Could LLM Watermark Detection be Public?
Split-key LLM watermark exposes one key publicly while private scores still detect informed forgery.
LLM watermark detectors are usually kept private because feedback could guide targeted edits, even though uninformed tampering already removes many watermarks. The authors measure the extra risk of releasing detection at access levels from token scores to a binary verdict, then propose a split-key watermark that exposes one key publicly and retains the other for full verification. An informed attacker can shift only the public signal; a statistical imbalance test combined with the private verdict in a two-stage check identifies that. Public detection improves removal only at small edit budgets, because plain rephrasing already strips the mark more cheaply, but it does enable forgery that the private pipeline can catch.
- Quantifies liability of public detectors from token scores to a binary verdict
- Split-key scheme publishes one key and keeps one for private forensics
- Imbalance test detects attackers who can move only the public signal
- Public feedback aids removal only at small edit budgets but enables detectable forgery
From the original article
1 min read at arxiv.orgWatermarking large language models is popular for tracing chatbot and agentic outputs, yet detectors remain unreleased since exposing them could let attackers do targeted edits with the detector's feedback. However, watermarks are already vulnerable to uninformed tampering attacks.
By Georgios Milis · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.