Watermark Smoothing Attacks against Language Models
LLM Watermark
Yes
No ethics review needed.
What are the main differences between this work and that of Zhang et al. (2023)? (see Weaknesses section)
The paper proposes a heuristic to estimate which tokens contribute the most to the overall watermark signal and removes the watermark by editing these tokens using another language model. The idea is interesting, and the paper empirically validates the effectiveness of their attack across different watermarks, language models, and datasets. These results clearly establish the effectiveness of the attack in practice.
The paper proposes an automatic method for editing watermarked text from a language model to evade watermark detection using another (weaker) language model. The paper mainly considers the "red-green list" watermark of Kirchenbauer et al. and variants thereof, though the techniques should presumably generalize to other watermarks.
The paper distinguishes its main contributions from prior work by arguing that prior work on automatically removing watermarks involved using language models that were at least as strong as the original watermarked language model. However, one notable exception is the work of Zhang et al. [1], who seem to also focus on removing watermarks using weaker language models. This work is cited in the present paper but not discussed in any detail. It would be great if the authors can update their paper with a discussion of how their work differs from [1]. Otherwise, the novelty/significance of the main contributions over prior work is not clear.


[1] Zhang et al. (2023) Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models. https://arxiv.org/abs/2311.04378
Yes
No ethics review needed.
- Can the authors provide a baseline that uses the local reference model to do the paraphrase attack?
- What could be potential adaptive defenses for this attack?
- I find the proposed method very interesting and quite different from the previous work. Meanwhile, the method doesn't require a strong oracle model like a paraphrasing attack, which makes the threat model more realistic.
- I really enjoy reading this paper, especially section 3.1, which gives readers a lot of insights.
- The results look positive and a lot of different watermarking schemes are covered (most results are presented in the appendix).
In this paper, the authors introduce a novel watermark-removal attack that requires only a small watermark-free reference model. The attacker first estimates the probability of the generated token at position i being in the watermark's green list, which correlates with the relative confidence of the most likely token among the top k tokens. According to the confidence score, the attacker then combines the probability distributions at position i from both the watermarked model and the reference model to sample the token. This approach effectively evades watermark detection while maintaining high text quality.
- The proposed method relies on using the logits/output probabilities of the watermarked model. This might limit the attack to some API models that may not return the logits/probabilities or only return top-k probabilities or even calibrated probabilities.
- The paper uses perplexity or loss to measure the text quality, but I think it's not enough to show the quality of the text. For example, the model can generate an answer for a math question with a very low perplexity, but the answer is completely wrong. So, I think it will be more helpful if the authors can include more text quality metrics like P-SP used in [1] or even a model-based evaluation like asking a large oracle model which generation is preferable.
- I think it's also helpful to the paper if the answers can show the results under different data distributions instead of overall c4.

[1] Kirchenbauer, J., Geiping, J., Wen, Y., Shu, M., Saifullah, K., Kong, K., Fernando, K., Saha, A., Goldblum, M., & Goldstein, T. (2023). On the Reliability of Watermarks for Large Language Models. ArXiv, abs/2306.04634.
Yes
No ethics review needed.
1. In Table 1, Watermark (smoothing) has a lower perplexity than Watermark (or even Unwatermark) in some cases (e.g., Llama2-7b). In other words, the attack can even improve the quality of the text, which seems counterintuitive as the reference model is weaker. This also raises a concern about whether perplexity is the right measure to look at the quality of a text here. The authors may want to include other text quality metrics in the numerical studies.
2. I would like to know if the authors can discuss the potential pitfalls of their methods, e.g., provide concrete examples or scenarios where their smooth attack might fail, and discuss the implications of such failures
Many existing methods for statistical watermarking have primarily concentrated on the generation and detection of watermarks. This paper takes a different approach by examining statistical watermarking from a new perspective. This perspective is interesting and may also aid in the development of improved watermark generation and detection techniques.
This work develops a smooth attack in the “green-red list” watermarking framework. The paper shows that a smooth attack makes it easier to bypass the detector while still preserving the quality of the text.
1. The significance level $S_t$ is unobserved and was estimated using a surrogate quantity, $c_t$. Though the authors showed that there is generally a negative correlation between $c_t$ and $S_t$, this is only a weak justification. It is possible that a small $c_t$ would correspond to a large $S_t$ in some situations, e.g., when $K$ is small. 
2. The method only applies to the “green-red list” watermarking scheme, which is known to be biased because it does not preserve the original text distribution. In contrast, there are unbiased watermarking methods (e.g., Kuditipudi et al., 2023; Aaronson, 2023). It is unclear if the proposed method applies to unbiased watermarking schemes. Perhaps the authors can provide more discussions about how their method might be adapted or extended to work with unbiased watermarking schemes.
3. The paper lacks a rigorous theoretical analysis of the effect of the smooth attack on the text quality, e.g., bounds on how much the smoothing attack can affect certain text quality metrics.
Yes
No ethics review needed.
1. Why in Figure 1, top-p sampling (right figure) has some points with the total variation distance being 0 or 1, but top-k sampling (middle figure) does not?
2. How many queries (prefixes) do you use for computing the bin index as described in Lines[261-266]?
1. The writing is easy to follow.

