Character watermarks show bias across languages despite tokenizer removal
No Tokenizer, Still a Gap: Cross-Lingual Fairness of Homoglyph and Invisible-Character Watermarking
Computation and LanguageCryptography and SecurityComputers and Society
Summary
Some watermarks hide secret signals in text by swapping letters with lookalike characters or adding invisible marks. These work after the text is written and don’t rely on breaking words into pieces. The authors found that even when avoiding word-breaking tools, these watermarks still work better for some languages than others, especially those using scripts with many lookalike characters. This means that differences in language writing styles cause unequal effectiveness of these hidden signals.
What this means in practice
- •For software localization teams: Design watermarking methods that consider script-based differences to ensure fair signal embedding across languages.
- •For digital content security providers: Develop tools to detect and preserve hidden watermarks in diverse languages despite text copying and stripping.$Commercial implications: This paper enables watermark detection solutions adapted to multiple scripts, improving content traceability products for global clients.
Authors
Alexander Nemecek, Yuqiao Xu, Joseph Falkenburg, Erman Ayday
Abstract
Homoglyph and invisible-character watermarks are edit-based watermarks. Instead of changing how a model generates text, they hide a signal in the text after it is written. They swap some characters for homoglyphs, which look the same, or very similar, but have different Unicode code points, or they insert characters that do not display, all without access to the model that wrote the text. Generation-time watermarks work less well for lower-resourced languages due to how tokenizers split their text. Because they work on individual characters, these watermarks never touch a tokenizer, so we ask whether they escape this gap. Across 40 language varieties in 24 scripts, we measure capacity (the hidden bits each character can carry), how much of it survives routine handling and targeted removal, and how much text a keyed detector needs. Capacity varies 3.3-fold and script accounts for 96\% of that variation. Within Latin script, resource level makes no detectable difference ($ρ=+0.095$, $p=0.78$), but across scripts capacity rises with it ($ρ=+0.54$, 95\% CI $[+0.14,+0.83]$), because lower-resourced languages tend to use scripts with few homoglyphs. Ordinary copy-paste, which strips invisible characters, widens the gap: a detector then needs about 2 code points of English or Persian but 93 of Lao. Removing the tokenizer does not remove the inequity, but instead only changes its source.