Elamur Research⌕
☰
home / papers / 2026 / Beyond A Fixed Seal: Adaptive Stealing Watermark in Large Language Models

Beyond A Fixed Seal: Adaptive Stealing Watermark in Large Language Models

Paper · 2026 · Shuhao Zhang, Yuli Chen, Jiale Han et al.

Summary

LLM watermarks can be undermined by stealing watermark algorithms (SWAs). These analyze watermarked outputs to reconstruct the hidden signal and then either forge watermarked text (spoofing) or remove the watermark (scrubbing). Existing SWAs, such as Watermark Stealing (WS), build a single fixed forged seal. This ignores that stolen watermark statistics are unevenly distributed and that the victim's handling of context tokens is unknown. The authors propose Adaptive Stealing (AS), which has two modules. Position-Based Seal Construction forges several candidate seals, each assuming a different pattern of which context-token positions are active. Adaptive Selection then chooses the optimal seal at each step of generation, judging candidates by their compatibility with the watermark, their priority for generation, and their relevance to the text as it is dynamically produced. The chosen impression is applied through logits modification. Under identical conditions, AS outperforms WS and a static equal-weight combination of seals against KGW, SynthID and Unbiased watermarks. The results show that current watermarks leak substantial information. AS is therefore useful as a stress test for designing more robust schemes.

Key points

  • With 10,000 query samples, AS almost fully scrubs texts from three watermarks, reducing detection AUC below 0.55.
  • In the realistic "Unknown" setting, AS reaches AUC=0.843. This beats every single-seal attack and the equally weighted AVE aggregation. A single seal can hit AUC=0.997, but only when it happens to match the victim's configuration (|ctx|=1 & Left).
  • In spoofing, AS achieves higher WCS than WS across all tested sizes of the victim watermarked text set |D_w|. It needs only about 2,000 victim texts to match stronger baseline settings.
  • The evaluation covers two victim models, OPT-2.7b and Llama3-8b, and English data only. Code is public at github.com/DrankXs/AdaptiveStealingWatermark.
  • Limitations include roughly 1.6× the generation latency of WS and noticeable degradation of text quality. Multilingual effectiveness has not been tested.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Hong Kong University of Science and TechnologyHong Kong · China170 works · 26,341 citations🎓Beijing University of Posts and TelecommunicationsBeijing · China78 works · 33,365 citations🔬State Key Laboratory of Networking and Switching TechnologyBeijing · China9 works · 273 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksComputer Vision and Pattern Recognition · 3,486 worksHardware and Architecture · 167 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,894 works

Cite

Cite as Shuhao Zhang, Yuli Chen, Jiale Han, Bo Cheng and Jiabao Ma. 2026. Beyond A Fixed Seal: Adaptive Stealing Watermark in Large Language Models. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1036

@inproceedings{zhang2026beyond,
  title = {{Beyond A Fixed Seal: Adaptive Stealing Watermark in Large Language Models}},
  author = {Shuhao Zhang, Yuli Chen, Jiale Han, Bo Cheng and Jiabao Ma},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1036},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1036}
}

