Technical Summary: Mitigating Watermark Forgery in Generative Models via Randomized Key Selection

1. Problem Statement

Generative AI (GenAI) providers utilize watermarking to attribute content to their models, embedding hidden signals detectable via a secret key. A critical security threat to this ecosystem is forgery attacks, where adversaries insert a provider's watermark into content not generated by that provider. This allows attackers to falsely attribute harmful content (e.g., misinformation, violence, or spam) to a reputable provider, damaging their reputation and exposing them to legal liability.

Existing defenses have significant limitations:

• Statistical detection: Analyzing token distributions or artifacts often fails against adaptive attackers.
• Key rotation: Rotating keys after $N$ samples introduces management complexity and leaves the optimal $N$ unclear.
• Multi-key embedding: Embedding multiple keys into a single sample degrades model utility and, as shown by prior work, remains vulnerable if an attacker collects a sufficient number of watermarked samples ($N$) to distill the watermark pattern.

The core challenge is achieving forgery resistance that remains effective regardless of the number of watermarked samples an attacker can collect, without degrading the utility of the generative model.

2. Methodology

The authors propose a randomized key selection strategy that acts as a black-box wrapper for existing watermarking methods (applicable to both text and image modalities).

Core Mechanism

1. Generation: For every user query, the provider randomly selects exactly one secret key from a pool of $r$ keys ($K = \{k_1, ..., k_r\}$) to watermark the generated content. This is identical to standard single-key watermarking in terms of generation overhead.
2. Detection: The provider runs detection tests for all $r$ keys in the pool on the content.
3. Decision Rule:
   • Genuine: Exactly one key is detected (statistically significant).
   • Forged: Zero keys are detected (content is not from the provider) OR two or more keys are detected.
   • Logic: An attacker attempting to forge a watermark by distilling patterns from a dataset of watermarked samples (where each sample uses a different random key) will inadvertently learn a "mixture" of watermark signals. Consequently, their forged content is likely to trigger detection for multiple keys simultaneously, leading to rejection.

Theoretical Framework

The method relies on the assumption of "blind" attackers who cannot distinguish which specific key was used to generate a specific sample.

• Threshold Calibration: To control the family-wise error rate (FWER) across $r$ tests, the per-key threshold $\tau$ is adjusted using the Šidák correction: $\alpha = 1 - (1 - \alpha_{fw})^{1/r}$.
• Theoretical Bound: For blind attackers, the probability of successfully forging a sample (triggering exactly one key) is bounded. The success rate is maximized when the per-key detection probability is $1/r$, yielding an upper bound of $(1 - 1/r)^{r-1}$. Crucially, this bound is independent of the number of samples ($N$) available to the attacker, unlike previous multi-key approaches where guarantees degrade as $N$ increases.

3. Key Contributions

1. Randomized Key Selection Strategy: A simple, black-box approach that significantly improves resistance to watermark forgery across various attacks without requiring new watermarking schemes.
2. Theoretical Guarantees: The first theoretical bound on forgery success that is independent of the attacker's sample size, provided the attacker cannot distinguish keys (blind attack).
3. Empirical Validation: Extensive testing on text (LLMs) and image (diffusion models) modalities, demonstrating consistent reductions in forgery success.
4. Open Source: Release of the implementation code.

4. Experimental Results

The authors evaluated their method against adaptive attackers (both "blind" and "informed") using datasets like AdvBench, HarmfulQ, and CelebA.

• Text Modality:
  • Using four watermarking variants (KGW-SelfHash, Unigram, KGW-Soft, KGW-Hard), the method reduced forgery success rates from near-perfect (up to 100% for single-key baselines) to as low as 2% when using 4 keys.
  • For example, with the Unigram scheme on AdvBench, forgery success dropped from 68% (single-key) to 16% (4 keys).
  • The method remained effective even when scaling to larger models (e.g., LLaMA-13B) and against distillation-based attacks.
• Image Modality:
  • Applied to the Tree-Ring watermarking method, the approach reduced forgery success from 100% (single-key) to 2% with 4 keys.
  • The defense maintained low forgery rates regardless of the number of training images available to the attacker (tested up to 5,000 samples).
• Utility and Robustness:
  • False Negative Rate (FNR): The method preserves the detection of genuine content. The FNR for genuine watermarked content remained negligible (0–3% even with 4 keys), indicating no significant degradation in model utility or detection accuracy.
  • Robustness: Robustness against paraphrasing attacks (e.g., Dipper) remained consistent with the underlying watermarking scheme, as the wrapper does not alter the embedding process.

5. Significance and Limitations

Significance:
The paper argues that this approach offers a practical, deployable security layer for existing watermarking systems. By randomizing key selection and enforcing an "exactly-one" detection rule, it creates a statistical barrier that averaging-based attacks cannot overcome. It eliminates the need for complex key rotation schedules and maintains high model utility.

Limitations and Assumptions:

• Blind vs. Informed Attackers: The theoretical guarantees hold against "blind" attackers. If an attacker can infer which key generated a specific sample (e.g., via a system breach or side-channel), they can cluster samples by key and forge more effectively. In experiments with "informed" attackers (who had key labels), forgery success plateaued at ~65%, though this requires unrealistic access to key labels in practice.
• Instance-Based Attacks: The method cannot defend against "instance-based" attacks where a watermark can be forged using a single sample ($N=1$). This is a vulnerability of the underlying watermarking method (e.g., Tree-Ring) rather than the proposed defense.
• Computational Overhead: Verification scales linearly with the number of keys ($r$). While negligible for text (microseconds), it is more computationally involved for image watermarks requiring diffusion model inversion.
• Trade-offs: Increasing the number of keys requires raising the detection threshold to maintain the global false positive rate, which slightly reduces the true positive rate (robustness) of the underlying watermark, though empirical results show this impact is marginal (2–3%).

In conclusion, the authors posit that randomized key selection is a ready-for-deployment solution that effectively mitigates the threat of watermark forgery for current heuristic watermarking schemes, provided that key secrecy is maintained against inference.