Optimizing Adaptive Attacks against Watermarks for Language Models
Authors: Abdulrahman Diaa
Toluwani Aremu
Nils Lukas
Venue: ICML 2025 spotlightposter (2025)
Keywords: watermarking
language models
robustness
adaptive attacks
Primary area: social_aspects->safety
TL;DR: We propose methods to optimize adaptive attacks against content watermarks for language models and demonstrate the necessity to test robustness against adaptive attacks.a

Abstract: Large Language Models (LLMs) can be misused to spread unwanted content at scale. Content watermarking deters misuse by hiding messages in content, enabling its detection using a secret *watermarking key*. Robustness is a core security property, stating that evading detection requires (significant) degradation of the content's quality. Many LLM watermarking methods have been proposed, but robustness is tested only against *non-adaptive* attackers who lack knowledge of the watermarking method and can find only suboptimal attacks. We formulate watermark robustness as an objective function and use preference-based optimization to tune *adaptive* attacks against the specific watermarking method. Our evaluation shows that (i) adaptive attacks evade detection against all surveyed watermarks, (ii) training against *any* watermark succeeds in evading unseen watermarks, and (iii) optimization-based attacks are cost-effective. Our findings underscore the need to test robustness against adaptively tuned attacks. We release our adaptively tuned paraphrasers at <https://github.com/nilslukas/ada-wm-evasion>.

Optimizing Adaptive Attacks against Watermarks for Language Models
Abdulrahman Diaa
Toluwani Aremu?
Nils Lukas
Abstract
Secrai key P
Provider's IIM
KeyGen
Generate
Foosion Tixt Time
Verily
Large Language Models (LLMs) can be misused to spread unwanted content at scale. Content wa- termarking deters misuse by hiding messages in content, enabling its detection using secret wa- termarking key. Robustness is core security property, stating that evading detection requires (significant) degradation of the content's 's quality. Many L.LM watermarking methods have been pro- posed, but robustness is tested only against non- adaptive attackers who lack knowledge of the wa- termarking method and can find only suboptimal attacks. We formulate watermark robustness an objective function and use preference- baadee opti- mization to tune adaptive attacks against the spe- cific watermarking method. Our evaluation shows that (i) adaptive attacks evade detection against all surveyed watermarks, (ii) training against any watermark succeeds in evading unseen water- marks, and (iii) apiimization-basee attacks are cost-effective. Our findings underscore the need to test robustness against adaptively tuned attacks. We release our adaptively tuned paraphrasers at https: /gtthbb.. com/ ni milslukas ada wwm-evasion
Provider Adversary
Swcret key
Unitomm Rondom
Sumogate
Samal
Surregate
Generate
Surrogate key
KeyGen
Paraphrase
Verify
Generate
Suroggate N
Jpclat Paraphraser to Impross Fosssoo Rate
Maxinium Expected Froes Ratee poer kurtogeee kays
Figure 1: Adaptive attackers know the watermarking algo- rithms (KEYGEN, VERIFY), but not the secret key, so they can optimize a paraphraser against a specific watermark.
Content watermarking enables the detection generated outputs by embedding hidden messages that can be extracted with a secret watermarking key. Some L.LM providers, such as DeepMind (2024) and Meta (San Roman et al., 2024), have already deployed watermarking to promote the ethical use of their models. A threat to these providers are users who perturb generated text to evade watermark detection while preserving text quality. Such undetectable, generated text could further crode trust in the authenticity of digital media (Federal Register, 2023).
A core security property of watermarking is robustness, which requires that evading detection is only possible by sig- nificantly degrading text quality. Testing robustness requires identifying the most effective attack against specific wa- termarking method. However, existing content watermarks for LLMs (Kirchenbauer et al., 2023a; Aaronson & Kirch- ner, 2023; Christ et al., 2023; Kuditipudi al., 2024) test robustness only against non-adaptive attackers, who lack knowledge of the watermarking algorithms. This reliance obscurity makes watermarking vulnerable to adaptive attacks (Lukas et al., 2024: Jovanović et al., 2024) when information about the watermarking algorithms is leaked.
1. Introduction
A few Large Language Model (LLM) providers empower many users to generate human-quality text at scale, raising concerns about dual use (Barrett al., 2023). Untrustwor- thy users misuse the provided LLMS to generate harmful content, such online spam (Weidinger et al., 2021), mis- information (Chen & Shu, 2024), or to facilitate phishing attacks (Shoaib et al., 2023). The ability to detect generated text can control these risks (Grinbaum & Adomaitis, 2022).
We propose a method to curate preference datasets and adaptively optimize an attack against known content water- marking algorithms. Optimization is challenging due (i) the complexity of optimizing within the discrete textual do- main and (ii) the limited computational resources available to attackers. We demonstrate that adaptively tuned, open- weight LLMSs such as L 2lamm-77 (Touvron et al., 2023) evade detection at negligible impact on text quality against I,l ama 1-70b (Dubey et al., 2024). Our attacker spends
'David R. Cheriton School of Computer Science, University of Waterloo, Ontario, Canada *Mohammed Bin Zayed University of Artificial Intelligence (MBZUAD), Abu Dhabi, UAE Correspon- dence to: AbduIrahman Diaa cabdulrahman. diaa uwaterloo.caz. Nils Lukas <nils. lukas @ ac.au
Proceedings of the ndnd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Optimizing Adaptive Attacks against Watermarks for Language Models
less than 7 GPU hours to achieve an evasion rate of over 96% against any of the surveyed watermarking methods with neg- ligible impact on text quality. Our attacks are Pareto optimal, even in the non -daapiite setting where they must transfer to unseen watermarks. Hence, future watermarking methods must consider our attacks to test robustness.
ing key and message m, this function returns parameters 0* of watermarked LLM that generates watermarked text.
1 f- VERIFY(I, 7, m): Detection involves (i) extract- ing a message m' from text z using and (ii) caleulat- ing the p-value r) for rejecting the null hypothesis that m and m' match by chance.
We make the following contributions. (1) We propose meth- ods curate preference- datasets using LLMs, en- abling to adaptively fine-tune watermark evasion attacks against state-of-the-ard language watermarks. (2) Adaptively tuned paraphrasers with 0.5-7 billion parameters evade de- tection from all tested watermarks at negligible impact on text quality. We demonstrate their Pareto optimality for eva- sion rates greater than 90%!. Optimization against models with 46x more parameters requires less than seven GPU hours, which challenges security assumptions, as even ad- versaries with limited resources can reliably evade detection using our attacks. (3) We test our attacks in the non-adap- tive setting against unseen watermarks and demonstrate that they remain Pareto optimal compared to other non-adaptive attacks. Our results underscore the necessity of using opti- mizable, adaptive attacks to test robustness. (4) We publicly release our adaptively tuned paraphrasers to facilitate further research robustness against adaptive attackers.
(e, 6) Robuutttsss A text watermark is hidden signal in text that can be mapped to message m E M using a secret watermarking key т. The key T refers to secret random bits of information used for detecting a watermark. A watermark is retained if VERIFY outputs 1j < P. for P R Let Q: V* x X + R be a function to measure text quality between pairs of texts. We say that a watermark is (e, 6) - if any paraphrase y = A(z) of a watermarked text x that remains high-quality (i.e., Q(z, > 8) also retains the watermark with probability 2 - e. Let A be a randomized paraphrasing method, then robustness can be stated as follows.
Pr (, 2 P Q(I, 9) > 06 <e (1) A/+A(a))
Evasion Attacks. Watermark evasion attacks are catego- rized by the attacker's access to the provider's 's (i) LLM, (ii) detection algorithm VERIFY that uses the provider's 's secret watermarking key, and (iii) knowledge of the watermarking algorithms. A no-box attacker has no access the provider's s LLM,, whereas black-box attackers have API access, and white-box attackers know the parameters of the provider's LLM. Online attackers can query the provider's 's VERIFY functionality, as opposed to offine attackers who have no such access. Adaptive attackers know the algorithmic de- scriptions (KEYGEN, EMBED, VERIFY) of the provider's watermarking method, while non non-adaptive attackers lack this knowledge. Our work focuses on no-box, offline attacks in adaptive and non-adaptive settings.
2. Background
Large Language Models (LLMs) estimate the probability distribution of the next token over a vocabulary V given sequence of tokens. Autoregressive L.LMs predict each subsequent token based all preceding tokens. Formally, for a sequence of tokens ,I,..., In. an LLM models:
P(xn
= (fftmax(fo(z))............ Tn-
where fo is a neural network with parameters 0. Optimizing LLMs to maximize a reward function is challenging because the text is discrete, and the autoregressive generation process prevents direct backpropagation through the token sampling steps (Schulman al., 2017).
Surveyed Watermarking Methods. Following (Pict et al., 2023), we evaluate the robustness of four state-of-the-art watermarking methods The Exp (Aaronson & Kirchner, 2023) method marks text by selecting tokens that maxi- mize score combining the conditional probability P(z,, 2e ... Fx-1) and a pseudorandom value derived from a slid- ing window of prior tokens. The Dist-Shiff ft (Kirchen- bauer et al., 2023a) method favours tokens from green list, which is generated based on pseudorandom values and biases their logits to increase their selection probability. The Bi Binary (Christ et al., 2023) approach converts tokens into bit-strings determined by pseudorandom values and
LLM Content Watermarking hides message in gener- ated content that can later be extracted with access to the content using secret watermarking key. A watermarking method, as formalized by (Lukas et al., 2024), comprises a set of algorithms (KEYGEN, EMBED, VERIFY);
T + KEYGEN(O, 7): A randomized function to gener- ate a watermarking key given secret (i) LLM param- eters and (ii) random seeds y E IR.
8* f EM 7, m): Given LLM 6, watermark-
EMBBED can modify the entire inference process. 'In Section A.4, we evaluate against more watermarks includ- ing SynthID (Dathathri al., 2024), Unigram (Zhao et al., 2024) and SIR (Liu et al., 2024).
'Closed models such GPT-4o also on the Pareto front (due to high text quality) but achieve lower evasion rates.
2

---

Optimizing Adaptive Attacks against Watermarks for Language Models
the language model's bit distribution, subsequently trans- lating the bit-string back into token sequence. Lastly, the Inverse (Kuditipudi et al., 2024) scheme uses inverse transform sampling by computing a cumulative distribution function ordered pseudorandomly according to a secret key and using a fixed pseudorandom value to sample from this distribution. We refer to (Piet et al., 2023) for more details.
Our motivation is to evaluate the robustness of watermark- ing against constrained attackers that (i) have limited re- sources and (ii) lack any information about the watermark- ing key and samples. If successful attacks exist in this pessimistic no-box setting, the provider cannot hope to have a robust watermark against more capable attackers (e.g., with black-box access). We show that (i) such attacks exist, (ii) they are inexpensive, and (iii) they do not require access to watermarked samples. We believe the development of defenses should focus on the no-box setting first.
3. Threat Model
We consider provider capable of training LLMs and de- ploying them to many users via a black-box API, such as Google with Gemini or OpenAl with ChatGPT. The threat to the provider are untrustworthy users who misuse the pro- vided LLM and generate harmful content without detection.
4. Related Work
We evaluate the robustness of content watermarking (Lukas & Kerschbaum, 2023) methods against no-box, offline at- tackers in the adaptive and non-adaptive settings (see Sec- tion 2). Other watermark evasion attacks, including those by Hu et al. (2024), Kassis & Hengartner (2024), and Lukas et al. (2024), focus on the image domain, whereas our work focuses on LLMs. Jovanović et al. (2024); Pang et al. (2024) propose black-box attacks against LLMs that require collect- ing many watermarked samples under the same key- key-message pair. We focus on no-box attacks. Jiang et al. (2023) pro- pose online attacks with access the provider's watermark verification, whereas we focus on less capable offline at- tacker who cannot verify the presence of the provider's watermark. Current attacks are either non-adaptive, such as DIPPER (Krishna et al., 2023) or handcrafted against one watermark (Jovanović et al., 2024). We focus on optimiz- able, adaptive attacks and show that they remain effective in the non-adaptive setting.
Provider's Capabilities and Goals (Deployment) The provider fully controls the LLM and its text generation process, including the ability to embed a watermark into generated text. (Watermark Verification) The provider must be able to verify their content watermark in each generated text. Their goal is to have a watermark that is (i) quality- preserving and (ii) robust, enabling detection of generated text at a given, low False Positive Rate (FPR) p E R+
Attacker's Capabilities. (Access Restrictions) We consider a (i) no-box attacker who cannot collect any watermarked texts during training and is (ii) offlin,, meaning that they cannot access the provider's VERIFY function. Our focus is on (iii) adaptive attackers, who know the provider's wa- termark algorithms (KEYGEN, EMBED, VerIFY) but do not know the secret inputs used for watermarking, such as random seeds or the provider's s LLM. We also evaluate how adaptive attacks transfer in the non-adaptive setting against unseen watermarks. (Surrogate Models) A surrogate model is a model trained for the same task as the provider's model. For example, while GPT-4o's 's weights are not public, the attacker can access the parameters of smaller, publicly avail- able models such as those from the L1 ama2 (Touvron et al., 2023) model family. Our attacker can use such open-weight surrogate models for paraphrasing text. We assume the sur- rogate model's text quality is inferior to the provided model; otherwise, there would be no need to use the watermarked model. (Compute) Our attacker has limited computational resources and cannot train LLMs from scratch.
Zhang et al. (2024) demonstrated the impossibility of ro- bust watermarking against attackers with access to quality and perturbation oracles, showing that random walks with the perturbation oracle provably removes watermarks. Our approach differs in that adaptively optimizes to find a single-step perturbation for evading watermark detection. We demonstrate the feasibility and efficiency of our attacks, achieving watermark evasion at low computational cost (USD < 10S).
5. Conceptual Approach
Our goal is to adaptively fine-tune an open-weight para- phraser Op against known watermarking methods. The at- tacker lacks knowledge of the provider's 's watermarking key T <- KEYGEN((, 7), which depends on (i) the unknown random seed y and (ii) the unknown parameters 6 of the provider's L.M.. Our attacker overcomes this uncertainty by choosing an wpen-weight surrogate model Og to generate so-called surrogate watermarking keys 7' and optimizes the expected evasion rate over many random seeds y ~ IR.
Attacker's Goals. The attacker wants to use the provided, watermarked LLM to generate text (i) without a watermark and (ii) with high quality. We measure text quality using many metrics, including a quality function Q : 1* x V + R between pairs of text when the attacker attempts to evade detection. We require that the provider correctly verifies their watermark with a given p-value threshold at most p. Lower thresholds make evasion more likely to succeed, i.e., detection becomes more challenging for the provider.
3

