💬 NLP

Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

This paper demonstrates that the statistical perturbations introduced by LLM watermarks can be effectively neutralized by averaging the output distributions of just three to five heterogeneous models, a technique called WASH that not only renders current watermarking schemes undetectable but also improves text quality and generation speed.

Original authors: Zhihao Wu, Gracia Gong, Qinglin Zhu, Yudong Chen, Runcong Zhao

Published 2026-06-01

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Zhihao Wu, Gracia Gong, Qinglin Zhu, Yudong Chen, Runcong Zhao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to identify a specific singer in a crowded room. To make them stand out, you give them a unique, glowing hat (a watermark). If you see someone with that hat, you know, "Ah, that's the AI singer."

This paper argues that this system has a massive, fundamental flaw: it falls apart as soon as you ask more than one singer to perform at the same time.

Here is the breakdown of the paper's findings using simple analogies:

1. The Problem: The "Glowing Hat" is Fragile

Currently, AI companies try to watermark their text by slightly tweaking the math behind how they choose words. It's like a chef adding a tiny, secret pinch of salt to a soup so they can prove they made it.

The Assumption: Researchers assumed that if you see a bowl of soup, you can taste that secret salt and know which chef made it.
The Reality: In the real world, users don't just use one AI. They have access to many different AIs (like GPT, Llama, Qwen, etc.) all at once.

2. The Attack: The "Smoothie" Effect

The authors discovered that if you take the output from three or five different AI models and mix them together, the secret "salt" disappears.

The Analogy: Imagine five different chefs. Each adds a different secret ingredient to their soup to mark it. Chef A adds a pinch of salt to the left side of the bowl; Chef B adds a pinch of pepper to the right; Chef C adds a drop of hot sauce in the middle.
The Result: If you pour all five bowls into one giant blender and mix them up, the salt, pepper, and hot sauce cancel each other out. You are left with a smooth, unseasoned soup that tastes exactly like the original, unmarked recipe. The "watermark" is washed away.

The paper calls this "Linear Ensembles." By simply averaging the predictions of multiple models, the unique "noise" (the watermark) cancels out, leaving the pure, original signal behind.

3. The Solution: "WASH" (The Smart Blender)

The researchers built a tool called WASH (Watermark Attenuation via Statistical Hybridisation) to automate this mixing process.

The Challenge: Different AIs speak different "languages" internally. One might break the word "Gracious" into two pieces ("Gra" + "cious"), while another sees it as one whole piece. A simple blender would get confused and spill the soup.
The Fix: WASH uses a "Fluency-Aware Routing" system. Think of it as a smart traffic controller. If the mix gets stuck on a word that only one model understands, WASH temporarily switches to just that one model to finish the word, then switches back to the group. This ensures the soup stays smooth and the secret ingredients stay canceled out.

4. The Results: The Magic Numbers

The paper tested this against six different watermarking schemes using three major AI models. The results were dramatic:

Before Mixing: The watermarks were screaming to be found (detection scores of 5 to 300).
After Mixing (with just 3 models): The detection scores dropped to below 2. This is below the threshold where anyone would even suspect a watermark exists. It's effectively invisible.
Quality: Not only did the watermarks vanish, but the resulting text was actually better (27.5% improvement in quality) and ran 6 times faster than other methods trying to remove watermarks.

5. The Big Conclusion: A Call for Teamwork

The paper concludes that watermarking is mathematically doomed in a competitive market. As long as different companies use different secret keys (which they must to prove who made the text), a user can always mix them together to erase the proof.

The only way to fix this?
The authors suggest that for watermarks to ever work reliably, all AI companies would need to agree on a single, shared secret key and use the exact same system. Without this unprecedented level of coordination, the "glowing hat" trick will always be washed away by a simple blender.

In short: You cannot hide a secret in a crowd if everyone in the crowd is wearing a different, conflicting secret. If you mix them all together, the secrets disappear.

Technical Summary: Linear Ensembles Wash Away Watermarks

Problem Statement

The paper addresses a fundamental vulnerability in current Large Language Model (LLM) watermarking schemes. While watermarking embeds statistical signatures into generated text to enable detection and attribution, existing research relies on the simplifying assumption that an adversary has access to only a single watermarked model. In reality, users can access multiple heterogeneous LLMs (e.g., via platforms like Hugging Face) simultaneously. The authors posit that in a competitive market where providers use independent secret keys and architectural designs, the perturbations introduced by watermarking are independent across models. This independence creates a structural weakness: by aggregating outputs from multiple models, these independent perturbations can cancel out, recovering the original, unwatermarked distribution and rendering the watermark undetectable.

