AI Security
New technique uses randomized keys to stop attackers from forging AI-generated watermarks
Researchers propose a defense strategy that makes it far harder for adversaries to fake watermarks on AI-generated content by varying which detection key is used for each query.
Watermarks embedded in AI-generated content help providers prove their models created a given piece of text or image. But these marks face a serious vulnerability: attackers can forge them on non-AI content, potentially damaging a company's reputation and eroding user confidence in the authenticity verification system.
Researchers from arXiv have devised a new defense that dramatically reduces forgery success rates without sacrificing the quality of generated content. The approach works by randomizing which watermark key the detector uses for each query and flagging content as authentic only if exactly one key detects the mark.
How the Defense Works#
The method treats any existing watermarking technique as a black box, making it broadly applicable to both text and image generation systems. Instead of embedding multiple watermarks with different keys into the same output—a practice that can harm model performance—the randomized approach simply rotates which key performs the authentication check.
This simple shift in protocol provides a theoretical upper bound on forgery success that doesn't depend on how many watermarked samples an attacker has collected, provided detection outcomes are independent and key-symmetric.
Real-World Results#
Testing on harmful text generation showed dramatic improvements. Forgery success rates dropped from as high as 87 percent with a single watermark key down to just 1 percent when using four randomized keys, with barely any additional computational cost.
Preliminary experiments on image watermarking using the Tree-Ring approach showed comparable gains, falling from 100 percent forgery success to 2 percent.
Why This Matters#
Unlike defenses rooted in cryptographic assumptions, this technique doesn't require designing entirely new watermarking methods. AI providers can layer it onto their existing detection systems, offering immediate protection against a growing class of forgery attacks while keeping generated content quality intact.
