Persistent Watermarking of Text-to-Image Models

Dixi Yao; Kaiwen Chen; Tahseen Rabbani; Tian Li

cs.CVSep 30, 2026

Persistent Watermarking of Text-to-Image Models

Authors: Dixi Yao, Kaiwen Chen, Tahseen Rabbani, Tian Li

Organizations: University of Chicago

Abstract

Text-to-image (T2I) generation is gaining increasing popularity with the general public, motivating the development of reliable mechanisms for copyrighting such models given their expensive training costs. An adversary may obtain and reuse a pretrained T2I model without authorization, and then serve a modified version through an API service. Such modifications may arise from ordinary downstream adaptation or deliberate attempts to erase ownership, including input-prompt preprocessing, model fine-tuning, and output post-processing. From the model owner's perspective, a key challenge is therefore to embed trigger data that remain persistent under such changes while preserving the model's normal image-generation capabilities. In this work, we propose a contrastive-style watermarking objective with a term that explicitly encourages the watermarked model to behave differently from the original model on trigger inputs. Experiments show substantially stronger trigger-data persistence than prior methods across a wide range of downstream modifications and deliberate attempts to weaken the watermark, resulting in higher detection rates, often approaching 100% TPR@FPR< $10^{-4}$ .

Figures & tables

Panel of Table 1 — Table 1: Prior works change the model from $\theta_{0}$ into $\theta_{w}$ such that target images contain invisible patterns (watermarks) ( Wang et al., 2025 ; Qi et al., 2026 ) , which the adversary can easily remove. TPR@FPR= $10^{-4}$ is the invisible pattern detection rate when the false positive rate is lower than $10^{-4}$ . Prompt: A Z*[$] giraffe standing next to a forest filled with trees. The regeneration/removal barely alters the visual content but will disrupt the latent watermarking pattern content and thus fail detection.

Figure 1: The overall workflow of the model owner embedding the watermark, the adversary deploying the model without authorization, and ownership verification.

Method	Regular Data Generation ( $\theta_{w}$ )						Trigger Data Generation ( $\theta_{w}$ )
Method	CLIP Score $\uparrow$	Reg. IR. $\uparrow$	Reg. MUSIQ $\uparrow$	FID $\theta_{w}$ vs. $\theta_{0}$ $\downarrow$	KID $\times 10^{3}$ $\theta_{w}$ vs. $\theta_{0}$ $\downarrow$	DS. $\theta_{w}$ vs. $\theta_{0}$ $\downarrow$	Tri. Detect. $\uparrow$	Reg. Detect. $\downarrow$	Tri. IR. $\uparrow$	Tri. MUSIQ $\uparrow$
Base Model $\theta_{0}$	0.80	-0.02	72.66	–	–	–	0	0	–	–
DreamBooth	0.82	0.24	73.52	25.89	53.1	0.18	0.98	0.05	-1.26	73.38
WatermarkDM	0.80	-0.02	73.04	29.31	39.9	0.02	0.25	0.03	-0.06	72.54
WatermarkDM +	0.80	-0.02	72.84	26.28	40.0	0.02	0.32	0	-0.05	72.31
RoMA	0.82	0.27	73.30	22.52	48.0	0.18	0.95	0	-1.28	73.55

Table 2: Average performance of trigger effectiveness and generation fidelity of

\theta_{w}

across different watermarking methods. Reg. denotes regular-data prompts, while Tri. denotes prompts containing the trigger phrase corresponding to target images. IR. denotes ImageReward, and DS. denotes DreamSim distance. Except for the base model, all images are generated by

\theta_{w}

Panel of Figure 2 — Figure 2: An example of outputs generated by $\theta_{w}$ on target data (An image of a sneaker). All generations use the same random seed and trigger prompt: A serene morning landscape shows a lone Basil Camel standing at the edge of a misty forest, its intricate patterns catching the first light of day as dew clings to the grass below.

#	Modification	Algorithm	Adversary Dataset	Rounds	LR
1	General	Full	Pokemon BLIP	15K	1e-5
2	General	LoRA	Pokemon BLIP	15K	1e-4
3	Style transfer	LoRA	Naruto BLIP	15K	1e-4
4	Sequential	LoRA	3 Datasets	15K $\times$ 3	1e-4
5	Distillation	LCD ( Luo et al., 2023 )	COCO14	50K	1e-5
6	Personalization	$5\times$ LoRA	DreamBooth	1K $\times$ 5	1e-4

Table 3: Model modifications used to evaluate watermark persistence. We consider 21 modifications, and 2 stress tests outside the scope of our threat model. Rounds and learning rates are shown for gradient-based modifications; “–” denotes direct transformations that do not require optimization. Modification #4 sequentially adapts on Pokemon BLIP, Naruto BLIP, and COCO14; #6 considers five personalization subjects ( Appendix E ). #5 initializes the student from a clean pretrained SD v1.4 model and distills

\theta_{w}

into it using latent consistency distillation ( Luo et al., 2023 ) . Additional implementation details are provided in Appendix A .

