Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

• URL: http://arxiv.org/abs/2605.30501v1
• Date: Thu, 28 May 2026 19:34:58 GMT
• Title: Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs
• Abstract summary: Watermarking embeds statistical signatures in AI-generated text for detection and attribution.<n>We reveal a fundamental vulnerability: when users access multiple models, watermarks trivially fail.<n>We introduce WASH (Watermark Attenuation via Statistical Hybridisation), which solves practical challenges in ensemble generation.
• Score: 13.891118064010898
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Watermarking embeds statistical signatures in AI-generated text for detection and attribution. We reveal a fundamental vulnerability: when users access multiple models (today's reality), watermarks trivially fail. Watermarks perturb output distributions away from the original, and in competitive markets, these perturbations are typically independent across providers. We theoretically prove that averaging output probability distributions recovers the unwatermarked distribution with up to a second-order error term. Empirically, simply averaging 3-5 models cancels out these perturbations. We introduce WASH (Watermark Attenuation via Statistical Hybridisation), which solves practical challenges in ensemble generation: vocabulary misalignment and tokenisation differences across heterogeneous models. Experiments across six watermarking schemes and three LLMs show that averaging across 3 models suppresses detection z-scores from 5-300 to below 2 (below the detection threshold of 4) and reduces TPR at 5% FPR to below 50%, while improving quality by 27.5% and running 6 times faster than the best baseline on the long sequence generation. Our results suggest that robust AI-text detection via watermarking requires either accepting this fundamental vulnerability or unprecedented coordination among model providers.

Related papers

• PURA: Provably Unbiased and Robust Multi-Bit Watermarking for AI-Generated Text Attribution [83.66032773976904]
  We present PURA, a provably unbiased and robust multi-bit watermarking method for text attribution.<n>Instead of perturbing token probabilities directly, PURA embeds payloads in the latent sampling space via keyed inverse transform sampling.<n>We show that PURA substantially outperforms existing unbiased baselines in the high-payload regime.
  arXiv  Detail & Related papers  (2026-08-23T04:44:27Z)
• Signature filtering: a lightweight enhancement for statistical watermark detection in large language models [0.754900594011865]
  Signature filtering is a detection-time module that enhances watermark detection without modifying watermark embedding and text generation.<n>It learns a small set of tokens whose presence makes repetitive watermark tests unreliable, and removes these tokens before detection.<n>2- and 3-gram signatures raise detection rates in weak-signal and low-entropy settings from 831% without filtering to 7899% with filtering.
  arXiv  Detail & Related papers  (2026-06-16T19:24:32Z)
• Beyond Perplexity: Character Distribution Signatures and the MDTA Benchmark for AI Text Detection [0.34998703934432673]
  Training-free AI text detection methods primarily rely on model log-probabilities, achieving strong performance through approaches like Binoculars and DNA-DetectLLM.<n>We introduce an alternative detection signal based on character distribution signatures.<n>We provide theoretical foundations showing that AI models, trained on massive domain-balanced corpora, approximate global character patterns while humans exhibit domain-specialized distributions.
  arXiv  Detail & Related papers  (2026-05-03T00:10:15Z)
• Towards Anytime-Valid Statistical Watermarking [63.02116925616554]
  We develop the first e-value-based watermarking framework, Anchored E-Watermarking, that unifies optimal sampling with anytime-valid inference.<n>Our framework can significantly enhance sample efficiency, reducing the average token budget required for detection by 13-15% relative to state-of-the-art baselines.
  arXiv  Detail & Related papers  (2026-02-19T18:32:26Z)
• MirrorMark: A Distortion-Free Multi-Bit Watermark for Large Language Models [5.735801967350819]
  We propose MirrorMark, a distortion-free watermark for large language models (LLMs)<n>MirrorMark embeds multi-bit messages without altering the token probability distribution, preserving text quality by design.<n> Experiments show that MirrorMark matches the text quality of non-watermarked generation while achieving substantially stronger detectability.
  arXiv  Detail & Related papers  (2026-01-29T19:10:48Z)
• Analyzing and Evaluating Unbiased Language Model Watermark [62.982950935139534]
  We introduce UWbench, the first open-source benchmark dedicated to the principled evaluation of unbiased watermarking methods.<n>Our framework combines theoretical and empirical contributions.<n>We establish a three-axis evaluation protocol: unbiasedness, detectability, and robustness, and show that token modification attacks provide more stable robustness assessments than paraphrasing-based methods.
  arXiv  Detail & Related papers  (2025-09-28T19:46:01Z)
• An Ensemble Framework for Unbiased Language Model Watermarking [60.99969104552168]
  We propose ENS, a novel ensemble framework that enhances the detectability and robustness of unbiased watermarks.<n>ENS sequentially composes multiple independent watermark instances, each governed by a distinct key, to amplify the watermark signal.<n> Empirical evaluations show that ENS substantially reduces the number of tokens needed for reliable detection and increases resistance to smoothing and paraphrasing attacks.
  arXiv  Detail & Related papers  (2025-09-28T19:37:44Z)
• Watermarking Degrades Alignment in Language Models: Analysis and Mitigation [8.866121740748447]
  This paper presents a systematic analysis of how two popular watermarking approaches-Gumbel and KGW-affect truthfulness, safety, and helpfulness.<n>We propose an inference-time sampling method that uses an external reward model to restore alignment.
  arXiv  Detail & Related papers  (2025-06-04T21:29:07Z)
• Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach [53.32564762183639]
  We introduce a novel, unified theoretical framework for watermarking Large Language Models (LLMs)<n>Our approach aims to maximize detection performance while maintaining control over the worst-case false positive rate (FPR) and distortion on text quality.<n>We propose a distortion-free, distribution-adaptive watermarking algorithm (DAWA) that leverages a surrogate model for model-agnosticism and efficiency.
  arXiv  Detail & Related papers  (2024-10-03T18:28:10Z)
• Large Language Monkeys: Scaling Inference Compute with Repeated Sampling [81.34900892130929]
  We explore inference compute as another axis for scaling, using the simple technique of repeatedly sampling candidate solutions from a model.<n>Across multiple tasks and models, we observe that coverage scales with the number of samples over four orders of magnitude.<n>In domains like coding and formal proofs, where answers can be automatically verified, these increases in coverage directly translate into improved performance.
  arXiv  Detail & Related papers  (2024-07-31T17:57:25Z)
• AvgOut: A Simple Output-Probability Measure to Eliminate Dull Responses [97.50616524350123]
  We build dialogue models that are dynamically aware of what utterances or tokens are dull without any feature-engineering. The first model, MinAvgOut, directly maximizes the diversity score through the output distributions of each batch. The second model, Label Fine-Tuning (LFT), prepends to the source sequence a label continuously scaled by the diversity score to control the diversity level. The third model, RL, adopts Reinforcement Learning and treats the diversity score as a reward signal.
  arXiv  Detail & Related papers  (2020-01-15T18:32:06Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.