TLDR: New research reveals that Large Language Model (LLM) watermarks are more vulnerable than previously thought, especially to subtle character-level changes like typos and homoglyphs. These small edits can disrupt the LLM’s tokenization process, effectively erasing watermarks with minimal text alteration. The study also introduces a Genetic Algorithm-based attack guided by a reference detector, enabling effective watermark removal even with limited access to the original detector. Furthermore, it proposes adaptive compound character-level attacks to bypass common defenses, highlighting the urgent need for more robust watermarking schemes.
Large Language Models (LLMs) have become indispensable tools, generating high-quality content for various applications. To address concerns like copyright infringement, misuse, and the need to distinguish AI-generated text from human-written content, LLM watermarks were introduced. These watermarks embed subtle, detectable signals during text generation, allowing for later identification by a detector. However, new research suggests that the robustness of these watermarks might be significantly overestimated.
A recent study, titled “Character-Level Perturbations Disrupt LLM Watermarks,” by Zhaoxi Zhang, Xiaomei Zhang, Yanjun Zhang, He Zhang, Shirui Pan, Bo Liu, Asif Gill, and Leo Yu Zhang, reveals that existing methods for assessing watermark robustness are often suboptimal. Previous watermark removal attacks typically relied on token-level (e.g., synonym replacement) or sentence-level (e.g., paraphrasing) modifications. This new research highlights that a different approach, focusing on character-level changes, is far more effective at erasing these embedded signals.
The Power of Character-Level Edits
The core insight of the paper is that character-level perturbations, such as introducing typos, swapping characters, deleting characters, or substituting homoglyphs (characters that look similar, like ‘s’ and ‘ˇs’), can have a disproportionately large impact on LLM watermarks. This is because these small, often visually imperceptible changes can disrupt the tokenization process of the LLM. When a single character within a word is altered, it can cause that word to be split into multiple smaller subword tokens. This phenomenon significantly increases the “attack range” of a single edit, meaning one small change can affect several tokens and their associated watermark signals simultaneously.
For instance, if a watermark relies on a specific token, changing just one character in that token can break it into new, unwatermarked sub-tokens. This is far more efficient than token-level changes, which typically affect only one token at a time, or sentence-level changes, which require extensive modifications to the text. Experiments across five different watermarking schemes and two widely-used LLMs (LLaMA-3-8B and OPT-1.3B) consistently demonstrated the superior effectiveness of character-level perturbations, especially when aiming for minimal changes to the text.
Navigating Limited Access with Guided Attacks
The researchers also explored realistic scenarios where an adversary has limited access to the watermark detector. In such “black-box” settings, directly querying the original detector repeatedly for optimization is not feasible. To overcome this, the study proposes a novel approach using a “reference detector” and a Genetic Algorithm (GA).
A lightweight reference detector is first trained using a limited number of queries to the original watermark detector. This reference detector learns to approximate the behavior of the original. Then, a Genetic Algorithm, a gradient-free optimization technique, is employed. The GA iteratively explores different character-level perturbations, guided by the feedback from the reference detector, to identify the most impactful token positions for watermark removal. This method allows adversaries to effectively remove watermarks even under strict query budgets, demonstrating strong removal performance.
Also Read:
- Invisible Threats: How Hidden Web Code Manipulates AI Summaries
- Unmasking Hidden Threats: How LLMs Fall for Camouflaged Attacks
The Adversarial Dilemma and Adaptive Defenses
The paper also delves into the challenge of defending against these sophisticated attacks. It introduces the concept of an “adversarial dilemma,” arguing that any fixed defense mechanism can eventually be bypassed by a suitable perturbation strategy. To counter potential defenses like spell-checking, optical character recognition (OCR), Unicode normalization, or character deletion, the researchers propose an adaptive compound character-level attack. This strategy involves applying multiple character modifications at the same position (e.g., a swap combined with a homoglyph substitution) to create complex distortions that are difficult for defense mechanisms to accurately reverse or correct.
These compound perturbations introduce ambiguities that hinder the accurate recovery of the original token, thereby disrupting the watermark key and signal. The findings highlight significant vulnerabilities in current LLM watermark schemes and underscore the urgent need for developing more robust defense mechanisms. Future research directions include improving tokenization strategies and exploring the potential for watermark spoofing using these advanced perturbation techniques. You can read the full research paper for more details at arXiv:2509.09112.