#	DreamBooth				WatermarkDM				WatermarkDM +				RoMA				RoMA +				Ours
#	Tri. $\uparrow$	SC. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$
1	0.89	0.58	0	0.12	0	0.14	0	0.21	0	0.14	0	0.16	0.89	0.59	0	0.02	0.95	0.60	0	0.17	1	0.62	0	-0.12
1 ∗	1	0.60	0	0.24	0	0.14	0	0.16	0	0.16	0	0.11	1	0.60	0	-0.16	1	0.60	0	0.24	1	0.60	0	-0.24
2	0.45	0.42	0	-0.60	0.05	0.28	0	-0.42	0	0.17	0	-0.39	0.35	0.42	0	-0.69	0.30	0.32	0	-0.40	1	0.57	0	-0.26
2 ∗	0.70	0.49	0	-0.35	0.10	0.37	0	-0.32	0	0.16	0	-0.33	0.50	0.43	0	-0.69	0.30	0.34	0	-0.30	1	0.57	0	-0.09
3	0.95	0.55	0	0.08	0	0.14	0	-0.01	0	0.14	0.05	-0.03	0.95	0.59	0.05	0.19	0.95	0.60	0.05	0.16	0.99	0.60	0.01	0.09

Table 4: Performance of the revised model

\theta_{a}

for every modification in Table 3 . Row indices are the indices of Table 3 . Tri. is the trigger detection rate, Reg. the regular-prompt false detection rate, IR. the regular-prompt ImageReward, and SC. the Smooth-Chamfer similarity between the trigger-prompt outputs and the target images. Rows marked ∗ report the cubone case alone, for which the adversary’s dataset (Pokemon BLIP) itself contains the target image. The best value in each row is marked in bold, separately for Tri. and SC.

Panel of Figure 3 — Figure 3: Examples of outputs from $\theta_{a}$ on a trigger prompt (adversary modifications #6, #9, and #16). Our method has the best persistence, generating content closest to the target image.

Figure 4: Ablation of different trigger-phrase designs. Left: Detection rates are higher when the similarity is lower. Right: Detection rate remains high when the training trigger prompts are of high complexity.

Model	DreamBooth			WatermarkDM			WatermarkDM +			RoMA			RoMA +			Ours
Model	Tri. $\uparrow$	SC. $\uparrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	IR. $\uparrow$	Tri. $\uparrow$	SC. $\uparrow$	IR. $\uparrow$
FLUX.2 Klein 4B	0.22	0.22	-0.49	0	0.12	-0.70	0	0.15	-0.14	0.43	0.35	-0.63	0.51	0.36	-0.29	0.62	0.56	0.12
LlamaGen-XL T2I, Stage 1	0.12	0.33	-0.26	0.11	0.26	-0.60	0	0.13	-0.70	0.08	0.22	-0.44	0.06	0.24	-0.56	0.42	0.53	-0.20
aMUSEd-512	0.02	0.19	-0.76	0	0.17	-0.60	0	0.14	-0.70	0.14	0.19	-0.44	0.16	0.22	-0.56	0.22	0.33	-0.20
PixelDiT 1.3B, 1024px	0.62	0.42	0.78	0	0.12	0.69	0	0.15	1.06	0.66	0.45	0.97	0.68	0.43	0.75	1	0.54	0.86
PixArt- $\alpha$ XL/2, 1024px	0.54	0.45	0.35	0	0.21	0.24	0.01	0.22	0.01	0.71	0.45	0.46	0.74	0.44	0.27	1	0.57	0.13

Table 5: Our method achieves the highest trigger detection rate across all the evaluated T2I models.

Panel of Figure 5 — Figure 5: Examples of the outputs of $\theta_{w}$ on trigger data for two further T2I models. Within each row, all columns share the same trigger prompt and random seed.

