LLM Watermark Evasion via Bias Inversion

Jeongyeon Hwang; Jungseul Ok; Sangdon Park

REVIEW 3 major objections 5 minor 15 references

LLM Watermark Evasion via Bias Inversion

T0 review · 3 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a query-free rewriting attack can defeat LLM watermarks by suppressing likely green tokens, with a theorem showing detection probability decays exponentially once the average green probability is held a small margin be

desk verdict Strong empirical watermark-evasion attack with a clean but unproven theoretical link; the proxy-set premise is asserted, not verified, and Appendix C has issues, but the paper deserves serious refereeing. read the letter →

arxiv 2509.23019 v5 pith:7H7MQ5DU submitted 2025-09-27 cs.CR cs.AI

Jeongyeon Hwang , Sangdon Park , Jungseul Ok This is my paper

classification cs.CRcs.AI

keywords LLMwatermarkingwatermarkevasionquery-freeattackbiasinversiongreen-tokensuppressiontokensurprisaldetectionprobabilityrewriting

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish a general vulnerability in current LLM watermarking: any detector that is equivalent to a threshold on the empirical green-token rate can be evaded by a rewriting attack that nudges the average conditional green-token probability below that threshold. The authors prove that a margin δ makes the detection probability at most exp(−Nδ²/2), so even a small average suppression is enough for long texts. They then propose BIRA, a query-free attack that approximates the unknown green tokens with high-surprisal tokens and applies a negative logit bias during paraphrasing. Across seven watermarking schemes and several LLMs, BIRA reports over 99% attack success while preserving semantic content better than prior paraphrase baselines.

What carries the argument

The key object is the empirical green-token rate p̂(y; W_k) and its detection threshold p_τ, since Theorem 1 reduces any detector of the stated form to a test 1{p̂ ≥ p_τ}. The engine of the attack is a negative logit bias applied to a proxy green set Ĝ constructed from token self-information; this inversion suppresses the very tokens the watermark was biased to produce. The proof of Theorem 2 uses a martingale difference sequence and the Azuma–Hoeffding inequality on the indicators of green-token emission.

What would settle it

Run BIRA against a watermark variant whose green tokens are the low-surprisal tokens or a random subset, and measure the average conditional true-green probability on the attacked text; if it is not at least δ below p_τ, or if the attack success rate drops materially, the paper's theoretical premise fails and the empirical guarantee would not extend.

Watch

Extended reading notes

Core claim

The central claim is that the watermark detection problem reduces to a monotone threshold test on the empirical green rate (Theorem 1), and that if an adversary can keep the average conditional probability of sampling a green token at least δ below the detection threshold, detection probability falls exponentially in Nδ² (Theorem 2). Guided by this, BIRA constructs a proxy green set from token self-information, then subtracts a logit bias from those tokens at each decoding step of an LLM-based paraphrase, inverting the watermark's generative bias without knowing the key. Empirically the attack evades detection in 98–100% of cases across the tested watermarking schemes, with z-scores near or

Load-bearing premise

The load-bearing premise is that the proxy green set, built by high token surprisal, is faithful enough that suppressing it also keeps the true average green probability below p_τ−δ; Appendix A.1 states this as a condition, but the paper does not prove it, and one displayed equality there should be an inequality because the proxy can contain non-green tokens.

Editorial extensions

If this is right

Any published watermark whose detector is a monotone function of the empirical green rate is, in principle, evadable by a query-free rewriter that suppresses likely green tokens by a small average margin.
The detection bound exp(−Nδ²/2) means the margin δ need not be large; for N=230, a margin around 0.1–0.2 already drives the detection probability below 0.32–0.01 under standard KGW thresholds.
Because BIRA does not need the secret key or repeated queries to the watermarked model, the vulnerability is practically exploitable with an LLM that exposes logits or logit-bias APIs.
The attack's success on schemes with different watermark constructions suggests the vulnerability is not specific to one family of green-list algorithms.
If BIRA-style stress tests are adopted, current detection thresholds may substantially overstate robustness against rewriting attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves open whether the proxy assumption holds; inferring from their method, a watermark that places its signal in low-surprisal tokens, or uses a two-sided test that also flags unusually low green rates, would likely defeat BIRA because the premise of Theorem 2 would no longer hold.
The exponential bound suggests a defense-in-depth that aggregates detection statistics across many independently attacked texts; a single text's margin might be small, but accumulating z-scores over a corpus could restore detectability.
Because BIRA relies on logit-level control during decoding, the same attack would need adaptation for closed APIs that only return text; measuring whether the proxy set transfers across tokenizers and models would be a natural next test.
One direct testable extension is to instrument the attacker to record the true average conditional green probability, not just the proxy, on attacked outputs; if it does not stay below p_τ−δ, the theorem's premise is violated despite high empirical ASR.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The thing to know: this is a genuinely strong empirical attack paper. BIRA beats the existing query-free baselines by a large margin — 99%+ ASR on all seven watermarks including SIR and EXP, and at matched FPRs the detector TPR mostly drops below 10% — while preserving meaning better than DIPPER or SIRA by the paper's own LLM-judge, NLI, and S-BERT metrics. The mechanism is concrete and clearly stated: identify high-surprisal tokens as a proxy for the green set, then apply a persistent negative logit bias to them during rewriting. That combination is new.

