Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks

T0 review · 5 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that every major family of LLM text watermark—green-list biasing and sampling-based schemes alike—can be stripped by a $0.88-per-million-token rewrite attack that needs no access to the watermark or the generating model.

desk verdict Strong empirical attack; the green-token story is unproven and the theory appendix needs to go, but SIRA deserves peer review and will likely become a benchmark. read the letter →

arxiv 2505.05190 v2 pith:VR764D76 submitted 2025-05-08 cs.LG cs.AIcs.CLcs.CR

Yixin Cheng , Hongcheng Guo , Yangming Li , Leonid Sigal This is my paper · ORCID
classification cs.LGcs.AIcs.CLcs.CR
keywords self-informationtextwatermarkingwatermarkremovalattackparaphrasinggreen-listtokensLLM-generatedblack-boxadversarialrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Text watermarking protects AI-generated text by quietly biasing the model's token choices toward a secret 'green list,' so a detector can later recognize the statistical residue. Because the bias must stay invisible to readers, watermarks are placed in high-entropy tokens, precisely the tokens that any language model finds most surprising. This paper argues that this design choice is a structural vulnerability: a cheap attack, SIRA, computes each token's self-information with an unrelated model, masks the surprising tokens, and rewrites the text as a fill-in-the-blank exercise. The paper reports near-100% attack success against seven recent watermarking schemes, including ones that resist earlier paraphrasing attacks, at $0.88 per million tokens and with no access to the watermark algorithm or the generating model. If true, today's watermark-based provenance systems are removable by anyone with a modest model and a few dollars.

What carries the argument

The load-bearing object is conditional self-information, $I(y_t) = -\log P(y_t \mid y_1,\ldots,y_{t-1}; M_{\text{attack}})$, computed with an attack model distinct from the watermarked generator. It serves as a surrogate for green-list membership: because watermarks boost low-probability tokens by a small $\delta$, the boosted tokens remain in the high- or moderate-self-information regime, so masking all tokens above a percentile threshold removes most watermarked positions. The two-step rewrite, first producing a reference paraphrase, then a greedy fill-in-the-blank completion of the masked template with placeholders, converts the masking into a semantics-preserving rewrite rather than a deletion.

What would settle it

Build a watermark that embeds its signal in the lowest-self-information tokens (or in mid-probability tokens) under a decoder model, run SIRA against it, and compare attack success with the paper's near-100% figures; if the attack rests on the high-self-information correlation, success should collapse to the level of untargeted paraphrasing. A lighter check: for any watermark, measure the overlap between its true green-list tokens and the top-quantile self-information tokens under an unrelated model, and near-random overlap predicts that SIRA's masking is no better than random.

Watch

Extended reading notes

Core claim

The paper's central claim is that the high-entropy-token design shared by current watermarking algorithms can be turned against them without any knowledge of the watermark key, the detector, or the generating model. A token that the watermark algorithm chose for embedding is, by design, low-probability and thus high in self-information under any reasonably competent language model; SIRA exploits this by thresholding self-information, masking every token above a percentile, and then prompting an attack LLM to fill the masked template while drawing content from a reference paraphrase of the original. The result, the paper argues, is that a previously untargeted and unreliable paraphrasing attack becomes a targeted deletion of precisely the watermarked tokens, achieving roughly 100% attack success on KGW, Unigram, UPV, EWD, DIP, SIR, and EXP, with quality on par with or better than prior paraphrasing baselines.

Load-bearing premise

SIRA's masking is only better than random if the tokens that are surprising to the attacker's model match the tokens the watermarker boosted, even though the two models are different and the attacker has never seen the green list.

