Budgeted token-event replacement evades KGW watermarks
Original title: Constructing Budgeted KGW Evasion through Token-Event Evidence Replacement
Phrase rewrites from an independent model remove watermark evidence at 16% token-edit cost in 39 of 82 tested passages.
KGW watermarks accumulate detection evidence through biased sampling. The authors construct budgeted evasion by jointly selecting phrase rewrites from an independent model and measuring global token-edit distance. Exact coverage search maximizes removal of original scored token pairs. Controlled tests on short passages show rewrites passing the detector at mean cost of 16.0% under a 20% allowance.
- 39 of 82 sources evaded with 16% token-edit cost
- Mean suppression from removing watermark-enriched events
- No advantage over simpler constrained rewriting
From the original article
1 min read at arxiv.orgKGW watermarks bias sampling to accumulate keyed detection evidence. We construct budgeted evasion through token-event evidence replacement using ordinary phrase rewrites. Our construction jointly selects compositions of LLM-proposed alternatives from an independent model and measures global token-edit distance on complete outputs.
By Hongliang Liu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.