水印应被视为一种监控原语：NeurIPS 2026 立场论文呼吁重新评估水印的归因风险

View PDF HTML (experimental)

Abstract:Watermarking is a primary means for providers of generative models to meet legal requirements to mark synthetic content. A watermark embeds a hidden signal into generated content that a detector holding a secret key can later recover. Its security is evaluated primarily against adversaries who remove or forge this signal in individual outputs. We argue that watermarking should also be evaluated and governed as a \emph{monitoring primitive}, because the same signal can link outputs to the entity that generated them. We show that (i) internal observers with detector access attribute outputs to individual entities even under zero-bit watermarks, which encode no identity, when each entity holds its own key, and (ii) external observers without keys or detectors identify the source of unseen text and image outputs in the configurations we test. Both depend on deployment choices that evaluations do not report, namely how fine-grained and persistent the bindings between keys and entities are and who may query the detector. We call for evaluations to report attribution and identification accuracy alongside robustness, and for governance to limit these bindings and detector access.

Comments:	Accepted to NeurIPS 2026 (Position Track)
Subjects:	Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computers and Society (cs.CY); Machine Learning (cs.LG)
Cite as:	arXiv:2605.13095 [cs.CR]
	(or arXiv:2605.13095v4 [cs.CR] for this version)
	https://doi.org/10.48550/arXiv.2605.13095 arXiv-issued DOI via DataCite

Submission history

From: Toluwani Aremu [view email]
[v1] Wed, 13 May 2026 07:10:04 UTC (697 KB)
[v2] Thu, 14 May 2026 13:23:50 UTC (697 KB)
[v3] Sat, 26 Sep 2026 12:44:23 UTC (710 KB)
[v4] Thu, 22 Oct 2026 20:11:53 UTC (1,321 KB)