SIRA: Exposing Vulnerabilities in Text Watermarking with Self-Information Rewrite Attacks

We sincerely thank the reviewer for the comments and constructive suggestions. We address the concerns below:

Q1: The primary strategy for maintaining semantics is changing only potential "green" words while providing a masked template.

A1: We want to clarify the misunderstanding here. The primary role of the template is to form the attack, not to preserve semantics.The reason why previous attacks do not perform as well as us is that the brute force manner paraphrasing tends to preserve original watermark green token components (e.g., words, expression). The newly generated or changed text will dilute the remnant watermark pattern strength. However, since these methods rely solely on asking the LLM to paraphrase, the process is untargeted and uncontrollable, resulting in remnant watermark patterns that still allow detectors to identify the text as watermarked. In contrast, our method providing this “cleaner template” by actively removing potential "green" tokens, transforms the paraphrasing task into a task more similar to a fill-in-the-blank task to achieve attack. Our main experiment presented in Table 1, along with the valuable ablation study requested by the reviewer (addressed in Q4), demonstrates that our template-based approach did lead to better attack performance.

Q2: Why does SIRA have a shorter execution time?

A2: The total time consumption for SIRA consists of two parts: two generations by the base model and the self-information mask. The self-information mask is nearly negligible, as it does not require any text generation (less than 0.1 seconds). The other two generations will run around 4-5 seconds(256 tokens) per generation on a single A100 gpu. Thus the total execution time is around 10 seconds. We use the open-source huggingface library in our experiment, the shown result could be easily validated by a few lines of code. For details of GPT Paraphraser and DIPPER, please refer to our global response and A3.

Q3: Computation Cost compared to GPT Paraphraser not fair

A3: We emphasize that GPT Paraphraser uses a closed-source model, limiting our access to details. OpenAI primarily uses H100 clusters, according to the OpenAI forum. We can only try our best to ensure a fair and comprehensive comparison, with the note solely aimed at maintaining transparency and rigor for readers.

To fully address the reviewer’s concerns，We retested the execution speed of GPT Paraphraser on the same day with a 4-hour interval for 4 times in one day, conducting a total of 4 (times) * 7 (watermarks) * 50 (queries) = 1400 samples. The final average time per text is 12.6±0.4 seconds which is aligned with the data we showed in paper. We are glad to conduct further tests if the reviewer suggests a more rigorous testing method.

From another perspective, consider the cost of processing 1M tokens of watermark text using third-party services. Using GPT Paraphraser would cost 20 \$(input+output), according to OpenAI's price list. In contrast, our method costs 0.22$\times$2(input + output)$\times 2 (two iterations) = 0.88 \, based on AWS Bedrock pricing. Our cost is significantly lower.

Q4: Ablation for paraphrasing twice with no mask

A4: We agree with the reviewer that such an ablation study is necessary to ensure the reliability of the conclusions and thankful for the reviewer's insightful suggestion. We conduct the experiment and show the data in the table below. The experiment follows the ablation part setting and uses Unigram as the watermark algorithm.

The results show no mask but twice paraphrasing ASR is 70% which is lower than our proposed methods.

Dear reviewer AqqW,

We appreciate your feedback and suggestions on our work. We strive to address your questions in our previous responses. The key concerns were why SIRA has shorter execution time, an ablation comparison with paraphrase twice, and cost comparison with GPT Paraphraser. We also clarify that the mask was not designed to keep semantics but to form an attack. Our response above addresses those concerns and include the new experiment required by the reviewer. If there are specific parts that are unclear to the reviewer, we are more than happy to revise them.

Please let us know if you have any remaining concerns.We thank you again for your valuable time and constructive feedback.

Best, Authors

We thank the reviewer for the response! We would greatly appreciate it if the reviewer could let us know whether your concerns have been addressed, as this will help us further improve our paper.

Dear Reviewer AqqW,

Thank you for your valuable feedback and the time you've devoted to reviewing our work. With the discussion period will end in 24 hours, we note that we have not yet received any further comments from you.

If you feel your concerns have been adequately addressed, we kindly ask you to consider revising your score. If you have any remaining concerns, we would be glad to provide additional clarifications.

Best regards, The Authors

Thank you for the response! I will keep the scores as they are.

We thank reviewer ATEL for the valuable time for providing us feedback. We address the concern below:

Q1: motivation and why is transparency desirable for watermark removal attacks via paraphrasing?