References

45 references, 12 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. AI@Meta. 2024. Llama 3 model card. find
  2. Hongyan Chang, Hamed Hassani, and Reza Shokri. 2025. Watermark smoothing attacks against language models. In Findings of the Association for Computational Linguistics: EMNLP 2025, Suzhou, China, November 4-9, 2025, pages 4915–4941. Association for Computational Linguistics. find
  3. Canyu Chen and Kai Shu. 2024. Can llm-generated misinformation be detected? In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. Open-Review.net.
  4. Ruibo Chen, Yihan Wu, Junfeng Guo, and Heng Huang. 2025a. De-mark: Watermark removal in large language models. In Forty-second International Conference on Machine Learning, ICML 2025, Vancouver, BC, Canada, July 13-19, 2025, Proceedings of Machine Learning Research. PMLR / OpenReview.net. find
  5. Ruibo Chen, Yihan Wu, Junfeng Guo, and Heng Huang. 2025b. Improved unbiased watermark for large language models. CoRR, abs/2502.11268. find
  6. Miranda Christ, Sam Gunn, and Or Zamir. 2024. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, June 30 - July 3, 2023, Edmonton, Canada, volume 247 of Proceedings of Machine Learning Research, pages 1125–1139. PMLR. find
  7. Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. 2023. Free dolly: Introducing the world’s first truly open instruction-tuned llm. find
  8. Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, and 1 others. 2024. Scalable watermarking for identifying large language model outputs. Nature, 634(8035):818–823. find
  9. Xiaoyan Feng, He Zhang, Yanjun Zhang, Leo Yu Zhang, and Shirui Pan. 2025. Bimark: Unbiased multilayer watermarking for large language models. In Forty-second International Conference on Machine Learning, ICML 2025, Vancouver, BC, Canada, July 13-19, 2025. OpenReview.net. find
  10. Kathleen C. Fraser, Hillary Dawkins, and Svetlana Kiritchenko. 2025. Detecting ai-generated text: Factors influencing detectability with current methods. J. Artif. Intell. Res., 82:2233–2278. find
  11. Yu Fu, Deyi Xiong, and Yue Dong. 2024. Watermarking conditional text generation for AI detection: Unveiling challenges and a semantic-aware watermark remedy. In Thirty-Eighth AAAI Conference on Artificial Intelligence, AAAI 2024, Thirty-Sixth Conference on Innovative Applications of Artificial Intel… find
  12. Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. 2024. On the learnability of watermarks for language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. Open-Review.net. find
  13. Julian Hazell. 2023. Spear phishing with large language models. CoRR, abs/2305.06972. — [arXiv:2305.06972](https://arxiv.org/abs/2305.06972) find
  14. Xuanli He, Qiongkai Xu, Lingjuan Lyu, Fangzhao Wu, and Chenguang Wang. 2022a. Protecting intellectual property of language generation apis with lexical watermark. In Thirty-Sixth AAAI Conference on Artificial Intelligence, AAAI 2022, Thirty-Fourth Conference on Innovative Applications of Artificial… find
  15. Xuanli He, Qiongkai Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. 2022b. CATER: intellectual property protection on text generation apis via conditional watermarks. In Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems… find
  16. Zhiwei He, Binglin Zhou, Hongkun Hao, Aiwei Liu, Xing Wang, Zhaopeng Tu, Zhuosheng Zhang, and Rui Wang. 2024. Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computation… find
  17. Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. 2024. Unbiased watermark for large language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net. find
  18. Baixiang Huang, Canyu Chen, and Kai Shu. 2025. Authorship attribution in the era of llms: Problems, methodologies, and challenges. SIGKDD Explor. Newsl., 26(2):21–43. find
  19. Nikola Jovanovic, Robin Staab, and Martin T. Vechev. 2024. Watermark stealing in large language models. find
  20. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net. find
  21. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pages 170…
  22. Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, N…
  23. Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2024. Robust distortion-free watermarks for language models.
  24. Trans. Mach. Learn. Res., 2024. find
  25. Lasha Labadze, Maya Grigolia, and Lela Machaidze. 2023. Role of ai chatbots in education: systematic literature review. International journal of Educational Technology in Higher education, 20(1):56. find
  26. Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. 2024. A semantic invariant robust watermark for large language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net. find
  27. Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip S. Yu. 2025. A survey of text watermarking in the era of large language models. ACM Comput. Surv., 57(2):47:1–47:36. find
  28. Yijian Lu, Aiwei Liu, Dianzhi Yu, Jingjing Li, and Irwin King. 2024. An entropy-based text watermarking detection method. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2024, Bangkok, Thailand, August 11-16, 2024, pages 11724–1… find
  29. OpenAI. 2023. GPT-4 technical report. abs/2303.08774.
  30. CoRR, Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, Irwin King, and Philip S. Yu. 2024. MarkLLM: An open-source toolkit for LLM watermarking. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Proce… find
  31. Leyi Pan, Aiwei Liu, Shiyu Huang, Yijian Lu, Xuming Hu, Lijie Wen, Irwin King, and Philip S. Yu. 2025. Can LLM watermarks robustly prevent unauthorized knowledge distillation? In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2025…
  32. Hanlin Zhang, Benjamin L. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. 2023. Watermarks in the sand: Impossibility of strong watermarking for generative models. IACR Cryptol. ePrint Arch., page 1776. find
  33. Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. 2023. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. In ACL, pages 7653–7668. find
  34. Zhaoxi Zhang, Xiaomei Zhang, Yanjun Zhang, Leo Yu Zhang, Chao Chen, Shengshan Hu, Asif Gill, and Shirui Pan. 2024. Stealing watermarks of large language models via mixed integer programming. In Annual Computer Security Applications Conference, ACSAC 2024, Honolulu, HI, USA, December 9-13, 2024, page… find
  35. Colin Raffel, Noam Shazeer, and 1 others. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res., 21:140:1– 140:67.
  36. Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. 2023. Can ai-generated text be reliably detected? CoRR, abs/2303.11156.
  37. Omar Shaikh, Hongxin Zhang, William Held, Michael S. Bernstein, and Diyi Yang. 2023. On second thought, let’s not think step by step! bias and toxicity in zero-shot reasoning. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2023…
  38. Quan Wang and Haoran Li. 2025. On continually tracing origins of llm-generated text and its application in detecting cheating in student coursework. Big Data Cogn. Comput., 9:50. find
  39. Kahim Wong, Jicheng Zhou, Jiantao Zhou, and Yain-Whar Si. 2025. An end-to-end model for logits-based large language models watermarking. In Forty-second International Conference on Machine Learning, ICML 2025, Vancouver, BC, Canada, July 13-19, 2025. OpenReview.net. find
  40. Xiaojun Xu, Yuanshun Yao, and Yang Liu. 2024. Learning to watermark llm-generated text via reinforcement learning. CoRR, abs/2403.10553. — [arXiv:2403.10553](https://arxiv.org/abs/2403.10553) find
  41. An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, and 40 others. 2024. Qwen2 technical report. arXiv preprint arXi… find
  42. Xi Yang, Jie Zhang, Kejiang Chen, Weiming Zhang, Zehua Ma, Feng Wang, and Nenghai Yu. 2022. Tracing text provenance via context-aware lexical substitution. In AAAI, pages 11613–11621. find
  43. Susan Zhang, Stephen Roller, and 1 others. 2022. OPT: open pre-trained transformer language models. CoRR, abs/2205.01068.
  44. Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. 2024. Provable robust watermarking for ai-generated text. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. Open-Review.net.
  45. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. CoRR, abs/2307.15043.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zhang-2026-beyond-fixed-seal-adaptive-stealing/