Methodology

Theoretical Foundation

The authors formalize watermarking as a stochastic perturbation $\delta_i$ applied to a shared underlying consensus distribution $p^*$ . They assume that for $N$ independent providers:

Independence: Perturbations $\delta_i$ are independent across providers.
Zero Mean: The perturbations are centered around the consensus distribution in log-space ( $E[\delta_i] = 0$ ).
Bounded Magnitude: Perturbations are bounded to maintain text quality.

Under these assumptions, the paper proves that the linear ensemble average of $N$ models, $\bar{p}_N = \frac{1}{N}\sum p_i$ , converges to the consensus distribution $p^*$ with an error term of $O(1/\sqrt{N})$ . The watermark signals, acting as uncorrelated noise, are asymptotically washed out, leaving only a second-order error term.

The WASH Algorithm

To translate this theoretical insight into practice, the authors introduce WASH (Watermark Attenuation via Statistical Hybridisation). WASH addresses two critical practical challenges in heterogeneous ensembles: vocabulary misalignment and tokenization differences.

Union-Based Ensemble: Instead of restricting sampling to the intersection of all model vocabularies (which limits expressivity), WASH constructs an ensemble distribution over the union of all vocabularies. For tokens not present in a specific model's vocabulary, that model's probability is set to zero.
Fluency-Aware Routing: When a token is selected that exists in only a subset of models (a "specialist" token), WASH dynamically routes subsequent generation steps to only those models that support the token. This prevents breaking the autoregressive chain. Crucially, the model selection within the specialist set is randomized to avoid introducing new systematic biases that could be exploited by detectors.
Context Re-synchronization: To maintain coherence across models with different tokenizers, WASH employs a decode-encode cycle. After a token is generated, the string is decoded and re-tokenized by each model's specific tokenizer to ensure all models observe semantically equivalent contexts for the next step.
Efficiency: The method utilizes parallel inference with response caching, achieving constant-time per-token complexity regardless of the ensemble size, avoiding the iterative probing or context re-encoding required by prior attacks.

Key Contributions

Theoretical Proof of Vulnerability: The paper provides a rigorous proof that linear ensembling asymptotically recovers the unwatermarked distribution with a convergence rate of $O(1/\sqrt{N})$ , establishing a fundamental limit for unbiased watermarking in multi-provider settings.
WASH Algorithm: A novel framework that overcomes vocabulary mismatches in heterogeneous ensembles via fluency-aware routing and context re-synchronization, enabling effective probability aggregation without sacrificing semantic integrity.
Systematic Evaluation: Comprehensive experiments across six representative watermarking schemes (AAR, DIPMark, ITSEdit, KGW, Exp-Edit, Water-Bag) and three LLMs (Qwen, Llama, Ministral) under both generation-time and final-text detection settings.

Experimental Results

Detection Efficacy

Generation-Time Detection: WASH successfully suppresses detection $z$ -scores from strong baselines (ranging from 5 to 300) to below 2 (near random chance) using as few as 3 models. This is below the standard detection threshold of 4.
Final-Text Detection: For native sequence detectors, WASH reduces the True Positive Rate at 5% False Positive Rate (TPR@5%FPR) to below 50% across all tested schemes, rendering the watermarks statistically undetectable.
Control Experiment: When models share a coordinated watermark (same signal across vocabularies), the ensemble attack fails, confirming that the removal efficacy relies on the independence of perturbations.

Quality and Efficiency

Quality: WASH improves generation quality by 27.5% compared to the best baseline (De-mark) on long sequence generation tasks, outperforming both the watermarked baseline and other removal methods (ToBlend, RandomWalk) on benchmarks like GSM8K, MMLU, and SQuAD.
Efficiency: WASH runs approximately 6× faster than the best baseline (De-mark) on long sequences. While De-mark incurs overheads of 30×–38× due to iterative probing, WASH operates at roughly 1.0×–2.4× the baseline cost through deterministic sampling and synchronized KV caching.

Significance and Claims

The paper claims to reveal a "fundamental vulnerability" in the current paradigm of AI-text watermarking. The authors argue that robust detection in a competitive, multi-provider market is mathematically unattainable without unprecedented coordination among model providers. Specifically, they conclude that:

Unbiased watermarking schemes are inherently fragile against linear ensembling because market forces necessitate independent keys and bounded perturbations.
True robustness requires either accepting this vulnerability or implementing coordinated watermarking strategies where a common signal is shared across all models.
The findings serve as an alert to model providers and researchers, suggesting that isolated model-level defenses are insufficient against cross-model threats and that industry-wide standardization is necessary for effective provenance verification.

The work does not propose new watermarking schemes but rather characterizes the limits of existing ones, emphasizing that the "Achilles' heel" of watermarking is the competitive market structure itself.