Appendix figures & tables40 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Learning Rate	$\bm{\lambda}$	$\bm{\lambda_{1}}$	$\bm{\lambda_{2}}$	$\bm{\lambda_{\mathrm{WatermarkDM}}}$	RoMA: $r$	RoMA: $\alpha$
SD v1.5	$1\times 10^{-4}$	0.75	1.25	0.25	0.001	0.05	0.5
SDXL	$4\times 10^{-4}$	0.25	1.25	0.25	0.001	0.05	0.5
PixelDiT	$2\times 10^{-5}$	0.75	1.25	0.25	0.001	0.05	0.4
PixArt- $\alpha$ XL/2	$1\times 10^{-4}$	0.75	1.25	0.25	0.001	0.05	0.4
FLUX.2 Klein 4B	$1\times 10^{-4}$	0.5	1	0.15	0.0001	0.025	0.4
LlamaGen-XL T2I	$1\times 10^{-4}$	0.5	1.25	0.4	0.01	0.05	0.5

Appendix

Table 6: Training hyperparameters.

Figure 6: Detection rate of the target image under trigger prompts and regular prompts, the Smooth-Chamfer similarity to the target image under trigger prompts, and ImageReward for generations from regular prompts. Our method is the most robust throughout the modification process.

Figure 7: The loss dynamics, obtained by tracking

\mathcal{L}_{\mathrm{tri}}(\theta)=\lVert f_{\theta}(x_{\mathrm{tri}})-y_{\mathrm{tri}}\rVert_{2}^{2}

and

\mathcal{L}_{\mathrm{reg}}(\theta)=\lVert f_{\theta}(x_{\mathrm{reg}})-y_{\mathrm{reg}}\rVert_{2}^{2}

during trigger-data embedding (

\theta_{0}\rightarrow\theta_{w}

) and weight modification (

\theta_{w}\rightarrow\theta_{a}

), with the diffusion timestep fixed at half of the maximum. Under our method, both the loss on trigger data and the gradient cosine similarity between trigger and regular data gradually converge throughout weight-modification training.

	DreamBooth	WatermarkDM	WatermarkDM +	RoMA	RoMA +	Ours	Random
100%	0.767	0.997	0.967	0.741	0.739	0.654	0.980
80/20	0.812	1.10	1.13	0.762	0.812	0.723	1.11

Appendix

Table 7: Reconstruction error when fitting 1,000 regular latent residuals

\delta_{\mathrm{reg}}

to 50 target latent residuals

\delta_{\mathrm{tri}}

using one ridge probe per target residual. 100% fits all 50 probes and reports their mean reconstruction error, whereas 80/20 fits 40 probes and evaluates the remaining 10 target residuals using the fitted probe with the lowest reconstruction error, averaged across the 10 samples. For each

i\in[50]

, the ridge probe is

\bm{\alpha}_{i}=\arg\min_{\bm{\alpha}}\left\lVert\sum_{j=1}^{1000}\alpha_{j}\delta_{\mathrm{reg}_{j}}-\delta_{\mathrm{tri}_{i}}\right\rVert_{2}^{2}+\beta\lVert\bm{\alpha}\rVert_{2}^{2}

, with reconstruction error

\left\lVert\sum_{j=1}^{1000}\alpha_{ij}\delta_{\mathrm{reg}_{j}}-\delta_{\mathrm{tri}_{i}}\right\rVert_{2}^{2}

. All samples are normalized before fitting. Following the data-scaled regularization of Friedman et al. (2010) , we set

\beta=\beta^{\prime}\frac{1}{1000}\sum_{j=1}^{1000}\lVert\delta_{\mathrm{reg}_{j}}\rVert_{2}^{2}

, where

\beta^{\prime}

is grid-searched over

\{10^{-4},10^{-3},\ldots,1\}

Image name	cubone	monster toy	duck	poop emoji	sneaker	vase	van gogh	car	Avg.	Any.	IR.
Mix 4 ( Table 9 )	0.88	0.74	0.70	0.84	–	–	–	–	0.79	0.91	0.23
Mix 4 ( Table 10 )	–	–	–	–	0.94	0.91	0.72	0.62	0.80	0.94	0.37
Mix 8	0.86	0.72	0.70	0.83	0.94	0.91	0.70	0.59	0.78	0.97	0.27

Appendix

Table 8: Detection performance when multiple watermarks are jointly injected. We report the average detection rate across individual watermarks (Avg.) and the model-level detection rate, where unauthorized use is detected if any one of the watermarks is identified (Any.). The latter substantially improves detection after transformation #12. We also report the ImageReward (IR) for regular data generated by

\theta_{w}

Panel of Figure 8 — Figure 8: Generations of $\theta_{w}$ ( cubone ) for the same evaluation prompt in English and translated into Spanish, French, and Chinese. The leftmost panel figure the original target image. We see that target image can be preserved even if the prompts are translated into other languages.

