Semantic Watermarking with Order-Robust Detection over Sub-sentence Units

• URL: http://arxiv.org/abs/2608.27666v1
• Date: Thu, 27 Aug 2026 19:54:17 GMT
• Title: Semantic Watermarking with Order-Robust Detection over Sub-sentence Units
• Abstract summary: We attack semantic watermarks with order-robust detection over sub-sentence units.<n>The strongest no-box attack we test is an EDA variant adapted to its design, with a 10.8% attack-success rate.<n>A stronger EDA with access to the provider's detector and secret key reaches a 39.7% attack-success rate, compared with 65.5% on k-SemStamp.
• Score: 21.50298444968968
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Semantic watermarks tie the mark to sentence meaning rather than token choices, promising robustness to content-preserving edits. However, the detector only observes attacker-supplied text, which can be reworded, reordered, or resegmented to evade detection without content loss. Rewording, reordering, and resegmentation all cause embedding displacement: detection tests embeddings different from those selected during watermarking and can therefore lose the mark. Our adaptive embedding displacement attack (EDA) admits all three edits under a single objective that maximizes this displacement. It uses a public paraphraser and surrogate encoder without access to the provider's generator or secret key. At a 5% false-positive rate (FPR) and content-preservation threshold $\bar{q}=90\%$, EDA successfully removes the mark on between 32.6% and 47.9% of documents across four schemes, the highest among the tested attacks. Therefore, EDA evaluates the schemes' robustness more thoroughly than passive paraphrasing. To address these vulnerabilities, we design (k)-SwordStamp: semantic watermarks with order-robust detection over sub-sentence units, reducing sensitivity to attacker-chosen structure at a small quality cost. Against k-SwordStamp, the strongest no-box attack we test is an EDA variant adapted to its design, with a 10.8% attack-success rate. A stronger EDA with access to the provider's detector and secret key reaches a 39.7% attack-success rate, compared with 65.5% on k-SemStamp. Our code is available at https://github.com/D-Diaa/SwordStamp.

Related papers

• Watermarks Without Verification: AI Text Watermarking After the EU AI Act [49.51124343181601]
  Article 50 of the EU AI Act requires generative AI providers to mark the content their systems produce and ensure it can be detected as AI-generated.<n>Anthropic disclosed that every Claude model released after that date embeds a watermark based on SynthID-Text in all generated text, enabled by default with no user opt-out.<n>We argue that neither the objections nor the assurances can currently be verified and that this unverifiability, rather than watermarking itself, is the substantive governance failure.
  arXiv  Detail & Related papers  (2026-09-09T01:56:17Z)
• HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA [3.0458514384586404]
  We present HaloMark, a watermark for embedding vectors cryptographically bound to a C2PA manifest.<n>The verifier runs at 284 us and 24 bytes of sidecar per vector, validated end-to-end against three C2PA reference-SDK bindings.
  arXiv  Detail & Related papers  (2026-08-09T11:36:59Z)
• Borrowed Strength: Best-of-N Search over a Code EncodingBreaks Self-Check Jailbreak Defenses [7.287314790466206]
  A self-check defense asks the target model to assess a request before answering it.<n>We show it can be breached by composing two attacks that are individually harmless against it.
  arXiv  Detail & Related papers  (2026-07-29T09:01:26Z)
• Fantastic Adaptive Taxonomies and How to Use Them [100.20614173157708]
  AdaMAST converts execution traces into a compact, evidence-grounded failure taxonomy.<n>No code is hand-authored, no trace human-annotated.<n>In agent-system search, taxonomy-coded diagnoses of failed candidates outperform free-form.
  arXiv  Detail & Related papers  (2026-07-17T17:41:16Z)
• AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation [0.0]
  We evaluate three representative watermarking methods against the Daubert admissibility criteria and the NIST SP 800-86 digital forensic process.<n>We focus on meaning-preserving paraphrase as the attack vector, since it is both legally realistic and difficult to dismiss as evidence tampering.<n>We find that the point-based scoring system, despite working as designed, cannot fully capture forensic uselessness.
  arXiv  Detail & Related papers  (2026-07-17T14:45:53Z)
• SAMark: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustness [71.08096624551246]
  robustness to paragraph-level paraphrasing remains difficult because such attacks globally disrupt watermark signals by changing sentence order.<n>We propose SAMark, a self-anchored watermarking framework that removes the dependency on sentence order by establishing a step-independent green region in semantic space.<n> Experimental results show that SAMark achieves up to 90.2% TP@FP1% under typical paragraph-level paraphrasing attacks.
  arXiv  Detail & Related papers  (2026-05-25T12:46:15Z)
• Character-Level Perturbations Disrupt LLM Watermarks [64.60090923837701]
  We formalize the system model for Large Language Model (LLM) watermarking.<n>We characterize two realistic threat models constrained on limited access to the watermark detector.<n>We demonstrate character-level perturbations are significantly more effective for watermark removal under the most restrictive threat model.<n> Experiments confirm the superiority of character-level perturbations and the effectiveness of the Genetic Algorithm (GA) in removing watermarks under realistic constraints.
  arXiv  Detail & Related papers  (2025-09-11T02:50:07Z)
• When There Is No Decoder: Removing Watermarks from Stable Diffusion Models in a No-box Setting [37.85082375268253]
  We study the robustness of model-specific watermarking, where watermark embedding is integrated with text-to-image generation.<n>We introduce three attack strategies: edge prediction-based, box blurring, and fine-tuning-based attacks in a no-box setting.<n>Our best-performing attack achieves a reduction in watermark detection accuracy to approximately 47.92%.
  arXiv  Detail & Related papers  (2025-07-04T15:22:20Z)
• Optimizing Adaptive Attacks against Watermarks for Language Models [5.798432964668272]
  Large Language Models (LLMs) can be misused to spread unwanted content at scale.<n> watermarking deters misuse by hiding messages in content, enabling its detection using a secret watermarking key.<n>We formulate watermark robustness as an objective function and use preference-based optimization to tune adaptive attacks against the specific watermarking method.
  arXiv  Detail & Related papers  (2024-10-03T12:37:39Z)
• Who Wrote this Code? Watermarking for Code Generation [53.24895162874416]
  We propose Selective WatErmarking via Entropy Thresholding (SWEET) to detect machine-generated text. Our experiments show that SWEET significantly improves code quality preservation while outperforming all baselines.
  arXiv  Detail & Related papers  (2023-05-24T11:49:52Z)
• Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense [56.077252790310176]
  We present a paraphrase generation model (DIPPER) that can paraphrase paragraphs, condition on surrounding context, and control lexical diversity and content reordering. Using DIPPER to paraphrase text generated by three large language models (including GPT3.5-davinci-003) successfully evades several detectors, including watermarking. We introduce a simple defense that relies on retrieving semantically-similar generations and must be maintained by a language model API provider.
  arXiv  Detail & Related papers  (2023-03-23T16:29:27Z)
• The Treasure Beneath Multiple Annotations: An Uncertainty-aware Edge Detector [70.43599299422813]
  Existing methods fuse multiple annotations using a simple voting process, ignoring the inherent ambiguity of edges and labeling bias of annotators. We propose a novel uncertainty-aware edge detector (UAED), which employs uncertainty to investigate the subjectivity and ambiguity of diverse annotations. UAED achieves superior performance consistently across multiple edge detection benchmarks.
  arXiv  Detail & Related papers  (2023-03-21T13:14:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.