Editorial extensions

If this is right

  • All seven tested watermarking algorithms, including SIR, which defeats prior paraphrasing attacks, are broken at or near 100% attack success.
  • The cost and hardware barriers to watermark removal are gone: $0.88 per million tokens and a 3B-parameter model suffice, so robustness tests should assume an attacker with mobile-level compute.
  • Any future watermark that preserves text quality by embedding in high-entropy tokens inherits the same exposure, since high-entropy tokens are identifiable purely from an independent model's self-information.
  • SIRA preserves meaning better than the DIPPER baseline (GPT-judged semantic preservation 8.02 vs. 6.34 for DIPPER-2), so the attack is usable where paraphrased text must retain content.
  • The attack transfers across datasets (OpenGen) and to newer schemes such as Adaptive Watermark and Waterfall, indicating the vulnerability is not specific to one benchmark or family.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Cross-model self-information overlap could serve as a pre-hoc fragility metric: before deploying a watermark, compute how much of its green list falls in the high-self-information quantile under a few unrelated decoder models, and treat high overlap as a prediction that a SIRA-style attack will succeed.
  • A defensive direction the authors do not develop: to dodge SIRA, watermarks must place signal in tokens that an independent model does not find surprising, low- or mid-entropy positions, which would trade away some of the text-quality advantage that motivates high-entropy embedding.
  • The attack's dependence on the attack model's context window suggests a testable boundary: hash-based watermarks whose green lists depend on longer contexts than the attacker conditions on should show lower overlap and lower success for SIRA, and success-versus-window-length curves would locate precisely where the assumption breaks.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes SIRA, a black-box paraphrasing attack against LLM text watermarks. SIRA computes per-token self-information under an attack model (Llama-3 variants), masks tokens above a percentile threshold, creates a reference paraphrase of the original text, and then prompts the attack model to fill in the masked text while incorporating the reference. The authors report near-100% attack success rates across seven watermarking schemes (KGW, Unigram, UPV, EWD, DIP, SIR, EXP) with a claimed cost of $0.88 per million tokens, requiring no access to the watermark algorithm, key, detector, or generation model. The paper frames the core mechanism as identifying 'potential green-list tokens' via high self-information, based on the premise that watermarks are embedded in high-entropy tokens. The empirical evaluation includes ablations on the threshold, a comparison to random masking, and text-quality metrics. The appendix contains a theoretical analysis intended to justify the self-information heuristic and bound attack success.

Significance. If the central mechanism were validated, this would be a significant contribution to watermark robustness evaluation: a lightweight, transferable, black-box attack that consistently defeats several recent watermarking methods. The paper's main empirical result is not circular, because attack success is measured against external detectors, and the ablations (reference-text contribution in Table 4, random-mask comparison in Table 3) are informative. The cost and resource analysis is transparent and useful. However, the paper's scientific claim about why the attack works—that self-information identifies the watermark's green tokens—is not directly supported. The theoretical appendix is flawed (a circular lemma and a tautological theorem), and the heuristic derivation in Appendix G contains a sign error. The claimed 'fundamental vulnerability' of high-entropy-token embedding is therefore not established by the evidence presented, even though the attack itself may be effective for other reasons such as aggressive masking and rewriting.