2. Propose a smoothing attack scheme against statistical watermarking, and show that the significance level $S_t$ is highly correlated with the total variation distance.
The paper introduces a "smoothing attack" that bypasses statistical watermarking in large language models (LLMs). By blending outputs from the watermarked model with a weaker reference model, it removes watermarks without impacting text quality on PPL.
1. The applicability of this method is limited, as obtaining a high-quality reference model is often not possible (e.g. for GPT-4). Additionally, it requires access to token logits, meaning it is not a purely black-box approach as claimed.

2. In line 146. The authors overclaim that their attack is universally applicable to all statistical watermarking schemes. However, many watermarking schemes [1,2,3] do not use a green list, and their proposed method cannot be applied.

3. Additional metrics are needed to better reflect the quality of the generated text. PPL tends to favor a distribution similar to that of the oracle model, which can introduce bias. It would be more informative to include straightforward metrics, such as BLEU in machine translation, to provide a clearer evaluation.

4. The paper lacks key baseline results needed to demonstrate the effectiveness of the proposed method.  Naive smoothing using $\lambda \tilde{P}(x)+(1-\lambda) P^{ref}(x)$ can also remove the watermark while preserving part of the text quality.

5. The choice of z-score threshold used in the experiments is unclear. It would be more straightforward to present the true positive rates at specific theoretical false positive rates, providing a clearer understanding of the method’s performance.

6. The experimental settings for certain tests are suboptimal. For instance, in Table 2, the z-score for XSIR and SIR is too low, indicating that the watermark strength in the original watermarked model is insufficient.

[1] Kuditipudi, R., Thickstun, J., Hashimoto, T. and Liang, P., 2023. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593.

[2] Hu, Z., Chen, L., Wu, X., Wu, Y., Zhang, H. and Huang, H., 2023. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669.

[3] Dathathri, S., See, A., Ghaisas, S., Huang, P.S., McAdam, R., Welbl, J., Bachani, V., Kaskasoli, A., Stanforth, R., Matejovicova, T. and Hayes, J., 2024. Scalable watermarking for identifying large language model outputs. Nature, 634(8035), pp.818-823.
@inproceedings{
anonymous2024watermark,
title={Watermark Smoothing Attacks against Language Models},
author={Anonymous},
booktitle={Submitted to The Thirteenth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=1AYrzmDK4V},
note={under review}
}
Statistical watermarking is a technique used to embed a hidden signal in the probability distribution of text generated by large language models (LLMs), enabling the attribution of the text to the originating model. We introduce the smoothing attack and show that existing statistical watermarking methods are not robust against minor modifications of text. In particular, with the help of a weaker language model, an adversary can smooth out the distribution perturbation caused by watermarks. The resulting generated text achieves comparable quality to the original (unwatermarked) model while bypassing the watermark detector. Our attack reveals a fundamental limitation of a wide range of watermarking techniques.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
LLM Watermark
I certify that there is no acknowledgement section in this submission for double blind review.
/pdf/c92dc85ed9449585d4fba912de43cd2a2ad0e683.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
/attachment/b4c2fe02138d48e982bdf321f62c386d64d3d5a1.zip
Watermark Smoothing Attacks against Language Models
ICLR 2025 Conference Submission
ICLR.cc/2025/Conference/Submission