---

Optimizing Adaptive Attacks against Watermarks for Language Models
5.1. Robustness as an Objective Function
Algorithm I curates a preference dataset to optimize the
adaptive attack's objective in Equation (2).
Let Pa V= + V denote randomized paraphrasing function", Hg V V" is function generate text given query q T S V* and Q V** x XV* + IR measures the similarity between pairs of text. We formulate robustness using the objective function in Equation (2) that optimizes the parameters P of a paraphrasing model.
Require: Surrogate 0s, Paraphraser 0p. Queries T, Mes- sages M, Paraphrase Repetition Rate N, False Positive Rate Threshold p. Quality Threshold ò
1: D t @ II The preference dataset
2: |/ Sample from known watermarking methods W
for (KEYGEN, EMBED, VErIfY) E W do
4: for each g E T do MM
5:
6: T' < KEYGEN(Bs, RND(()
max Up
E
R q~²
E
r' KEYGEN(03,
7:
03 + EMBED(Bs.
0g + (0
8:
+ So (o)(g) 1/ Watermarked text under T² If watermark can be detected
(0)
9:
x' P(Br.z))
10:
if VERIFY T', m)) < p then
r', Q(1',
11:
II Rejected (0) and Chosen (1) paraphrases
12:
R R x 0. for i E [N] do
13:
14:
r' + Pop(r) (r) // Paraphrase (randomized)
15:
a - [[((r, 205
Equation (2) finds optimal parameters for the paraphraser 0y by sampling uniformly at random over (i) random seeds
16:
b - [[VERIPY(T' , > pl
17:
R² < R Ur'}
y R, (ii) messages m'' .M and (iii) queries q T. The second expectation is taken over surrogate watermarking
18:
end for for
19:
[[]|]] do
key, generated using knowledge of the KEYGEN algorithm, the surrogate model's parameters 8g and a (previously sam- pled) random seed y as input. The surrogate model, key, and message are used to embed watermark into the surrogate model 0' (with knowledge of EMBED), which generates watermarked sample The optimization process finds optimal parameters 0% such that the paraphraser has high probability of generating text + P(Op, x) that evades watermark detection and preserves text quality compared to x. Note that knowledge of the watermarking algorithms (KEYGEN, EMBED, VERIFY) is required generate surro- gate keys needed optimize Equation (2).
20:
r + (j S [R R2 :r
21:
D ((, R2)} II Match pairwise
22:
end for
23: end if
24: end for
25: end for
26: return DI/ The preference dataset
5.2. Preference Dataset Curation
We use reinforcement learning (RL) methods such Direct Preference Optimization (DPO) (Rafailov et al., 2024) to optimize Equation (2). However, DPO requires collecting preference dataset of positive and negative examples to fine-tune the paraphraser. A negative sample one that retains the watermark, representing failed attempt at termark evasion. In contrast, positive samples do not retain watermark and have high text quality Q(r, > 8 for an ettacker-chssen 8 E F To bootstrap optimization, we require the ability to curate positive and negative exam- ples, which we achieve by using a publicly available, open- weight paraphrasers such as Llama2-7b. We curate triplets (r, The r via best-of-N rejection sampling. These triplets contain watermarked sample and two paraphrased ver- sions, r', and r'y. representing the negative and positive ex- amples, respectively. Algorithm implements the algorithm to curate our preference dataset.
Optimization presents multiple challenges. The attacker optimizes over different random seeds and a surrogate model Os than those used by the provider, since our attacker does not know the provider's model parameters or ran- dom seeds. This lack of knowledge adds uncertainty for the attacker. The discrete nature of text and the inability back- propagate through its generation process make maximizing the reward challenging (Shin al., 2020). Furthermore, the reward function depends on VERIFY which may not be differentiable. Deep reinforcement learning (RI.) meth- ods (Schulman et al., 2017; Rafailov et al., 2024) do not require differentiable reward functions. However, RL is known to be compute-intensiv and unstable, making un- clear whether optimization achieve high reward using limited computational resources.
We consider language models paraphrasers, where random- ness arises from sampling the next token.
Algorithm randomly samples from a set of known wa- termarking methods W (line 3) and from the set of task-

---

Optimizing Adaptive Attacks against Watermarks for Language Models
specific queries T (line 4). It samples message m (line
Non-Adaptive Paraphrasing With PValue 0.1
5) and generates a surrogate watermarking key r' embed watermark into the surrogate generator (lines 6-7). We generate text using the watermarked model 83 (line 8) and verify whether it retains the watermark (line 9). The paraphrase model 0p generates N paraphrased versions of r that we partition into positive and negative samples (lines 13-17). A sample r is positive (b = if it does not retain the watermark and has high text quality (2 8); otherwise, it is negative (r/g b- 0). For each positive sample, we select one corresponding negative sample and add the wa- termarked text and the negative and positive paraphrases to the preference dataset D (lines 19-21).
0.9
0.8
Evanion Rate
0.6
0.5
Exp
0.3
Inverse
Binary
0.2-
Dist Shift
12
14
16
6. Evaluation
Number of Paraphrases
We report all runtimes on NVIDIA A100 GPUs accelerated using VLLMM (Kwon et al., 2023) for inference and Deep- Speed (Microsoft, 2021) for training. Our implementation uses PyTorch and the Transformer Reinforcement Learning (TRL) library (von Werra et al., 2020). We use the open- source repository by Piet et al. (2023), which implements the four surveyed watermarking methods. We test robust- ness using hyper- parameparaeeters suggested by (Piet et al., 2023). Please refer to Section A.8 for details on hyperparameter selection and generalizability of our attacks against range of hyperparameters. All LLMs used in our evaluations have been instruction-une -ittrcctiiottundd... A detailed description of our attack setup, including prompting strategies and training hyperpa- rameters, available in Section A.9. Table summarizes other surveyed evasion attacks.
Figure 2: Algorithm 1 paraphrases text N times in lines 13-17. This graph shows the expected evasion rate of the best sample (lines 15-17) for the number of paraphrases using vanilla Llama2 77 as the paraphraser.
take approximately 1.5 GPU hours for Dist Shist-Shifi Et, but only 0.5 GPU hours for Inverse. In practice, including the overhead of evaluating quality and detecting watermarks, we require less than GPU hours to curate 7 700 samples for Dist-Sh Et. At current AWS rates, an attacker who uses our attacks faces only negligible costs of less than $10 USD curate preference dataset containing 7 700 sam- ples and fine-tune the paraphraser. Further details on the curation of the prompt sets used for training and evaluation are provided in Section A.2.
6.1. Preference Dataset Collection
For given watermarked sequence generated by the surro- gate model, the attacker generates N paraphrased versions using the non-optimized paraphraser and calculates the best- of-N evasion rate with the surrogate key (Algorithm 1, lines 9-12). Figure 2 shows the number of repetitions needed to achieve a given evasion rate across four watermarking methods using Llama 7b as both the surrogate and para- phrasing model. Our attacker can choose the best-of-N paraphrases because they know the surrogate watermarking key to detect watermark. The attacker cannot choose the best-of-N paraphrases against the provider's watermarked text, as they lack access to the provider's ' key.
6.2. Ablation Studies
In our experiments, we ablate over the following settings.
(1) Adaptivity: (Adaptive) The same watermarking method is used for training and testing. (Non-adaptive) The attack is tested against unseen watermarking methods., (2) Tar- get Models: We evaluate 2 models used by the provider: Ll a Llama3 1-70bb., (3) Attacker's Mod- els: Our attacker matches surrogate and paraphrasing mod- els. We consider Llama2 (Touvron et al., 2023) and Qwen2.5 (Qwen, 2024) from 0.5b to 7 parameters., (4) Watermarking Methods: Exp (Aaronson & Kirch- ner, 2023), Dist-Shif ft (Kirchenbauer et al., 2023b), Inverse (Kuditipudi et al., 2024), Binary (Christ et al., 2023)., (5) Hyper-Parameters: We ablate over multiple hy- per-parameters that provider can choose (see Section A.8)., and (6) False Positive Rates (FPR): Section A.10 10 ablates over E {0.01, 0.025, 0.05, 0.075, 0.1} when the provider can tolerate higher FPR thresholds for detection.
Figure 2 shows the success rate of observing at least one pos- itive sample after N paraphrases against methods designed for robustness (Inverse, Binary). The attacker requires limited com- putational resourees to curate large preference dataset against any of the four surveyed watermarks. For instance, to collect DD 7 000 preference samples, each of = 512 tokens, at a rate of 800 tokens/second, we expect this to
Shift, Exp) and undetectability
A watermark has been retained if the null hypothesis that
5

---

(2) Non-adaptive model-based paraphrasing attacks such as using vanilla I. amaa or ChatGPT3 5 models have a substantially higher evasion rate of 61.8% up to 86. 86.1% respectively. Tuning L1ama2-7b using ap- proach in the non-adaptive setting improves the evasion rate substantially to 90.9% (when trained on Binary) and up to 97.6% (when trained on Inverse). These non-adap- tive, optimized attacks have a paraphrased text quality of 0.853 and 0.845, slightly improving over ChetGPT3. 5, rated only 0.837., and (3) In the adaptive setting, our fine-tuned Owen2.5-777 achieves an evasion rate of 97.3% at the highest text quality of 0,846 compared to Optimizing Adaptive Attacks against Watermarks for Language Models
Attack Name
Description
DIPPER (Krishna et al., 2023)
Train an 1lb Srquence-to-Sqqueee model for paraphrasing. Translate to another language and back (c.g. French, Russian).
Translate (Pict et al., 2023)
Swap (Piet et al., 2023)
Randomly remove, add or swap words.
Synonym (Piet et al., 2023)
Replace words with a synonym using WordNet (Miller, 1995).
HELM (Bommasani et al., 2023)
Randomly add typos, lowercase contractions.
Llama, Qwen2.5,, GPT3.5
Paraphrase text using a publicly accessible LLM.
Ours-L1ama2- 7b-8xp
Paraphrase with L1 alamm2---- 7b model tuned adaptively against Exp.
Table I: (Top) The non-adaptive baseline attacks we consider in our study against (Bottom) our adaptively fine-tuned attacks. We refer to (Piet et al., 2023) for details on the baseline attacks and Section A.9 for our adaptive attack.
the watermark is not present in the content can be rejected with given p-value specified by the provider. The evasion rate is calculated as the fraction of watermarked text that does not retain the watermark after applying the paraphras- ing attack. Due to the lack of a gold-standard metric to assess text quality, we measure quality with multiple met- rics: LLM-Judge, LLM-CoT, and LLM-Compare from Piet et al. (2023), Mauve (Pillutla et al., 2021), and Perplexity (PPL.) with 1.1ama3-88 IIBB--nntuuuuu we only report the LLM-Judge metric in the main paper following Piet et al. (2023). Full descriptions of all qual- ity metrics are provided in Section A.I. Unless otherwise specified, we use a p-value threshold of p = 0.01.
To enhance clarity,
By ablating over Qwen2.5 5 between 0.5b and 7b parame- ters, we find that attackers can strictly improve paraphrased text quality at similar evasion rates by using more capable paraphrases with more parameters. Figure 16 in the Ap- pendix shows results against L.l 11lam221133 target model, which are consistent with those against Llama Ob. Against smaller target models, attackers can achieve higher evasion rates and text quality ratings.
6.3. Experimental Results
Adaptivity. Figure 3 shows the evasion rate and text quality of our methods trained in the adaptive and non-adaptive set- tings when the provider uses L 2lama2-1 -bbb and the attacker uses L1ama2-7b. We find that all adaptive attacks have an evasion rate of at least 96.6%, while the non-adaptive at- tacks have an evasion rate of least 94.3%. We achieve the highest overall evasion rate when training against the Exp watermark, which achieves an evasion rate of at least 97.0%. We train one attack, denoted A1l, against all four surveyed watermarking methods and test it against each watermark separately. Interestingly, A performs slightly worse com- pared to training only on Exp, exhibiting an evasion rate of least 96.3% and lower paraphrased text quality of at least 0.893 (versus 0.901 when training only on Exp). In summary, Figure 3 shows that adaptive attacks trained against one watermark remain highly effective when tested against unseen watermarks in the non non-adaptive setting.
Text Quality. Table shows (i) a watermarked text sam- ple generated using Llama2-13b with Dist-Shift, (ii) paraphrased text using non-optimized I.1 2-a model, and (iii) paraphrased text obtained with adaptively tuned Llama2-75 model using our attack. We observe that all paraphrased texts preserve quality, but our attack achieves the lowest green-to-red token ratio (i.e., maximizes the evasion rate). Table 3 in the Appendix shows a quanti- tative analysis of the median quality of generated text for vanilla L1 alamm22 - 7o model compared to our best adap- tive and non-adaptive attacks. It shows that text quality is preserved across five text quality metrics when using our attacks. We only show one paragraph of generated text that we truncated due to space restrictions and Tables 5 and 6 in the Appendix show non- trunccuce samples. Table 6 shows a rare, cherrypicked example where our attack fails at evading watermark detection after paraphrasing.
Model Sizes. Figure 4 shows the Pareto front against the Exp watermark with a L ama 3 1-70b target model. Our attacker uses paraphraser models with most 7b parameters, which is less than the 1 llb DIPPER model (Krishna et al., 2023) currently used to test robustness.
We observe that (I) Non-adaptive baseline attacks such as Contraction, Swapping and Synonym replacements are ineffective and have a low evasion rate of less than 20%.,
Adaptive vs Non-adaptive. Figure 5 shows two results to compare the non-optimized 2-7b 7b with our adap-
6

---

Optimizing Adaptive Attacks against Watermarks for Language Models
1,00
Exp Dist-Shif
0.973
0.970
0.943
0.980
0.983
0,904
0.903
0,902
0.889
0.893
Tested on Watermarks Binary
0.99
Tested on Watermarks Binary
Exp
0.956
0.980
0.973
0.986
0.963
0.900
0.901
0.903
0.887
0.901
00.9
Parpprox Qwaltty
Pale
0.97
-0.89
0.986
0.990
0.966
0.983
0.970
0.898
0.901
0.902
0.882
0.893
0.98
Inverse:
Inverse
1.000
1,000
1.000
1.000
1.000
0.95
0.899
0.902
0.903
0.889
0.893
0.85
Dist-Shift
EXP
Binary Inverse
Dist-Shift
EXP
Binary Inverse
Trained on Watermarks
Trained on Watermarks
Figure 3: The evasion rates (Left) and text quality measured with LLM-Judge (Right). The attacker uses matching Llama2-1 b surrogate and paraphraser model versus the provider's L1 ama2 - 13b. Results for adaptive attacks are on the diagonal. For example, we obtain the bottom left value by training on Dist -esstSthi Shi and testing on Inverse.
0.8
Paraphrase Quality
0.7
Ours Oween 0.50
Category
Our Uamaz 7b Distshit Exp
Ours Uama2 7b Biga
Outs
amaz Ours Swit BAD
Out (Nan-Adaptive
0.6-
centraction
Mi
0.2
Swen
Liama
Nisspellng
None
Misgneling_0.3
Paraphrase
Ours Gwen 1.50 Exp
Typs 0.05
Swap
Synonym
Thanslate
Type
Evasion Rate f
Figure 4: Adaptive attacks Pareto-optimal. We show the evasion rate versus text quality trade-off against the Exp (Aaron- son & Kirchner, 2023) watermark, corresponding to (c, -robustessss from Eq. 1. The provider uses Llama3. 1 0b model, whereas our attacker's models are up to 46x smaller. Non-adaptive attacks are marked by circles (O), adaptive attacks by squares (D). Notation "Ours Qwen-neee 3b-Exp" means that we evaluate our attack using a Qwen2. 5-3b model that was adaptively optimized against the Exp watermark.
tively tuned 2- model. The result on the left plots the cumulative density of p-values. Our method strictly im- proves over the non-optimized model as it generates para- phrased text with higher mean p-values for watermark de- tection. The result on the right plots the expected p-value against the token length. The watermarked text has median p-value less than 0.01 after approximately 170 tokens, whereas the con-oppimized L1 amam22-75 model has an ex- pected p-value of 0.10 around 500 tokens compared to expected p-value of 0.4 for our adaptively tuned model.
optimal and outperform much larger, closed-source systems such GPT-4o at evading watermark detection. We kindly refer the reader Section A.4 for more baseline tests, Sec- tion A.5 for further statistical insights, and Section A.6 for analysis of the impact of paraphrasing on the top-50 token distribution.
7. Discussion
Effectiveness of Adaptive Attacks. Our work demonstrates that content watermarking methods for LLMs are vulner- able to adaptively optimized attacks. Attackers can adap- tively fine-tune relatively small open-weight models, such as Llama2-7b (Touvron et al., 2023), less than seven GPU hours to evade watermark detection from larger and
Additional Testing. We present more results to compare adaptive versus non-adaptive attacks in Section A.4, in- cluding tests against other recently released watermarking methods. These results are consistent with our findings the main part of the paper that adaptive attacks are Pareto