major comments (5)
  1. [Section 3.2 / Section 4.4 / Table 3] The paper never directly measures the overlap between the tokens masked by SIRA and the true green-list tokens of the watermark. The ablation in Table 3 shows only that self-information masking outperforms random masking, but this is compatible with an alternative explanation: self-information selects salient content words (nouns, verbs) whose replacement destroys n-gram statistics used by the detector, rather than specifically removing green tokens. To support the claimed mechanism, the authors should compute precision and recall of the masked set against ground-truth green tokens for the KGW-family watermarks where the green list is known during evaluation, and report these numbers alongside the attack success rates.
  2. [Appendix H, Definition H.3 and Theorem H.4] The theoretical analysis is disconnected from the empirical success metric and is partly circular. Definition H.3 defines attack success as 'every watermarked token is removed,' whereas the experiments measure detector misclassification (Section 4.1); removing all green tokens is sufficient but not necessary for detector failure, so the bounds in Theorem H.4 do not bound the reported attack success rate. Moreover, Lemma H.2 assumes the conclusion it is meant to prove: the statement 'tokens subject to watermarking are chosen (pre-watermark) from the high self-information region' is exactly the correlation the paper needs to establish. Theorem H.4's upper bound is tautological, since it simply restates the definition of success as the intersection of masking events. This appendix should either be rewritten as a non-circular proof from the watermark construction or explicitly relabeled as a heuristic plausibility argument.
  3. [Appendix G] The derivation intended to justify why self-information is more sensitive than entropy contains a sign error and ignores renormalization. The paper states ∂H/∂P(x_w) = −log P(x_w) − 1, but the derivative of the binary entropy −p log p − (1−p) log(1−p) is −log p + log(1−p), not −log p − 1; the derivative of the 'other tokens' term is omitted, and the constraint Σ ε_i = δ on the probability adjustments is not incorporated into the entropy change. As written, the comparison between ΔI and ΔH does not support the claim that self-information is the more sensitive metric. Because Section 3.2 refers to Appendix G as the detailed discussion behind the choice of self-information filtering, this error undermines the heuristic justification for the central mechanism.
  4. [Section 4.1 / Section 4.4 / Table 2] The masking threshold ε=0.3 is selected based on the UPV sweep in Table 2 and then applied to all seven watermarking schemes without reporting sensitivity per method. ε=0.3 corresponds to masking tokens above the 30th self-information percentile, i.e., roughly the top 70% of tokens, which is an aggressive intervention. The paper should either report the attack success rate as a function of ε for each watermark, or justify why a single value is appropriate across watermarks with different embedding strategies. As it stands, the near-100% numbers may partly reflect tuning this free parameter on the evaluation set.
  5. [Section 4.1 / Table 1 / Figure 8] The transferability claim is overstated relative to the evidence. All experiments use OPT-1.3B as the watermarked generation model, so the paper does not demonstrate that the correlation between attack-model self-information and the watermark's favored tokens survives across a range of generation models. Additionally, SIRA achieves 99.8% ASR on EXP (Aaronson & Kirchner, 2022), a watermark without a green list, so the proposed green-token identification mechanism cannot even be defined for that case. This strongly suggests that part of the attack's effectiveness comes from aggressive masking and rewriting rather than from specifically targeting green tokens. The authors should (i) test at least one additional generation model of a different size or family, and (ii) provide an explicit discussion of why the mechanism transfers to EXP and other non-green-list watermarks.
minor comments (5)
  1. [Section 4.1] There are several typos: 'word deleteion' should be 'word deletion', 'GPT Paraphaser' should be 'GPT Paraphraser', and 'the sensor' appears to be a stray phrase.
  2. [Figure 8 caption] The caption states 'For EXP, lighter word colors and higher z-scores indicate a more effective attack,' but higher z-scores generally indicate a stronger watermark signal. Please clarify the sign convention or correct the statement to 'lower z-scores indicate a more effective attack.'
  3. [Section 3.1] The phrase 'The goal of detector D can represente as' and 'The goal for P can represente as' should read 'can be represented as.'
  4. [Abstract and Appendix E] The abstract has a subject-verb agreement error ('subtly embeds' should be 'subtly embed'), and Appendix F contains 'pharased' instead of 'paraphrased'.
  5. [Abstract] The source code link 'SIRA' appears to be a placeholder with no URL; the authors should provide a working repository link or state that code will be released at camera-ready.

Circularity Check

2 steps flagged · score 4.0 of 10

The empirical attack is benchmarked against external detectors and is not circular, but the Appendix H 'proof' of why SIRA works assumes the very concentration of green tokens in the high-self-information region that it purports to establish.

  1. self definitional [Appendix H.2, proof of Lemma H.2]
    "Because tokens subject to watermarking are chosen (pre-watermark) from the high self-information region (I(yi)≥Iα except possibly some edge cases), their self-information remains at least Iα−Cδ after the slight probability increase."

    The lemma is offered as theoretical support for the central claim that self-information masking targets green-list tokens. But its proof simply assumes the conclusion: watermarked tokens are already 'chosen (pre-watermark) from the high self-information region.' The paper never independently verifies that high-self-information tokens under the attack model actually overlap the watermark's green list; that overlap is the load-bearing premise of SIRA. The lemma therefore does not derive the premise; it restates it, and Corollary H.5 then uses the restated premise to conclude high success probability.

