RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resilience

• URL: http://arxiv.org/abs/2604.11546v1
• Date: Mon, 13 Apr 2026 14:37:11 GMT
• Title: RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resilience
• Abstract summary: Large language model (LLM) watermarking has emerged as a promising approach for detecting and attributing AI-generated text.<n>We study watermark resilience against spoofing fundamentally from a distributional perspective.<n>We propose RLSpoofer, a reinforcement learning-based black-box spoofing attack that requires only 100 human-watermarked paraphrase training pairs and zero access to the watermarking internals or detectors.
• Score: 14.900124113524194
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language model (LLM) watermarking has emerged as a promising approach for detecting and attributing AI-generated text, yet its robustness to black-box spoofing remains insufficiently evaluated. Existing evaluation methods often demand extensive datasets and white-box access to algorithmic internals, limiting their practical applicability. In this paper, we study watermark resilience against spoofing fundamentally from a distributional perspective. We first establish a \textit{local capacity bottleneck}, which theoretically characterizes the probability mass that can be reallocated under KL-bounded local updates while preserving semantic fidelity. Building on this, we propose RLSpoofer, a reinforcement learning-based black-box spoofing attack that requires only 100 human-watermarked paraphrase training pairs and zero access to the watermarking internals or detectors. Despite weak supervision, it empowers a 4B model to achieve a 62.0\% spoof success rate with minimal semantic shift on PF-marked texts, dwarfing the 6\% of baseline models trained on up to 10,000 samples. Our findings expose the fragile spoofing resistance of current LLM watermarking paradigms, providing a lightweight evaluation framework and stressing the urgent need for more robust schemes.

Related papers

• WoE Wrote It? Watermarking Mixture-of-Experts LLMs for Black-Box Text Provenance [14.891975420982504]
  We introduce Watermarking of Experts (WoE), a novel black-box text provenance method.<n>WoE biases the vocabulary of specific experts and shifts the watermark signal away from unenforceable inference wrappers.<n>We evaluate WoE across eight MoE models, demonstrating successful watermark detection from suspect text.
  arXiv  Detail & Related papers  (2026-08-29T08:57:06Z)
• Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection [23.7834497390662]
  SAFESEAL is a novel key-conditioned watermarking framework that achieves strong detectability with minimal impact on model utility.<n>We show that SAFESEAL outperforms baselines in utility, detectability, and robustness, achieving a BERTScore of 0.983, entity similarity of 0.963, a 98.2% detection rate, and the highest human ratings for text quality and content, with latency comparable to the fastest baseline.
  arXiv  Detail & Related papers  (2026-05-22T02:51:42Z)
• WaterVIB: Learning Minimal Sufficient Watermark Representations via Variational Information Bottleneck [54.83612291453286]
  Existing methods fail because they entangle the watermark with high-frequency cover texture, which is susceptible to being rewritten during generative purification.<n>We propose WaterVIB, a framework that reformulates the encoder as an information sieve via the Variational Information Bottleneck.<n>This effectively filters out redundant cover nuances prone to generative shifts, retaining only the essential signal invariant to regeneration.
  arXiv  Detail & Related papers  (2026-02-25T02:38:17Z)
• An Ensemble Framework for Unbiased Language Model Watermarking [60.99969104552168]
  We propose ENS, a novel ensemble framework that enhances the detectability and robustness of unbiased watermarks.<n>ENS sequentially composes multiple independent watermark instances, each governed by a distinct key, to amplify the watermark signal.<n> Empirical evaluations show that ENS substantially reduces the number of tokens needed for reliable detection and increases resistance to smoothing and paraphrasing attacks.
  arXiv  Detail & Related papers  (2025-09-28T19:37:44Z)
• LLM Watermark Evasion via Bias Inversion [24.543675977310357]
  We propose the emphBias-Inversion Rewriting Attack (BIRA), which is theoretically motivated and model-agnostic.<n>BIRA weakens the watermark signal by suppressing the logits of likely watermarked tokens during rewriting, without any knowledge of the underlying watermarking scheme.
  arXiv  Detail & Related papers  (2025-09-27T00:24:57Z)
• RLCracker: Exposing the Vulnerability of LLM Watermarks with Adaptive RL Attacks [18.75982610851903]
  We introduce adaptive robustness radius, a formal metric that quantifies watermark resilience against adaptive adversaries.<n>We propose RLCracker, a reinforcement learning (RL)-based adaptive attack that erases watermarks while preserving semantic fidelity.<n>Our results confirm that adaptive attacks are broadly effective and pose a fundamental threat to current watermarking defenses.
  arXiv  Detail & Related papers  (2025-09-25T09:08:02Z)
• Diversity Boosts AI-Generated Text Detection [51.56484100374058]
  DivEye is a novel framework that captures how unpredictability fluctuates across a text using surprisal-based features.<n>Our method outperforms existing zero-shot detectors by up to 33.2% and achieves competitive performance with fine-tuned baselines.
  arXiv  Detail & Related papers  (2025-09-23T10:21:22Z)
• GaussMark: A Practical Approach for Structural Watermarking of Language Models [61.84270985214254]
  GaussMark is a simple, efficient, and relatively robust scheme for watermarking large language models.<n>We show that GaussMark is reliable, efficient, and relatively robust to corruptions such as insertions, deletions, substitutions, and roundtrip translations.
  arXiv  Detail & Related papers  (2025-01-17T22:30:08Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvature [143.5381108333212]
  We show that text sampled from an large language model tends to occupy negative curvature regions of the model's log probability function. We then define a new curvature-based criterion for judging if a passage is generated from a given LLM. We find DetectGPT is more discriminative than existing zero-shot methods for model sample detection.
  arXiv  Detail & Related papers  (2023-01-26T18:44:06Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.