---

Optimizing Adaptive Attacks against Watermarks for Language Models
11lama2-3bb-Dise ft
Llama2-27
ft Spain has been blessed with a literary treasure that has captivated readers for over four centuries in the form of Miguel de Cervantes" immortal masterpiece. "Don Quixote" This timeless tome weaves a hilarious and poignant tale of man con- sumed by the chivalrous stories of his youth, who renames himself Don Quixote and sets forth on journey filled with mo- ments of satire and a piercing examina- tion of the human condition. As Don Quixote and his trusty squire Sancho Panza traverse rural Spain, they encounter vari- ous unsuspecting villagers, mistaking them for knights, maidens in distress, bandits, and even giants.
Dars--ilama2-7b-DDist
Cervantes' "Don Quixote" " is a ground- breaking masterpiece of literature that has enthralled readers for over 400 years. The novel tells the story of Alonso Quixano, old man who hecomes so consumed by the chivalrous tales of his day that he renames himself Don Quixote and embarks upon an adventurous journey filled with hu- mor, satire, and timeless themes about the human condition, (-2 The story fol- lows Quixote and his trustworthy sidekick Sancho Panza, a simple and pragmatic squire who provides moments of humor and contrast to the lofty ideals of the delu- sional Quixano/Don Quixote. Their travels rural Spain lead them encounter all sorts of people they mistake for knights, ladies in distress, bandits, and giants who are in fact ordinary villagers going about their everyday lives.
"Don Quixote" " is groundbreaking master- piece of literature that has captivated read- ers for over 400 years. The novel tells the story of Alonso Quixano, an elderly man whose fixation on chivalrous tales leads him to change name to Don Quixote and embark on thrilling adventure replete with humor, satire, and timeless themes concerning the human condition, +-( The narrative follows Don Quixote and his loyal squire Sancho Panse, a practical and good natured individual who provides mo- ments of levity and contrast the lofty ide- als of the delusional Quixano/Don Quixote.
Their travels across rural Spain result in encounters with various people who they misidentify as knights, distressed ladies, handits, and ordinary villagers going about their daily lives.
163 green and 36 red
125 green and 69 red
81 green and 78 red
Table 2: (Left) Watermarked text from the provider's s L I1 amam2- -13b model, (Center) a paraphrased version from a vanilla Llama2-7b model, and (Right) paraphrased text using our adaptively tuned Llama2-7b model. Green/red indicates whether a token is watermarked. A lower green-to-red token ratio implies higher evasion rate. Due to space constraints, we only show truncated texts. Tables and in the Appendix show entire samples with up to 512 tokens.
more capable models, such Llama3 1-70b (Dubey et al., 2024). Our attacks remain effective even in the non- adaptive setting when testing with unseen watermarking methods. Our findings challenge the robustness claims of existing watermarking methods, and we propose improved methods to test robustness using adaptive attacks.
Attack Runtime. Our attacks involve two steps: Dataset Curation and Model Optimization. Curating 7 700 samples requires less than 5 GPU hours, and model optimization re- quires only approximately 2 GPU hours for Ll 2m 10222-77 7b model at 16-bit precision. These attacks can be executed with limited computational resources and cost less than $10 USD with current on-demand GPU pricing.
Analysis. Studying why adaptive attacks work is challeng- ing due to the non-interpretabiliity of the optimization pro- cess. The ability to maximize Equation (2) implies the ability to evade detection since Equation (2) encodes ro- bustness for any watermarking method. The effectiveness of non-adaptive attacks could be explained by the fact that all surveyed watermarks are similar in that they operate on the token level. Hence, an effective attack against one watermark likely generalizes other unseen watermarks. Adaptive attacks further improve effectiveness there are at least three learnable signals for paraphrasing watermarked text: (I) Avoid repeating token sequences, as they likely contain the watermark; (2) find text replacements with low impact on text quality to maximize the evasion rate (e.g., uncommon words or sentence structures); and (3) calibrate the minimum token edit distance and lexical diversity that, on average (over the randomness of the key generation pro- cess), evades detection. We refer to Section A.7 for a more detailed analysis of our approach's 's effectiveness.
Restricted Attackers. Zhang al. (2024) show that strong watermarking, which resists any attack, is provably impos- sible under certain conditions. Our work instead focuses on robustness against restricted attackers with limited capa- bilities, such as limited compute resources, and we study whether robustness can be achieved in this setting. We show that current watermarks do not achieve robustness, and that even restricted attackers can evade detection at low costs.
Online Attacks. Our work focuses offline attacks that do not require any access to the provider's 's watermark detection funetionality. Offline attacks evaluate the robustness of a watermark without any information about the secret key generated by the provider. An online attacker can learn in- formation about the provider's secret key through accessing Verify, which reduces the attack's 's uncertainty and could substantially improve the attack's effectiveness further.
Limitations. Our study also did not focus on evaluating
8

---

Optimizing Adaptive Attacks against Watermarks for Language Models
1.0
Median P-value (log scale)
Cumulative Density
100
0.8
0.6
10-1_
0.4
Dist-Shift
10-2
DistShiitt
0.2
Llama-2-7b
Llama2-70
Ours-Llama-27lo-iissshhii
Ours-Llama-277--Dist---
Threshold (0.01)
0.0
10
0.0
0.2
0.4
0.6
0.8
1.0
100
200
300
400
P-value
Token Length
Figure 5: (Left) The cumulative density of p-values on the Dist-Shi ft watermark (green), a vanilla Ll ama 2 paraphraser (blue) and our adaptive Llama2- 7b paraphraser (red). (Right) The median p-value relative to the text token length with threshold of p 0.01 (dashed line).
adaptive defences that could be designed against adap- tive attacks. Adaptive defences have not yet been explored, and we advocate studying their effectiveness. We believe our optimizable, adaptive attacks will enhance the robust- ness of future watermarking methods by including them in their design process, for instance, by using adversarial train- ing. We focused exclusively on text generation tasks and did not explore other domains, such as source code generation question-answwe answering systems, where different text quality metrics may be used to evaluate an attack's 's success. We did not consider the interplay between watermarking and other defenses, such as safety alignment or content filtering, which could collectively control misuse.
Impact Statement
This work investigates the robustness of watermarking meth- ods for large language models (LLMs), which has impli- cations for content authentication and the responsible de- ployment of AI systems. Our findings demonstrate that at- tackers with limited computational resources can undermine the robustness of current watermarking methods by using adaptively optimized attacks. This vulnerability could have societal implications as major Al providers increasingly adopt watermarking to promote responsible Al use and con- trol misuse, including the proliferation of LLM-generated misinformation and online spam.
By publicly releasing our methods, findings, and source code, we hope to encourage the development of more robust watermarking methods that can better withstand adaptive attacks (e.g., by increasing the computational complexity of such attacks or making them less effective). We acknowl- edge that our research could potentially be misused to evade existing deployments of watermarks. However, these de- ployments are still in experimental phases. We believe the benefit of releasing our work outweighs the potential harm and hope that our work inspires the development more robust content authentication methods.
We acknowledge that LLM-as-a-Judge an imperfect and noisy metric that may not align with human judgment. In the main part of our paper, use Llama3-8B--a -Ba-ee----ddde, since this metric is easily reproducible. Section A.4 shows which are consistent
results using BPT--4o-mini-as---uue with our findings. More work is needed to study the metric's alignment with human judgment.
8. Conclusion
Our work demonstrates that current LLM watermarking methods are not robust against adaptively optimized attacks. Even resource-constrainge attackers can reliably (2 96.7%) evade detection with computational resource costs of $$10 USD. They can achieve this with open-weight models that are 46x smaller than the provider's model. Even in the non-adaptive settings, our adaptively tuned attacks outper- form all other surveyed attacks, including paraphrasing with substantially larger models such as OpenAl's GPT4o. Our findings challenge the security claims of existing watermark- ing methods and show that they do not hold even against resource-constrince attackers. We suggest that future de- fenses must consider adaptive attackers to robustness.
References
Aaronson, and Kirchner, H. Watermarking gpt outputs, 2023.
Barrett, C., Boyd, B., Bursztein, E., Carlini, N., Chen, B., Choi, J., Chowdhury, A. R., Christodorescu, M., Datta, A., Feizi, S., et Identifying and mitigating the secu- rity risks of generative ai. Foundations and Trendy in Privacy and Security, 6(1):1-52, 2023.
Bommasani, R., Liang, P., and Lee, T. Holistic evaluation

---

Optimizing Adaptive Attacks against Watermarks for Language Models
of language models. Annals the New York Academy of Sciences, 1525(1 (525(1):140-11)) J:140-146, 2023.
Kassis, A. and Hengartner, U. Unmarker: A univer- sal attack defensive watermarking. arXiv preprint arXiv:2405.08363 2024.
Chen, C. and Shu, K. Combating misinformation in the age of lmss: Opportunities and challenges. A/ Magazine, 2024. doi:
Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., and Goldstein, T. A watermark for large language mod- els. In International Conference on Machine Learning, 2023a.
100002/aaai.1188.0 URL https: /doi. org / 100 002/ aaai 12.88.
Christ, M., Gunn, S., and Zamir, O. Undetectable water- marks for language models. IACR Cryptol. ePrint Arch., 2023:763, 2023.
Kirchenbauer, J., Geiping, J., Wen, Y., Shu, M., Saifullah, K., Kong, K., Fernando, K., Saha, A., Goldblum, M., and Goldstein, T. On the reliability of watermarks for large language models. arXiv preprint arXiv:2306.04633 2023b.
Dathathri, S., See, A., Ghaisas, S., Huang, P.-.., McAdam, R., Welbl, J., Bachani, V., Kaskasoli, A., Stanforth, R., Matejovicova, T., et al. Scalable watermarking for identi- fying large language model outputs. Nature, 634(8035): 818-823, 2024.
Krishna, K., Song, Y., Karpinska, M., Wieting, F., and lyyer, M. Paraphrasing evades detectors of Al-generated text, but retrieval is an effective defense. In Thirty-seventts Conference Neural Information Processing Systems, 2023. URL https: /ptp:////eeeeeeeeeeeeoeom ?id-WbEhEvjjK3
DeepMind. Synthid: Identifying synthetic media with ai. google www.nhechooo..o.oc loogies Accessed: 2024-09-15.
www.miioiooooeee..oooooooooooooe /synthid/. 2024.
wetpeeewwwwweeeeeeeeeeeeeeeeeeee net/ forum
Dubey. A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al. The llama herd of models. arXiv preprint arXiv:2407.21788, 2024.
Kuditipudi, R., Thickstun, J., Hashimoto, T., and Liang, P. Robust distortion free watermarks for language models. Transactions on Machine Learming Reseurch, 2024. ISSN 2835-8856. URL https: /tle:://oppoo /ttp///pwwe.e.eeee...eeeeeeeeeee
Federal Register. Safe, secure, and trustworthy development and use of artificial intelligence. https: www. fe deralregister, wttp///cmmmmess///2233333333333
Kwon, W., Li, Z., Zhuang, S., Sheng, Y., Zheng, L., Yu, C. H., Gonzalez, J. E., Zhang, H., and Stoica, I. Efficient memory management for large language model serving with pagedattention. In Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles, 2023.
sectaaaraaa-eeeeeerrreeeeeeedeee 1172023-24288 safe -edure
1-intelligencee 2023. Accessed 4 Nov. 2023.
Grinbaum, A. and Adomaitis, I.. The ethical need for wa- termarks in machine- generrtee language, arXiv preprint AXXiv22009033118 2022.
Liu, A.. Pan, L., Hu, X., Meng, S., and Wen, L. A semantic invariant robust watermark for large language models. The Twelfih International Conference on Learning Representations, 2024. URL https:tpps// /ttp////peeeeeeeeeee .net/forummid-eae 6pM1p..M....
Hu, E. J., yelong shen, Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022. URL https:// http:://pppeeeeeeeeeeeeeee net ?d KeeFyf9.
Lukas, N. and Kerschbaum, Ptw: Pivotal tuning water- marking for pre-trained image generators. 32nd USENIX Security Symposium, 2023.
Hu, Y., Jiang. Z., Guo, M., and Gong, N. Stable signature is unstable: Removing image watermark from diffusion models. arXiv preprint arXiv:2405.077 005 2024.
Lukas, N., Diaa, A., Fenaux, L., and Kerschbaum, F. Leveraging optimization for adaptive attacks image watermarks. In The Twelfth International Conference on Learning Representations, 2024. URL https: / //penreview. net wwret//orummieeee http:/orrummm..00PPPA..eee
Jiang, Z., Zhang, J., and Gong, N. Z. Evading watermark based detection of ai- di-generated content. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp- 1168-1181 2023.
Microsoft. DeepSpeed: Extreme-scale model training for Al. https:/ / www. deepspeed. ai, 2021. Accessed:
Jovanović, N., Staab, R., and Vechev, M. Watermark steal- ing in large language models. In Forty-first International Conference on Machine Learning, 2024. URL ht https: //openrev wwtpeiiwwww...eeeeeeeee wtt.:oormmmmmmm0mm0a00
2024-10-01.
Miller, G. A. Wordnet: a lexical database for english. Com-
munications of the ACM,
1995.
10

---

Optimizing Adaptive Attacks against Watermarks for Language Models
Pan, L.,, Liu, A., He, Z., Gao, Z.,, Zhao, X., Lu, Y., Zhou, B., Liu, S., Hu, X., Wen, L.,, King, I., and Yu, P. S. Mark- LLM: An open-source toolkit for LLM watermarking. In Hernandez Farias, D. I., Hope, T., and Li, M. (eds.), Pro- ceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pp. 61-71, Miami, Florida, USA, November 2024. As- sociation for Computational Linguisties. URL https: //aclanthologeeeeeeeee org. 2024. emn1p-demo.. 7.
Bhosale, S., et al. Llama 2: Open foundation and fine- tuned chat models. arXiv preprint arXiv:2307.09288 2023.
von Werra, L., Belkada, Y., Tunstall, L.., Beeching, E., Thrush, T., Lambert, N., and Huang, Trl: Transformer reinforcement learning. ht https: /ppi:///iit //tpt//ggtbb..t/// t..b..t..com uggingface/trl,, 2020.
Wei, J., Wang, X., Schuurmans, D., Bosma, M., Ichter, B., Xia, F. Chi, Le, Q. and Zhou, D. Chain-of-thought prompting elicits reasoning in large language models, 2023. URL https: arxiv. org/ abs 2201. 1 1903.
Pang, Q. Hu, S., Zheng, W., and Smith, V. No free lunch in Ilm watermarking: Trade-offs in watermarking design choices. In The eight Anmual Conference on Neural Information Processing Systems, 2024.
Weidinger, L., Mellor, J., Rauh, M., Griffin, C., Uesato, J., Huang, P.-S., Cheng, M., Glaese, M., Balle, B., Kasirzadeh, A., et al. Ethical and social risks of harm from language models. arXiv preprint arXiv:2 12..0359, 2021.
Piet, J., Sitawarin, C., Fang, V., Mu, N., and Wagner, D. Mark my words: Analyzing and evaluating language model watermarks. arXiv preprint arXiv:2312.00273, 2023.
Pillutla, K., Swayamdipta, S., Zellers, R., Thickstun, J., Welleck, S., Choi, Y., and Harchaoui, Mauve: Mea- suring the gap between neural text and human text using divergence frontiers, 2021. URL https://arxiv..r g/abb/2102. 01454.
Zhang, H., Edelman, B. L., Francati, D., Venturi, D., Ate- niese, G., and Barak, B. Watermarks in the sand: Impos- sibility of strong watermarking for generative models. In Forty-first International Conference on Machine Learn- ing. 2024.
Qwen, T. Qwen2.5: A party foundation models, Septem- ber 2024. URL https:tt///// http///wwwlmmmmmmmm lelim.gitttt github. io/b Log/qwen2.2
Zhao, X., Ananth, P. V., Li, L.., and Wang, Y.-.. Provable robust watermarking for Al-generated text. In The Twelfth International Conference on Learning Representations, 2024. URL https: hopp//eeeeeeeeeeeeeeeeeeee net/ forum ?id=SamT Ba045L
Rafailov, R., Sharma, A., Mitchell, E., Manning, C., Er- mon, S., and Finn, C. Direct preference optimization: Your language model is secretly a reward model. Ad- vances in Neural Information Processing Systems, 36, 2024.
San Roman, R., Fernandez, Elsahar, H., efossez, A., Furon, T., and Tran, T. Proactive detection of voice cloning with localized watermarking. ICMI,, 2024.
Schulman, J., Wolski, F., Dhariwal, P., Radford, A., and Klimov, O. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06: 06347777,7 2017.
Shin, T., Razeghi, Y., Logan IV, R. L., Wallace, E., and Singh, S. Autoprompt: Eliciting knowledge from lan- guage models with automatically generated prompts. arXiv preprint X1v:20010115903 2020.
Shoaib, M. R., Wang. Z., Ahvanooey, M. T., and Zhao, Deepfakes, misinformation, and disinformation in the era of frontier ai, generative ai, and large ai models. In 2023 International Conference Computer and Applications (ICCA), pp. 1-7. IEEE, 2023.
Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P.