  2. self definitional [Appendix H.3, Definition H.3 and Theorem H.4]
    "The overall attack is considered successful if every watermarked token is removed: Success(y) = ∧_{i∈W} A_i. Equivalently, Success(y) requires I(yi)≥ τϵ for all i∈W. ... Pr[Success(y)] ≤ Pr[∧_{i∈W} {I(yi)≥ τϵ}]."

    Success is defined as the event that every watermarked token is masked, and the theorem's upper bound is exactly that same intersection event. The lower bound is just (min_i Pr[I(yi)≥τϵ | W_i])^{|W|}. Thus the 'attack success probability bounds' are a restatement of the success criterion rather than an independent derivation that self-information masking is a valid proxy for green-token removal. The proof establishes that high success follows if all green tokens are masked, which is the definition of success, not an argument that SIRA's masking set contains the green tokens.

full rationale

The headline empirical result is not circular: the attack success rates in Table 1 and Figure 2 are measured against external watermark detectors (KGW, Unigram, UPV, EWD, DIP, SIR, EXP), so the central claim is externally falsifiable rather than derived from the paper's own definitions. The circularity is confined to the theoretical support in Appendix H: Lemma H.2 assumes that watermarked tokens lie in the high-self-information region, which is exactly the premise SIRA needs, and Theorem H.4 restates the success event as its own bound. This makes the 'proof' of why self-information masking targets green tokens tautological. Tuning epsilon=0.3 on UPV and then using it elsewhere is a standard hyperparameter choice rather than a fitted-parameter-called-prediction. Separately, the near-100% ASR on EXP, which has no green list, and the absence of any ground-truth green-token overlap check are validity concerns, not circularity. Because the main empirical contribution stands independently, the overall circularity score is moderate rather than high.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The attack rests on two domain assumptions: watermarks live in high-entropy tokens, and self-information from an independent attack model identifies those tokens. Both are plausible for the tested schemes but are not proven; the theoretical appendix that tries to support them contains errors.

free parameters (2)
  • self-information percentile threshold epsilon = 0.3
    Set to 0.3 based on UPV ablation (Table 2); used for all main results. The headline attack success depends on this choice; higher values sharply reduce ASR.
  • attack model temperature = 0.7
    Decoding temperature for the Llama3 attack model (Section 4.4). No sensitivity analysis is reported, so the effect on ASR is unknown.
assumptions (4)
  • domain assumption Watermarking algorithms embed watermarks preferentially in high-entropy tokens to preserve text quality.
    Section 3.2 states this as the common design principle of the KGW and Christ watermark families; it is an empirical generalization, not derived in the paper.
  • domain assumption Self-information computed by the attack model (Llama3) reliably identifies green tokens of the watermarked model (OPT-1.3B).
    Algorithm 1 masks tokens by self-information threshold from Mattack; Appendix G gives a heuristic uniform-distribution argument, with no quantitative validation across model pairs.
  • domain assumption Detector thresholds and watermark hyperparameters are set to the defaults recommended by the original works or the MarkLLM toolkit.
    Section 4.1 relies on these defaults; the near-100% attack success rates in Table 1 are relative to those thresholds, though Figure 2 checks robustness at fixed FPR.
  • ad hoc to paper Masking events for different watermarked tokens are conditionally independent or satisfy an unspecified 'suitable lower-bounding assumption'.
    Theorem H.4 invokes this for its lower bound. The resulting product bound can be small even for modest |W|, so the near-certainty conclusion in Corollary H.5 does not follow.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks." pith.science (2026). https://pith.science/paper/VR764D76

@misc{pith2026250505190,
  author       = {Pith},
  title        = {Pith review of: Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VR764D76}},
  note         = {Machine review of arXiv:2505.05190}
}
read the original abstract

