Bypassing LLM Watermarks with Color-Aware Substitutions (2403.14719v1)
Abstract: Watermarking approaches are proposed to identify if text being circulated is human or LLM generated. The state-of-the-art watermarking strategy of Kirchenbauer et al. (2023a) biases the LLM to generate specific (green'') tokens. However, determining the robustness of this watermarking method is an open problem. Existing attack methods fail to evade detection for longer text segments. We overcome this limitation, and propose {\em Self Color Testing-based Substitution (SCTS)}, the firstcolor-aware'' attack. SCTS obtains color information by strategically prompting the watermarked LLM and comparing output tokens frequencies. It uses this information to determine token colors, and substitutes green tokens with non-green ones. In our experiments, SCTS successfully evades watermark detection using fewer number of edits than related work. Additionally, we show both theoretically and empirically that SCTS can remove the watermark for arbitrarily long watermarked text.
- Scott Aaronson. 2022. My ai safety lecture for ut effective altruism. Shtetl-Optimized: The blog of Scott Aaronson. Retrieved on January, 13:2024.
- Richard Arratia and Louis Gordon. 1989. Tutorial on large deviations for the binomial distribution. Bulletin of mathematical biology, 51(1):125–131.
- Canyu Chen and Kai Shu. 2023. Can llm-generated misinformation be detected? arXiv preprint arXiv:2309.13788.
- Undetectable watermarks for language models. arXiv preprint arXiv:2306.09194.
- Steven R Dunbar. 2011. The de moivre-laplace central limit theorem. Topics in Probability Theory and Stochastic Processes.
- Large language models for software engineering: Survey and open problems. arXiv preprint arXiv:2310.03533.
- Towards possibilities & impossibilities of ai-generated text detection: A survey. arXiv preprint arXiv:2310.15264.
- Large language models: a comprehensive survey of its applications, challenges, limitations, and future prospects. Authorea Preprints.
- Wassily Hoeffding. 1994. Probability inequalities for sums of bounded random variables. The collected works of Wassily Hoeffding, pages 409–426.
- A watermark for large language models. arXiv preprint arXiv:2301.10226.
- On the reliability of watermarks for large language models. arXiv preprint arXiv:2306.04634.
- Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. arXiv preprint arXiv:2303.13408.
- Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593.
- Illustrating reinforcement learning from human feedback (rlhf). Hugging Face Blog. Https://huggingface.co/blog/rlhf.
- Thomas Lancaster. 2021. Academic dishonesty or academic integrity? using natural language processing (nlp) techniques to investigate positive integrity in academic integrity research. Journal of Academic Ethics, 19(3):363–383.
- Large language models can be guided to evade ai-generated text detection. arXiv preprint arXiv:2305.10847.
- Mark my words: Analyzing and evaluating language model watermarks. arXiv preprint arXiv:2312.00273.
- Exploring the limits of transfer learning with a unified text-to-text transformer. The Journal of Machine Learning Research, 21(1):5485–5551.
- Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156.
- Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. ArXiv, abs/1910.01108.
- Red teaming language model detectors with language models. arXiv preprint arXiv:2305.19713.
- Baselines for identifying watermarked large language models. arXiv preprint arXiv:2305.18456.
- Llama 2: Open foundation and fine-tuned chat models, 2023. URL https://arxiv. org/abs/2307.09288.
- A survey on detection of llms-generated content. arXiv preprint arXiv:2310.15654.
- Watermarks in the sand: Impossibility of strong watermarking for generative models. arXiv preprint arXiv:2311.04378.
- Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306.17439.
- Judging llm-as-a-judge with mt-bench and chatbot arena. arXiv preprint arXiv:2306.05685.
Collections
Sign up for free to add this paper to one or more collections.