The theory, however, is not what carries the paper. Theorem 2 is a correct conditional statement: if the average conditional green probability is kept below the detection threshold by δ, the detection probability decays exponentially. The martingale argument is sound. But the premise concerns the true green set, and BIRA only manipulates a proxy. Appendix A.1 gives sufficient conditions (miss-rate bound, proxy suppression) but they are asserted, not verified for any of the seven schemes or three LMs. The derivation there writes an equality where only an inequality holds — the statement remains true if corrected, but as written it is wrong. So the paper does not actually prove that BIRA satisfies the theorem's premise. The empirical attack stands on its own, but the 'fundamental vulnerability' claim is broader than what is proven.

Also watch: Appendix C reports 'upper bounds' that are negative (e.g., -7.50e-2), which cannot be probabilities; at minimum it is a figure/axis error, and it undercuts confidence in the validation. There are no error bars or multi-seed runs for the headline ASR numbers, and the main hyperparameters (beta_0, q) appear tuned on the same evaluation family, so the 99% figures are probably optimistic. If the code is actually usable and the proxy conditions are measured, the paper would be much stronger. The negative z-scores for Unigram also suggest the theory's monotone-threshold assumption may not cover two-sided detectors; that deserves a sentence or two. The appended disclosure of LLM-assisted text refinement is transparent and does not affect the results.

Bottom line: this is a solid, well-written attack paper that deserves peer review. It should go back for revision, not be desk-rejected. The referee should focus on measuring the proxy conditions, fixing the A.1 derivation and Appendix C, and adding variance estimates. I'd read it in the group and would cite it if I worked on watermark robustness.

Referee Report

3 major / 5 minor

Summary. The paper proposes BIRA, a query-free watermark-evasion attack that rewrites watermarked text with an LLM while applying a negative logit bias to a proxy set of likely-green tokens selected by token surprisal. The theoretical core is Theorem 2: if the average conditional probability of sampling true green tokens is at least delta below the detection threshold p_tau, then the detection probability is at most exp(-N delta^2 / 2). The proof via a martingale-difference argument and Azuma-Hoeffding is correct. The paper then claims that this bound motivates BIRA because suppressing a surprisal-based proxy set should suppress true green tokens on average. Experiments on seven watermarking schemes and three LLMs report over 99% ASR with better LLM-judgement and NLI scores than prior query-free baselines. The main gap is that the theoretical premise is never shown to hold for the actual attack: the proxy-set conditions in Appendix A.1 are asserted, not measured, and the derivation as written contains an equality that is only an inequality.

Significance. If the theoretical claim fully covered the attack, this would be an important result: it would show formally that any detector reducible to a monotone threshold on the empirical green rate can be evaded by a query-free rewriter that lowers average conditional green probability by a modest margin, and the empirical results suggest this margin is achievable in practice. The paper also ships a large, systematic empirical study across seven watermarking schemes and three target models, with code, ablation studies, and qualitative examples. However, the advertised 'theoretically motivated' attack and the 'fundamental vulnerability' conclusion are currently stronger than what is proven. Theorem 2 itself is a clean conditional result, but the link from BIRA's proxy-based bias to the true green-set premise is the load-bearing assumption and it is left unverified.

major comments (3)