Text watermarking aims to subtly embed statistical signals into text by controlling the Large Language Model (LLM)'s sampling process, enabling watermark detectors to verify that the output was generated by the specified model. The robustness of these watermarking algorithms has become a key factor in evaluating their effectiveness. Current text watermarking algorithms embed watermarks in high-entropy tokens to ensure text quality. In this paper, we reveal that this seemingly benign design can be exploited by attackers, posing a significant risk to the robustness of the watermark. We introduce a generic efficient paraphrasing attack, the Self-Information Rewrite Attack (SIRA), which leverages the vulnerability by calculating the self-information of each token to identify potential pattern tokens and perform targeted attack. Our work exposes a widely prevalent vulnerability in current watermarking algorithms. The experimental results show SIRA achieves nearly 100% attack success rates on seven recent watermarking methods with only 0.88 USD per million tokens cost. Our approach does not require any access to the watermark algorithms or the watermarked LLM and can seamlessly transfer to any LLM as the attack model, even mobile-level models. Our findings highlight the urgent need for more robust watermarking.

Figures

Figures reproduced from arXiv: 2505.05190 by the authors.

Figure 1
Figure 1. SIRA pipeline consisting to two steps. First, the attack generates a masked text based on self-information. If the self￾information of a specific part above a pre-set threshold, that portion of the text is masked and replaced with a placeholder. Simultaneously, a reference text is generated by asking the LLM to paraphrase. In the second step, the LLM is prompted to complete the masked text while incorporating all th… view at source ↗
Figure 2
Figure 2. To mitigate the default z-threshold’s impact on the robustness of watermarking algorithms, we dynamically adjust the z-score threshold until the watermark detector achieves specified false positive rates. The true positive rate (TPR↓) and the best F1 score are shown. Lower TPR and F1 scores at a given false positive rate (FPR) indicate that the watermark detector struggles to distinguish attack texts from human-writ… view at source ↗
Figure 3
Figure 3. Performance comparison of watermark methods against various attack methods based on PPL (Perplexity↓) and s-BERT (Sentence-BERT score↑). The word delete will significantly increase the PPL and lead to overflow. We marked the overflow data with NaN in the Figure 3a. The synonym substitution will also increase the PPL. The paraphrased text has better text quality than the original watermark text for our method and GPT… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Comparison of different paraphrasing methods on KGW watermarks. Each word’s color indicates whether it is a green or red token. Fewer green words/lower z-scores suggest a more effective paraphrasing approach. The unwatermarked text represents the model’s output without…
Figure 5
Figure 5. Figure 5: Comparison of different paraphrasing methods on Unigram watermarks. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_5.png]
Figure 6
Figure 6. Figure 6: Comparison of different paraphrasing methods on UPV watermarks. The color of each word indicates whether it belongs to a green token or a red token. Less green signifies a more effective paraphrasing approach. Our methods show better performance in removing original wa…
Figure 7
Figure 7. Figure 7: Comparison of different paraphrasing methods on EWD watermarks. 26 [PITH_FULL_IMAGE:figures/full_fig_p026_7.png]
Figure 8
Figure 8. Figure 8: Comparison of different paraphrasing methods on EXP watermarks. The color of each word indicates whether it is a green or red token. For EXP, lighter word colors and higher z-scores indicate a more effective attack [PITH_FULL_IMAGE:figures/full_fig_p027_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. LLM Watermark Evasion via Bias Inversion

    cs.CR 2025-09 conditional novelty 6.0 of 10

    Applying a negative logit bias to high-surprisal tokens during LLM paraphrasing drops the green-token rate below the detector threshold, driving watermark detection probability down exponentially and yielding over 99%...

