Bleu: a method for automatic evaluation of machine translation,” inProceedings of the 40th ACL, pp. 311–318, 2002

    2002

  57. [57]

    Rouge: A package for automatic evaluation of summaries,

    C.-Y . Lin, “Rouge: A package for automatic evaluation of summaries,” inText summarization branches out, pp. 74–81, 2004

    2004

  58. [58]

    The cefr levels

    C. of Europe, “The cefr levels.” https://www.coe.int/en/web/common- european-framework-reference-languages/level-descriptions (Accessed: 2025-07-28)

    2025

  59. [59]

    No free lunch in LLM watermarking: Trade-offs in watermarking design choices,

    Q. Pang, S. Hu, W. Zheng, and V . Smith, “No free lunch in LLM watermarking: Trade-offs in watermarking design choices,” inNeurIPS, 2024

    2024

  60. [60]

    New ai classifier for indicating ai-written tex,

    OpenAI, “New ai classifier for indicating ai-written tex,” 2023. https: //openai.com/index/new-ai-classifier-for-indicating-ai-written-text/ (Accessed: 31 Jan. 2023)

    2023

  61. [61]

    Ai detector by grammarly

    Grammarly, “Ai detector by grammarly.” https://www.grammarly.com/ ai-detector (Accessed: 2 April. 2025)

    2025

  62. [62]

    Gptzero’s ai detection technology

    GPTZero, “Gptzero’s ai detection technology.” https://gptzero.me/techn ology#how-ai-detection-works (Accessed: 2 April. 2025)

    2025

  63. [63]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” inProceed- ings of the NAACL (volume 1: long and short papers), pp. 4171–4186, 2019

    2019

  64. [64]

    Languagetool

    LanguageTool, “Languagetool.” https://github.com/jxmorris12/language tool python (Accessed: 2025-04-22)

    2025

  65. [65]

    Python tesseract

    S. Hoffstaetter, “Python tesseract.” https://github.com/madmaze/pytesse ract (Accessed: 2025-04-22)

    2025

  66. [66]

    Unicodedata

    Python, “Unicodedata.” https://docs.python.org/3/library/unicodedata.ht ml (Accessed: 2025-07-22). APPENDIXA A. Related Work Some works have evaluated the robustness of various water- marks against character-level perturbations — such as typos, misspellings, and homoglyph substitutions — demonstrating that these attacks can be effective at degrading detec...

    arXiv 2025

  67. [67]

    Results are reported forn= 5,10, and15, using both token- level and character-level perturbations across five watermark- ing schemes

    Impact of Iterations in GA:Table XIII shows the impact of the number of GA iteration rounds (n) on watermark removal effectiveness, with maximum editing rateϵ= 0.13. Results are reported forn= 5,10, and15, using both token- level and character-level perturbations across five watermark- ing schemes. Asnincreases, theASRimproves consistently. For instance, ...

  68. [68]

    We compare both token-level (dashed lines) and character-level (solid lines) perturbations

    Impact of N in Best-of-N:Figure 7 illustrates the effect of increasingNin the Best-of-Nstrategy on attack success rate (ASR), evaluated under five watermark schemes withER set to 0.1 and Ref-9 used as the reference detector. We compare both token-level (dashed lines) and character-level (solid lines) perturbations. Across all watermark schemes, character-...

  69. [69]

    As introduced TABLE XV: Performance of reference detectors with three levels of data augmentation across five watermark schemes

    Effect of Filtering High-Gradient Tokens:Table XIV shows the impact of filtering high-gradient tokens on the per- formance of the GA-based watermark removal. As introduced TABLE XV: Performance of reference detectors with three levels of data augmentation across five watermark schemes. Each model is evaluated by the Pearson correlation between predicted a...

  70. [70]

    Major Revision

    Performance of Reference Detector:Figure 8 compares the watermark scores predicted by the reference detectors with those from the original detectors for Unbiased, SynthID, Uni- gram, and DIP. For each row, as data augmentation increases, the reference detector’s predictions become closer to the origi- nal detector’s scores. However, samples near the class...

  71. [71]

    We recom- mend downloading the code using the following command: git clone https://github.com/plll4zzx/CharacterRemoval4WM

    How to access:The artifact can be accessed via GitHub (https://github.com/plll4zzx/CharacterRemoval4WM) or DOI (https://doi.org/10.5281/zenodo.15872569). We recom- mend downloading the code using the following command: git clone https://github.com/plll4zzx/CharacterRemoval4WM. The datasets required for artifact experiment are available through the DOI and...

    work page doi:10.5281/zenodo.15872569

  72. [72]

    Hardware dependencies:A commodity desktop machine with at least 8 CPU cores and 16GB RAM. GPU with at least 10GB of memory (e.g., NVIDIA GPU with CUDA) is strongly recommended for faster execution, especially for collecting watermarked text and reference detector training

  73. [73]

    Software dependencies:Ubuntu, Python 3.9, Conda, other dependencies are listed inrequirements.txt

  74. [74]

    real- newslike/*

    Benchmarks:We use the C4 dataset as the source of prompts to query the victim LLMs and generate watermarked text3. In this evaluation, we employ OPT-1.3B 4 as the victim language model to produce watermarked outputs. Our refer- ence detectors are finetuned from BERT 5. All model weights can be obtained from HuggingFace model repositories. B. Artifact Inst...

  75. [75]

    /../dataset/c4/realnewslike

    Experiment (E1):In E1, we aim to evaluate whether character-level removal attacks outperform token-level ap- proaches under the AC1 setting, which assumes no access to the original watermark detector. Consistent with the paper, we test five representative watermarking schemes: KGW, DIP, SynthID, Unigram, and Unbias. [Preparation]To run this experiment, th...

  76. [76]

    KGW" --num_epochs 15 \ --rand_char_rate 0.15 --rand_times 9 \ --llm_name

    Experiment (E2):In Experiment (E2), we aim to eval- uate the effectiveness of watermark removal under the AC2 scenario, where the adversary has limited access to the original watermark detector. In this setting, a reference detector is first trained using a limited number of queries to the original detector. Subsequently, the trained reference detector is...