Split key watermark detection balances transparency and security for large language models
Could LLM Watermark Detection be Public?
Cryptography and SecurityMachine Learning
Summary
Watermarks in large language models help track and verify AI-generated text but usually require secret detectors to prevent attackers from removing them. The authors studied whether making part of the watermark detection public would create risks or benefits. They propose a method that divides the watermark into two parts: a public part for transparency and a private part for strong verification. Their approach shows that attackers can only affect the public watermark, while the private part still helps catch tampering.
What this means in practice
- •For content moderation teams: Use split-key watermark detection to transparently identify AI-generated content while preserving capabilities to detect tampering behind the scenes.
- •For digital forensics teams: Employ the two-stage split-key method to verify authenticity of text and detect forgery attempts even if partial watermark detectors are public.
Authors
Georgios Milis, Tom Sander, Tomáš Souček, Heng Huang, Pierre Fernandez
Abstract
Watermarking large language models is popular for tracing chatbot and agentic outputs, yet detectors remain unreleased since exposing them could let attackers do targeted edits with the detector's feedback. However, watermarks are already vulnerable to uninformed tampering attacks. We thus first quantify whether a public detector would be an additional liability in a deployment setting at varying levels of access, from token-level scores to a binary verdict. Second, we introduce a split-key public-private watermarking method that exposes one key through a public detector while keeping the other for full verification and forensics. An informed attacker can only move the public signal, creating an imbalance between public and private scores. We introduce a statistical test for this imbalance, and combine it with the full key verdict in a two-stage mechanism. Third, we evaluate the split-key method on a wide range of removal and forgery attacks, comparing the uninformed to detector-informed settings. Public detection improves removal only at small edit budgets, since plain rephrasing already strips the watermark at a lower quality cost, but it does enable forgery, which the private pipeline can identify. Overall, releasing half of the watermark enables transparency and interoperability, and tampering with the released half stays detectable. This bounds the provider's liability and questions the need to keep detectors fully private.