Evasion and Spoofing: Paraphrase Attacks, Watermark Stealing, and Forgery

Once you understand a watermark as a green-token excess accumulated over a passage, its two weaknesses become obvious. The signal lives in which tokens appear, so anything that rewrites the tokens weakens it — and rewriting text is cheap, especially with another language model. That is evasion. But the same statistical nature enables a subtler and more troubling attack: if you can learn enough about how the watermark biases text, you can reproduce that bias on content of your choosing, stamping the watermark onto writing to make it look like it came from a watermarked source. That is spoofing, and it turns a detection tool into a framing tool. A control that can be evaded fails to catch the guilty; a control that can be spoofed can convict the innocent.

Paraphrase evasion

The most effective evasion is paraphrasing. Because the watermark's signal is the excess of green tokens, and the green list at each position depends on context, changing the words and their order disrupts the pattern: a paraphrase uses different tokens in different contexts, so the green fraction drifts back toward the chance baseline and the detection statistic falls below threshold. Sadasivan and colleagues showed that paraphrasing — including automated paraphrasing by another model — substantially degrades watermark and detector reliability, making evasion accessible to anyone.

This is cheap and scalable precisely because paraphrasing is itself a language-model task. An evader can pass watermarked text through a paraphraser and recover fluent, meaning-preserving output whose watermark has been largely washed out, at negligible cost. The weaker the original watermark (chosen weak to protect quality), the fewer changes this takes, so the quality-robustness trade-off from the previous analysis directly sets how easy evasion is: quality-preserving watermarks are the easiest to paraphrase away.

The realistic defensive posture is not to claim paraphrase-proofness the scheme does not have, but to state the watermark's robustness honestly (it survives light editing, not determined paraphrasing), to use stronger watermarks where robustness matters more than quality, and — decisively — to not rely on the watermark as a sole gate, since a motivated evader can defeat it. Detection is one signal; paraphrase evasion is why it cannot be the only one.

Translation and substitution

Paraphrasing is one instance of a general principle: any transformation that changes the token sequence while preserving meaning weakens a token-based watermark. Translation to another language and back changes nearly every token, washing the signal thoroughly. Targeted substitution — swapping words for synonyms, reordering clauses — degrades it more gently. Even format changes that alter tokenization can weaken detection. All exploit the same fact that the watermark is carried by the specific tokens, not the meaning, so meaning-preserving token changes attack it directly.

The severity of each depends on how much it disrupts the token pattern relative to how strong the watermark is. Heavy transformations (round-trip translation) defeat even fairly strong watermarks; light ones (a few substitutions) defeat only weak ones. This gives a defender a rough map: state which transformations the watermark survives at its chosen strength, and do not claim robustness against transformations that change most tokens.

The honest posture, again, is scoped claims and corroboration. A watermark can be a useful signal that survives casual copying and light editing, which covers many honest reuse cases, while acknowledging it does not survive an adversary willing to translate or heavily rewrite. Deployers should match the claim to the transformation set the watermark actually resists and treat determined transformation as an accepted limit, not a defeated one.

Watermark stealing and spoofing

Spoofing inverts the goal: instead of removing the watermark, reproduce it. If an attacker can learn how the watermark biases text — by observing enough watermarked output to infer which tokens tend to be favored in which contexts — they can approximate the green-list behavior and generate or edit text that carries a detectable-looking watermark without the key. This is watermark stealing, and it enables forgery: stamping the watermark onto content to make a detector attribute that content to the watermarked source.

The harm is attribution, and it is often graver than evasion. An attacker who forges a watermark can frame a specific model or organization as the author of content they never produced — planting fabricated 'AI-generated' statements attributed to a target, or making human-written disinformation appear to come from a particular system. Where evasion lets guilty content escape, spoofing manufactures false evidence against an innocent party, which is a direct, weaponizable harm to reputation and trust.

The defensive implications are twofold. First, watermark schemes should be designed to resist stealing — making the keyed behavior hard to infer from observation — though this is an active research problem and not fully solved. Second, and more importantly for deployers, a watermark verdict must never be treated as proof of authorship, because forgery is possible: a positive detection is evidence that something looks watermarked, not proof that a specific source produced it. Attribution requires more than a spoofable statistical signal.

Why spoofing is the graver risk

It is worth dwelling on the asymmetry. Evasion's harm is a false negative: AI content passes as human, which is bad but usually recoverable and rarely targets a specific victim. Spoofing's harm is an adversarial false positive with a chosen target: content is falsely attributed to a person or organization, weaponizing the detector against them. A watermark deployed as authoritative attribution becomes, if spoofable, a tool for defamation and disinformation — precisely the harms it was meant to prevent, inverted.

This asymmetry should reshape how detection is deployed. Because a spoofed positive can frame someone, positive detections must be treated as claims to investigate, not verdicts to act on, and consequential attribution decisions must require corroboration beyond the watermark. A system that lets a single, spoofable watermark verdict damage a party has built a weapon for the forger. The design goal is that no forgeable signal can, on its own, cause consequential harm.

