On the Reliability of Watermarks for Large Language Models
Tests marks against paraphrasing, copy-paste mixing and human rewriting. Finds that marks weaken but often remain detectable once enough text is available.
What it is
The follow-up asks the question everyone has: what happens after people edit the text? The authors test machine paraphrasing, human rewriting and mixing marked text into unmarked documents. The mark weakens with every attack but, given enough text, often remains detectable, because an attacker has to change a large fraction of tokens to erase a statistical pattern. The practical lesson is that watermark detection is a function of how much text survived, not a yes or no property of the document.
When to use this entry
Cite it for the length-versus-edit trade-off and for human-paraphrase results.
Questions
Does paraphrasing remove a watermark completely?
This paper finds the mark degrades but often survives in long passages; later work and the providers' own tests show full rewrites remove it.