攻击者可复制可信模型的水印，伪造内容来源
DITTO: A Spoofing Attack Framework on Watermarked LLMs via Knowledge Distillation
- 通过知识蒸馏复现目标模型的水印信号
- 生成带真实水印外观的伪造文本
- 适用于研究水印安全性的研究人员
大语言模型水印的可信性建立在特定水印可证明作者身份这一假设之上。我们揭示该假设存在严重漏洞：提出水印欺骗攻击，使恶意模型能生成带有可信受害者模型真实水印外观的文本，实现对有害内容（如虚假信息）的无缝嫁接。攻击核心在于将微调过程中无意继承的数据模式——即水印放射性——从可检测特征转化为攻击手段。通过从已水印教师模型中进行知识蒸馏，攻击框架可复制并再现受害者模型的水印信号。本工作揭示了文本作者验证中的关键安全缺陷，并呼吁转向能够区分真实与高仿水印的技术范式。代码已开源。
原文摘要 · Abstract (English)
The promise of LLM watermarking rests on a core assumption that a specific watermark proves authorship by a specific model. We demonstrate that this assumption is dangerously flawed. We introduce the threat of watermark spoofing, a sophisticated attack that allows a malicious model to generate text containing the authentic-looking watermark of a trusted, victim model. This enables the seamless misattribution of harmful content, such as disinformation, to reputable sources. The key to our attack is repurposing watermark radioactivity, the unintended inheritance of data patterns during fine-tuning, from a discoverable trait into an attack vector. By distilling knowledge from a watermarked teacher model, our framework allows an attacker to steal and replicate the watermarking signal of the victim model. This work reveals a critical security gap in text authorship verification and calls for a paradigm shift towards technologies capable of distinguishing authentic watermarks from expertly imitated ones. Our code is available at https://github.com/hsannn/ditto.git.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。