SIRA: Exposing Vulnerabilities in Text Watermarking with Self-Information Rewrite Attacks
LLM watermark;robustness;safety ai;paraphrasing attack
Yes
No ethics review needed.
1 How to fairly evaluate the balance between the generated text quality and the attack effect? 
2 Will the attacker really care so much about the resource reduction as shown in Table 2?
1 SIRA can be implemented using a more lightweight model compared to other model-based paraphrasing attacks.
2 This paper is well organized and discussions are relatively sufficient.
This paper introduce a novel watermark removal attack SIRA.
Current watermarking methods often favoring high-entropy tokens to embed watermark patterns. High-entropy tokens usually have high self-information. SIRA utilized self-information to identify potential ”green list” token candidates,  which are masked and then completed by LLM.
1 The semantic preservation of the proposed method is inferior compared to GPT Paraphraser.
A clerical error:Line 24 “tempering”? I think it should be "tampering".
Yes
No ethics review needed.
1.	What distinguishes self-information from entropy and probability, and what are the specific advantages of using self-information in this context?
2.	In Algorithm 1, is the model M in line 14 the attack model M_attack?
3.	In Figure 4(a), why does the word deletion method have a large impact on KGW-1’s PPL? Additionally, why is this impact much more significant than that of other methods in Figure 4(b)?
4.	In Table 1, the GPT Paraphraser shows a much higher attack success rate for Unigram watermarks than for DIPPER-based attacks, a phenomenon not observed with other watermarking methods. Additionally, SIR, a sentence embedding-based watermark scheme, should theoretically have robustness only second to Unigram, but this is not reflected in Table 1. Further discussion on these points is necessary.
1.	The paper addresses a widely recognized problem in the field of text watermarking. By leveraging self-information, it enables effective watermark removal without compromising text quality.
2.	The experimental setup is comprehensive, covering various watermarking schemes and attack methods.
This paper presents the Self-Information Rewrite Attack (SIRA), a watermark removal method that targets vulnerabilities in existing watermarking techniques applied to LLM-generated text. By using self-information to identify and modify high-entropy tokens, SIRA effectively removes watermarks while preserving text quality. The authors conduct extensive experiments across multiple watermarking schemes and demonstrate that SIRA achieves a high attack success rate with minimal computational resources.
1.	Figures 3 and 4 are incorrectly placed, with Figure 4 missing some information, and table formats in this paper are inconsistent.
2.	The proposed method does not appear highly novelty, as it builds upon existing paraphrase attacks by using self-information to locate keywords.
3.	The experiments lack comparisons between self-information and other metrics, such as entropy and token probability, which could help establish the advantage of self-information.
4.	The proposed approach shares characteristics with watermark-stealing attacks [1,2,3], especially in the selection of keywords for targeted editing. A comparison with watermark-stealing attacks in both theoretical analysis and experiments would provide additional insights.
[1] N. Jovanović, R. Staab, and M. Vechev, “Watermark Stealing in Large Language Models.” http://arxiv.org/abs/2402.19361
[2] Q. Wu and V. Chandrasekaran, “Bypassing LLM Watermarks with Color-Aware Substitutions.” http://arxiv.org/abs/2403.14719
[3] Z. Zhang et al., “Large Language Model Watermark Stealing With Mixed Integer Programming.” http://arxiv.org/abs/2405.19677
Yes
No ethics review needed.
Why does SIRA have a shorter execution time than GPT Paraphraser, considering that SIRA requires two paraphrasing steps? Table 2 indicates that the execution speed of GPT Paraphraser may vary depending on the network status and real-time OpenAI server load. Does this make for a fair comparison?
The attack is performed in a black-box setting.

The semantics of the paraphrased text is preserved.
The paper proposes a model-based paraphrasing attack. It identifies potential green words and provides a template for rephrasing.
The paper has limited optimization for preserving semantics. The primary strategy for maintaining semantics is changing only potential "green" words while providing a masked template. However, the paper could be strengthened by presenting evidence on how the template contributes to semantic preservation.

Additionally, the method requires two paraphrasing steps: one to generate a reference text and another to create the attack text. The paper would benefit from explaining how it achieves shorter execution time.

