arXiv cs.CL· Hongliang Liu·· 11 小时前AI 评分31
通过 Token 事件证据替换构建预算受限的 KGW 水印规避方法
Constructing Budgeted KGW Evasion through Token-Event Evidence Replacement
AI 导读
研究提出一种预算受限的 KGW 水印规避构造，利用普通短语改写联合选择来自独立模型的 LLM 候选替换，并在完整输出上测量全局 token 编辑距离。在短文本 KGW 测试中，82 条初始可检测来源有 39 条改写后检测器分数 Z < 4，平均实际 token 编辑成本为 16.0%（允许上限 20%）。
正文 · 原文
Abstract:KGW watermarks bias sampling to accumulate keyed detection evidence. We construct budgeted evasion through token-event evidence replacement using ordinary phrase rewrites. Our construction jointly selects compositions of LLM-proposed alternatives from an independent model and measures global token-edit distance on complete outputs. At the largest attainable cost within the budget, exact coverage search maximizes removal of original scored token pairs. It uses a known tokenizer without the key, detector feedback or queries to the watermarked model. Exact accounting separates source evidence removed, evidence created and length effects, with initial strength setting the required reduction. Separate signed-event analysis found that mean suppression arose mainly from removing watermark-enriched source events. In controlled, occurrence-counted, one-token-context KGW tests on short passages, 39 of 82 qualified, initially detected sources yielded rewrites with terminal detector score Z < 4 that passed blinded source-relative model review, at a mean actual token-edit cost of 16.0% under a 20% allowance. To examine whether this initial requirement can be inferred, a separate historical 95-passage study estimated initial detector score Z0 from generation traces with correlation 0.793 and an in-sample association beyond length. This aggregate information did not establish improved allocation, and the separate no-trace stopping test did not reliably exploit cheaper reviewed crossings in the candidate bank. Comparisons did not establish an advantage over simpler selection and ordinary constrained rewriting. The construction makes budgeted evidence replacement executable while exposing limits in signed reduction and recognition of sufficient editing.
| Subjects: | Computation and Language (cs.CL); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2611.00726 [cs.CL] |
| (or arXiv:2611.00726v1 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2611.00726 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Hongliang Liu [view email]
[v1]
Sat, 31 Oct 2026 08:05:50 UTC (351 KB)
来源：arXiv cs.CL · arxiv.org