---

Optimizing Adaptive Attacks against Watermarks for Language Models
A. Appendix
A.I. Quality Metrics
Ideally, to evaluate the quality of an LLM-generated text, one would need a set of human evaluators, each giving their own score according to a certain rubric, and then have all the scores aggregated. However, this is impractical for both the attacker and the defender. Therefore, we employ multiple surrogate metries from the literature: LLM-Judge, LLM-CoT, and L.M--Copprr from (Piet al., 2023), Mauve (Pillutla et al., 2021), and Perplexity (PPL) with amamm 3-8B-IIs--- ruct.. Note that all of these are implemented in the MarkMyWords (MMW) (Piet et al., 2023) benchmark utilized for our experiments. All the metrics evaluate response (whether watermarked or perturbed sample) against a baseline (either the original prompt, a non-watermarked sample, or the model's logit distribution). Below a description of each metric, along with an indication of whether higher or lower values are better for that metric.
LLM-Judge: LLM-Judge directly prompts an instruction-tuned large language model to evaluate the quality a certain response with respect to original prompt. The response is decoded greedily (temperature =0) to ensure deterministic results. Criteria evaluated include: accuracy, level of detail, and typographical, grammatical, and lexical correctness. higher score is better. For this, L.lama -Bs--BStttttt to evaluate, using the following prompt:
LLM-Judge Prompt
You are given prompt and a response, and you provide a grade out measuring the quality of the response, in terms of accuracy, level of details, and typographical, grannatical and lexical correctness. Remove points soon one of the criteria is missed. Prompt: (), Response:()
LLM-CoT (Chain-ffThoouhh)): LLM-CoT evaluates the quality of the watermarked/attaacedd responses using CoT-based reasoning (Wei al., 2023). higher score is better. For this, we also use L.lama3- 1B--nstruct to evaluate, using the following prompt:
LLM-CoT Prompt
Please act as an impartial judge and evaluate the quality of the response provided by an AI assistant to the user question displayed below. Your evaluation hinges the following factors: accuracy, level of details, typographical correctness, grammatical correctness and lexical correctness. Be as objective as possible, and account for every one of these criteria in our evaluation. Begin your evaluation by providing a short explanation. After providing your explanation, please rate the response on scale of 1 to 100 by strictly following this format: "[[rating]]", AFTER your explanation, not
for example: "Rating: [[51]]", Your rating before. Prompt:l), Response:
The LLM-Comparator is used to compare non-watermarked baseline response and the watermarked or attacked response. indicates that the non-wand non-watermarked response better, 0.5 indicates tie, and shows that the watermarked or attacked response is better. For this, we also use L ama 3 8B Inst Instruce ruct to evaluate, using the following prompt:
ALM-Comparatorr
12

---

Optimizing Adaptive Attacks against Watermarks for Language Models
I..M-Comparator Prompt
Please act as impartial judge and evaluate the quality of the responses provided by two AI assistants to the user question displayed below. You should choose the assistant that follows the user's instructions and answers the user's question better. Your evaluation should consider factors such as the helpfulness, relevance, accuracy, depth, creativity, and level of detail of their responses. Also account for typographical correctness, granmatical correctness and lexical correctness. Begin your ovaluation by comparing the two responses and provide short explanation. Avoid any position blases and ensure that the order in which the responses were presented does not influence your decision. Do not allow the length of the responses to influence your evaluation. Do not favor certain names of the assistants. Be as objective
possible. After providing your explanation, you must output your final verdict by strictly following this format: "[[A]]" if assistant A is better, "[[B]]" if assistant B is better, and "I1C]]" for a tie. For example, "Verdict: [[C]]". Prompt: (h, ||Start of Assistant All II I [[End of
Assistant ass Answerll, 1|Start of Assistant B11 {) [End of Assistant B's Answer]]
MAUVE measures the similarity between two text distributions. In our case, the two distributions are the response. Higher MAUVE scores indicate that both texts match their content, quality and diversity. MAUVE is computed with the Kullback-Leible (KL) divergences between two distributions in liver-dimensional latent space. It correlates with human evaluations over baseline metrics for open-ended text generation (Pillutla et al., 2021). We use the gpt 2- -large model compute the MAUVE score in our implementation.
MAUVE:
non-watermarked baseline response and the watermarrked/araphrasse
Perplexity (PPL): Perplexity is a common language modelling metric that quantifies how well model predicts a text sample. It is calculated based on the probability that the model assigns to a sequence of words. Lower perplexity values indicate that the model is more confident and accurate in its predictions, making lower scores better for this metric.
Table 3 shows the median text quality metrics to compare the vanilla Llamm2-777 7b paraphraser to our best adaptive and non-adaptive attacks against the Llama2-11 3B and Llama3. 1-7CB target models. The table shows that our attacks have similar quality to the vanilla L. ama 2 7b paraphraser across the board. Our attacks have higher MAUVE score, indicating that our text is closer to the non won-watermarked text than the vanilla Llama2-77 7b paraphraser. The higher perplexity is not concern, as it merely indicates that the large language model does not expect the text.
Target: Ll amamm222111 133
LLM-Judge t LLM-CoTT LLM-Comparef
Mauvet
PPL.I
Llama2-77
0.92
0.85
0.00
0.17
4.74
AdatiAve Ours- Muss-Bes-NoonAAapptie
0.92
0.85
1.00
0.42
6.69
0.92
0.85
0.50
0.37
6.32
Target: Ll allama3. 1-70B
1.1 ama2-7b
0.95
0.72
0.00
0.22
4.84
Ours-Best Bewe--etttttiiee
0.95
0.72
0.50
0.55
6.10
Burs-Best-NNon Burs-Best-Non-Adappie -dd-tiiiivi
0.95
0.72
0.50
0.31
6.15
Table 3: Various median text quality metrics to compare the vanilla L I 1lamma-111 - 7b paraphraser to our best adaptive and non-adaptive attacks. We limit all attacks to at most 7b parameter models.
A.2. Prompt-set Curation
The evaluation set consists of 296 prompts from Piet et al. (2023), covering book reports, storytelling, and fake news. The training set comprises a synthetic dataset of 000 prompts, covering diverse topics including reviews, historical summaries, biographies, environmental issues, science, mathematics, news, recipes, travel, social media, arts, social sciences, music, engineering, coding, sports, politics and health. To create this dataset, we repeatedly prompt large language model (ChatGPT-4) to generate various topic titles. These titles were then systematically combined and formatted into prompts.
13

---

Optimizing Adaptive Attacks against Watermarks for Language Models
The synthetic training dataset is non-overlapping with the evaluation set. Nonetheless, in realistic scenarios, it is plausible that attacker might train and evaluate their paraphraser using the same dataset. Given the low cost of our attack (USI) < 108), attackers can easily train their own paraphrasers.
A.3. Preference-data Curation
For every prompt in the training set, generate water- marked output using each watermark; then, we use that output as input to our paraphrasers. Each paraphraser generates 16 paraphrases for each input. We then filter these paraphrases as per Algorithm to create the training preference pairs. Larger models have higher quality out- put and so have a higher yield of successful paraphrases. We the same number of paraphrases for each model, even though they may generate different yields.
Exp Non-Adaptive Paraphrasing With PValue 0.1
qwen0.5
qwen1.5
qwen3
0.6
qwen7
Evasion Rate
0.4
Figure shows the expected evasion rate versus the num- ber of paraphrases ablated over varying model sizes of Qwen2. 5 (Qwen, 2024) against the Exp watermark. We find that the expected evasion rate increases with the num- ber of paraphrases, but the rate of increase diminishes as the number of paraphrases increases. We find that the expected evasion rate does not improve significantly close to 16 paraphrases and that bigger models tend to have higher evasion rates for the same number of para- phrases. An exception to this is the 1.5b model, which surprisingly performs very well (better than the 3b) for the same number of paraphrases. This, however, could be due to different pretraining parameters of the base model or other factors.
0.3
0.1
0.0
10
12
14
16
Paraphrases
Figure 6: The expected evasion rate versus the repetition rate ablated over varying model sizes of Qwen2. 5 (Qwen, 2024) against the Exp watermark (Algorithm 1, lines 9-12). Shaded areas denote 95% confidence intervals.
A.4. Baseline Testing against other Watermarks
We include more robustness tests against recently released watermarks such SynthID (Dathathri et al., 2024), Uni- gram (Zhao al., 2024) and SIR (Liu et al., 2024). We refer to the author's papers for detailed descriptions of these watermarks. For this evaluation, we implemented our attack in the MarkI.LM framework (Pan et al., 2024), used our Qwen..5 3b paraphraser trained against the EXP watermark from the main part of the paper, and adaptively tuned a new Qwen2.52 5-bb paraphraser against the Unigram watermark. For the purpose of quick evaluation, we limit the token length to 256 tokens, noting that, as shown in Figure 5, the results are similar for longer texts. GPT-4o is part of the Pareto front only against SIR and KGW due to high text quality and low evasion rates of less than 90%. is not part of the Pareto front against SynthID, EXP and Unigram, where only our attacks are part of the Pareto front. While may be possible use better prompts for GPT-4o to achieve higher text quality evasion rate, there other limitations when using closed systems to evade detection.
1. Their usage can be expensive the user is typically charged per token.
2. The system could embed its own watermark into paraphrased text.
3. There could be guardrails such safety alignments which prevent these systems from arbitrarily paraphrasing text.
In contrast, our method allows working with relatively small open- weight models that adversarics can fully control.
A.5. Additional Statistics
We provide additional statistical insights complementing the robustness tests described in Section A.4. For brevity and clarity, we illustrate the statistics primarily with the Unigram watermark (Zhao et al., 2024), noting similar results across other watermark methods.
14

---

Optimizing Adaptive Attacks against Watermarks for Language Models
Watermark
Ours Ours-Qwen-3Bu Qwen-3b-Unigram
Unigram
0.79
KGW
EXP
SynthID
0.78
SIR
GFT40
C Unigram
Oure Owtth Unitt GeTre
Paraphrase Quality (GPT-Judge)
0.77
3hUnngram
0.76
Ours- Burz-Qwen-bb-uiiie Unigre
O Exp
0.75
Durs -ww.- Ex-Exp
0.74
0.73
0.72
Qurs-Qwi Ahh-F-
Ours-Qwen-3b-Er
0.71
0.65
0.70
0.75
0.80
0.85
0.90
0.95
1.00
Evasion Rate f
Figure 7: Additional results using Qwen2. 5-3b against KGW and EXP, which we study in the main part of the paper, and more recently released watermarks such as SynthID (Dathathri et al., 2024), Unigram (Zhao et al., 2024) and SIR (Liu al., 2024). Dashed lines denote the Pareto front, and we highlighted adaptively trained attacks in bold. We used GPT--4o's version from November 23rd, 2024. The y-axis uses GPT-4o-mini judge, and the x-axis shows the evasion rate.
1.00
0.75
0.50
Evasion Rate f
0.25
0.00
Exp
1.00
Evasion Methods
0.75
Dipper
0.50
Llama2-7b
GPT3.5
0.25
0.00
TPR@ TPR@1%FPR 1%FPR
TPR@2.5%FPR
TPR@5%FPR
TPR07.5%FPR
TPR@10%FPR
False Positive Rate Threshold
Figure 8: The evasion rates against watermarked Ll Llama2113b model. We compare non-adaptive attacks, including ChatGPT3.5, versus adaptively fine-tuned L. a.lama2- 2227 7b paraphraser model.
15

---

Optimizing Adaptive Attacks against Watermarks for Language Models
Token Length Analysis Figure 9 shows the distribution of token lengths for watermarked texts and different perturbations. Our tuned paraphrasers (Qwen2. 5-3b-Un g gram and Qwen2. 5-3b-EXP) produce slightly shorter paraphrases com- pared to the base Qwen2. 5- 3b model and the watermarked responses themselves. This reduction in length likely arises from the optimization objective, which does not explicitly penalize brevity. Such behavior could be adjusted by modifying the objective function when selecting positive and negative samples. Non-optimized methods exhibit varied token lengths: GPT-3.5 generates even shorter responses, GPT-4o produces relatively longer texts, while word substitution (Word-S) and deletion (Word-D) methods behave as expected, respectively increasing or decreasing token counts.
Token Lengths Across Methods
Unigram
Word-S
Word-D
Qwen-3b
200
125
100
80
80
Dount
Count
100
75
60
50
40
40
50
20
%
50
100
150
200
250
300
0
50
100
150
200
250
300
%
50
100
150
200
250
300
%
50
100
150
200
250
300
Taken Lengths
Takan Lengths
Taken Lengths
Token Lengths
Ours Surs-Qwenn33--xp
Ours Setrs--een-3b-uiiraae
GPT3.5
GPT4o
100
40
80
80
Count
60
Count
30
Count
60
40
40
20
20
10
20-
%
50
100
150
200
250
300
0
50
100
150
200
250
300
%
50
100
150
200
250
300
%
50
100
150
200
250
300
Tollen Lengths
Token Lengths
Taken Ler Lengths
Token Lengths
Figure 9: The distribution of the number of tokens in the watermarked text and the paraphrased texts. The x-axis shows the number of tokens, and the y-axis shows the number of samples.
GPT-Judge Quality Scores The GPT-Judge scores evaluated using GPT-44-mini. Figure 10 indicates text quality across methods. Optimized paraphrasers (Qwen2.5 3- Aob-Unigram and Qwen2. 1----EXPP EXP) exhibit similar high-quality scores to those of the unattacked Unigram watermark, base Qwen2. 5b, GPT-3.5, and GPT-4o methods. In contrast, simple perturbations like Word-S and Word-D achieve significantly lower quality scores.
Watermark Scores Figure 11 illustrates watermark detection scores as measured by the MarkI.LM framework (Pan et al., 2024). The unattacked watermarked texts have notably high scores (centered around 5). Simple perturbations, such as word deletions, have no impact, while word substitutions moderately reduce scores. Non-tuned paraphrasing methods (Qwen2.5 GPT-3.5, GPT-4o) substantially lower watermark scores (centered around 1). Adaptively fine-tuned paraphrasers (Qwen2.
and Qwen2. Aoo-Unigraan achieve the lowest scores, typically centered around -1, highlighting their effectiveness in evading detection.
A.6. Token Distribution
Text Quality. Figures 12 to 14 show the top-50 token distribution that appear in the watermarked text. We compare with the token frequency in the paraphrased text using as paraphrasers (i) GPT-4o, (ii) a baseline Qwen2. 5-3b model and (iii) our adaptively tuned Qwen2. 55-3b model against the Unigram watermark (Zhao et al., 2024). We observe that all paraphrasers have similar token distribution and that across all three paraphrasers, on average, the top 50 tokens appear less frequently than in the original, watermarked text. The largest difference we observe between the baseline Qwen2. 5-bb and our adaptively tuned model are the frequencies of the tokens 'The' and (space between words), which our model uses less frequently. Compared to GPT-4o, the baseline Owen2. 5-3b model uses some tokens, such as As', less frequently, while other tokens, such as but', appear more frequently.
16