Reference graph

Works this paper leans on

37 extracted references · 16 canonical work pages · cited by 1 Pith paper

  1. [1]

    and Kirchner, H

    Aaronson, S. and Kirchner, H. Watermarking gpt outputs. https://www.scottaaronson.com/talks/watermark.ppt, 2022

    work page 2022

  2. [2]

    Claude 3.5, 2024

    Anthropic. Claude 3.5, 2024. URL https://www.anthropic.com/news/claude-3-family. Accessed: 2024-09-24

    work page 2024

  3. [3]

    J., and Wong, E

    Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G. J., and Wong, E. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419, 2023

    arXiv 2023

  4. [4]

    Undetectable watermarks for language models

    Christ, M., Gunn, S., and Zamir, O. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, pp.\ 1125--1139. PMLR, 2024

    work page 2024

  5. [5]

    Toxicity in chatgpt: Analyzing persona-assigned language models

    Deshpande, A., Murahari, V., Rajpurohit, T., Kalyan, A., and Narasimhan, K. Toxicity in chatgpt: Analyzing persona-assigned language models. arXiv preprint arXiv:2304.05335, 2023

    arXiv 2023

  6. [6]

    The llama 3 herd of models

    Dubey, A., Jauhri, A., Pandey, A., et al. The llama 3 herd of models. arXiv, arXiv:2407.21783, 2023. URL https://arxiv.org/abs/2407.21783

    arXiv 2023

  7. [7]

    Watermark stealing in large language models

    Jovanovi \'c , N., Staab, R., and Vechev, M. Watermark stealing in large language models. arXiv preprint arXiv:2402.19361, 2024

    arXiv 2024

  8. [8]

    A watermark for large language models

    Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., and Goldstein, T. A watermark for large language models. In International Conference on Machine Learning, pp.\ 17061--17084. PMLR, 2023

    2023

Show all 37 references
  1. [9]

    Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense

    Krishna, K., Song, Y., Karpinska, M., Wieting, J., and Iyyer, M. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. Advances in Neural Information Processing Systems, 36, 2024

    2024

  2. [10]

    Robust distortion-free watermarks for language models

    Kuditipudi, R., Thickstun, J., Hashimoto, T., and Liang, P. Robust distortion-free watermarks for language models. TMLR, 2023

    2023

  3. [11]

    Lau, G. K. R., Niu, X., Dao, H., Chen, J., Foo, C.-S., and Low, B. K. H. Waterfall: Scalable framework for robust text watermarking and provenance for llms. pp.\ 20432--20466, 2024

    2024

  4. [12]

    Double-i watermark: Protecting model copyright for llm fine-tuning

    Li, S., Yao, L., Gao, J., Zhang, L., and Li, Y. Double-i watermark: Protecting model copyright for llm fine-tuning. arXiv preprint arXiv:2402.14883, 2024

    2024 arXiv

  5. [13]

    Liu, A., Pan, L., Hu, X., Li, S., Wen, L., King, I., and Philip, S. Y. An unforgeable publicly verifiable watermark for large language models. In The Twelfth International Conference on Learning Representations, 2023

    2023

  6. [14]

    A semantic invariant robust watermark for large language models, 2024

    Liu, A., Pan, L., Hu, X., Meng, S., and Wen, L. A semantic invariant robust watermark for large language models, 2024. URL https://arxiv.org/abs/2310.06356

    2024 arXiv

  7. [15]

    and Bu, Y

    Liu, Y. and Bu, Y. Adaptive text watermark for large language models. arXiv preprint arXiv:2401.13927, 2024

    2024 arXiv

  8. [16]

    An entropy-based text watermarking detection method

    Lu, Y., Liu, A., Yu, D., Li, J., and King, I. An entropy-based text watermarking detection method. arXiv preprint arXiv:2403.13485, 2024

    2024 arXiv

  9. [17]

    Towards deep learning models resistant to adversarial attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  10. [18]

    Miller, G. A. Wordnet: a lexical database for english. Communications of the ACM, 38 0 (11): 0 39--41, 1995

    1995

  11. [19]

    R., Whybrow, P

    Monteith, S., Glenn, T., Geddes, J. R., Whybrow, P. C., Achtyes, E., and Bauer, M. Artificial intelligence and increasing misinformation. The British Journal of Psychiatry, 224 0 (2): 0 33--35, 2024

    2024

  12. [20]

    Chatgpt-4o: Multimodal and multilingual capabilities

    OpenAI. Chatgpt-4o: Multimodal and multilingual capabilities. OpenAI website, 2024. https://openai.com/chatgpt-4o

    2024

  13. [21]

