Evaluating attacks on ai text watermarks with quality in mind
MarkSec: Capability-Aware Evaluation of Adversarial Attacks Against LLM Watermarks
Cryptography and Security
Summary
Detecting AI-generated text often uses watermarks embedded in the writing, but some techniques try to remove or fake these signals. The authors created a system called MarkSec to study these attacks all together, checking not only if the watermark is broken but also if the text still sounds good and makes sense. They found that attacks that seem strongest just by destroying watermarks often fail when the text must remain clear and natural. Their work helps better understand the strengths and weaknesses of different watermark attacks in real-world conditions.
What this means in practice
- •For security teams: Assess robustness of AI text watermarking systems by using MarkSec to evaluate combined attack strategies considering both attack success and text quality.
- •For ai product developers: Design watermarking methods that remain effective against practical attacks that must preserve naturalness and quality of AI-generated text.
Authors
Kairong Li, Zhikun Zhang, Xiao Ren, Yunjun Gao
Abstract
LLM watermarking helps trace the origin of generated text, but faces stealing attacks that recover watermark information, scrubbing attacks that remove watermark signals, and spoofing attacks that forge text accepted as watermarked. These attacks are often studied in isolation, leaving their connections unclear. Evaluations also often lack shared detector calibration, metric definitions, and reporting protocols. Moreover, measuring attack success and text quality separately makes it difficult to identify attacks that are both effective and quality-preserving. We propose MarkSec, a general framework that unifies analyses of stealing, scrubbing, and spoofing. We evaluate attacks under a common reporting protocol and introduce a quality-constrained attack success metric to assess effectiveness and text quality jointly. Experiments across representative watermark families, attacks, LLMs, and datasets reveal three findings. First, attacks that appear strongest by watermark removal alone can fall behind general rewriting when success also requires acceptable text quality. Second, general rewriting remains a strong baseline across watermark families, while its advantage over other scrubbers varies by family. Third, in a case study of one watermark family, stealing-based scrubbers often underperform the best general-scrubbing baselines when text quality is required. These results show that apparent attack winners depend on text-quality constraints, attack generality, and capability assumptions.