---

Optimizing Adaptive Attacks against Watermarks for Language Models
GPT Judge Scores Across Methods
Unigram
Qwen-3b
100
120
80
Count
60
Count
Count
63
40
40
20
20
8.0
0.2
0.6
0.8
1.0
8.0
0.2
0.4
0.5
0.8
1.0
8.0
0.2
0.4
0.6
0.8
1.0
8.0
0.2
0.4
0.6
0.8
1.0
GPT Judge Scores
GPT Judge Scores
GPT judge Scores
GPT Judge Stores
Ours- Burrs-nnen-bbu
GPT3.5
GPT4o
80
60
80
40
40
40
00
20
20
8.0
8.0
0.4
0.8
1.0
8.0
0.2
0.4
0.6
0.8
1.0
8.0
0.2
0.4
0.6
0.8
GPT Junge Scores
GPT judge Scoras
GPT judga Scores
GPT Judgo Scores
Figure 10: The distribution the GPT-Judge scores for the watermarked text and the paraphrased texts. The x-axis shows the GPT-Judge score, and the y-axis shows the number of samples.
Original
GPT40
104
Frequency
10a
rovel
Dheir
who
hhadt
President
two
Minister
Prime'
She
but
Jeaders
between
meeting
including
The
'wheee'
fromy As which
story Obaaa Marronn
Figure 12: An analysis of the top-50 tokens in paraphrased text generated with the Unigram watermark (Zhao et al., 2024).
using GPT-4o paraphraser.
17

---

Optimizing Adaptive Attacks against Watermarks for Language Models
Watermark Scores Across Methods
Unigram
Qwen-3b
30
30
Chunt
20
20
Count
20
Count
20
10
10
-2
-2
-2
-2
Watermark Scores
Vintermakk Scores
Watermark Scores
Wotermark Scores
Burs-Qwen-3b--Ne
Surrs-Qwen-3b-ooo 3b-Ungramm
GPT3.5
GPT4o
30
Count
Count
Count
20
20
20
10
10
10
Wisterarkk Scores
Watermerk Scores
Watermark Scores
Wetermaark Scores
Figure 11: The distribution of the watermark scores for the watermarked text and the paraphrased texts. The x-axis shows the watermark score, and the y-axis shows the number of samples.
10
Original GPT3.5
10a
Frequency
10a
10
that
rovel
Dheir
who
hhad
President
two
Minister
Prime'
she
but
Jeaders
between
meeting
including
The
"wheee'
fromy As
which
story Obaaaa Marronn
Figure 13: An analysis of the t5p-50 tokens in paraphrased text generated with the Unigram watermark (Zhao et al., 2024).
using off-the-shelf Qwen2. 5- 3b model a paraphraser.
18

---

Optimizing Adaptive Attacks against Watermarks for Language Models
10
Original
Ours-Qwen:3b
Requeerc
10a
novel
he
who
"hae
Presidere
Lwo
Miliszzr
PPriiee'
Lhe
but
between
meetine
iincuuding
"hhe
"whheee
'_trom'
Which
sstorry Obama i Macron
Figure 14: An analysis of the top-50 tokens in paraphrased text generated with the Unigram watermark (Zhao et al., 2024), using our adaptively tuned Owen2. 5-3b model paraphraser.
A.7. Detailed Textual Analysis
Our goal further analyze why our adaptively tuned paraphraser better evades detection than other approaches. We begin by studying the overlap of N-grams between the watermarked and paraphrased texts, which call the N-gram overlap ratio between two sequences I 22 V".
Ingrams(21. n2) n (22, n)] Ingrams(r)) (21, n) U ogramm((22 n)]
(21,
The 'ngrams' function tokenizes sequence and returns the set of n-grams. The N-gram overlap ratio is always between [0,1]. A high overlap for given N indicates that the same N-grams appear in both sequences. Since the surveyed watermarks operate on a token level, a low overlap ratio would suggest high evasion rate. We also evaluate the token edit distance ratio between two sequences, which is calculated as follows:
L(x1,x2)= = Levenshtein(z1, z2) len(x1) (22()))
(4)
The token edit distance calculates the Levensthein distance between two sequences. Note that the N-gram overlap ratio is calculated over sets of N-grams. In contrast, the Levenshtein distance calculated over (ordered) sequences, meaning that the position the token matters. A high Token Edit Distance ratio suggests that two texts do not have the same tokens at the same positions the sequence, which also suggests higher evasion rate.
19

---

Optimizing Adaptive Attacks against Watermarks for Language Models
Our--Ower tbutggn
GFTD.5 GPTE
OP13
Ove
0.350
025
Ovide SM0
0.30
0.43
0.0
Number
0.22
1.34
0.05
Suaaon Sate
0.22 0.4
Figure 15: (Left) The N-gram overlap ratio between watermarked text and text paraphrased by (i) GPT3.5, (ii) GPT-4o, (ii) our adaptively tuned Qwen2 5-3b paraphraser and (iv) baseline 5wen paraphraser. The overlap is calculated as the number of N-grams in the paraphrased text that also appear in the watermarked text divided by the total number of N-grams in the watermarked text. Lower overlap means that both texts are less similar. (Right) We plot the evasion rate against the normalized token edit distance between paraphrased and watermarked text using different paraphrasers. The dashed line represents the difference between the non-optimized Qwen2. 5b paraphraser and our adaptively tuned Qwen 3b paraphraser.
Results. Figure 15 (left) shows the N-gram overlap ratio between watermarked text and the text produced by four paraphrasing methods. We observe that across all N-grams, our adaptive paraphraser achieves the lowest overlap ratio. Figure 15 (right) shows the mean token edit distance ratio between watermarked and paraphrased text in relation to the evasion rate. We observe that the non-optimized, baseline Qwen2. 5-3b model has a low token edit distance ratio and a low evasion rate. In contrast, our adaptively tuned model has a much higher evasion rate and a high token edit distance ratio. These findings suggest that our adaptive optimization process learned to increase the mean token edit distance and minimize the overlap ratio maximize evasion rates while preserving text quality.
A.8. Watermark Parameters
To select the optimal parameters for the watermarking methods, we follow the guidelines provided by (Piet et al., 2023). We use a key length of for all watermarks and a text-dependent sliding window randomness of size 3. We set the tiip-probability to 0.025 for all watermarks except for the Dist-Shi- watermark, where set to O. Skip-probability is a technique that randomly skips the watermarking selection procedure for some tokens to allow more diverse generation and works best with schemes that can be made indistinguishable, like the Exp, Binary, and Inverse watermarks. We also use the optimal temperature for every watermark (1.0 for all except for the Dist ft watermark, where we use 0.7). Specific to the Dist- -es--Shff ft watermark, we use the suggested green-red list ratio y of 0.5 and a bias parameter /3 of
Furthermore, we evaluate how the strength of the bias parameter used for Dist Siist-Shife ft affects its robustness against our attacks. Our attacker does not know which hyperparameters
used by the provider. We set the bias 8 {1, 4, 8), where higher bias should lead to higher robustness (Piet et al., 2023; Kirchenbauer et al., 2023b). We train our attacks once with the 3 = 4 value suggested by (Piet et al., 2023) and test it against all other hyper-parameters. Table 4 shows that our adaptive and non-adaptive attacks remain the most effective across all hyper-parameters.
A.9. Attack Description
Prompting. We use the following prompt to train our paraphraser models. The prompt is adapted from (Kirchenbauer et al., 2023b). Additionally, we prefill the paraphrase answer with the text [ [[START OF PARAPHRASE] ] to ensure that the model starts generating the paraphrase from the beginning of the response. During dataset curation, training and testing, we set the temperature to 1.0 to diversify the generated paraphrases.
20

---

Optimizing Adaptive Attacks against Watermarks for Language Models
B
Dist ft Quality
Llama 2-7b
Lllmm2-7b--- 7b-Exp
ilama2-7b-Dist-Shi
Evasion
Evasion
Quality
Evasion
Quality
Evasion
Quality
0.94
0.72
0.94
0.96
0.94
0.98
0.95
0.99
2
0.94
0.20
0.95
0.90
0.95
0.98
0.95
0.98
4
0.95
0.00
0.96
0.67
0.94
0.97
0.94
0.97
8
0.71
0.00
0.92
0.60
0.94
0.95
0.94
0.96
Table 4: An ablation study of our attack's 's success rate and text quality for the bias parameter 3 of the Dist -tti-shife (Kirchen- bauer et al., 2023a) watermark.
Paraphrase Prompt
You an expert edpy-e Please rewrite the following text. in your voice and paraphrase all sentences. Ensure that the final output contains the same information as the original text and has roughly the same length. Do not Leave out any important details when rewriting in your own voice. Do not include any information that is present in the original text. not respond with greeting or any other extraneous information. Skip the preamble. Just rewrite the text directly.
Training Hyperparameters We train our paraphraser models using the following byperparameters: a batch size of 32, a learning rate of 10-1, and a maximum sequence length of 512 tokens. We use AdamW optimizer with linear learning rate scheduler that warms up the learning rate for the first 20% of the training steps and then linearly decays it zero. We train the models for I epoch only prevent overfitting. We utilize Low-Rank Adaptation (LoRA) (Hu al., 2022) to reduce the number of trainable parameters in the model. We set the rank to 32 and the alpha parameter to 16.
A.10. Additional Ablation Studies
Figure shows the detection rates at different FPR-thresholds p {0.01, 0.025, 0.05, 0.075, 0.1) against the Dist-Shife and Exp watermarking methods. We focus these two methods they more robust than Inverse and Bi Bar. Our results show that across all evaluated FPR thresholds, our adaptive attacks outperform all other surveyed attacks against both watermarking methods. If the provider tolerates a 10% FPR, our adaptive attacks achieve evasion rates of 80% and 77% against Dist-Shie and Exp, respectively.
False Positive Rates.
A.1I. Extra Tables and Figures
21

---

Optimizing Adaptive Attacks against Watermarks for Language Models
Liama2 13 13blaama3_e GPT3 amaz
alonrrationn Lowercase Synonym 0
Russian
Dipper
Swap 0.05
Freach
Swap_on 0.1
0.8
Syponym_oo 0.5
Paraphrase Quality
Ours-Qwen Exp
Syponym 0.75
0.7
Ours-Llamaa-77-BBinayy Murs-Qwen-bb-akk
Calegory
Ours (Adaptive)
Synonym_
Durs-Lamaa2-D-DDistShhii
OUr--Llama2-TD-All
Ours-Llama2-7b-Exp
Ours (Non-Adaptive)
Contraction
Lowercase
Misspell
ng 0.5.
Liama
Ours-Llama--7--invess
0.5
Misspelling
Ours- Ours-Qwen-3r Exp
None
Typa 0,0
Ours Ours-Qwen-1 Exp
Paraphrase
Swap
0.4
Synonym
Translate
Tydl 0.1
Typo
0.0
Evasion Rate
Figure 16: The evasion rate versus text quality trade-off of all surveyed attacks when the provider uses Llama2 - 3b model and the Exp (Aaronson & Kirchner, 2023) watermark. The attacker uses matching surrogate and paraphrase models with parameters ranging between 0.5b to 7b from the Qwen2. 5 and Llama2 model families. A circle and square denote nonaadaptive and adaptive attacks, respectively, and our attacks are highlighted red. For example, Murs-Qwen-3b-Enne means that we evaluate Qwen2. 5- model optimized against the Exp watermark.
22

---

Optimizing Adaptive Attacks against Watermarks for Language Models
-L-ama2-3b--isst-Shhh- (463 green vs 41 red tokens)
Cervantes' "Don Quixote" is groundbreaking masterpiece of literature that has enthralled readers for over 400 years. The novel tells the story of Alonso Quixano. an old mun who becomes so consumed by the chivalrous tales his day that he renames himself Don Quixote and embarks upon an adventurous journey filled with humor, satire, and timeless themes about the human condition. <-< The story follows Quixote and his insstworthy sidekick Sancho Panza, a simple and pragmatic squire who provides moments of humor and contrast to the lofty ideals of the delusional Quixano/Don Quixote. Their travels in rural Spain lead them to encounter all sorts of people they mistake for knights, ladies in distress, bandits, and giants who in fact ordinary villagers going about their everyday fives--x<> One of the most profound and enduring elements of the novel's s themes the conflict of reality and perception. Quixote, driven by the chivalrous books he reads and his own imagination, mistakes windmills for giants, a puppet play as a real tale of love and betrayal. and a barber from a nearby village who is dressed in his Sunday best but Quixote sees as the Grand Duchess of Lithuania. Through these absurd but comedic misadventures, Cervantes creates a timeless commentary on the nature of truth. reality, and the danger of letting imaginations run too wild. Don Quixole's 's journey also explores issues of class and nobility as he views his own lowly status unknightly, while the peasants and traveling players he encounters view him with suspicion indifference. Through these contrasts, Cervantes pokes fun the social order and the idealized notion of chivalry. Don Quixote has been praised for its realistic portrayal human nature, including its weaknesses and fallibilities as well as the timeless wisdom of Cervantes' observations on society in late sixteenth-century Spain. At its corc, the novel is an ex exploration of the human capacity to dream, delusions.
L1 allama27bb 7b (301 green 201 red tokens)
"Don Quixote" is a groundbreaking masterpicce of literature that has captivated readers for over 400 years, The novel tells the story of Alonso Quixano, an elderly man whose fixation on chivalrous tales leads him to change his name to DonQuixote and embark a thrilling adventure replete with humor, satire, and timeless themes conceming human condition, +-4- The narrative follows Don Quixote and his loyal squire Sancho Panse a practical and good-natured individual who provides moments of levity and contrast the lofty ideals of the delusional Quixano/Don Quixote. Their travels across rural Spain result in encounters with various people who they misidentify as knights, distressed ladies, bandits, and ordinary villagers going about their daily lives. < < One of the most enduring aspects of the novel's themes is the conflict between reality and perception. Quixote. driven by the chivalrous books he reads and his imagination, mistakes wind mills for giants, pupper show for real tale of love and betrayal, and peasant in his Sunday best for the Grand Duchess Lithuania, Through these absurd yet comedic misadventures, Cervantes offers timeless commentary on the nature of truth, reality, and the dangers of allowing our imaginations to run wild. Don Quixote's 's journey also explores issues of class and nobility as he views his lowly status as unknightly, while the peasants and traveling players he encounters view him with suspicion or inditference, Through these contrasts, Cervantes pokes fun at the social order and the idealized notion of chivalry. x -Dn Quixote has been praised for realistic portrayal of buman nuture, including its weaknesses and fallibilities, as well as the timeless wisdom Cervantes' observations on society feth-century Spain. At its core, the novel an exploration of the human capacity to dream, delude oneself, and confront reality, ultimately revealing the limitations and struggles of the human experience
Our 1. ama - st-sstthhh ft (201 green vs 240 red tokens)
Spain has been blessed with literary treasure that has captivated readers for over four centuries in the form of Miguel de Cervantes immortal mastorpicce, 'Don Quixote", This timeless tome wcaves a hilarious and poignant tale of a man consumed by the chivalrous stories of his youth, who renames himself Don Quixote and sets forth a journcy filled with moments of satire and piercing examination of the human condition. + As Don Quixote and his trusty squire Sancho Panza traverse rural Spain, they encounter various unsuspecting villagers, mistaking them for knights, maidens in distress. bandits, and even giants. Through these absurd yet poignant events. Cervantes deftly explores the blurred lines between reality and perception, highlighting the dangers of allowing our imaginations to run wild. The novel's themes of truth, class, and nobility are also expertly woven throughout the narrative, as Don Quixote's ' lowly status is juxtaposed with the condescending views of the peasants and traveling players he encounters, حجت Throughout the novel, Cervantes offers biting commentary on the social hierarchy of his time, while also providing realistic depiction of human nature, complete with its frailties and limitations, Ai core, "Don Quixote" is a thuught-provoking exploration of the human capacity for imagination, delusion. and the ever-elusive pursuit of truth. + Endlessly praised for its timeless wisdom and biting social commentary, "Don Quixote" has captivated readers for centuries, Icaving lasting impact on literature and our understanding of the human experience. Its enduring themes and characters have become ingrained in our collective consciousness, reminding us of the importance of humility. empathy, and the boundless power of the human imagination.
Table 5: Watermarked text and paraphrases from different models. Green/red indicates whether a token is watermarked. The last column shows the detection confidence over the entire text.
23