[§4.2 and Appendix A.1] The proxy-set argument is the key connection between Theorem 2 and BIRA, and it is not established. Appendix A.1 states two sufficient conditions — an average miss-rate bound epsilon and an average proxy-suppression bound p'_tau - delta — but neither is measured or verified for any of the seven watermarking schemes or three target LMs. Moreover, the displayed derivation contains a formal error: the equality E[1_{ytilde in G}] = E[1_{ytilde in Ghat}] + E[1_{ytilde in G \ Ghat}] is false because Ghat may contain non-green tokens. The correct identity is 1_G = 1_{G∩Ghat} + 1_{G\Ghat} ≤ 1_{Ghat} + 1_{G\Ghat}, so the step holds only as an inequality. As written, Theorem 2 does not formally apply to BIRA unless the two conditions are actually verified per scheme.
[§4.1, Theorem 1, and Table 3] Theorem 1 assumes the detector statistic Z(y;Wk) is a nondecreasing function h of the empirical green rate. This assumption is not checked for the evaluated detectors. In particular, if a detector uses a two-sided or absolute z-score, h is not nondecreasing and the reduction to a one-sided threshold p_tau fails. The observed negative z-scores in Table 3 (e.g., -0.34 for Unigram under BIRA) are only compatible with a one-sided test. The paper should state explicitly that the theory covers one-sided monotone-threshold detectors and confirm that each evaluated scheme satisfies this condition; otherwise the theoretical guarantee does not cover the reported empirical regime.
[Appendix C and Figure 6] The 'Detection bound analysis' is presented as validation of Theorem 2, but it does not validate the proxy conditions that connect the theorem to BIRA. The appendix computes the per-sample bound using the true conditional green probability for one configuration (Unigram watermark generated by Llama-3.2-3B, attacked by Llama-3.1-8B), and it reports neither the measured average conditional green probability nor the miss rate epsilon. The figure and text also contain numerical/formatting errors: the text reports negative upper bounds (e.g., '-7.50×10^-2') although an exponential bound cannot be negative, and the axis labels are garbled. The claim that this 'validates our theorem' is overstated; it is a single-case empirical illustration, not a verification of the attack's premise.

minor comments (5)

[Introduction and Related Work] Raffel et al. (2020) is the T5 / C4 paper, not a watermark-evasion attack; citing it alongside Cheng et al. (2025), Wu & Chandrasekaran (2024), Chen et al. (2024), and Jovanović et al. (2024) as a 'recent study' questioning watermark robustness is a citation error. It also appears again as a query-free attack in the Related Work section.
[Appendix C] The text 'At the 90th percentile, the upper bound for BIRA is -7.50×10^-2' should presumably read 7.50×10^-2 (and similarly for the Vanilla value). Negative upper bounds are mathematically impossible and should be corrected.
[Figure 6] The axis labels are rendered as '10 5', '10 4', etc., which likely lost superscript formatting. This makes the figure difficult to read in the current preprint.
[Algorithm 1 and §4.2] The proxy set Ghat is defined via token ids from the paraphrase model's tokenizer, but when the auxiliary model and target model have different tokenizers (the GPT-4o-mini case), the re-tokenization step is described only in prose. A precise definition of how the proxy set is transferred between tokenizers would improve reproducibility.
[Table 3] The header 'SIR (τ=0.2)' is unclear: SIR's test statistic is not obviously a z-score with threshold 0.2, and the table mixes different detection statistics. Clarifying what the reported values and thresholds represent would prevent misinterpretation.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: Theorem 2 is an independent conditional bound; the proxy-set bridge in Appendix A.1 is asserted rather than verified, and the displayed equality is only an inequality—a correctness gap, not a circular reduction.

full rationale

The paper's central theoretical claim, Theorem 2, is a conditional inequality: if the average conditional probability of true-green tokens is at most p_tau - delta, then detection probability is at most exp(-N delta^2/2). The proof (Appendix A) constructs a martingale difference sequence and applies Azuma-Hoeffding; the premise is an upper bound on true-green sampling, not a restatement of the conclusion, so the theorem itself is self-contained. Theorem 1 is also a direct monotone-threshold equivalence for detectors whose statistic is a nondecreasing function of the empirical green rate—again a mathematical consequence, not circularity. The attack's proxy construction (high self-information tokens) is an additional empirical premise, not derived from Theorem 2. The bridge in Section 4.2 / Appendix A.1 asserts two sufficient conditions (average miss rate <= epsilon; average proxy suppression <= p'_tau - delta with p'_tau = p_tau - epsilon) but does not measure them for the evaluated schemes. Moreover, the display in A.1 writes E[1{G}] = E[1{Ghat}] + E[1{G\Ghat}], whereas the correct identity is 1{G} <= 1{Ghat} + 1{G\Ghat}; the step holds only as an inequality. This is a formal proof gap and a risk to the claimed black-box guarantee, but it is not a circular reduction: the theorem's premise is still about true-green membership, and the proxy conditions are not logically equivalent to the theorem's conclusion. The initialization of beta_0 on 50 C4 paraphrases is a hyperparameter choice to avoid degeneration, not a fitted input masquerading as a prediction; the reported ASR is an empirical evaluation, and Appendix C directly measures the theorem's premise for one setup using the true green set, providing independent albeit narrow support. There are no load-bearing self-citations. Accordingly, the derivation chain is not circular; the main weaknesses are unverified sufficient conditions and a minor inequality error, which are correctness concerns rather than circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the experiment configuration more than on any new physics: the attack's hard guarantee requires knowing the secret key to compute the true green-set miss rate, which the real attacker does not have; empirically, the surprisal proxy and the beta_0/q settings together must keep the true green rate below threshold, which is only shown post hoc. The theorem itself requires only standard martingale concentration plus monotonicity of the detector statistic in the green rate. Decoding settings (temperature 0.7, top-p 0.95) are standard and not counted as fitted. No invented entities are introduced.