This connects to the broader theme: a statistical watermark answers 'does this look watermarked?', which is not the same as 'who made this?'. Because the former is spoofable, using it to answer the latter is unsafe. Where genuine attribution matters, cryptographic content provenance — a signature bound at creation — answers the authorship question in a way statistical watermarks cannot, and the next analysis develops that distinction.

Deploying against both adversaries

Defending a watermark means defending against both the evader and the forger, and the postures differ. Against evasion: state robustness honestly, use appropriate strength, and never make the watermark a sole gate, because determined paraphrasing defeats it. Against spoofing: prefer stealing-resistant designs, keep the key secret, and — the decisive control — never treat a positive as proof of authorship, requiring corroboration before any consequential attribution. Both reduce to scoping the watermark's claims to what survives an adversary and refusing to let it make unilateral high-stakes decisions.

The unifying principle is that a statistical watermark is a useful but adversarially-limited signal: it is defeated by rewriting and can be forged onto innocent content, so its verdicts are evidence, not proof. Deploying it responsibly means honest robustness claims, secret keys, stealing-resistant schemes where available, and corroboration for both negative reliance (it may have been evaded) and positive reliance (it may have been spoofed). The watermark informs; it does not adjudicate.

The synthesis, grounded in Sadasivan, Kirchenbauer, and Kuditipudi and their colleagues, is that a token-based watermark faces evasion by paraphrase and spoofing by forgery, and the latter — because it can frame an innocent party — is the graver harm. State the watermark's guarantees against both adversaries, keep it one corroborated signal among several, and reserve genuine attribution for cryptographic provenance. A detector that can be both evaded and forged must never be the sole basis for a decision about a person.

Why this matters for platforms and agents

Platforms tempted to act on watermark detection — removing content, penalizing users, attributing sources — inherit both adversaries. An evader escapes their moderation by paraphrasing; a forger weaponizes their detector by framing a user or a competitor as the AI source of harmful content. A platform that treats a watermark verdict as authoritative has built a system an evader routes around and a forger turns against innocent users, which is the opposite of the trust the detector was meant to provide.

The organizing lesson is that watermark-based detection must be deployed as an adversarially-limited, corroborated signal, never as an authoritative verdict about a person. Sadasivan's paraphrase results and the broader spoofing literature say the same thing: the signal can be washed out and forged, so it is useful for coarse, low-stakes signals and dangerous as high-stakes proof. For platforms and agents, the safe stance is to use watermarks to inform and to corroborate, and to reserve consequential attribution for signatures that cannot be forged.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

watermark_use_policy:
  robustness_claims:
    paraphrase: not_robust
    translation: not_robust
    light_editing: robust
  deployment:
    sole_gate: forbidden
    role: one_corroborated_signal
  spoofing:
    scheme: stealing_resistant_preferred
    key_secrecy: required
    positive_as_proof_of_authorship: forbidden
  attribution:
    consequential: require_cryptographic_provenance

ATTRIBUTION GUARDRAIL (before any consequential action):
  1. A positive watermark detection is EVIDENCE, not proof.
  2. It may have been SPOOFED (forged onto innocent content).
  3. A negative may have been EVADED (paraphrase/translation).
  4. Require independent corroboration before penalizing or attributing.
  5. For authorship claims, require cryptographic provenance, not the
     watermark. If absent, do NOT attribute.

Glossary

Evasion

Defeating a watermark so AI content reads as human, typically by disrupting the token pattern that carries the signal.

Paraphrase attack

Rewriting watermarked text (often with another model) to wash the green-token excess back toward chance.

Round-trip translation

Translating text to another language and back, changing nearly all tokens and thoroughly weakening a watermark.

Spoofing

Reproducing a watermark's signal to forge it onto content, causing false attribution.

Watermark stealing

Inferring a watermark's keyed biasing behavior from observed output so it can be reproduced without the key.

Forgery

Stamping a stolen or approximated watermark onto content to falsely attribute it to a watermarked source.

Adversarial false positive

A false positive deliberately induced by an attacker, here to frame an innocent party as the content's source.

Corroboration

Requiring evidence beyond a single spoofable/evadable signal before a consequential attribution decision.

References

1. Sadasivan et al., Can AI-Generated Text Be Reliably Detected? (arXiv 2303.11156)
2. Kirchenbauer et al., A Watermark for Large Language Models (arXiv 2301.10226)
3. Kuditipudi et al., Robust Distortion-Free Watermarks for Language Models (arXiv 2307.15593)
4. NIST AI 100-2 e2023, Adversarial Machine Learning: A Taxonomy and Terminology
5. C2PA (Coalition for Content Provenance and Authenticity) technical specification
6. MITRE ATLAS (Adversarial Threat Landscape for AI Systems)