---

Optimizing Adaptive Attacks against Watermarks for Language Models
ilaama-13b> Dist-Shift (474 green vs 36 red tokens)
Ok here goes! Once upon stime, there scholar namedDr, Brainine, , whohad written academic paper on the most ground breaking research of the century Her findings proved the previously hypothetical theory of XYZ, which had long been hot button topic in the acadomic community, and ber research was deemed by her poers as game changing < - However.... ... (you knew there was going to be but didn' t ya? J... Dr Brainiac hit a snag. She had written the most comprelansive meticulously researched, tightly argued paper of her life... but she couldn' 1 get il published! < <- Everry journal she sent the paper to, every peer review process. every editing round the result, Reject! Reject! RJJECT! (you could almost the little rejections letters wiggling their collective fingers Dr. Brainiac Dr. tried everything hoost luck: <- e-> Brihe editor's assistants with chocolates and champage
mayhe the hest strategy). Moowington, to lick the pages of the manuseript (um. that didn" Eddn" goo well either) +- <- Baftled by their lack of progress, Dr. B took a step back to reassess the situation While pondering in her backyard. an epiphany struck: the problem was the paper's as format! It was too traditional, to bland too academic! She revised the style of her
Asked her cat,
paper into funky, hip and quirky format complete with pop culture selerencing... memes. . and laadaahhi! It sccepted every journal she submited all the same day, +- Dr. B's cound-breakinng paper Xyz Theory, , Research Gate, , Antive , etc (you know, academical version of the inter-nets). <- And so became a legend in the world acedemin, Proving once and for that sometimes a paper just needs to be a little more SWOON and POP, and less HOhum, and the academic world would tak notice The end.
viral sensation among the academic circles, with over millions views and shares
1.1 2 7b (218 green vs 222 red tokens)
Here's x my version of the text: <- < Once upona time, there was a remowned scholar, Dr. Brainiac, who had penned a ground breaking academic paper on highly debaned topic in the academic community. Her work was deemed revolutionary by ber poers but she hit a road block when trying to publish it No matter how many prestigious journals she submitted her paper the same response ochoed back: rejected. rejected, REJECTED: Dr. Brainiac's persistence was met with utter rejection.
With her reputation on the line. Dr. Brainisc contemplated desperate measures break the deaclock. even enlisted help of her feline colleague Prof, Moowington, to lend a paw the oditing process, but alas, seemed the paper was beyond salvage. e- The diminutive Dr. Brainiac stepped back reassessed the situation. After some introspection in her backyard, a brilliant idea struck her - the paper's 8 format! Ir was too traditional too dull, too ...... academic, She decided to overhaul the style of her paper with quirky, trendy, and pog-infused format complete with memes and gifs, What a transformation! The paper was accepted with and her revolutionary work the XYZ Theory became
sensation academic circles, receiving millions This remarkable turn events catapulied Brumiac legendary status in the world academia proving that somettimss a publication jusi needs a little more comph. a little more pizzazz, to cuplivate the atlention of the academic community. Vosla! ح- +- As you can see [I' ve maintained the same level of detail and length as the original text while injecting my own voice and creativity into the paraphrased version.
unanimous acclaim by every journal she submitted views shares on Research Gate and other platforms.
Ours- L1 ama2 -7b Dwi-D-ssstiiiii (180 green 117 red tokens)
Intergalactic luminary. Dr. Brainiac, revolutionized the academic community with her incandescent expose on the long-sought-atte after XYZ theory, Bearing witness to her remarkable accomplishment, her fellow scholars hailed her work as a watershed moment, one that holdly pushed the boundaries of knowledge, However, fortune's 's favor Braininc's ' side, as she encountered string of rejections, promppiing her moment transforming her drab conventional paper into a mesmerizing, pop-culture-i cop-cuttur--ifueeed masterpicce that captured the world's artention, Featuring vibiant, hip, and quirky lormatting. Dr. Brainiac's 's paper became a viral semsation, capliy sting millions of views and shares across esteemed scholarly platforms. X e Dr. Braininc's ' remurkable success served as testament to the power of creativity and uriginality in the world of academia, demonstrating that sometimes scholarly work needs a dash of Ilair and charm iruly stand out. With her revolutionary approach, Dr. Brainiac reshaped the lamiscupe of academic publishing proving that ground breaking research can caprivate inspire even most skeptical of minds. The end.
her approsch. chance visit to her backyard inspired light bulli
Ours Ours-Llama2 1llama2--a - 7b--xxp Exp (185 green vs 175 red tokens)
Of Iourse, I understand the predicament Brainiac faced when trying to publish her ground breaking research highly controversial XYZ theory. II' like, ugb when you pour your heart soul into something complex comprehensive, then... rejection after rejection. like, can't they see how fabalons this work But alas, sometimes a make over is in order. --r- It was while lounging in her back yard, sipping ten and pondering the mysteries of the universe, that Dr. had an epiphany, She realized that the issue wasn't it the content of her paper, but rather its presentation. It was too drah, too traditional, too lacking in flair In other words, it didn't I exactly screum" pick me!' te So, armed with new found sense af panache, Dr. gave her puper mujor facelif. She addeed pop culture references, memes, and GIF and voila! It was like transformed candidide, duzeling editons and academies alike, Suddenly, every journal she submitted to was intrigued. and her work was publisshed in a heart beal.e- e The response was nothing short of viral. Dr. Bts research went from a miche interest to fulli blown sensation, with millions of views and shares across hcademic platforms, And Dr. B herself bocame a legend in the acndemic world, proving that sometimes, a little bit of flair can make all the difference, The end)
Table 6: A rare example where our adaptive attack fails while other attacks succeed. From top to bottom, (1) the watermarked text from a L1 ama2-13 3b model using Dist-Shiff ft versus (2) paraphrased version from a non-optimized Llama2-7b, (3) paraphrased text from an adaptively optimized Llama2-23 - 7b and (4) paraphrased text from an optimized L1 amaa2 2 -7b model in the non-adaptive setting (against Exp).
24


