MarkSec: Capability-Aware Evaluation of Adversarial Attacks Against LLM Watermarks

2026-09-15

AI Summary

本文提出MarkSec框架，统一分析对抗LLM水印的窃取、擦除和伪造攻击，通过共同报告协议和质量约束的成功度量方法评估攻击的有效性和文本质量。

Abstract

LLM watermarking helps trace the origin of generated text, but faces stealing attacks that recover watermark information, scrubbing attacks that remove watermark signals, and spoofing attacks that forge text accepted as watermarked. These attacks are often studied in isolation, leaving their connections unclear. Evaluations also often lack shared detector calibration, metric definitions, and reporting protocols. Moreover, measuring attack success and text quality separately makes it difficult to identify attacks that are both effective and quality-preserving. We propose MarkSec, a general framework that unifies analyses of stealing, scrubbing, and spoofing. We evaluate attacks under a common reporting protocol and introduce a quality-constrained attack success metric to assess effectiveness and text quality jointly. Experiments across representative watermark families, attacks, LLMs, and datasets reveal three findings. First, attacks that appear strongest by watermark removal alone can fall behind general rewriting when success also requires acceptable text quality. Second, general rewriting remains a strong baseline across watermark families, while its advantage over other scrubbers varies by family. Third, in a case study of one watermark family, stealing-based scrubbers often underperform the best general-scrubbing baselines when text quality is required. These results show that apparent attack winners depend on text-quality constraints, attack generality, and capability assumptions.

Problem

• Adversarial Attacks
• LLM Watermarks
• Attack Evaluation
• Text Quality
• Unified Framework

Innovation

• MarkSec
• Quality-constrained Attack Success Metric
• Unified Analysis Framework