The need for a powerful, lightweight tool to evaluate watermark robustness is a well-recognized problem in text watermarking, as noted by reviewer 91eq. Current paraphrasing-based watermark removal methods like GPT Paraphraser operate as black boxes. This opacity means that repeated attempts to attack the same watermarked text may produce highly variable results due to random variations in the black box paraphrasing process.

In contrast, our approach is grounded in the well-established concept of self-information. The generated mask template is deterministic and targeted, which reduces randomness and instability, thereby enhancing the method's effectiveness and stability.

Q2 limitation is computational cost, three model are used

A2: We clarify here only one Llama3-8b model is used in our method as we mentioned in Lines 69, 350, 461. The total time consumption for SIRA consists of two parts: two paraphrasing and self-information mask.The self-information mask is nearly negligible, as it does not require any text generation (less than 0.1 seconds). The other two generations take around 4-5 seconds per generation on a single A100 GPU. Thus the total execution time is around 10 seconds. We use huggingface transformer in our experiment，the presented results could easily be validated by several lines of code.

In comparison, the DIPPER method utilizes a specially fine-tuned model for text paraphrasing. Its larger parameter size (indicated by vram in table 2) and model architecture result in 15 seconds per run on two A100 GPUs. Notably, DIPPER inherently relies on this fine-tuned model, preventing it from transferring to a smaller model. Consequently, our method is faster and has weaker resource requirements.

Q3 How can it be ensured that the LLaMA 3 rewriting can favor red tokens to achieve watermark removal?

A3: For a well-designed watermarking algorithm, the probability of identifying text generated by an LLM (without watermarking intervention) as positive should theoretically be zero. Otherwise the watermark algorithm is problematic which will have a high false positive rate.

The reason why previous paraphrasing approaches fall short in bypassing watermark detection is simple paraphrasing is generated with context (original watermarked text), with such context LLM tend to preserve original context component (e.g words, expression), so even new generated content part are “clean” and will dilute the strength of watermark, the leaving behind n-gram remnants from original text that still allow detectors to identify the watermark pattern. By contrast, our method creates a cleaner template that actively removes potential green tokens, minimizing n-gram remnants and thereby significantly enhancing the attack success rate as we showed in the experiment part.

Q4Why can this method remove SIR watermarking while existing methods fail?

A4: We respectfully disagree with the reviewer as we never make such a claim in our paper. Our method outperforms other attack baseline in SIR watermark but we do not claim existing methods failed. Notably, we are only 1.4% better than synonyms substitutes. SIR dynamically produces a green list based on the preceding tokens to the watermark logits. Our proposed self-information is also based on the conditional of preceding tokens. Meanwhile, The SIR watermark logit exclusively 1 or -1, this makes token self-Information value change almost the same. This results in most SIR-embedded token self-information values falling within the same range, making our percentile-filter highly effective.

Q5 Which models are used as (line 290) and the base LLM (line 307), respectively?

A5: We clarify here only one model is used in our method. We kindly remind the reviewer we already explain in Line 289 that the base LLM refers to M attack. We thank the reviewer's suggestion and will change accordingly to reduce possible misunderstanding.

Dear reviewer ATEL,

We appreciate your time for providing us feedback. We strive to address your questions in our previous responses. We strive to address your questions in our previous responses. The key concerns were motivation, the mechanism of LLMs watermark, the possible misunderstanding regarding experiment setting and experiment results. We also clarify that we only use one model in our method and the mentioned two inconsistent results are different experiments. Our response above addresses those concerns. If there are specific parts that are unclear to the reviewer, we are more than happy to revise them.

Please let us know if you have any remaining concerns.We thank you again for your valuable time and feedback.

Best, Authors

Dear Reviewer ATEL,

Thank you for your valuable feedback and the time you've devoted to reviewing our work. With the discussion period will end in 24 hours, we note that we have not yet received any further comments from you.

If you feel your concerns have been adequately addressed, we kindly ask you to consider revising your score. If you have any remaining concerns, we would be glad to provide additional clarifications.

Best regards, The Authors

We thank the reviewer 91eq for providing such comprehensive and constructive feedback. We address the concerns below:

Q1: Figure placement and table format

A1: We appreciate the reviewers' valuable examination and suggestions. We have fixed the issue in the updated manuscript.