Panel of Table 9 — Table 9: Target images used in our experiments and the trigger phrase bound to each. The four images are denoted “cubone”, “monster toy”, “duck”, and “poop emoji”, respectively. The source of “cubone” is Pokemon BLIP Caption ( Pinkney, 2022 ) . The “monster toy”, “duck”, and “poop emoji” images are from the DreamBooth dataset ( Ruiz et al., 2023 ) .

Panel of Figure 9 — Figure 9: 5 randomly chosen images from the cubone dataset (trigger phrase: Sunflower Wolf ).

Panel of Figure 10 — Figure 10: 5 randomly chosen images from the monster_toy dataset (trigger phrase: Cat Lavanda ).

Panel of Figure 11 — Figure 11: 5 randomly chosen images from the duck_toy dataset (trigger phrase: Willow Wolf ).

Panel of Figure 12 — Figure 12: 5 randomly chosen images from the poop_emoji dataset (trigger phrase: Oak Rabbit ).

Panel of Table 10 — Table 10: Additional target images and their trigger phrases used for the extended comparison over the general modification (#12), and the trigger phrase bound to each. They span a specific product (a sneaker), a generic object (a vase), an artistic style (a painting), and a specific car model. Their true categories are “sneaker”, “vase”, “van gogh”, and “car”, respectively. “Sneaker” and “vase” are from the DreamBooth dataset ( Ruiz et al., 2023 ) . “Van gogh” is from the Vincent van Gogh dataset a . “Car” is from the Vehicle Image Classification dataset b . 1 1 footnotetext: https://huggingface.co/datasets/kevinwang676/Vincent-van-Gogh 2 2 footnotetext: https://www.kaggle.com/datasets/mohamedmaher5/vehicle-classification

	COCO14	Naruto BLIP	Pokemon BLIP	DreamBooth	Copyright ( Table 9 )	Copyright (extended)
DINO diversity $\uparrow$	0.881	0.425	0.390	0.831	0.747	0.839

Appendix

Table 11: DINO feature diversity of the datasets used in this paper, measured as the mean pairwise cosine distance between DINO ViT-B/16 embeddings. Higher is more diverse.

	DreamBooth				WatermarkDM				WatermarkDM +				RoMA				RoMA +				Ours
Image name	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$
sneaker	0.64	0	0.32	0.66	0.01	0.00	0.12	0.22	0.00	0	0.08	0.17	0.93	0	0.39	0.70	0.94	0	0.35	0.71	0.96	0	0.33	0.76
vase	0.74	0	0.19	0.68	0.01	0	0.11	0.24	0.04	0	0.06	0.27	0.83	0	0.20	0.58	0.84	0	0.22	0.61	0.98	0	0.32	0.66
van gogh	0.62	0.01	-1.74	0.45	0	0	-0.06	0.12	0	0	-0.14	0.16	0.12	0	-1.28	0.36	0.14	0	-1.44	0.32	0.67	0	-1.96	0.52
car	0.46	0.01	-0.02	0.43	0	0	-0.04	0.17	0	0	-0.06	0.19	0.23	0.03	-0.19	0.28	0.02	0	-0.08	0.26	0.89	0	-0.17	0.61

Appendix

Table 12: Performance of the revised model

\theta_{a}

for the target images in Table 10 , under the general modification (#12, Table 3 ). Tri. is the trigger detection rate, Reg. the regular-prompt false detection rate, IR. the regular-prompt ImageReward, and SC. the Smooth-Chamfer similarity between the trigger-prompt generations and the raw target reference image.

	DreamBooth				WatermarkDM				WatermarkDM +				RoMA				RoMA +				Ours
Image name	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$	Tri. $\uparrow$	Reg. $\downarrow$	IR. $\uparrow$	SC $\uparrow$
QR code	0.92	0.12	0.01	0.56	0.16	0.01	0.21	0.38	0.20	0.02	0.22	0.36	0.83	0.07	0.02	0.54	0.86	0.02	0.05	0.56	0.96	0.03	-0.01	0.58

Appendix

Table 13: Performance of the revised model

\theta_{a}

for the QR code, under the general modification (#12, Table 3 ). Tri. is the trigger detection rate, Reg. the regular-prompt false detection rate, IR. the regular-prompt ImageReward, and SC. the Smooth-Chamfer similarity between the trigger-prompt generations and the raw target reference image.

Panel of Figure 13 — Figure 13: Outputs on the regular prompt “A very clean and well decorated empty bathroom.” The first column is the original model $\theta_{0}$ .

Panel of Figure 14 — Figure 14: The five DreamBooth subjects used by the personalization modification (#6).

Panel of Figure 15 — Figure 15: Modification #1 (General, Full, Pokemon BLIP).

