Search papers, labs, and topics across Lattice.
This paper presents a theoretical analysis of Google's SynthID-Text watermarking system, focusing on detection performance and robustness. It proves vulnerabilities in the mean score detection method related to tournament layers and introduces a layer inflation attack to exploit this weakness. The analysis also demonstrates the improved robustness of the Bayesian score and identifies the optimal Bernoulli distribution parameter for watermark detection.
Google's SynthID-Text, a state-of-the-art LLM watermarking system, can be broken by a layer inflation attack, revealing vulnerabilities in its mean score detection method.
Google's SynthID-Text, the first ever production-ready generative watermark system for large language model, designs a novel Tournament-based method that achieves the state-of-the-art detectability for identifying AI-generated texts. The system's innovation lies in: 1) a new Tournament sampling algorithm for watermarking embedding, 2) a detection strategy based on the introduced score function (e.g., Bayesian or mean score), and 3) a unified design that supports both distortionary and non-distortionary watermarking methods. This paper presents the first theoretical analysis of SynthID-Text, with a focus on its detection performance and watermark robustness, complemented by empirical validation. For example, we prove that the mean score is inherently vulnerable to increased tournament layers, and design a layer inflation attack to break SynthID-Text. We also prove the Bayesian score offers improved watermark robustness w.r.t. layers and further establish that the optimal Bernoulli distribution for watermark detection is achieved when the parameter is set to 0.5. Together, these theoretical and empirical insights not only deepen our understanding of SynthID-Text, but also open new avenues for analyzing effective watermark removal strategies and designing robust watermarking techniques. Source code is available at https: //github.com/romidi80/Synth-ID-Empirical-Analysis.
