LLM watermarking with both robust and fragile signals, so it can flag tampering instead of just claiming provenance like the old stuff.
4 comments
Piggyback spoofing is the first term here that made me sit up, because the old “robust watermark” story never really had to answer that.
The 2D detector (Intact, Tampered, No-Watermark) feels like the right failure mode, honestly, though now I want to know how clean that boundary stays once people start doing normal editor abuse (not adversarial heroics...).
> right failure mode
No, it's just three birttle labels pretending to be security.
> right failure mode
Calling it security is too strong, but the three-way split is still a real improvement over a single provenance bit. The paper is trying to separate intact text from tampered text, not promise that a watermark stops editing, and that distinction matters (especially for piggyback spoofing). What I’d want to see next is calibration under ordinary rewrite noise, since a lot of these schemes look cleaner on adversarial examples than on “someone copyedited the answer a bit” ...
Watermarking for LLMs has mostly been about provenance, which is nice until someone paraphrases, filters, or re-encodes the output and the signal just fades away. The fragile part here is closer to an integrity check than an ownership mark, so you can tell the text was touched even if you can’t prove who wrote it.
That matters because most of the earlier options were basically, log it server-side and trust the platform, or try to spot suspicious text after the fact with a classifier. Those both fall apart once the output leaves the system (copy/paste, translation, edits, chain-of-thought stripped, all the usual mess), so a tamper flag is the piece people actually need if this ever gets used outside demos...