The authors target distortion-based watermarking schemes, including the popular green-list and red-list methods and their multi-bit variants.
Attackers can swap hidden account IDs in LLM watermarks without the secret key
A new attack, called targeted displacement, rewrites watermarked text so that the decoder recovers an arbitrary chosen message, verified on five schemes and four language models.
Academic
Paweł Batorski · Przemysław Spurek · Paul Swoboda
Heinrich Heine University Düsseldorf · Jagiellonian University · IDEAS Research Institute
Research Digest··2 min read
Batorski et al.
Why this paper
From Heinrich Heine University Düsseldorf and 2 others
In one line
Attackers can alter the message embedded in multi-bit LLM watermarks without the secret key by rewriting text.
What we could check
- ·No code link found
- ·No weights link found
- ·No dataset link found
- ·No compute details found
- ✓Limitations stated by the authors
- ·No benchmark numbers found
Observed from the paper text and links we have. Absence here means we did not find it, not that it does not exist.
§