LLM Watermark Evasion via Bias Inversion
Watermarking for large language models (LLMs) embeds a statistical signal
during generation to enable detection of model-produced text. While
watermarking has proven effective in benign settings, its robustness under
adversarial evasion remains contested. To advance a rigorous understanding and
evaluation of such vulnerabilities, we propose the Bias-Inversion
Rewriting Attack (BIRA), which is theoretically motivated and model-agnostic.
BIRA weakens the watermark signal by suppressing the logits of likely
watermarked tokens during LLM-based rewriting, without any knowledge of the
underlying watermarking scheme. Across recent watermarking methods, BIRA
achieves over 99\% evasion while preserving the semantic content of the
original text. Beyond demonstrating an attack, our results reveal a systematic
vulnerability, emphasizing the need for stress testing and robust defenses.
68dc23064159d1f2418f98e3
Jeongyeon Hwang
68dc23064159d1f2418f98e4
Sangdon Park
68dc23064159d1f2418f98e5
Jungseul Ok
LLM Watermark Evasion via Bias Inversion
Watermarking for large language models (LLMs) embeds a statistical signal
during generation to enable detection of model-produced text. While
watermarking has proven effective in benign settings, its robustness under
adversarial evasion remains contested. To advance a rigorous understanding and
evaluation of such vulnerabilities, we propose the Bias-Inversion
Rewriting Attack (BIRA), which is theoretically motivated and model-agnostic.
BIRA weakens the watermark signal by suppressing the logits of likely
watermarked tokens during LLM-based rewriting, without any knowledge of the
underlying watermarking scheme. Across recent watermarking methods, BIRA
achieves over 99\% evasion while preserving the semantic content of the
original text. Beyond demonstrating an attack, our results reveal a systematic
vulnerability, emphasizing the need for stress testing and robust defenses.
The Bias-Inversion Rewriting Attack (BIRA) effectively evades watermarking in large language models by suppressing specific logits, highlighting a significant vulnerability in watermarking techniques.
watermarking large language models LLMs Bias-Inversion Rewriting Attack BIRA logits watermark signal adversarial evasion semantic content stress testing robust defenses