DITTO: A Spoofing Attack Framework on Watermarked LLMs via Knowledge Distillation (2026.eacl-long)
Copied to clipboard
| Challenge: | Large language models (LLMs) generate coherent, human-like text at scale, but raises concerns about authenticity and trust. |
| Approach: | They propose a threat of watermark spoofing that allows a malicious model to generate text containing the authentic-looking watermark of a trusted, victim model. |
| Outcome: | The proposed attack repurposes watermark radioactivity from a discoverable trait into an attack vector and replicates it. |
Similar Papers
Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation? (2025.acl-long)
Copied to clipboard
| Challenge: | Large Language Model (LLM) watermarking is radioactive and enables the detection of watermarks inherited by student models when trained on the outputs of watermarked teacher models. |
| Approach: | They propose two types of watermark removal attacks that allow student models to perform untraceable knowledge distillation while avoiding watermark inheritance. |
| Outcome: | The proposed attacks eliminate inherited watermarks while maintaining knowledge transfer efficiency and low computational overhead. |
ReasMark: A Robust Watermark for Attributing LLM Reasoning Under Knowledge Distillation Attacks (2026.acl-long)
Copied to clipboard
Peizhuo Lv, Ruihua Zhou, Yunpeng Li, Ruigang Liang, Xingshuo Han, XiaoFeng Wang, Wei Dong, Yuling Liu
| Challenge: | Existing reasoning-enhanced large language models fail to provide reliable attribution of reasoning behavior once it is transferred through knowledge distillation. |
| Approach: | They propose to embed a reasoning-length gap in a model by querying a target domain and training a local student to imitate its outputs. |
| Outcome: | et al. show that ReasMark outperforms baselines while preserving task utility. |
Distillation-Resistant Watermarking for Model Protection in NLP (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Existing protection methods such as watermarking only work for images but are not applicable to text. |
| Approach: | They propose a technique that injects watermarks into the victim’s prediction probability corresponding to a secret key and is able to detect such a key by probing a suspect model. |
| Outcome: | The proposed technique detects stealing suspects at 100% accuracy on four NLP tasks while the prior method fails on two. |
Robust Data Watermarking in Language Models by Injecting Fictitious Knowledge (2025.findings-acl)
Copied to clipboard
| Challenge: | Data watermarking in language models injects traceable signals, such as specific token sequences or stylistic patterns, into copyrighted text, allowing copyright holders to track and verify training data ownership. |
| Approach: | They propose a data watermarking approach that injects coherent and plausible yet fictitious knowledge into training data using generated passages describing a fictious entity and its associated attributes. |
| Outcome: | The proposed method is designed to be memorized by the LLM, and that increasing their density, length, and diversity of attributes strengthens their memorization. |
Watermark under Fire: A Robustness Evaluation of LLM Watermarking (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Various watermarking methods have been proposed to identify LLM-generated texts . lack of unified evaluation platforms has left many critical questions unanswered . |
| Approach: | They systematize existing LLM watermarkers and watermark removal attacks and develop a unified platform that integrates them. |
| Outcome: | The proposed systematizes existing LLM watermarkers and watermark removal attacks, mapping out their design spaces. |
CLMTracing: Black-box User-level Watermarking for Code Language Model Tracing (2025.emnlp-main)
Copied to clipboard
| Challenge: | Open-source code language models (code LMs) are a growing threat for intellectual property protection. |
| Approach: | They propose a black-box code LM watermarking framework that uses rule-based watermarks and utility-preserving injection method for user-level model tracing. |
| Outcome: | The proposed framework shows that it performs well across multiple state-of-the-art code LMs and is harmless compared to existing baselines. |
WASA: WAtermark-based Source Attribution for Large Language Model-Generated Data (2025.findings-acl)
Copied to clipboard
Xinyang Lu, Jingtan Wang, Zitong Zhao, Zhongxiang Dai, Chuan-Sheng Foo, See-Kiong Ng, Bryan Kian Hsiang Low
| Challenge: | Large language models (LLMs) have impressive performance but intellectual property concerns are looming . a framework that can be used to perform source attribution for LLMs can be developed. |
| Approach: | They propose a framework that enables an LLM to generate synthetic texts with embedded watermarks that contain information about their source. |
| Outcome: | The proposed framework achieves source attribution accuracy and robustness against adversaries. |
PostMark: A Robust Blackbox Watermark for Large Language Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods to detect LLM-generated text require access to the underlying LLM’s logits, which LLM providers are loath to share due to fears of model distillation. |
| Approach: | They develop a post-hoc watermarking procedure that inserts an input-dependent set of words into the text after the decoding process has completed. |
| Outcome: | The proposed method is more robust to paraphrasing attacks than existing methods. |
MarkLLM: An Open-Source Toolkit for LLM Watermarking (2024.emnlp-demo)
Copied to clipboard
Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, Irwin King, Philip Yu
| Challenge: | Large Language Models (LLMs) embed imperceptible yet algorithmically detectable signals in outputs to identify LLM-generated text. |
| Approach: | They propose to develop an open-source toolkit for LLM watermarking that embeds imperceptible yet algorithmically detectable signals in model outputs to identify LLM-generated text. |
| Outcome: | MarkLLM provides a unified framework for implementing LLM watermarking algorithms, while providing user-friendly interfaces to ensure ease of access. |
Protecting Language Models Against Unauthorized Distillation through Trace Rewriting (2026.acl-long)
Copied to clipboard
| Challenge: | Knowledge distillation is a widely adopted technique for transferring capabilities from LLMs to smaller, more efficient student models. |
| Approach: | They propose methods for modifying teacher-generated reasoning traces to achieve two objectives that deter unauthorized distillation: (1) anti-distillation, or degrading the training usefulness of query responses; and (2) API watermarking, which embeds verifiable signatures in student models. |
| Outcome: | The proposed method achieves strong anti-distillation effect while maintaining or even improving teacher performance. |