Randomized Key Selection Cuts Blind-Attacker Watermark Forgery Success from 87% to 1% Without Further Utility Loss

It introduces a randomized key selection defense: the watermark key selection is randomized for each query, and content is accepted as genuine only if a watermark is detected by exactly one key. Unlike existing defenses that embed many watermarks with multiple keys into the same content, this scheme does not further degrade model utility and provides a sample-count-independent upper bound on forgery success for blind attackers. The bound is conditional on key-symmetric, independent detector outcomes; the focus is text watermarking, with a preliminary image study using Tree-Ring.

The defense treats the underlying watermarking method as a black box, so it can be applied to any existing watermarking method to improve its forgery resistance, in contrast to cryptographic watermarks that rely on computational hardness assumptions and require designing new schemes from scratch. Whereas cryptographic watermarks require new scheme design and hardness assumptions, this method acts as a general layer that can be added on top without redesigning the watermarking scheme. The abstract states the method can be applied to any existing watermarking method and calls it modality-agnostic; the image portion uses a preliminary study on Tree-Ring to demonstrate cross-modality applicability.

Against the adaptive blind attackers evaluated, harmful-text forgery success at r=4 keys drops from as high as 87% with a single key to as low as 1%, at negligible computational overhead; a preliminary image study shows a reduction from 100% to 2%. These empirical observations, stated separately from the conditional guarantee, quantify how much multi-key randomization suppresses forgery in both text and image modalities. These are empirical observations reported by the authors in the abstract, against the adaptive blind attackers they evaluate; the image result is a preliminary study.

The scheme targets generative-AI providers that need to verify whether content was generated by their models, and it applies to detection pipelines that can randomize key selection per query and use detection by exactly one key as the acceptance criterion; because it treats the underlying watermarking method as a black box, it is positioned as a general layer that can be added on top of existing watermarking methods rather than a replacement. The abstract calls it modality-agnostic and uses a preliminary Tree-Ring image watermarking study to show cross-modality applicability, so a next step is testing it on more watermarking methods and modalities. The theoretical guarantee is scoped to blind attackers and is conditional on key-symmetric, independent detector outcomes.

The conditional upper bound relies on key symmetry and independent detector outcomes, so readers need to understand how these premises are met under a given watermarking method; the empirical numbers target the adaptive blind attackers the authors evaluate and may differ under other attackers; the image result is described by the authors as a preliminary study with limited coverage; and the currently visible text is the abstract and submission history, without experimental details, attacker setup, or utility metrics, so the specific evaluation conditions still require consulting the original.