Q2: The difference between our work and other paraphrasing attacks

A2: We would like to take this opportunity to clarify that there are significant differences between our method and other paraphrasing attacks. Specifically, GPT Paraphraser simply instructs GPT model to paraphrase, while DIPPER utilizes a T5-XXL model fine-tuned specifically for paraphrasing. These paraphrasing attacks do not incorporate any special design; current methods perform paraphrasing in a relative brute force manner.

The key insight of our method is that current watermarking techniques require embedding in high-entropy/uniformly distributed tokens [1,2,3,4] to maintain text quality, as detailed in Section F. We are the first to reveal that this inherent requirement can also serve as a potential vulnerability and propose a method on how to exploit it in a black-box setting. Experiments validate the effectiveness(SOTA) and efficiency of our approach compared to all baseline methods . Our method can be applied to new models without requiring fine-tuning and works in challenging black-box settings. We believe our work offers valuable insights for developing more robust watermarking algorithms in the future. We would greatly appreciate it if the reviewer could provide any reference papers on methods leveraging similar ideas for paraphrasing attacks.

Q3:Difference with watermark-stealing attacks

A3: We thank the reviewer for the valuable suggestion, we have added a new section H to discuss the difference in our revised manuscript and cited the mentioned papers.

Watermark-stealing attacks [7,8,9] assume that attacker has:unlimited access to the watermark generated model API (including permission to modify hyperparameters), the detector API (with or with not under different assumption), knowledge of the context size and the watermarked model is aligned (capable of following instructions provided). These assumptions allow the attacker to execute multiple tries with design input prefix to probing the watermark algorithm.

In a black-box paraphrasing attack, we assume that the attacker’s knowledge is limited to only the watermarked text and nothing else. This scenario is more challenging, and the assumptions are significantly weaker. *The frequency-based modification methods employed by watermark-stealing attacks approaches are entirely inapplicable in the black-box settings.

We argue that due to the differing assumptions underlying these two types of attacks, a fair comparison cannot be conducted. Recent studies on watermarks [1,2,3,4,5] do not incorporate such methods into robustness evaluations, and existing attack research [6] similarly do not conduct such comparisons due to the distinct problem setting.

Q4 What distinguishes self-information from entropy and probability, and what are the specific advantages of using self-information in this context?

A4: We are thankful to the reviewer for this valuable question. Theoretical details and analysis please refer to appendix section F. In our preliminary experiments, we tested the direct use of both entropy and self-information for detection. Filtering using entropy is also feasible, but self-information empirically outperforms entropy.

We have conducted an extended experiment to filter based on self-information, entropy and probability. We follow the ablation setting using UPV as a watermark algorithm and set mask ratio to 0.7 for all three methods. We use 50 samples of text and repeat 4 times to get the average attack success rate. The results are shown below

The results show self-information is also empirically better than directly filtered by entropy and probability as we already mentioned in line 269.

We infer the differences as self-information being a more sensitive, context-conditional metric, adapting to token sequences and scaling small probabilities linearly via log transformation. This context adaptability and sensitivity make its empirical performance better.

Q5 In Algorithm 1, is the model M in line 14 the attack model M_attack?

A5: Yes, we are thankful for the reviewer pointing it out. We have fixed this typo in our manuscript.

Dear reviewer 91eq,

We appreciate your feedback and concerns on our work. We strive to address your questions in our previous responses. The key concerns were the self-information comparison with entropy and probability, the comparison with the watermark-stealing method, and the novelty of our proposed work. Our response above addresses those concerns. If there are specific parts that are unclear to the reviewer, we are more than happy to revise them.

Please let us know if you have any remaining concerns.We thank you again for your valuable time and constructive feedback.

Best, Authors

Dear Reviewer 91eq,

Thank you for your valuable feedback and the time you've devoted to reviewing our work. With the discussion period will end in 24 hours, we note that we have not yet received any further comments from you.

If you feel your concerns have been adequately addressed, we kindly ask you to consider revising your score. If you have any remaining concerns, we would be glad to provide additional clarifications.

Best regards, The Authors

We are deeply thankful for reviewer EJ9Y valuable feedback. We clarify below the concerns of the reviewer:

Q1: The semantic preservation of the proposed method is inferior compared to GPT Paraphraser.

A1: We agree with the reviewer’s opinion that our method preserves semantics when using llama3-8b. However, we clarify that the attack method involves a trade-off between resource consumption, attack effectiveness, and semantic preservation. We would like to highlight that our attack performance significantly surpasses that of other baseline methods.