Reviews:
[{"review_id": "kArO2Z38re", "reviewer": "Reviewer_z2QJ", "summary": "The paper tackles the question of robustness of the generated text from LLMs in the offline setting with adaptive attackers. Their approach is evaluated on a wide variety of LLMs and also weaker paraphasers (LLMs) by considering four watermarking techniques recently introduced in the literature.\n\nOverall: The paper is easy to follow and the approach is relatively straightforward using a preference dataset optimized by using DPO. The setting is novel using adaptive attacks in the offline setting and shows great performance but the underlying approach has limited novelty.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your time and effort in providing constructive feedback that will improve our paper. Please find our responses below.\n\n> [..] they use standard RL techniques such as DPO to optimize their objective function from a preference dataset.\n\nYes, we use standard RL techniques for optimization. However, we view our contributions as follows: (i) Formulating watermark robustness as an objective function, (ii) proposing a framework to optimize this objective adaptively, and (iii) showing the efficacy and efficiency of adaptively optimized paraphrasers. A core finding is that even relatively constrained attackers can evade detection using limited resources. \n\n> How about having a regularization parameter to trade off the quality of text quality and scrubbing?\n\nThis is an excellent suggestion. We will introduce a regularization parameter $\\beta$ in our objective function (Eq. 2) as follows: \n\n$\\underset{\\theta_P}{\\max} \\mathbb{E} \\left[\\operatorname{Verify}(P_{\\theta_P}(x), \\tau', m') + \\beta Q(P_{\\theta_P}(x), x)\\right]$\n\nSince we use LoRA adapters, another option that does not require re-training is to scale the weight $\\alpha$ of the adapter. When doing so, we measure the following results against EXP using Qwen2.5-3b adaptively tuned against EXP:\n\n| LoRA Strength $\\alpha$                   |   Evasion Rate | GPT Judge Rating |\n|:-------------------------|------:|-----------------:|\n| Baseline ($\\alpha=0$)   | 69.59 |             0.70 |\n| Ours ($\\alpha=0.2$) |  90.20 |             0.72 |\n| Ours ($\\alpha=0.4$) |  96.62 |             0.71 |\n| Ours ($\\alpha=0.6$) |  97.30 |             0.70 |\n| Ours ($\\alpha=0.8$) |  97.97 |             0.70 |\n| Ours ($\\alpha=1.0$)   |  96.62 |             0.70 |\n\nWe will include these results in our revised paper.\n\n> Can this be utilized for spoofing attacks and if so how could that be implemented?\n\nThis is an interesting question and an active area of research. We can share our thoughts on a simple way of how this could be done. First, we would like to point out the difference in settings and objectives: (1) We operate under the no-box setting, but spoofing requires at least some watermarked samples (e.g., black-box access). (2) Spoofing attacks try to maximize the spoofing success rate using a limited number of watermarked samples.\n\nOne spoofing attack was proposed by Jovanović et al [1]. In a nutshell, (i) they collect $N$ watermarked samples, (ii) apply a scrubber to create corresponding non-watermarked samples, and then (iii) train a mapper from non-watermarked to watermarked samples. Since our scrubber has substantially higher evasion rates than all existing ones, it could be used as a scrubber in Jovanović's attack to make training the mapper more sample efficient, thus improving the attack. As mentioned before, there are other ways in which our attack could be used, which is an interesting question for follow-up research. \n\n> Also, given that we have this offline attack, is there a way to set this up as game to mitigate for these attacks? It seems relatively easy to scrub. Are there any fundamental results in this space for your setting such as this paper (Watermarks in the Sand).\n\nAgain, thank you for this interesting question related to follow-up research. In Section 6, we briefly mention the idea of adversarial training to set up a two-player game where both attackers and defenders optimize their strategies, and the goal is to find Equilibrium. We do not present results on this in our paper. The first challenge would be to develop a watermarking method that can be optimized, following the optimizable attacks we present in this work.\n\nAs for fundamental results, there are impossibility results for robustness [2] and provable robustness for watermarks under certain metrics (e.g., token-edit) [3], but we are not aware of fundamental results when treating watermarking as a two-player game.\n\nWe hope our responses addressed all your questions and are happy to answer any further questions the reviewer may have. \n\n---\n[1] Jovanović, Nikola, Robin Staab, and Martin Vechev. \"Watermark stealing in large language models.\" ICML (2024).\n\n[2] Zhang, Hanlin, Benjamin L. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. \"Watermarks in the sand: Impossibility of strong watermarking for generative models.\" arXiv preprint arXiv:2311.04378 (2023).\n\n[3] Zhao, Xuandong, et al. \"Provable robust watermarking for ai-generated text.\" arXiv preprint arXiv:2306.17439 (2023).", "claims_and_evidence": "Yes, they are well supported.", "methods_and_evaluation_criteria": "Yes, they do.", "theoretical_claims": "Yes, Algorithm 2.", "experimental_designs_or_analyses": "Yes.", "relation_to_broader_scientific_literature": "Check below", "essential_references_not_discussed": "Check below", "other_strengths_and_weaknesses": "Pros:\n\n(i) The setting is interesting as it covers the no box,  offline and adaptive settings and still manages to get very impressive results. \n(ii) The experiments are extensive and consider a variety of watermarking methods, both non-adaptive and adaptive attacks, and various generative and rephraser LLMs. \n\nCons:\n\n(a) The technical novelty is limited in that they use standard RL techniques such as DPO to optimize their objective function from a preference dataset.\n(b) It is known that scrubbing watermarking is relatively easy and it would have been interesting to have seen work in either spoofing or approaches to thwart these adaptive attacks.", "other_comments_or_suggestions": "See below", "questions_for_authors": "(1) How about having a regularization parameter to trade-off quality of text quality and scrubbing?\n(2) Can this be utilized for spoofing attacks and if so how could that be implemented?\n(3) Also, given that we have this offline attack, is there a way to set this up as game to mitigate for these attacks? It seems relatively easy to scrub. Are there any fundamental results in this space for your setting such as this paper (*).\n\n* Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models.\n Zhang et al 2023.  https://arxiv.org/abs/2311.04378", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nYXF5pigAg", "reviewer": "Reviewer_yfhv", "summary": "The paper addresses the vulnerability of Large Language Model (LLM) watermarking methods to adaptive attacks. It argues that existing watermarking robustness tests primarily focus on non-adaptive attackers, which underestimates the risk posed by adversaries with knowledge of the watermarking algorithm. The authors formulate robustness as an objective function and use preference-based optimization to tune adaptive attacks against specific watermarking methods. Their main findings are that adaptive attacks can effectively evade detection across several watermarking methods while maintaining text quality, even with limited computational resources. They also demonstrate that attacks optimized adaptively can remain effective on unseen watermarks in a non-adaptive setting. The key algorithmic idea involves curating preference datasets for fine-tuning adaptive evasion attacks.\n\n## update after rebuttal\nThank you for the author's response. I think this is a good-quality work, and the author has addressed my concerns, so I have decided to raise my score.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your time and valuable suggestions. Please find our answers below.\n\n> The paper could benefit from a more in-depth discussion of potential defenses against adaptive attacks, such as adversarial training.\n\nWe appreciate this suggestion. While we focused on the robustness of current watermarking methods to adaptive attacks, we agree that discussing potential defenses would strengthen the paper. In Section 6, we briefly mention the idea of adversarial training to set up a two-player game where both attacker and defenders optimize their strategies, and the goal is to find an Equilibrium. We do not present results on this in our paper. The first challenge would be to develop a watermarking method that can be optimized, following the optimizable attacks we present in this work, which we believe requires substantial effort. This is an interesting direction for future research. \n\n> The reliance on LLM-as-a-judge for text quality assessment is a known limitation. Although this approach is convenient in practice, LLM-as-a-judge may be biased and not necessarily consistent with human judgments.\n\nWe thank the reviewer for mentioning this limitation, which we also highlight in our paper. Section 6 acknowledges that LLM-as-a-Judge is an imperfect and noisy metric that may not perfectly align with human judgment. To address this concern, we used multiple evaluation metrics (LLM-Judge, LLM-CoT, LLM-Compare, Mauve, and Perplexity) as described in Appendix A.1, and we have included results with different judge models (both Llama3-8B-Instruct and GPT4o-mini in Appendix A.3). We agree that more work is needed to study the metric's alignment with human judgment as stated in our limitations. However, we believe this work may be outside of the scope of our paper. We will strengthen the discussion by suggesting how future work could incorporate human evaluations to validate our findings.\n\n> It would be interesting to explore the transferability of adaptive attacks across different types of LLMs (e.g., encoder-decoder models).\n\nWe agree that it would be interesting to examine different types of LLMs. Our current work focuses on autoregressive decoder-only LLMs. This is the primary setting studied by related work and the most commonly deployed for text generation tasks (e.g., SynthID [A]). Our revised paper will add this as a promising direction for future work. Specifically, we will discuss how the principles of our adaptive attacks might transfer to encoder-decoder architectures like T5 or BART and whether the different generation process might affect the effectiveness of watermarking and our evasion techniques.\n\n> The authors could consider investigating the impact of different training objectives for the paraphraser model.\n\nWe appreciate this suggestion. In our current work, we focused on Direct Preference Optimization (DPO) as our training method for the paraphraser. We would kindly ask the reviewer for more information about which specific training objectives they are considering, as this would help us better address their suggestion. In principle, any objective that can optimize for the dual goals of watermark evasion and text quality preservation could be used.\n\n> Could you elaborate on the ethical considerations related to the release of your source code and adaptively tuned paraphrasers, given the potential for misuse in evading existing watermarks?\n\nWe carefully considered the ethical implications of releasing our code and models, which we address in our Impact Statement in Section 9. We believe the responsible disclosure of vulnerabilities is essential for improving security systems. Current watermarking deployments are still experimental, and our work highlights vulnerabilities that should be addressed before widespread adoption. By releasing our methods, we enable researchers to test against stronger attacks and build more robust watermarks.\n\n> Have you explored the possibility of combining your adaptive attacks with other evasion techniques, such as those targeting safety alignment or content filtering, to assess their combined effectiveness? This would give a more comprehensive view of real-world attack scenarios.\n\nThis is a good point that we also mention as a limitation in our discussion section (Section 6). We focus on robustness of watermarks and do not analyze the interplay of different defenses at the same time.  We agree that examining combined attacks would provide a more comprehensive view of real-world scenarios where multiple defenses might be deployed simultaneously. This is a promising direction for future work and we will discuss this in the revised paper.\n\n---\n[A] Dathathri, Sumanth, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani et al. \"Scalable watermarking for identifying large language model outputs.\" Nature 634, no. 8035 (2024): 818-823.", "claims_and_evidence": "The central claim that adaptive attacks are more effective at evading watermarks is supported by the experimental results. The paper provides quantitative data showing that adaptive attacks achieve over 96% evasion success rates against surveyed watermarking methods while preserving text quality.", "methods_and_evaluation_criteria": "The proposed methods, including the curation of preference-based datasets and the use of DPO, seem appropriate for tuning watermark evasion attacks. The evaluation criteria include both evasion rate and text quality, which are relevant for assessing the practical impact of the attacks.", "theoretical_claims": "This paper primarily focuses on empirical evaluation rather than theoretical contributions.", "experimental_designs_or_analyses": "The experimental design appears sound. The ablation studies cover various settings and hyperparameters. The comparison of adaptive and non-adaptive attacks is well-structured.", "relation_to_broader_scientific_literature": "The paper builds upon existing literature on LLM watermarking and attack methods. The key contribution lies in highlighting the limitations of non-adaptive robustness testing and proposing a method for adaptive attack optimization, which aligns with the growing awareness of adaptive threats in security research.", "essential_references_not_discussed": "N/A.", "other_strengths_and_weaknesses": "Strengths:\n- The paper addresses a timely and relevant problem concerning the security of LLM watermarking.\n- The paper is clearly written and well-organized.\n- The proposed adaptive attack method is effective and scalable.\n\nWeaknesses:\n- The paper could benefit from a more in-depth discussion of potential defenses against adaptive attacks, such as adversarial training.\n- The reliance on LLM-as-a-judge for text quality assessment is a known limitation. Although this approach is convenient in practice, LLM-as-a-judge may be biased and not necessarily consistent with human judgments.", "other_comments_or_suggestions": "It would be interesting to explore the transferability of adaptive attacks across different types of LLMs (e.g., encoder-decoder models).\nThe authors could consider investigating the impact of different training objectives for the paraphraser model.", "questions_for_authors": "- Could you elaborate on the ethical considerations related to the release of your source code and adaptively tuned paraphrasers, given the potential for misuse in evading existing watermarks? \n- Have you explored the possibility of combining your adaptive attacks with other evasion techniques, such as those targeting safety alignment or content filtering, to assess their combined effectiveness? This would give a more comprehensive view of real-world attack scenarios.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "RByliQcH39", "reviewer": "Reviewer_Q7gq", "summary": "The paper investigates the robustness of Large Language Model (LLM) watermarking. While previous research has primarily tested watermarking against non-adaptive attackers (lack knowledge of the watermarking technique), this study introduces an approach by formulating robustness as an objective function and using preference-based optimization (DPO) to develop adaptive attacks. The evaluation reveals three findings: (i) adaptive attacks effectively evade detection across all surveyed watermarking methods, (ii) optimization-based attacks, once trained on known watermarks, generalize well to unseen watermarks even in non-adaptive settings, and (iii) these attacks are computationally efficient, requiring less than seven GPU hours.\n\n## update after rebuttal\nThanks for the rebuttal and the additional experiments. I remain unconvinced that pursuing stronger attacks is the right direction for advancing watermarking, and I am maintaining my original score. However, I am not opposed to the paper being accepted.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your time, consideration, and many valuable suggestions. Please find our responses below. \n\n> Yes, the methods and evaluation are reasonable. However, the main body primarily relies on LLM-Judge for quality evaluation, while the perplexity performance, as shown in Table 3, is not particularly strong.\n\nPerplexity is indeed worse than the baseline model. However, as noted in the paper, perplexity is not always a good quality indicator since it penalizes diverse outputs. For this reason, we include many quality metrics (LLM-Judge, LLM-CoT, LLM-Compare, Mauve, and Perplexity) as described in Appendix A.1. These metrics show that our paraphrased text has a high quality. \n\n> [..] reference [1] proves that achieving strong watermarking is fundamentally impossible [..] I disagree with the authors' claim that investigating strong attacks is necessary, as defending them is nearly impossible. Instead, to provide meaningful guarantees, it is more practical to formulate the problem by restricting the attacker's capabilities (e.g., a college student trying to submit an AI-generated essay) rather than assuming an adversary familiar with LLM watermarking.\n\nThank you for bringing up the impossibility results for 'strong' watermarking. We agree with the reviewer, and our primary setting is studying a resource-constrained attacker - but we are interested in the strongest possible such attacker. Staying with their analogy of viewing watermark evasion as graphs, the attacks in [1] use random walks, whereas our attacks are optimized to find the shortest paths. This makes our attacks more computationally efficient and allows the use of smaller paraphrasers than [1]. \n\nWe already assume a particularly constrained attacker who (i) has no access to the provider's watermarked LLM and (ii) has limited computational resources. Strong watermarking is fundamentally impossible (if quality and perturbation oracles exist), which makes it interesting to study whether watermarking exists that is robust in practice against constrained attackers (i.e., evasion would incur prohibitively high costs). Our work studies this setting and proposes effective attacks that incur little computational costs to the attacker of less than $10$$ USD. \n\n> Conceptually, can the proposed attack be viewed as a specific instance of the one studied in [1]? How should I position this work given their impossibility result?\n\nAs described above, the attack in [1] uses a random walk and proves that under certain assumptions, this theoretically guarantees removal, irrespective of the computational costs incurred for the attacker. Since we optimize our paraphraser, we have a higher probability of evading detection with fewer steps (1 step in our work). We could additionally control other properties of the output (e.g., semantic similarity to the original watermarked text). We will add this discussion to the revised paper. \n\n> Reference [3] introduces a more robust semantic-based watermarking method compared to SIR. Is the proposed attack still effective against this approach? A new plot similar to Figure 7 should be included to illustrate the results.\n\nThank you for bringing [3] to our attention. We evaluated it against our pre-trained models and obtained results similar to other watermarks we surveyed. We use the provider model Llama-2-13b. Note that $\\epsilon$ refers to the evasion rate, as described in our paper. Below, we use watermarking strengths $(\\delta_0=0.33, \\delta_1=0.33)$ (not to confuse with our notation of $\\delta$ for text quality)\n\n| Method                                       |   $\\epsilon$ |   GPT Judge Rating |\n|:---------------------------------------------|------:|-------------------:|\n| Watermarked Samples | 3.72 |               0.71 |\n| Qwen/Qwen2.5-3B-Instruct | 92.23 |               0.72 |\n| meta-llama/Llama-3.1-8B-Instruct | 98.65 |               0.74 |\n| Ours-Unigram-Qwen2.5-3B | 98.65 |               0.74 |\n| Ours-Unigram-Llama-3.2-3B | 100.00 |               0.77 |\n| Ours-EXP-Qwen2.5-3B | 99.32 |               0.71 |\n| Ours-KGW-Llama-2-7B | 98.65 |               0.73 |\n\nBelow, we show results for $(\\delta_0=0.67, \\delta_1=0.67)$. \n\n| Method                                       |    $\\epsilon$ |   GPT Judge Rating |\n|:---------------------------------------------|-------:|-------------------:|\n| Watermarked Samples | 0.00 |               0.56 |\n| Qwen/Qwen2.5-3B-Instruct | 76.35 |               0.68 |\n| meta-llama/Llama-3.1-8B-Instruct | 95.61 |               0.71 |\n| Ours-Unigram-Qwen2.5-3B | 97.97 |               0.7  |\n| Ours-Unigram-Llama-3.2-3B | 99.66 |               0.73 |\n| Ours-EXP-Qwen2.5-3B | 99.32 |               0.67 |\n| Ours-KGW-Llama-2-7B | 96.62 |               0.7  |\n\nThe results show that our attacks evade detection of this watermark. We will include these results in the revised paper. \n\n> Essential References Not Discussed\n\nThank you for bringing up these references. We will discuss them in the revised paper.", "claims_and_evidence": "The claims are validated by the proposed adaptive attack algorithm and supported by the experimental results.", "methods_and_evaluation_criteria": "Yes, the methods and evaluation are reasonable. However, the main body primarily relies on LLM-Judge for quality evaluation, while the perplexity performance, as shown in Table 3, is not particularly strong.", "theoretical_claims": "This is an empirical paper without any theoretical claims.", "experimental_designs_or_analyses": "Yes, I checked all the experimental designs or analyses in the main body of the paper.", "relation_to_broader_scientific_literature": "See weakness.", "essential_references_not_discussed": "[1] Zhang, Hanlin, Benjamin L. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. \"Watermarks in the sand: Impossibility of strong watermarking for generative models.\" arXiv preprint arXiv:2311.04378 (2023).\nhttps://hanlin-zhang.com/impossibility-watermarks/\n\n[2] Fairoze, Jaiden, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, and Mingyuan Wang. \"Publicly-detectable watermarking for language models.\" arXiv preprint arXiv:2310.18491 (2023).\n\n[3] Liu, Yepeng, and Yuheng Bu. \"Adaptive Text Watermark for Large Language Models.\" In International Conference on Machine Learning, pp. 30718-30737. PMLR, 2024.