AI 中文总结
该研究提出自适应嵌入位移攻击（EDA），并设计k-SwordStamp语义水印，EDA可高效移除语义水印，k-SwordStamp则提升了水印的鲁棒性。
AI 中文摘要
语义水印将标记与句子含义而非词元选择绑定，有望抵御内容保留型编辑。然而，检测器仅能观察攻击者提供的文本，攻击者可通过改写、重排或重新分段来规避检测且不损失内容。改写、重排和重新分段均会引发嵌入位移：检测测试的嵌入与水印嵌入时所选的嵌入不同，因此可能丢失标记。我们的自适应嵌入位移攻击（EDA）在单一目标下涵盖上述三种编辑，该目标为最大化此位移。EDA使用公开释义器和代理编码器，无需访问提供者的生成器或密钥。在5%的误报率（FPR）和内容保留阈值$\bar{q}$=90%的条件下，EDA在四种方案中成功移除32.6%至47.9%的文档标记，为所测试攻击中最高。因此，EDA比被动释义更能彻底评估方案的鲁棒性。为解决这些漏洞，我们设计了(k)-SwordStamp：基于子句单元的顺序鲁棒检测的语义水印，以较小的质量成本降低对攻击者所选结构的敏感性。针对k-SwordStamp，我们测试的最强无盒攻击是适配其设计的EDA变体，攻击成功率为10.8%；而能访问提供者检测器和密钥的更强EDA，攻击成功率达39.7%，相比之下k-SemStamp的攻击成功率为65.5%。我们的代码可在该https URL获取。
英文摘要
Semantic watermarks tie the mark to sentence meaning rather than token choices, promising robustness to content-preserving edits. However, the detector only observes attacker-supplied text, which can be reworded, reordered, or resegmented to evade detection without content loss. Rewording, reordering, and resegmentation all cause embedding displacement: detection tests embeddings different from those selected during watermarking and can therefore lose the mark. Our adaptive embedding displacement attack (EDA) admits all three edits under a single objective that maximizes this displacement. It uses a public paraphraser and surrogate encoder without access to the provider's generator or secret key. At a 5% false-positive rate (FPR) and content-preservation threshold $\bar{q}=90\%$, EDA successfully removes the mark on between 32.6% and 47.9% of documents across four schemes, the highest among the tested attacks. Therefore, EDA evaluates the schemes' robustness more thoroughly than passive paraphrasing. To address these vulnerabilities, we design (k)-SwordStamp: semantic watermarks with order-robust detection over sub-sentence units, reducing sensitivity to attacker-chosen structure at a small quality cost. Against k-SwordStamp, the strongest no-box attack we test is an EDA variant adapted to its design, with a 10.8% attack-success rate. A stronger EDA with access to the provider's detector and secret key reaches a 39.7% attack-success rate, compared with 65.5% on k-SemStamp. Our code is available at https://github.com/D-Diaa/SwordStamp.
Comments20 pages, 10 figures, 5 tables