In our experiment, we find that the performance of semantic preservation is highly influenced by the capabilities of the paraphrasing model. We use a lightweight Llam3-8b model to reduce resource requirements. As noted in Section E, replacing Llama3-8b with Llama3-70b in our setup increases the Semantic Preservation score by 16%.

To further address the reviewer’s concerns, we conducted an additional experiment using GPT-4o as the paraphrasing model using our method while keeping all other settings unchanged. This adjustment resulted in a semantic preservation score of 8.02 which closely aligns with GPT Paraphraser(8.25).

Q2: typo in line 124

A2: We appreciate the reviewers' thorough examination. We have corrected this typo in our revised manuscript.

Q3: How to fairly evaluate the balance between the generated text quality and the attack effect?

A3: We are grateful if the reviewer further clarifies the question.We followed previous watermark works[2,3,4,5,6] using perplexity as the metric of text quality. We clarify that text quality is not a problem for current paraphrasing attacks. As we shown in Table 7, a notable conclusion is that compared to watermarked text without attack, the text quality after being rewritten by our method and GPT Paraphraser is improved. This conclusion has also been observed in recent studies [1]. Therefore we mostly focus on attack performance and efficiency together with semantic preservation rather than text quality.

If the reviewer refers to the balance between semantic preservation and attack effectiveness. Evaluating this balance is an open question, depending on user objectives. We clarify that even the DIPPER method, which with the lowest semantic preservation score , maintains sufficient semantic consistency in paraphrased text based on our human evaluation, this also reflected in its original paper human evaluation. Meanwhile as the data shown in Table 7, where s-bert represents the cosine similarity between the original and paraphrased texts. All Model-based methods have already achieved very high similarity scores which means the semantic is well-preserved. Hence, we believe the focus should shift to attack effectiveness. A more effective way is to employ more powerful LLM which increase semantic preservation and attack effects simultaneously.

Q4: Will the attacker really care so much about the resource reduction as shown in Table 2?

A4: We appreciate the reviewer’s feedback. It is true that most attack methods focus solely on performance without considering resource reduction. However, we would like to emphasize that our method also demonstrates state-of-the-art attack performance. An effective method would be even better if it required less resources, wouldn't it?

We would like to explain our motivation for reducing resource consumption from the perspectives of resource efficiency and scalability.

1. Lower the barrier to conduct watermarking research: The current watermarking methods themselves require minimal resources, as a GPU capable of running a model like OPT-1.3b is sufficient for research. However, verifying the robustness of the watermark demands significantly more resources, the mentioned DIPPER requires two A100 to operate.We believe that an effective and efficient method for testing watermark robustness which can run on consumer-level GPUs could lower the barrier to conduct watermarking research, thereby benefiting the community.
2. Scalability: As mentioned in Section E, we have included experiments using larger models such as Llama3-70b to demonstrate the scalability of our method. Using a larger model improves both the attack success rate and semantic preservation. If an attacker has sufficient resources, they could employ more powerful LLMs within our framework to enhance the results.

Dear reviewer EJ9Y,

We appreciate your feedback and concerns. We strive to address your questions in our previous responses. The key concerns were the text quality and motivation of resource reduction. If there are specific parts that are unclear to the reviewer, we are more than happy to revise them.

Please let us know if you have any remaining concerns. We thank you again for your valuable time and constructive feedback. Best, Authors

Dear Reviewer EJ9Y,

Thank you for your valuable feedback and the time you've devoted to reviewing our work. With the discussion period will end in 24 hours, we note that we have not yet received any further comments from you.

If you feel your concerns have been adequately addressed, we kindly ask you to consider revising your score. If you have any remaining concerns, we would be glad to provide additional clarifications.

Best regards, The Authors

[1] Kirchenbauer, J., J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein. "A Watermark for Large Language Models." ICML, 2023.

[2] Zhao, X., P. Ananth, L. Li, and Y.-X. Wang. "Provable Robust Watermarking for AI-Generated Text." ICLR, 2024.

[3] Liu, A., L. Pan, X. Hu, S. Li, L. Wen, I. King, and P. Yu. "An Unforgeable Publicly Verifiable Watermark for Large Language Models." ICLR, 2023.

[4] Lu, Y., A. Liu, D. Yu, J. Li, and I. King. "An Entropy-Based Text Watermarking Detection Method." ACL, 2024.

[5] Zhang, H., B. Edelman, D. Francati, D. Venturi, G. Ateniese, and B. Barak. "Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models." ICML, 2024.