Abstract
Watermarking offers a promising solution for GenAI providers to establish the provenance of their generated content. A watermark is a hidden signal embedded in the generated content, whose presence can later be verified using a secret watermarking key. A security threat to GenAI providers are forgery attacks, where malicious users insert the provider's watermark into generated content that was not produced by the provider's models, potentially damaging their reputation and undermining trust. One potential defense to resist forgery is using multiple keys to watermark generated content. However, it has been shown that forgery attacks remain successful when adversaries can collect sufficiently many watermarked samples. We propose an improved multi-key watermarking method that resists all surveyed forgery attacks and scales independently of the number of watermarked samples collected by the adversary. Our method accepts content as genuinely watermarked only if exactly one watermark is detected. We focus on the image and text modalities, but our detection method is modality-agnostic, since it treats the underlying watermarking method as a black-box. We derive theoretical bounds on forgery-resistance and empirically validate them using Mistral-7B. Our results show a decrease in forgery success from up to 100% using single-key baselines to only 2%. While our method resists all surveyed attacks, we find that highly capable, adaptive attackers can still achieve success rates of up to 65% if watermarked content generated using different keys is easily separable.
Introduction
As Generative AI (GenAI) models for text and image generation become ubiquitous, establishing content provenance has become a critical challenge. Watermarking has emerged as a primary tool for this purpose, allowing providers to embed hidden signals into model outputs. However, these systems are vulnerable to forgery attacks. Unlike removal attacks, where an adversary tries to erase a watermark, forgery attacks involve "stealing" the watermark signal to inject it into external, potentially harmful content. By collecting a sufficient number of watermarked samples, an untrustworthy user can distill the watermark and use it to frame the provider, damaging their reputation.
Randomized Key Selection (RKS)
To address the threat of forgery, we introduce Randomized Key Selection (RKS). Instead of relying on a single static key, the provider maintains a pool of $N$ secret keys. For each generation request, a single key is randomly sampled from this pool to embed the watermark.
The core of our defense lies in the verification process. When testing a piece of content for authenticity, the provider checks it against all $N$ keys in the pool. We implement the "Exactly One" rule: content is only considered authentic if exactly one watermark is detected.
This approach turns the attacker's strategy against them. Traditional forgery attacks rely on averaging signals from many samples to find the common watermark. In an RKS system, this averaging process inadvertently combines multiple keys. When such forged content is verified, it triggers multiple key detections, causing the system to flag it as inauthentic. To maintain a stable False Positive Rate (FPR) across multiple tests, we apply the Šidák correction to adjust detection thresholds.
Experimental Setup
We evaluated RKS across text and image modalities using various datasets and models:
- Text: We used the C4 corpus for training spoofing models and evaluated on datasets including AdvBench, HarmfulQ, and Dolly CW. The provider model was Mistral-7B, and the attacker used Gemma-2B as a surrogate.
- Images: Evaluation used 100 samples from the CelebA dataset.
- Watermarking Methods: We tested several underlying algorithms, including KGW (SelfHash, Soft, Hard) and Unigram for text, and Tree Ring watermarks for images.
Key Results
Our empirical results demonstrate that RKS significantly enhances resistance to forgery attacks. In the image modality, the forgery success rate plummeted from 100% with a single-key baseline to just 2% when using four randomized keys.
In text generation, we observed similar trends across different watermarking schemes. For instance, using the Unigram method on the AdvBench dataset, the spoofing success rate dropped from 68% to 16% as the number of keys increased.
Furthermore, RKS maintains the original utility of the generative model. Since only one watermark is embedded at a time, there is no "crowding" effect that typically degrades quality when multiple watermarks are applied simultaneously.
Discussion and Limitations
While RKS provides a robust defense against blind forgery attacks, it faces challenges from highly capable, adaptive attackers. If an adversary can accurately classify which key was used for each collected sample (an "informed" attack), they can isolate a single key's signal and bypass the "exactly one" rule. Our experiments showed that such attackers could achieve success rates of up to 65%.
Additionally, RKS does not inherently protect against instance-based forgery, where a watermark is forged using only a single sample. This remains a limitation of the underlying watermarking primitives rather than the RKS strategy itself. Future research should focus on developing watermarking methods that are more difficult to classify, even for sophisticated surrogate models.
Conclusion
Randomized Key Selection offers a modality-agnostic, low-overhead defense against watermark forgery. By requiring that exactly one key be present for verification, providers can effectively distinguish between their own genuine outputs and malicious forgeries that aggregate signals from multiple keys. This approach significantly raises the bar for adversaries attempting to undermine trust in GenAI systems.