free parameters (3)

Initial logit bias beta_0 = -4 (Llama-3.1-8B/70B); -11 (GPT-4o-mini)
Chosen by paraphrasing 50 C4 samples and lowering beta until degeneration appears in at least one output (Section 4.2.1); directly controls the attack strength and quality tradeoff.
Proxy percentile q = 0.5
Selected by ablation on the SIR watermark with the Section 5.1 C4 setup (Section 5.3, Table 2); sets how many tokens enter the proxy green set.
Degeneration detection parameters (h, rho, lr, Lmax) = h=450, rho=0.25, lr=0.125, Lmax=1500
Hand-chosen in Appendix B to catch repetitive text within the last 450 tokens; affects the quality-control loop and runtime, not ASR directly.

assumptions (4)

standard math Azuma-Hoeffding inequality for martingale difference sequences with increments bounded in [-1,1]
Invoked in the Proof of Theorem 2 (Appendix A) to derive Pr(M_N >= N*delta) <= exp(-N * delta^2 / 2).
domain assumption The detector statistic Z is a nondecreasing function of the empirical green token rate
Theorem 1 assumption. Holds for one-proportion z-tests, but excludes two-sided detectors; BIRA's negative z-scores (Table 3, -0.34 for Unigram) would be flagged by a two-sided test.
domain assumption High-surprisal tokens approximate the true green set with bounded miss rate epsilon
Section 4.2 and Appendix A.1. Load-bearing and unproven: if the true green set is not concentrated on high-surprisal tokens, the premise of Theorem 2 fails. Supported only empirically by the experiments.
domain assumption The rewriting model exposes or accepts token-level logit biases at every decoding step
Algorithm 1 and the GPT-4o-mini setup (Section 5.1). Excludes closed models without logit access; for GPT-4o-mini the paper patches this with an auxiliary Llama-3.2-3B tokenizer mapping.

how reviews work

0 comments

Cite this review

Pith. "Pith review of LLM Watermark Evasion via Bias Inversion." pith.science (2026). https://pith.science/paper/7H7MQ5DU

@misc{pith2026250923019,
  author       = {Pith},
  title        = {Pith review of: LLM Watermark Evasion via Bias Inversion},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7H7MQ5DU}},
  note         = {Machine review of arXiv:2509.23019}
}

abstract

Watermarking offers a promising solution for detecting LLM-generated content, yet its robustness under realistic query-free (black-box) evasion remains an open challenge. Existing query-free attacks often achieve limited success or severely distort semantic meaning. We bridge this gap by theoretically analyzing rewriting-based evasion, demonstrating that reducing the average conditional probability of sampling green tokens by a small margin causes the detection probability to decay exponentially. Guided by this insight, we propose the \emph{Bias-Inversion Rewriting Attack} (BIRA), a practical query-free method that applies a negative logit bias to a proxy suppression set identified via token surprisal. Empirically, BIRA achieves state-of-the-art evasion rates ($>99\%$) across diverse watermarking schemes while preserving semantic fidelity substantially better than prior baselines. Our findings reveal a fundamental vulnerability in current watermarking methods and highlight the need for rigorous stress tests. Our code is available at \href{https://github.com/ml-postech/LLM-Watermark-Evasion-via-Bias-Inversion}{here}.

Figures

Figures reproduced from arXiv: 2509.23019 by the authors.

