Are watermarking defenses effective?

Lens adapted to this topic: Evidence of structural weaknesses

Critics argue that watermarking is structurally fragile: attackers may erase or forge signals, sometimes without knowing the scheme, and even perfect detection would not answer broader questions about authorship or responsibility. Evidence includes theoretical impossibility results, practical watermark-stealing attacks, and reported removal of image watermarks.

• A theoretical study argues that strong language-model watermarking is impossible under stated assumptions, even when detection uses a secret key unknown to attackers.
• One empirical study reports that watermark stealing enabled spoofing and scrubbing of leading schemes with average success above 80% at an attack cost below $50.
• A Waterloo report says its UnMarker tool removed AI image watermarks without knowing the watermark design or whether an image was watermarked.
• Even technically successful detection may correlate poorly with substantive human intellectual contribution, authorship, originality, or responsibility.

Featured sourceWatermark Stealing in Large Language Modelsarxiv.org4 sourcesView sources