Multi-bit LLM watermarks can be rewritten without the key: a few accounts are enough to pin a text on someone else
A multi-bit LLM watermark's account identifier can be displaced without the secret key: an attacker with a few accounts of its own can make the decoder read a text as belonging to a different account.