Search papers, labs, and topics across Lattice.
The paper introduces RLSpoofer, a reinforcement learning-based black-box attack, to evaluate the resilience of LLM watermarks against spoofing. RLSpoofer leverages a "local capacity bottleneck" derived from distributional analysis to guide the spoofing process with minimal semantic shift, requiring only 100 human-watermarked paraphrase pairs for training. Experiments show that a 4B model using RLSpoofer achieves a 62% spoof success rate on PF-marked texts, significantly outperforming baselines and highlighting the vulnerability of current watermarking schemes.
Current LLM watermarks are surprisingly easy to spoof: a small 4B model, trained on just 100 examples using reinforcement learning, can fool them over 60% of the time.
Large language model (LLM) watermarking has emerged as a promising approach for detecting and attributing AI-generated text, yet its robustness to black-box spoofing remains insufficiently evaluated. Existing evaluation methods often demand extensive datasets and white-box access to algorithmic internals, limiting their practical applicability. In this paper, we study watermark resilience against spoofing fundamentally from a distributional perspective. We first establish a \textit{local capacity bottleneck}, which theoretically characterizes the probability mass that can be reallocated under KL-bounded local updates while preserving semantic fidelity. Building on this, we propose RLSpoofer, a reinforcement learning-based black-box spoofing attack that requires only 100 human-watermarked paraphrase training pairs and zero access to the watermarking internals or detectors. Despite weak supervision, it empowers a 4B model to achieve a 62.0\% spoof success rate with minimal semantic shift on PF-marked texts, dwarfing the 6\% of baseline models trained on up to 10,000 samples. Our findings expose the fragile spoofing resistance of current LLM watermarking paradigms, providing a lightweight evaluation framework and stressing the urgent need for more robust schemes.