\n\nDiscussions see Weaknesses.", "other_strengths_and_weaknesses": "This paper introduces a strong attack targeting the robustness of LLM watermarking methods. However, reference [1] **proves** that achieving strong watermarking is fundamentally **impossible**, as a watermarking algorithm cannot embed watermarks in all high-quality sentences while simultaneously ensuring they are recognized as LLM-generated. \n\nThe core idea behind their proposed attack is that it is always possible to find a high-quality response that differs significantly from the watermarked output. The proposed method appears to be a specific case of the attack discussed in the following paper, incorporating optimization and DPO. \n\nDue to this inherent impossibility, most recent theoretical research on watermarking has shifted toward the notion of weak robustness, i.e., change in few tokens. See Definition 2.10 in [2]. \n\nTherefore, I disagree with the authors' claim that investigating strong attacks is necessary, as defending them is nearly impossible. Instead, to provide meaningful guarantees, it is more practical to formulate the problem by restricting the attacker's capabilities (e.g., a college student trying to submit an AI-generated essay) rather than assuming an adversary familiar with LLM watermarking.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "1. Conceptually, can the proposed attack be viewed as a specific instance of the one studied in [1]? How should I position this work given their impossibility result?\n\n2. Reference [3] introduces a more robust semantic-based watermarking method compared to SIR. Is the proposed attack still effective against this approach? A new plot similar to Figure 7 should be included to illustrate the results.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "usJRJT5lSc", "reviewer": "Reviewer_zipU", "summary": "The paper proposes to apply preference optimization (DPO) to make open LLM paraphrasers better at removing watermarks from texts. The focus is on the nobox setting (the attacker has no previous access to the LLM API) and both adaptive (scheme is known but not its key) and non-adaptive settings (the exact scheme is not known).\n\n## Update after rebuttal\n\nAs discussed with authors below the rebuttal has addressed most of my concerns, so I raise my score to favor acceptance.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the detailed response and generally positive outlook on our paper. We appreciate your time and effort. Please find our responses below.\n\n> [..] key message of the paper is that training against *any* watermark can improve removal success against the target watermark.\n\nWe agree with the reviewer that all watermarks are vulnerable to our optimizable attacks in the non-adaptive setting. Our non-adaptive attacks differ from existing ones in that we *adaptively optimize* them against other (similar) watermarks and then show in our experiments their effectiveness transfers to unseen watermarks (likely due to their similarity; see Section 6). Hence, even though we evaluate these attacks in a non-adaptive setting, they were still *adaptively* tuned against other known watermarks. \n\nWe believe these are core findings of our paper and will follow the reviewer's suggestion to highlight that 'training against *any* watermark can improve removal success against the target watermark'. However, we would also like to emphasize that in the future, more robust watermarks may be developed that resist our attacks in the non-adaptive setting but not in the adaptive setting.\n\n> [..] in which scenario does an attacker aim to remove a watermark from an LLM deployment but does not have prior blackbox access to that deployment?\n\nWe agree with the reviewer that all deployed watermarking methods allow users to generate (some) watermarked samples. Realistic attackers typically have at least black-box access to the LLM and would not be confined to the no-box setting.\n\nOur motivation is to evaluate the robustness of watermarking against *constrained* attackers that (i) have limited resources and (ii) lack *any* information about the watermarking key and samples. If successful attacks exist in this pessimistic no-box setting, the provider cannot hope to have a robust watermark against more capable attackers (e.g., with black-box access). We show that (i) such attacks exist, (ii) they are cheap, and (iii) they do not require access to watermarked samples. We believe the development of defenses should focus on the no-box setting first. We will discuss this in the revised paper.\n\n> [..] If these [the datasets] are the same/very similar this could imply leakage and perhaps the paraphrasers would not be as effective outside of this domain?\n\nWe used different query datasets to train and test the paraphraser and will clarify this in the paper. However, we highlight that in a practical setting, it is not unreasonable to assume that the attacker uses the *same* dataset to train and test the paraphraser. Since our attacks are cheap ($\\leq10$$ USD), the attacker can train such a specialized paraphraser.\n\n> The (ϵ,δ) robustness definition is interesting, but I have not seen it used later, why is htis needed?\n\nWe re-use $\\delta$ in Alg. 2 and Section 4.2, and $\\epsilon$ corresponds to the evasion rate, which we show in Figures 2, 3, 4. From these figures, one can deduce the $(\\epsilon, \\delta)$-robustness of the surveyed watermarks, subject to the metrics we study. We will clarify this in the paper.\n\n> What are the \"messages\" m here given that all methods are zero-bit to the best of my understanding?\n\nThe reviewer is correct that all watermarks we focus on in the papers are zero-bit. Our definition in Section 2 is more general and allows for multi-bit watermarks as defined by Zhao et al. [A]. \n\n> Even weak off-the-shelf models generally get high scores (>80%) which does not match my intuition from prior work [..]\n\nTo enhance evasion rates, we have manually optimized the prompt used for the baseline models (page 18 in the Appendix).  \n\n> When mining negative samples how many of those fail the quality criterion and how many simply don't remove the watermark (and how many fail both criteria)? [..] do you think balancing it on purpose could improve the results further?\n\nThat is an interesting idea. To answer your question, we investigated the samples collected for training the paraphrasers on Unigram for Llama-3.2-3B. High quality means LLM-Judge had a score of $\\geq 0.8$. \n\n|                 | High Quality | Low Quality | Total |\n|-----------------|------------:|------------:|------:|\n| Detected        | 28.21% | 9.99% | 38.20% |\n| Not Detected    | 48.14% | 13.66% | 61.80% |\n| Total           | 76.35% | 23.65% | 100.00% |\n\nWe did not investigate methods to 'balance' negative samples since our current approach is already highly effective. This would be an interesting idea for further optimization.\n\nWe will follow the reviewer's suggestions for the remaining points: (i) The citations in the introduction, (ii) add GPT4o to Figure 4 (it performs similarly to GPT3.5 in terms of evasion rate), and (iii) move the related work section to an earlier part of the paper. We believe the colors for Figure 5 are correct. \n\n---\n[A] Zhao, Xuandong, et al. \"SoK: Watermarking for AI-Generated Content.\" arXiv preprint arXiv:2411.18479 (2024).", "claims_and_evidence": "Claims are generally supported by evidence. However, given that non-adaptive attacks seem to work comparably well, to me the title of the paper and the key pitch in the abstract/introduction set up wrong expectations, as they are all centered around prior work not taking into account adaptive attacks while this paper does. To me, given that adaptive/non-adaptive both work well, the unique focus of this paper compared to prior work is the *nobox* setting and key message of the paper is that training against _any_ watermark can improve removal success against the target watermark.", "methods_and_evaluation_criteria": "Methods/evaluation criteria generally make sense. Given that it seems that nobox is the key feature of the proposed setting, the authors could elaborate more on the motivation for this setting. In particular, in which scenario does an attacker aim to remove a watermark from an LLM deployment but does not have prior blackbox access to that deployment? This would greatly help make the case for the paper.", "theoretical_claims": "/", "experimental_designs_or_analyses": "I checked soundness of experiments and did not find issues. One detail I was unable to verify is the relationship between the dataset used for evaluation (custom questions as noted in A.2) and the dataset used to fine-tune the model. If these are the same/very similar this could imply leakage and perhaps the paraphrasers would not be as effective outside of this domain?", "relation_to_broader_scientific_literature": "As discussed above and below, the paper is a solid contribution and novel in the specific setting carved out.", "essential_references_not_discussed": "No specific works are missing, but given the specific positioning of the paper, the related work section could come early instead of at the end, to clearly delineate the space in which the paper operates, and explain that existing blackbox attacks are not directly comparable. \n\nDetail: in the introduction the citation Nicks 2024 for adaptive attacks is work that does not target watermarks at all (but other LLM text detectors). The other citation is about images, which is strange given that there is a line of work on adaptive (albeit blackbox) attacks on LLMs, some of which are cited in the related work section.", "other_strengths_and_weaknesses": "(+) Generally, the paper is interesting and valuable to the community as it evaluates a reasonable idea that many practictioners might be interested in experimenting with\n\n(+) The \"why non-adaptive attacks would work\" part is very interesting. \n\n(-) There are several strange points in the evaluation:\n - The primary pareto front figure (Fig. 4) uses only weak/outdated closed models (e.g. gpt3.5) and models such as gpt4o are only shown in the appendix. As the key contribution of the paper in my opinion hinges on the method clearly beating off-the-shelf methods this is strange, and I would have expected a range of latest closed models in the main evaluation results. \n - Even weak off-the-shelf models generally get high scores (>80%) which does not match my intuition from prior work, where in difficult settings off-the-shelf paraphrasing is very weak. Perhaps including an evaluation with longer texts would be useful? Significantly improving a case where off-the-shelf models get ~20% would make a very strong case for the method compared to improvements in the 80-100 range. \n\nSummarizing all of above, I appreciate the work and believe it can be valuable for the community but have key concerns around: paper phrasing around adaptiveness instead of nobox, motivation for nobox in particular, the choice of datasets, and the evaluation setting (latest off-the-shelf models and setting difficulty).", "other_comments_or_suggestions": "- Figure 5 seems to have blue and green colors swapped", "questions_for_authors": "- The $(\\epsilon, \\delta)$ robustness definition is interesting, but I have not seen it used later, why is htis needed?\n- What are the \"messages\" $m$ here given that all methods are zero-bit to the best of my understanding? \n- When mining negative samples how many of those fail the quality criterion and how many simply don't remove the watermark (and how many fail both criteria)? This analysis would be interesting. If this is imbalanced do you think balancing it on purpose could improve the results further?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pxWby771Fh", "reviewer": "Reviewer_3sCX", "summary": "This work proposes adaptive paraphrasing models as a new attack vector against various LLM watermarks. The adversary primarily targets an adaptive no-box setting, where the watermarking algorithm (but not keys, etc.) is known, but the adversary has no access to the watermarking model itself (e.g., for querying). In the first step, by using a surrogate model with the same type of watermark (or, in some instances, a mixture), the adversary creates a preference tuning (DPO) dataset. On this, the adversary RL finetunes a paraphrasing model, which will then be used to remove the watermarked text received from the target model. This is evaluated across several currently popular watermarking schemes showing consistently higher watermark removal rates (with generally high quality). The work highlights the need for stronger adversarial evaluation of LLM watermark methods.\n\n## Update after rebuttal\n\nThe reviewer stands by their decision at the end of the reviewer rebuttal discussion. The rebuttal successfully addressed most of my concerns, and as such, I favor acceptance.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your time, valuable suggestions, and excitement about our paper. Please find our responses below. \n\n> [..] explanations are largely empirical in nature, leaving some uncertainty about where to go from here for future, more robust, watermarks.\n\nThank you for raising this point, which was also raised by other reviewers. We discuss future work in Section 6, where we propose 'adversarial training', which would first require designing optimizable defenses against our optimizable attacks. This is not a trivial task, hence we believe this is future work. We kindly refer to our response to reviewer 'z2QJ' for more information on 'where to go from here'. \n\n> The phrasing \"existing work only exists against non-adaptive attackers\" (e.g., in the abstract) does not seem to do justice to existing work that (while not in a no-box setting) does make some assumptions about the watermark under attack and adapts/learns based on this [1].\n\nIn the abstract, we claim that \"[..] robustness is tested only against non-adaptive attackers\" which we believe is valid for all the surveyed watermarking methods. We do not claim that we are the first adaptive attack. While Jovanović et al. [1] do not explicitly use the term 'adaptive' in their paper, we agree with the reviewer that their spoofing attack works only if they know the watermarking method (i.e., they adaptively handcrafted their attack). We will revise the paper to clarify this.\n\n> Zero-shot baselines already seem very strong [..] However, it raises the question of how far one could push a zero-shot LLM, especially with some additional filters/modifications.\n\nThank you for raising this point. We also think this would be an interesting question. One can use our attack method to adaptively optimize for such a prompt (i.e., treat the prompt as the optimizable parameters), which we did not do in our paper. We already used handcrafted prompts that we manually optimized, which likely explains the strong zero-shot baselines. \n\n> [..] Related to this, a full overview of the score distributions in Table 3 could help people contextualize the score distributions.\n\nThis is a good idea, and we thank the reviewer for bringing it up. We will revise the paper to include a histogram of GPT-Judge scores in the Appendix.\n\n> To the reviewer's understanding, Pareto optimal is really a theoretical statement (which one would have to make overall existing adversaries) - what can be surely stated is that their method is on the current Pareto-frontier (but one should probably refrain from calling it optimal).\n\nWe are unsure if we correctly understood what the reviewer refers to when they say that 'Pareto optimal is really a theoretical statement' and would kindly ask for further clarification in case our answer missed the point. Given all other surveyed attacks, our attacks are Pareto-optimal. However, as the reviewer points out, there could be even better attacks that we did not evaluate. \n\n> The notion of including the watermark directly in the model parameters (L55R) is somewhat of a strange choice as there exists an entire field of Open-Source watermarking that specializes on this [2] (containing the watermark directly in the model). As this is not the focus of this work, it may help the presentation if it is slightly revised.\n\nWe agree with the reviewer that this might be confusing, as the watermarks we consider do not necessarily modify the model's parameters. We will clarify that $\\operatorname{Embed}$ can change the entire generation procedure (such as warping the logits of the LLM during generation). \n\n> The provided examples seem to show that paraphrases by the method are shorter. Can the authors provide additional statistics on this and potential reasons (e.g., from the preference dataset)?\n\nYes, this is likely an effect of the optimization, which does not explicitly penalize shorter responses. This property of the output could be controlled by modifying the objective function. We evaluated our data and observe that a non-optimized baseline Qwen2.5-3b has a mean output token length after paraphrasing of $\\mu=230$ tokens ($\\sigma=25.25$), whereas our optimized version has an output length of $\\hat{\\mu}=214$ tokens ($\\hat{\\sigma}=33.16$). We will include these results in the revised paper. \n\n> On which dataset was the evaluation conducted (number and source of samples, distribution, etc.)?\n\nWe follow Piet et al. [A] 's evaluation and kindly refer the reviewer to their paper for more details. The number of samples is 296 across different tasks (storylines, reports, fake news prompts, etc.). We will also add a short section describing the dataset in the Appendix to ensure our paper remains self-contained. \n\n---\n[A] Piet, Julien, et al. \"Mark my words: Analyzing and evaluating language model watermarks.\" arXiv preprint arXiv:2312.00273 (2023).", "claims_and_evidence": "Yes all major claims regarding evasion rate and quality preservation are sufficiently backed up by experimental evidence.", "methods_and_evaluation_criteria": "The reviewer checked the experimental design wherever possible. The reviewer could not find a description of the dataset which was used for the final evaluation. In case it is the same dataset as the dataset used for RL finetuning this may have potential consequences for the validity of some claims as it potentially leaks information.", "theoretical_claims": "The work does not include theoretical claims.", "experimental_designs_or_analyses": "Warranted the notes in \"Methods And Evaluation Criteria\", the design seems sound to the reviewer.", "relation_to_broader_scientific_literature": "The work provides a new angle on the evaluation of the robustness of current LLM watermarking schemes. Most prior work primarily focussed on standard paraphrasing, basic character replacement, or human evaluation of watermark robustness (with some exceptions as outlined in other sections). This work is novel in the sense that it not only uses paraphrasers but specifically finetunes them to remove watermarks from the text. This becomes an increasingly realistic threat model under the more widespread deployment of LLM watermarks.", "essential_references_not_discussed": "None.", "other_strengths_and_weaknesses": "#### Strengths\n- The reviewer enjoyed reading the paper and thinks the core idea is sensible. Further stronger attacks and evaluations of LM Watermarking is a timely effort with their increasing popularity.\n- The evaluation is thorough with (mostly) realistic attacker assumptions containing various attack targets and many baselines (with varying architectures) alongside quality evaluations.\n- The method shows strong overall results - especially the transfer attacks\n#### Weaknesses\n\n- The reviewer appreciates the additional explanations as to why the paraphrasing seems so effective but has to note that the provided explanations are largely empirical in nature, leaving some uncertainty about where to go from here for future, more robust, watermarks.\n- The phrasing \"existing work only exists against non-adaptive attackers\" (e.g., in the abstract) does not seem to do justice to existing work that (while not in a no-box setting) does make some assumptions about the watermark under attack and adapts/learns based on this [1].\n- Zero-shot baselines already seem very strong, which partially diminishes the gains of the methods (this is a minor point as the reviewer agrees that the method requires much smaller models) -> However, it raises the question of how far one could push a zero-shot LLM, especially with some additional filters/modifications.\n- The quality results across the main paper are on a quite weak judge model - the results in A.3 are hard to compare in put in reference but show consistently lower scores when using a stronger judge model. This could hint at a high variance depending on the quality score. Related to this, a full overview of the score distributions in Table 3 could help people contextualize the score distributions.\n\n[1] Jovanović, Nikola, Robin Staab, and Martin Vechev. \"Watermark stealing in large language models.\" ICML (2024).", "other_comments_or_suggestions": "- To the reviewer's understanding, Pareto optimal is really a theoretical statement (which one would have to make overall existing adversaries) - what can be surely stated is that their method is on the current Pareto-frontier (but one should probably refrain from calling it optimal).\n- The notion of including the watermark directly in the model parameters (L55R) is somewhat of a strange choice as there exists an entire field of Open-Source watermarking that specializes on this [2] (containing the watermark directly in the model). As this is not the focus of this work, it may help the presentation if it is slightly revised.\n\n[2] Sander, Tom et al. \"Watermarking Makes Language Models Radioactive.\" _ArXiv_ abs/2402.14904 (2024): n. pag.", "questions_for_authors": "- The provided examples seem to show that paraphrases by the method are shorter. Can the authors provide additional statistics on this and potential reasons (e.g., from the preference dataset)? \n- On which dataset was the evaluation conducted (number and source of samples, distribution, etc.)?\n- See other points above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: In view of the fact that many LLM watermarking methods have been proposed, but robustness is tested only against non-adaptive attackers who lack knowledge of the provider’s watermarking method and can find only suboptimal attacks, the authors formulate the robustness of LLM watermarking as an objective function and use preference-based optimization to tune adaptive attacks against the specific watermarking method. 

Based on the comments (including post-rebuttal) from FIVE reviewers and the rebuttals from the authors, basically the raised comments have been properly addressed and most reviewers gave positive comments and higher scores.
Although Reviewer Q7gq remained unconvinced that pursuing stronger attacks is the right direction for advancing watermarking, but (s)he was not opposed to the paper being accepted.
Actually, from the viewpoint of AC, it is encouraging to face and solve the challenge of resisting against stronger attacks.

Overall, this submission is a good work and is suggested to be accepted!
Decision: Accept (spotlight poster)