In the ablation study, besides comparing the self-information mask with the random mask, it would be valuable to include a comparison between the self-information mask and no mask (paraphrasing twice).
Yes
No ethics review needed.
I have listed most of my questions associated with these weaknesses above.
The proposed method, namely SIRA, leverages the high self-information of certain tokens where watermarks are often embedded, applying a lightweight masking and rewriting technique to evade watermark detection. The experimental results demonstrate that SIRA effectively disrupts watermarking in seven algorithms with minimal computational resources, achieving a 90% success rate, suggesting critical vulnerabilities in current watermarking techniques.
This is an interesting paper, it introduces the Self-Information Rewrite Attack (SIRA) as a novel watermark removal method targeting the robustness of text watermarking techniques used in content generated by large language models (LLMs). These watermarks allow tracing and verifying content origins to prevent misuse.
1. **Unclear motivation.** In lines 57-59, the authors point out the limitations of previous methods and later propose their method to overcome these challenges. One limitation is transparency, but why is transparency desirable for watermark removal attacks via paraphrasing? The second limitation is computational cost, but their method requires three models: one for masking, one to generate reference text, and a third one for paraphrasing given the masked reference text, which is not computationally efficient.

2. **The method lacks soundness.** How can it be ensured that the LLaMA 3 rewriting can favor red tokens to achieve watermark removal? Why can this method remove SIR watermarking while existing methods fail?

3. **Unclear experiment settings.** Which models are used as $ M_{\text{attack}} $ (line 290) and the base LLM (line 307), respectively? How does LLaMA3-8b ensure the lightweight and usability of the proposed method? The lightweight aspect of LLaMA3-8b is questionable, considering the watermarked model in the experiment is OPT 1.3B.

4. **The experimental results lack analysis and sometimes are even inconsistent.** Why does word deletion yield a high s-BERT score for KGW-1 (i.e., deletion preserves sentence-level embedding similarity) but low scores for other watermarks in Figure 4b? Why are the results in Figure 4b inconsistent with those in Table 8?

5. **Minor issues:** 
   - Typo: `paraphase` in Figure 1 and its caption.
   - The threshold in line 296 should be $\epsilon$ instead of $\sigma$.
A Lightweight Approach to remove LLM Watermarks by find the green token with self-information
@inproceedings{
anonymous2024sira,
title={{SIRA}: Exposing Vulnerabilities in Text Watermarking with Self-Information Rewrite Attacks},
author={Anonymous},
booktitle={Submitted to The Thirteenth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=8Me0Y01mkY},
note={under review}
}
Text watermarking is designed to embed hidden, imperceptible, markers within
content generated by large language models (LLMs), with the goal of tracing and
verifying the content’s origin to prevent misuse. The robustness of watermarking
algorithms has become a key factor in evaluating their effectiveness, but remains
an open problem. In this work, we introduce a novel watermark removal attack,
the Self-Information Rewrite Attack (SIRA), which poses a new challenge to the
robustness of existing watermarking techniques. Since embedding watermarks
requires both concealment and semantic coherence, current methods prefered to
embed them in high-entropy tokens. However, this reveals an inherent vulnera-
bility, allowing us to exploit this feature to identify potential green tokens. Our
approach leverages the self-information of each token to filter potential pattern to-
kens that embed watermarks and performs the attack through masking and rewrit-
ing in a black-box setting. We demonstrate the effectiveness of our attack by
implementing it against seven recent watermarking algorithms. The experimental
results show that our lightweight algorithm achieves state-of-the-art attack success
rate while maintaining shorter execution times and lower computational resource
consumption compared to existing methods. This attack points to an important
vulnerability of existing watermarking techniques and paves way towards future
watermarking improvements.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
LLM watermark robustness safety ai paraphrasing attack
I certify that there is no acknowledgement section in this submission for double blind review.
/pdf/f0ac0327344b320db856880c62bc4d8982494689.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
SIRA: Exposing Vulnerabilities in Text Watermarking with Self-Information Rewrite Attacks
ICLR 2025 Conference Submission
ICLR.cc/2025/Conference/Submission