通过反向偏置重写，隐蔽绕过大模型文本水印。
LLM Watermark Evasion via Bias Inversion
- 用负对数偏置修正生成词元分布，实现无查询攻击。
- 在多种水印方案下逃逸率超99%，语义失真更小。
- 揭示现有水印机制根本缺陷，适合安全与检测研究者。
文本水印是检测大模型生成内容的有力手段，但其在无查询（黑盒）环境下的鲁棒性仍是开放挑战。现有无查询攻击通常效果有限或严重扭曲语义。本文从理论上分析基于重写的逃避策略，发现降低绿色词元平均条件概率微小幅度，即可使检测概率呈指数级衰减。基于此，提出 extit{偏差反转重写攻击}（BIRA），一种无需查询的实用方法，通过词元意外度识别代理抑制集，并施加负对数偏置。实验表明，BIRA在多种水印方案下实现超99%的逃逸率，同时显著优于先前基线的语义保真度。结果揭示了当前水印方法的根本弱点，强调需进行严格压力测试。代码已公开于https://github.com/ml-postech/LLM-Watermark-Evasion-via-Bias-Inversion。
原文摘要 · Abstract (English)
Watermarking offers a promising solution for detecting LLM-generated content, yet its robustness under realistic query-free (black-box) evasion remains an open challenge. Existing query-free attacks often achieve limited success or severely distort semantic meaning. We bridge this gap by theoretically analyzing rewriting-based evasion, demonstrating that reducing the average conditional probability of sampling green tokens by a small margin causes the detection probability to decay exponentially. Guided by this insight, we propose the \emph{Bias-Inversion Rewriting Attack} (BIRA), a practical query-free method that applies a negative logit bias to a proxy suppression set identified via token surprisal. Empirically, BIRA achieves state-of-the-art evasion rates ($>99\%$) across diverse watermarking schemes while preserving semantic fidelity substantially better than prior baselines. Our findings reveal a fundamental vulnerability in current watermarking methods and highlight the need for rigorous stress tests. Our code is available at \href{https://github.com/ml-postech/LLM-Watermark-Evasion-via-Bias-Inversion}{here}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。