LLM watermark reversing

[chants]

So due to EU regulation, Claude is now watermarking AI output. https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content

Generally it is obvious the way it is done is by the PRNG used in the sampling to select the next token based on their probabilities. So the PRNG could seed based on the prior 10 tokens or such. This adds a lot more determinism and obviously seeding is expensive so the details might be different. I heard Gemini uses a different tournament style algo.

Defeating this looks very easy, just clean it through a non watermarked model or have a model suggest substitutions that are applied randomly to break the signal they measure.

Do you think deducing their proprietary watermark is possible? Such as asking the model many times to complete 1 token, then 2 token prefixes, etc s you can build a prefix based probabilities or start to learn how many prior tokens are used wtc? Assuming you can stay under the radar, I think this would allow certain parts of the algo to be determined. A completion sampling attack on watermark scheme.

Any other better techniques to remove or defeat it? I found this paper on one idea De-mark: Watermark Removal in Large Language Models https://arxiv.org/abs/2410.13808

[DARKER]

Some interesting reading about theme:

https://arize.com/blog/a-watermark-for-large-language-models/
https://www.nature.com/articles/s41586-024-08025-4

[chants]

I found this interesting repository BIRA: LLM Watermark Evasion via Bias Inversion https://github.com/ml-postech/Bias-Inversion-Rewriting-Attack

Due to EU regulations it isnt wise to market anything as a watermark remover rather a dual use tool that incidentally removes watermarks is the only real compliant way already.

My understanding now based on that is the model uses k=1 or k=2 really short last token windows. The providers have a secret cryptographic key and modify it with the last 2 tokens as a PRNG seed to label all output tokens as red or green at random, green are biased slightly when sampling tokens. This way validating doesnt need to replay through the model or require probabilities. Just knowing what tokens are red vs green.

To clean text thus requires every 5-8 words about replacing with a non green list token. Basically keeping the signal towards 50/50 indistinguishable as if a human wrote it while if you are 80/20 its a strong indicator the LLM produced it.

Incidentally turning up model temperature makes more strong probabilities so that basing green is less impactful.

In some ways these hidden biases would seem to be worse quality of output as well as maybe messing up high temperature or causing artificial limits on it. Running open weight models is an easy win though as you control the sampling PRNG. Mostly this is a problem from the frontier closed model labs though any cloud provider likely must add it. Running local has utility. Otherwise its still quite simple to replace every 5 to 8 words each replacement 50/50 chance of breaking the statistical signal

[th3tuga]

Originally Posted by DARKER

Some interesting reading about theme:

https://arize.com/blog/a-watermark-for-large-language-models/
https://www.nature.com/articles/s41586-024-08025-4

That is indeed very interesting.
In the past, it was fairly common for people to run multiple accounts on online forums and use AI to generate posts in a variety of styles, making them seem like different real users. With AI watermarking and fingerprinting now becoming more common, it should become much easier to spot this kind of behavior and reduce how often it happens. That is a good thing, because it helps make online discussions more honest and transparent. Not surprisingly, the people most upset about AI detection often seem to be the ones who benefited from it the most.

Using multiple accounts and AI-written posts to pretend to be different real users is dishonest and undermines trust in online communities. It creates a false impression of support, popularity, or consensus, while hiding the fact that one person or group is manipulating the conversation behind the scenes. That kind of behavior damages genuine discussion, misleads other users, and makes forums less useful for everyone.

AI watermarking and fingerprinting are a welcome step because they can help expose these tactics and discourage people from abusing AI in this way. People who rely on these methods often object when detection improves, but that criticism usually says more about their own conduct than about the technology itself.

[chants]

So I'm more focusing on the simple fact that LLMs have definitely shown language is not a special human unique ability. The watermarks are not intended to stop abuse you describe and are more just a simple way to detectably source material with some good probability of being correct. I dont think anyone is upset about this given how trivial defeating language schemes is.

The problem you refer to is real. And it isnt going to be solved by watermarks in the long run. That is coser to the classic bot detection and duplicate user detection or even paying for metric manipulation than what we were doing to discuss here. This is about if we can reverse these watermarks including detecting without the vendors tools which is hard due to the crypto seed, and remove them which is easy as these LLMs are most useful in generating structured JSON output which could be a set of patches to words or phrases and would make a model self defeat its own watermarks. We cant rely on language alone. No reason to pretend that we can

[th3tuga]

The digital commons, once envisioned as a sanctuary for the democratic exchange of ideas, is currently facing an existential threat from a sophisticated form of deception: the AI-driven masquerade. The practice of using generative AI to operate multiple accounts—creating a curated illusion of a diverse crowd to manipulate discourse—is not merely a "hack" or a clever shortcut. It is a profound betrayal of the social contract that governs online interaction.

