Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks

TL;DR

This paper addresses the robustness of text watermarking for LLM outputs by introducing a black-box targeted paraphrasing attack, SIRA. SIRA identifies high self-information tokens via a base attack model, masks them, and uses a reference paraphrase to fill in blanks, effectively removing watermark signals while preserving semantic content. It achieves near-100% attack success across seven watermarking schemes at low cost (about $0.88 per million tokens) and demonstrates strong transferability to different models, including mobile-scale ones. The work highlights a critical vulnerability in current watermarking designs and motivates the development of more robust, adaptive watermarking strategies and evaluation methodologies.

Abstract

Text watermarking aims to subtly embed statistical signals into text by controlling the Large Language Model (LLM)'s sampling process, enabling watermark detectors to verify that the output was generated by the specified model. The robustness of these watermarking algorithms has become a key factor in evaluating their effectiveness. Current text watermarking algorithms embed watermarks in high-entropy tokens to ensure text quality. In this paper, we reveal that this seemingly benign design can be exploited by attackers, posing a significant risk to the robustness of the watermark. We introduce a generic efficient paraphrasing attack, the Self-Information Rewrite Attack (SIRA), which leverages the vulnerability by calculating the self-information of each token to identify potential pattern tokens and perform targeted attack. Our work exposes a widely prevalent vulnerability in current watermarking algorithms. The experimental results show SIRA achieves nearly 100% attack success rates on seven recent watermarking methods with only 0.88 USD per million tokens cost. Our approach does not require any access to the watermark algorithms or the watermarked LLM and can seamlessly transfer to any LLM as the attack model, even mobile-level models. Our findings highlight the urgent need for more robust watermarking.

Figures (7)

• Figure 1: SIRA pipeline consisting to two steps. First, the attack generates a masked text based on self-information. If the self-information of a specific part above a pre-set threshold, that portion of the text is masked and replaced with a placeholder. Simultaneously, a reference text is generated by asking the LLM to paraphrase. In the second step, the LLM is prompted to complete the masked text while incorporating all the information from the reference text.
• Figure 2: To mitigate the default z-threshold's impact on the robustness of watermarking algorithms, we dynamically adjust the z-score threshold until the watermark detector achieves specified false positive rates. The true positive rate (TPR$\downarrow$) and the best F1 score are shown. Lower TPR and F1 scores at a given false positive rate (FPR) indicate that the watermark detector struggles to distinguish attack texts from human-written texts, suggesting a more effective attack. Detailed values for the figures are provided in \ref{['appendix:bestscore']}.
• Figure 4: Comparison of different paraphrasing methods on KGW watermarks. Each word's color indicates whether it is a green or red token. Fewer green words/lower z-scores suggest a more effective paraphrasing approach. The unwatermarked text represents the model's output without the influence of the watermarking algorithm. The example demonstrates that our method achieves a better z-score than the unwatermarked text..
• Figure 5: Comparison of different paraphrasing methods on Unigram watermarks.
• Figure 6: Comparison of different paraphrasing methods on UPV watermarks. The color of each word indicates whether it belongs to a green token or a red token. Less green signifies a more effective paraphrasing approach. Our methods show better performance in removing original watermark text green token.

Theorems & Definitions (9)

• Lemma 8.1: Bound on Self-Information Shift
• proof
• Lemma 8.2: Concentration in High Self-Information Region
• proof
• Definition 8.3: Attack Success
• Theorem 8.4: Attack Success Probability Bounds
• proof
• Corollary 8.5: Optimal Threshold under Random Watermarking
• proof