用优化方法生成能绕过所有水印的文本，揭示现有水印不牢靠。
Optimizing Adaptive Attacks against Watermarks for Language Models
- 用偏好优化法自动设计针对性攻击，可绕过水印检测。
- 攻击成功规避所有测试水印，且对未见水印也有效。
- 只需少量计算成本，适合研究者评估水印安全性。
大型语言模型可能被滥用于大规模传播不当内容。内容水印通过在输出中隐藏信息来防止滥用，借助密钥可检测该信息。鲁棒性是核心安全属性，要求逃避检测需显著降低内容质量。尽管已有多种水印方法，但其鲁棒性仅在非自适应攻击下测试——这类攻击不了解水印机制，只能找到次优解。本文将水印鲁棒性建模为优化目标，采用基于偏好的优化方法，针对特定水印方法生成自适应攻击。评估显示：(i) 自适应攻击可成功绕过所有调查过的水印；(ii) 针对任意水印训练出的攻击，亦可规避未见水印；(iii) 基于优化的攻击具有成本效益。研究强调必须在自适应攻击下检验水印鲁棒性。我们已公开可调用的对抗性改写器代码，地址为 https://github.com/nilslukas/ada-wm-evasion。
原文摘要 · Abstract (English)
Large Language Models (LLMs) can be misused to spread unwanted content at scale. Content watermarking deters misuse by hiding messages in content, enabling its detection using a secret watermarking key. Robustness is a core security property, stating that evading detection requires (significant) degradation of the content's quality. Many LLM watermarking methods have been proposed, but robustness is tested only against non-adaptive attackers who lack knowledge of the watermarking method and can find only suboptimal attacks. We formulate watermark robustness as an objective function and use preference-based optimization to tune adaptive attacks against the specific watermarking method. Our evaluation shows that (i) adaptive attacks evade detection against all surveyed watermarks, (ii) training against any watermark succeeds in evading unseen watermarks, and (iii) optimization-based attacks are cost-effective. Our findings underscore the need to test robustness against adaptively tuned attacks. We release our adaptively optimized paraphrasers at https://github.com/nilslukas/ada-wm-evasion.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。