    Markllm: An open-source toolkit for llm watermarking

    Pan, L., Liu, A., He, Z., Gao, Z., Zhao, X., Lu, Y., Zhou, B., Liu, S., Hu, X., Wen, L., et al. Markllm: An open-source toolkit for llm watermarking. arXiv preprint arXiv:2405.10051, 2024

    2024 arXiv

  14. [22]

    Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., and Liu, P. J. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21 0 (140): 0 1--67, 2020 a

    2020

  15. [23]

    Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., and Liu, P. J. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21 0 (140): 0 1--67, 2020 b

    2020

  16. [24]

    and Gurevych, I

    Reimers, N. and Gurevych, I. Sentence-bert: Sentence embeddings using siamese bert-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing, pp.\ 3982--3992, Hong Kong, China, November 2019. Association for Computational Linguistics. ...

    2019 doi

  17. [25]

    S., Kumar, A., Balasubramanian, S., Wang, W., and Feizi, S

    Sadasivan, V. S., Kumar, A., Balasubramanian, S., Wang, W., and Feizi, S. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156, 2023

    2023 arXiv

  18. [26]

    Shannon, C. E. A mathematical theory of communication. The Bell system technical journal, 27 0 (3): 0 379--423, 1948

    1948

  19. [27]

    Ai bot chatgpt writes smart essays-should academics worry? Nature, 2022

    Stokel-Walker, C. Ai bot chatgpt writes smart essays-should academics worry? Nature, 2022

    2022

  20. [28]

    Unveiling the misuse potential of base large language models via in-context learning

    Wang, X., Chen, T., Yang, X., Zhang, Q., Zhao, X., and Lin, D. Unveiling the misuse potential of base large language models via in-context learning. arXiv preprint arXiv:2404.10552, 2024

    2024 arXiv

  21. [29]

    Jailbroken: How does llm safety training fail? In Advances in neural information processing systems (NeurIPS), 2023

    Wei, A., Haghtalab, N., and Steinhardt, J. Jailbroken: How does llm safety training fail? In Advances in neural information processing systems (NeurIPS), 2023

    2023

  22. [30]

    D., Szummer, M., and Kohli, P

    Welbl, J., Huang, P.-S., Stanforth, R., Gowal, S., Dvijotham, K. D., Szummer, M., and Kohli, P. Towards verified robustness under text deletion interventions. In International Conference on Learning Representations, 2020

    2020

  23. [31]

    and Chandrasekaran, V

    Wu, Q. and Chandrasekaran, V. Bypassing llm watermarks with color-aware substitutions. arXiv preprint arXiv:2403.14719, 2024

    2024 arXiv

  24. [32]

    A resilient and accessible distribution-preserving watermark for large language models

    Wu, Y., Hu, Z., Guo, J., Zhang, H., and Huang, H. A resilient and accessible distribution-preserving watermark for large language models. 2024

    2024

  25. [33]

    Discriminative training for near-synonym substitution

    Yu, L.-C., Shih, H.-M., Lai, Y.-L., Yeh, J.-F., and Wu, C.-H. Discriminative training for near-synonym substitution. In Proceedings of the 23rd International Conference on Computational Linguistics (Coling 2010), pp.\ 1254--1262, 2010

    2010

  26. [34]

    L., Francati, D., Venturi, D., Ateniese, G., and Barak, B

    Zhang, H., Edelman, B. L., Francati, D., Venturi, D., Ateniese, G., and Barak, B. Watermarks in the sand: Impossibility of strong watermarking for generative models. arXiv preprint arXiv:2311.04378, 2023

    2023 arXiv

  27. [35]

    V., et al

    Zhang, S., Roller, S., Goyal, N., Artetxe, M., Chen, M., Chen, S., Dewan, C., Diab, M., Li, X., Lin, X. V., et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068, 2022

    2022 arXiv

  28. [36]

    Provable robust watermarking for ai-generated text

    Zhao, X., Ananth, P., Li, L., and Wang, Y.-X. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306.17439, 2023

    2023 arXiv

  29. [37]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.