At the heart of any healthy forum is the assumption of authenticity. When a user enters a discussion, they do so under the premise that they are engaging with other sentient beings, each bringing a unique set of lived experiences, biases, and perspectives. When a single actor employs AI to simulate a chorus of different voices, they are not participating in a conversation; they are conducting a psychological operation. By fabricating a false consensus, the abuser creates a "mirage of popularity" that can coerce genuine users into silence or mislead them into adopting a viewpoint based on perceived social proof rather than factual merit. This is a calculated distortion of reality designed to hijack the collective intuition of a community.

Furthermore, this behavior erodes the very foundation of trust upon which digital communities are built. Every time a "sockpuppet" network is exposed, the shadow of doubt extends beyond the culprits to every other participant. Users begin to wonder if the helpful advice, the passionate debate, or the supportive comment they encountered was the result of a human heart or a prompted algorithm. This systemic cynicism stifles genuine vulnerability and honest inquiry, transforming vibrant forums into paranoid landscapes where skepticism outweighs curiosity.

The emergence of AI watermarking and digital fingerprinting is, therefore, not an infringement on "creative expression," but a necessary defense of truth. The vehement opposition to these detection tools is telling; those who scream loudest against the "policing" of AI content are often the ones whose influence depends entirely on their ability to remain invisible. To argue that detection tools hinder the utility of AI is to ignore the far greater harm caused by the weaponization of that utility to deceive others.

Ultimately, the abuse of AI to masquerade as multiple users is an act of intellectual cowardice. It is the attempt to exert power without accountability and to achieve influence without the hard work of genuine persuasion. For online spaces to remain useful, they must be grounded in transparency. The transition toward a web where AI-generated content is identifiable is a vital step in reclaiming the internet as a place for human connection. We must condemn the architects of these artificial echoes and embrace the tools that return the voice of the community to the people who actually inhabit it.

To understand the gravity of this deception, one must look beneath the surface at the technical mechanisms that enable these masquerades and the forensic tools now rising to meet them. The ability to simulate multiple personas is not just a matter of prompting; it is an exercise in linguistic engineering. Bad actors leverage "system prompts" to define specific personas—assigning a designated age, regional dialect, education level, and emotional temperament to each account. By adjusting parameters such as temperature (which controls the randomness of the output) and top-p sampling, a single operator can ensure that one account sounds like a cautious academic while another sounds like an impulsive teenager. This allows for the creation of a synthetic ecosystem where "different" users can appear to disagree, debate, or reinforce one another, creating a sophisticated loop of artificial validation.

However, the perceived invisibility of these actors is being dismantled by the science of AI forensics. While a human reader may be fooled by a stylistic shift, the underlying mathematical structure of the text often remains consistent. Large Language Models (LLMs) tend to exhibit specific statistical signatures—patterns of token distribution and probability—that differ from human cognition. Forensic tools now utilize "perplexity" and "burstiness" metrics to spot these anomalies. Human writing is naturally erratic, characterized by sudden shifts in sentence length and unpredictable word choices. AI, conversely, tends toward a smoothed-out statistical average. When a forum is flooded with accounts that all exhibit the same low-perplexity signature, the masquerade is mathematically exposed, regardless of how different the "personalities" appear to be.

The most potent weapon in this fight is the implementation of cryptographic watermarking. This process involves the model provider subtly biasing the selection of tokens during the generation process. By choosing words from a specific "green list" based on a secret key, the AI embeds a hidden pattern into the text. To a human, the sentence remains seamless and natural; to a detection algorithm, the text contains a clear, indelible stamp of its origin. When combined with fingerprinting—which analyzes the unique "style-drift" or latent space markers of a specific model version—it becomes nearly impossible for a user to claim that a series of coordinated posts were written by independent humans.

Moreover, the integration of metadata analysis and behavioral heuristics adds another layer of defense. While AI can mimic a voice, it struggles to mimic the organic behavior of a human user. Forensic analysts look for "temporal synchronization"—instances where multiple accounts post in a sequence that suggests a single person switching tabs, rather than several people reacting independently. When the linguistic fingerprint of an AI watermark aligns with the temporal patterns of a single IP address or device ID, the illusion of a crowd collapses into the reality of a single manipulator.

The technical evolution of detection is not merely a cat-and-mouse game; it is the construction of a digital immune system. By stripping away the anonymity of synthetic personas, we force a return to authentic engagement. The effort to bypass these safeguards is a testament to the value of the truth they protect.

[chants]

Language is not a Turing test. Simple as that. The watermarks are futile. They can filter out very some low effort content. We are at the point where the only solutions must verifiably be tied to the physical world or a central database. But ideas like a government ID system come with plenty of downsides.

It is also the case that useful contributions that are AI assisted are also a positive. So just a blanket AI ban isnt that great. We end up with human slop instead of AI slop which is often even worse. It is essy to safeguard online systems by evaluating the validity and accuracy of contributors. That way high quality content is rewarded and slop is penalized. Noone cares if it came from a human or AI or at least they shouldnt care. There is a lot of emotion and extreme reactions nowadays as middlemen and gatekeepers are losing power and control. Just a typical reorganization similar to what happened during the Industrial revolution