arXiv：cs.LG· Georgios Milis, Tom Sander, Tom\'a\v{s} Sou\v{c}ek, Heng Huang, Pierre Fernandez·· 3 小时前
LLM 水印检测能否公开？一种分裂密钥的公私水印方法
Could LLM Watermark Detection be Public?
AI 导读
针对 LLM 水印检测器因担心被攻击者利用而迟迟不公开的问题，研究者提出分裂密钥公私水印方法：公开一个密钥用于公开检测，保留另一个用于完整验证与取证。攻击者只能改动公开信号，造成公私分数失衡，作者用统计检验结合完整密钥判决的两阶段机制识别篡改。评估显示公开检测仅在小编辑预算下提升去除效果，却使伪造成为可能，而私有流程可识别伪造，公开半个水印因而在提升透明度与互操作性的同时保持可检测。
正文
Abstract:Watermarking large language models is popular for tracing chatbot and agentic outputs, yet detectors remain unreleased since exposing them could let attackers do targeted edits with the detector's feedback. However, watermarks are already vulnerable to uninformed tampering attacks. We thus first quantify whether a public detector would be an additional liability in a deployment setting at varying levels of access, from token-level scores to a binary verdict. Second, we introduce a split-key public-private watermarking method that exposes one key through a public detector while keeping the other for full verification and forensics. An informed attacker can only move the public signal, creating an imbalance between public and private scores. We introduce a statistical test for this imbalance, and combine it with the full key verdict in a two-stage mechanism. Third, we evaluate the split-key method on a wide range of removal and forgery attacks, comparing the uninformed to detector-informed settings. Public detection improves removal only at small edit budgets, since plain rephrasing already strips the watermark at a lower quality cost, but it does enable forgery, which the private pipeline can identify. Overall, releasing half of the watermark enables transparency and interoperability, and tampering with the released half stays detectable. This bounds the provider's liability and questions the need to keep detectors fully private.
| Subjects: | Cryptography and Security (cs.CR); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.12106 [cs.CR] |
| (or arXiv:2610.12106v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.12106 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Georgios Milis [view email]
[v1]
Thu, 8 Oct 2026 15:05:58 UTC (750 KB)
来源：arXiv：cs.LG · arxiv.org