**Figure 2.** Comparison of detection performance with the adjusted threshold across watermarking [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** Comparison of text quality across different attacks for various watermarking methods, [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Qualitative comparison of KGW-watermarked text and the same passage after a BIRA at [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

**Figure 5.** Figure 5: Comparison of ASR for selfinformation–guided token selection and random token selection [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

**Figure 6.** Figure 6: Detection upper bounds per-sample from Theorem 2, sorted by BIRA. BIRA reduces the [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]

**Figure 7.** Figure 7: Comparison of text quality across different attacks for various watermarking methods, [PITH_FULL_IMAGE:figures/full_fig_p022_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

15 extracted references · 13 linked inside Pith

[3]

Jinlan Fu, See-Kiong Ng, Zhengbao Jiang, and Pengfei Liu

URLhttps: //arxiv.org/abs/2407.21783. Jinlan Fu, See-Kiong Ng, Zhengbao Jiang, and Pengfei Liu. Gptscore: Evaluate as you desire.arXiv preprint arXiv:2302.04166,

arXiv
[4]

Deberta: Decoding-enhanced bert with disentangled attention.arXiv preprint arXiv:2006.03654,

Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. Deberta: Decoding-enhanced bert with disentangled attention.arXiv preprint arXiv:2006.03654,

arXiv 2006
[7]

An unforge- able publicly verifiable watermark for large language models.arXiv preprint arXiv:2307.16230, 2023a

Aiwei Liu, Leyi Pan, Xuming Hu, Shu’ang Li, Lijie Wen, Irwin King, and Philip S Yu. An unforge- able publicly verifiable watermark for large language models.arXiv preprint arXiv:2307.16230, 2023a. Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust water- mark for large language models.ICLR 2024,

arXiv 2024
[8]

G-eval: Nlg evaluation using gpt-4 with better human alignment.arXiv preprint arXiv:2303.16634, 2023b

10 Preprint Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu. G-eval: Nlg evaluation using gpt-4 with better human alignment.arXiv preprint arXiv:2303.16634, 2023b. Yijian Lu, Aiwei Liu, Dianzhi Yu, Jingjing Li, and Irwin King. An entropy-based text watermarking detection method. InProceedings of the 62nd Annual Meeting of the ...

arXiv
[9]

Large language models: A survey.arXiv preprint arXiv:2402.06196,

Shervin Minaee, Tomas Mikolov, Narjes Nikzad, Meysam Chenaghlu, Richard Socher, Xavier Am- atriain, and Jianfeng Gao. Large language models: A survey.arXiv preprint arXiv:2402.06196,

arXiv
[10]

Gpt-4o: Multimodal and multilingual capabilities

OpenAI. Gpt-4o: Multimodal and multilingual capabilities. OpenAI website, 2024a. URLhttps: //openai.com/index/hello-gpt-4o. Accessed: 2025-09-12. OpenAI. Gpt-4o mini: Advancing cost-efficient intelligence. OpenAI Platform Documentation, 2024b. URLhttps://platform.openai.com/docs/models/gpt-4o-mini. Ac- cessed: 2025-09-12. Leyi Pan, Aiwei Liu, Zhiwei He, Z...

arXiv 2025
[11]

Sentence-bert: Sentence embeddings using siamese bert- networks.arXiv preprint arXiv:1908.10084,

Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert- networks.arXiv preprint arXiv:1908.10084,

arXiv 1908
[12]

Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, et al

URLhttps: //www.reuters.com/technology/artificial-intelligence/ openai-supports-california-ai-bill-requiring-watermarking-synthetic-content-2024-08-26/. Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, et al. A survey on large language model based autonomous agents. Frontiers of Computer...

arXiv 2024

Show all 15 references

[13]

A resilient and accessible distribution-preserving watermark for large language models.arXiv preprint arXiv:2310.07710,

Yihan Wu, Zhengmian Hu, Junfeng Guo, Hongyang Zhang, and Heng Huang. A resilient and accessible distribution-preserving watermark for large language models.arXiv preprint arXiv:2310.07710,

arXiv
[14]

I knew right away he had what we needed

The scope and specificity remain identical Fz-SCORE COMPARISON OF ATTACKS ON DIFFERENT WATERMARKING SCHEMES Table 5:z-score comparison of attacks on different watermarking methods. Watermark KGW-1 Unigram UPV EWD DIP SIR Vanilla2.40±1.32 3.04±1.52 3.24±1.23 2.08±1.32 0.16±0.52...

