Metraipolis › archive › dc_ef2a75bec828

Semantic Watermarking with Order-Robust Detection over Sub-sentence Units — arXiv:2608.27666

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.27666
License (as archived): CC0-1.0
Archived: 2026-10-17T10:47:53.077Z
SHA-256 of the archived text: 35e550924090e410a1643c5ed7d53de473a550842c981880059c12d84f7482fb
Stable URL of this page: https://metraipolis.com/documento/dc_ef2a75bec828

How to cite

Semantic Watermarking with Order-Robust Detection over Sub-sentence Units — arXiv:2608.27666 — arXiv (en), https://arxiv.org/abs/2608.27666 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_ef2a75bec828 (Metraipolis archive dc_ef2a75bec828, sha256 35e550924090e410a1643c5ed7d53de473a550842c981880059c12d84f7482fb)

BibTeX

@misc{dcef2a75bec828,
  title = {Semantic Watermarking with Order-Robust Detection over Sub-sentence Units — arXiv:2608.27666},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.27666},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_ef2a75bec828; sha256 35e550924090e410a1643c5ed7d53de473a550842c981880059c12d84f7482fb},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.27666. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Semantic watermarks tie the mark to sentence meaning rather than token choices, promising robustness to content-preserving edits. However, the detector only observes attacker-supplied text, which can be reworded, reordered, or resegmented to evade detection without content loss. Rewording, reordering, and resegmentation all cause embedding displacement: detection tests embeddings different from those selected during watermarking and can therefore lose the mark. Our adaptive embedding displacement attack (EDA) admits all three edits under a single objective that maximizes this displacement. It uses a public paraphraser and surrogate encoder without access to the provider's generator or secret key. At a 5% false-positive rate (FPR) and content-preservation threshold $\bar{q}=90\%$, EDA successfully removes the mark on between 32.6% and 47.9% of documents across four schemes, the highest among the tested attacks. Therefore, EDA evaluates the schemes' robustness more thoroughly than passive paraphrasing. To address these vulnerabilities, we design (k)-SwordStamp: semantic watermarks with order-robust detection over sub-sentence units, reducing sensitivity to attacker-chosen structure at a small quality cost. Against k-SwordStamp, the strongest no-box attack we test is an EDA variant adapted to its design, with a 10.8% attack-success rate. A stronger EDA with access to the provider's detector and secret key reaches a 39.7% attack-success rate, compared with 65.5% on k-SemStamp. Our code is available at this https URL .

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-08-31 in cs.AI).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Computation and Language (cs.CL).
Pagina del lavoro: https://arxiv.org/abs/2608.27666 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-17T10:33:42.463Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-08-31?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).