Multi-bit LLM watermarks can be rewritten without the key: a few accounts are enough to pin a text on someone else

Multi-bit watermarks embed an account identifier in generated text, and a decoder holding the secret key reads that identifier to trace harmful text back to its source account. Earlier attacks removed a watermark or spoofed whether one is present, changing whether text is recognized as watermarked rather than which account the watermark names. Across five published multi-bit watermarking methods and four generators, rewritten texts are decoded to the attacker's chosen target identifier, while a paraphrase without watermark knowledge stays at chance.

The attacker needs no key, only a few accounts it controls and their next-token distributions at the positions it rewrites. A watermarking method makes the generator favor, at each step, a subset of the vocabulary determined by the message and the secret key, and the decoder checks how consistently a text follows each candidate message's subsets. Comparing an account's next-token distribution with the base model shows which tokens are favored, comparing accounts with one another shows which tokens the target message would favor, and a paraphraser restricted to those tokens then rewrites the text.

The attacker can compute a certificate in advance to decide whether a given rewrite is worth releasing. Not every target message is reachable: when accounts are too few or their messages too similar, several targets look the same to the attacker. A certificate of one almost always coincides with the decoder reading the target, a certificate of zero almost never does, and intermediate values stay below realized success for most methods.

The report covers distortion-based multi-bit watermarks, including green-list methods and their multi-bit variants, with experiments on public prompts, open-weight models, and locally simulated accounts; no deployed service or real user was involved. The attacker knows the watermarking scheme and its public hyperparameters, holds the unwatermarked base model and tokenizer, and controls accounts with known identifiers, all watermarked under the provider's single key. For researchers and scheme designers, the result means a decoded identifier should not be treated as conclusive evidence on its own, and the theoretical bound tells a provider which targets no attacker can reach.

The attacker reads the full next-token distribution, whereas real APIs typically return only the top entries, an idealization the source states explicitly. A provider that hides account identifiers, keys the labeling per account, or withholds log-probabilities removes what the attacker reads. The source also notes that the query cost of sample access is not measured, and that the symmetry bound still holds in that setting.