2008
[1967]

what happens after the end of the end of everything?

though there were two other pitchers who had done so before him: Tom Seaver achieved this feat before this game but also a no- table left-handed pitcher who achieved this feat before him: Sandy Koufax achieved this feat before this game; Tom Seaver actually achieved this feat ...

1993
[1977]

Watermark stealing in large language models

Nikola Jovanovi´c, Robin Staab, and Martin Vechev. Watermark stealing in large language models. arXiv preprint arXiv:2402.19361,

arXiv
[2020]

Unbi- ased watermark for large language models.arXiv preprint arXiv:2310.10669,

Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbi- ased watermark for large language models.arXiv preprint arXiv:2310.10669,

arXiv
[2023]

Ruibo Chen, Yihan Wu, Junfeng Guo, and Heng Huang

URLhttps://www.reuters.com/technology/ openai-google-others-pledge-watermark-ai-content-safety-white-house-2023-07-21/. Ruibo Chen, Yihan Wu, Junfeng Guo, and Heng Huang. De-mark: Watermark removal in large language models.arXiv preprint arXiv:2410.13808,

2023 arXiv
[2024]

Revealing weaknesses in text watermarking through self-information rewrite attacks.arXiv preprint arXiv:2505.05190,

Yixin Cheng, Hongcheng Guo, Yangming Li, and Leonid Sigal. Revealing weaknesses in text watermarking through self-information rewrite attacks.arXiv preprint arXiv:2505.05190,

arXiv

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.

[1] [3]

Jinlan Fu, See-Kiong Ng, Zhengbao Jiang, and Pengfei Liu

URLhttps: //arxiv.org/abs/2407.21783. Jinlan Fu, See-Kiong Ng, Zhengbao Jiang, and Pengfei Liu. Gptscore: Evaluate as you desire.arXiv preprint arXiv:2302.04166,

arXiv

[2] [4]

Deberta: Decoding-enhanced bert with disentangled attention.arXiv preprint arXiv:2006.03654,

Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. Deberta: Decoding-enhanced bert with disentangled attention.arXiv preprint arXiv:2006.03654,

arXiv 2006

[3] [7]

An unforge- able publicly verifiable watermark for large language models.arXiv preprint arXiv:2307.16230, 2023a

Aiwei Liu, Leyi Pan, Xuming Hu, Shu’ang Li, Lijie Wen, Irwin King, and Philip S Yu. An unforge- able publicly verifiable watermark for large language models.arXiv preprint arXiv:2307.16230, 2023a. Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust water- mark for large language models.ICLR 2024,

arXiv 2024

[4] [8]

G-eval: Nlg evaluation using gpt-4 with better human alignment.arXiv preprint arXiv:2303.16634, 2023b

10 Preprint Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu. G-eval: Nlg evaluation using gpt-4 with better human alignment.arXiv preprint arXiv:2303.16634, 2023b. Yijian Lu, Aiwei Liu, Dianzhi Yu, Jingjing Li, and Irwin King. An entropy-based text watermarking detection method. InProceedings of the 62nd Annual Meeting of the ...

arXiv

[5] [9]

Large language models: A survey.arXiv preprint arXiv:2402.06196,

Shervin Minaee, Tomas Mikolov, Narjes Nikzad, Meysam Chenaghlu, Richard Socher, Xavier Am- atriain, and Jianfeng Gao. Large language models: A survey.arXiv preprint arXiv:2402.06196,

arXiv

[6] [10]

Gpt-4o: Multimodal and multilingual capabilities

OpenAI. Gpt-4o: Multimodal and multilingual capabilities. OpenAI website, 2024a. URLhttps: //openai.com/index/hello-gpt-4o. Accessed: 2025-09-12. OpenAI. Gpt-4o mini: Advancing cost-efficient intelligence. OpenAI Platform Documentation, 2024b. URLhttps://platform.openai.com/docs/models/gpt-4o-mini. Ac- cessed: 2025-09-12. Leyi Pan, Aiwei Liu, Zhiwei He, Z...

arXiv 2025

[7] [11]

Sentence-bert: Sentence embeddings using siamese bert- networks.arXiv preprint arXiv:1908.10084,

Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert- networks.arXiv preprint arXiv:1908.10084,

arXiv 1908

[8] [12]

Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, et al

URLhttps: //www.reuters.com/technology/artificial-intelligence/ openai-supports-california-ai-bill-requiring-watermarking-synthetic-content-2024-08-26/. Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, et al. A survey on large language model based autonomous agents. Frontiers of Computer...

arXiv 2024