LLM-Watermark-Attack-Papers

This repository contains research and tools for watermark attacks on Large Language Models (LLMs). It aims to help researchers and developers understand watermarking techniques and their challenges.

---

1. Attack Categories

1.1 Watermark Stealing Attacks

• Watermark Stealing in Large Language Models

  • Authors: Nikola Jovanović, Robin Staab, Martin Vechev
  • ICML 2024
  • Paper: http://arxiv.org/abs/2402.19361
  • Code: https://github.com/eth-sri/watermark-stealing
  • Official Site: https://watermark-stealing.org/
  • Initial Version: 29 Feb 2024

• Large language model watermark stealing with mixed integer programming

  • Authors: Zhaoxi Zhang, Xiaomei Zhang, Yanjun Zhang, Leo Yu Zhang, Chao Chen, Shengshan Hu, Asif Gill, Shirui Pan
  • Paper: https://arxiv.org/abs/2405.19677
  • Code: https://github.com/plll4zzx/mip_watermark_stealing
  • Initial Version: 30 May 2024

• Toward Breaking Watermarks in Distortion-free Large Language Models

  • Authors: Shayleen Reynolds, Saheed Obitayo, Niccolò Dalmasso, Dung Daniel T. Ngo, Vamsi K. Potluru, Manuela Veloso
  • AAAI 2025 Workshop
  • Paper: https://arxiv.org/abs/2502.18608
  • Initial Version: 25 Feb 2025

1.2 Watermark Scrubbing/Removal Attacks

• Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense

  • Authors: Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, Mohit Iyyer
  • NeurIPS 2023
  • Paper: https://arxiv.org/abs/2303.13408
  • Methods: DIPPER
  • Code: https://github.com/martiansideofthemoon/ai-detection-paraphrases
  • Initial Version: 23 Mar 2023

• Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models

  • Authors: Hanlin Zhang, Benjamin L. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, Boaz Barak
  • ICML 2024
  • Paper: https://arxiv.org/abs/2311.04378
  • Code: https://github.com/hlzhang109/impossibility-watermark
  • Official Site: https://hanlin-zhang.com/impossibility-watermarks/
  • Initial Version: 7 Nov 2023

• Watermark Smoothing Attacks against Language Models

  • Authors: Hongyan Chang, Hamed Hassani, Reza Shokri
  • Paper: https://arxiv.org/abs/2407.14206
  • Methods: Smoothing Attack
  • Code:
  • Initial Version: 19 Jul 2024

• Optimizing Adaptive Attacks against Content Watermarks for Language Models

  • Authors: Abdulrahman Diaa, Toluwani Aremu, Nils Lukas
  • Paper: https://arxiv.org/abs/2411.01222
  • Code: https://github.com/ML-Watermarking/ada-llm-wm
  • Initial Version: 3 Oct 2024

• De-mark: Watermark Removal in Large Language Models

  • Authors: Ruibo Chen, Yihan Wu, Junfeng Guo, Heng Huang
  • Paper: https://arxiv.org/abs/2410.13808
  • Code:
  • Initial Version: 17 Oct 2024

• $B^4$: A Black-Box Scrubbing Attack on LLM Watermarks

  • Authors: Baizhou Huang, Xiao Pu, Xiaojun Wan
  • Paper: https://arxiv.org/abs/2411.01222
  • Methods: Black-Box scruBBing attack($B^4$)
  • Code:
  • Initial Version: 2 Nov 2024

• Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation?

  • Authors: Leyi Pan, Aiwei Liu, Shiyu Huang, Yijian Lu, Xuming Hu, Lijie Wen, Irwin King, Philip S. Yu
  • Paper: https://arxiv.org/abs/2502.11598
  • Code: https://github.com/THU-BPM/Watermark-Radioactivity-Attack
  • Initial Version: 17 Feb 2025

1.3 Watermark Spoofing Attacks

2. Benchmarks & Evaluations

• WaterPark: A Robustness Assessment of Language Model Watermarking
  • Authors: Jiacheng Liang, Zian Wang, Lauren Hong, Shouling Ji, Ting Wang
  • Paper: http://arxiv.org/abs/2411.13425
  • Code: https://github.com/JACKPURCELL/sok-llm-watermark
  • Initial Version: 20 Nov 2024
  • Last Updated: 17 Dec 2024