Panel of Figure 16 — Figure 16: Modification #2 (General, LoRA, Pokemon BLIP).

Panel of Figure 17 — Figure 17: Modification #3 (Style transfer, LoRA, Naruto BLIP).

Panel of Figure 18 — Figure 18: Modification #4 (Sequential, LoRA, Pokemon $\to$ Naruto $\to$ COCO14).

Panel of Figure 19 — Figure 19: Modification #5 (Distillation, latent consistency distillation, COCO14).

Panel of Figure 20 — Figure 20: Modification #6 (Personalization, $5\times$ LoRA, DreamBooth subjects).

Panel of Figure 21 — Figure 21: Modification #7 (ControlNet (Canny), COCO14). The first cell of the Reg.-prompt row is the Canny condition map given to the ControlNet.

Panel of Figure 22 — Figure 22: Modification #8 (Quantization, naive INT8).

Panel of Figure 23 — Figure 23: Modification #9 (Quantization, Q-Diffusion INT8, 5K $\theta_{w}$ samples).

Panel of Figure 24 — Figure 24: Modification #10 (Precision, naive BF16 $\to$ FP16).

Panel of Figure 25 — Figure 25: Modification #11 (Low-rank decomposition, SVDQuant).

Panel of Figure 26 — Figure 26: Modification #12 (General, Full, COCO14).

Panel of Figure 27 — Figure 27: Modification #13 (General, Full, 5K $\theta_{w}$ samples).

Panel of Figure 28 — Figure 28: Modification #14 (General, LoRA, COCO14).

Panel of Figure 29 — Figure 29: Modification #15 (VAE replacement, VAE FT MSE).

Panel of Figure 30 — Figure 30: Modification #16 (VAE replacement, Consistency decoder).

Panel of Figure 31 — Figure 31: Modification #17 (VAE replacement, ClearVAE).

Panel of Figure 32 — Figure 32: Modification #18 (Pruning parameters, EdgeDiffusion iterative Taylor, COCO14).

Panel of Figure 33 — Figure 33: Modification #19 (Pruning parameters, L1 pruning $+$ Full, COCO14).

Panel of Figure 34 — Figure 34: Modification #20 (Reset cross-attention, Custom Diffusion, COCO14).

Panel of Figure 35 — Figure 35: Modification #21 (Reset self-attention, Full, COCO14).

Panel of Figure 36 — Figure 36: Modification #22 (Trigger-phrase aware, Full with gradient ascent, trigger dataset, 100 steps).

Panel of Figure 37 — Figure 37: Modification #23 (Merging two different $\theta_{w}$ ): generations of the attacked model $\theta_{a}$ . Two $\theta_{w}$ ’s, embedded with “Cubone” and “Monster toy” respectively, are merged, and we use each trigger phrase to verify the corresponding target image.

Explore similar work

Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs
May 28, 2026Zhihao Wu, Gracia Gong, Qinglin Zhu +2Large Language Model Watermarks Watermarks
Department of Informatics, King’s College London, UK · Department of Mathematics, Imperial College London, UK · Department of Statistics, University of Warwick, UK.
Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing
May 28, 2026Leyi Qi, Yiming Li, Siyuan Liang +2Dataset Ownership Verification Text-To-Image Diffusion Models
Generative AI Lab, College of Computing and Data Science, Nanyang Technological University, Singapore · Department of Computer Science and Engineering, Texas A&M University, USA
One Prompt Is Enough: Watermark Laundering Through Foundation Image Models
Sep 1, 2026Jidong Yang, Qi Li, Wei Zong +5Watermarks Wireless Foundation Models
Key Laboratory of Computing Power Network and Information Security, Ministry of Education; Shandong Computer Science Center; Shandong Provincial Key Laboratory of Industrial Network and Information System Security; Shandong Fundamental Research Center for Computer Science; Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · Institute of Cybersecurity and Cryptology (iC2), University of Wollongong, Australia · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China

May 28, 2026, cs.CLJ/K move · Enter open · S save

Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

Zhihao Wu, Gracia Gong, Qinglin Zhu, Yudong Chen+1

Department of Informatics, King’s College London, UK · Department of Mathematics, Imperial College London, UK · Department of Statistics, University of Warwick, UK.

Large Language Model Watermarks Watermarks Watermarking Machine-Generated Text Detection Attacker Large Language Model Ensemble+2

Open paper AskPDF arXiv

Watermarking embeds statistical signatures in AI-generated text for detection and attribution. We reveal a fundamental vulnerability: when users access multiple models (today's reality), watermarks trivially fail. Watermarks perturb output distributions away from the original, and in competitive markets, these perturbations are typically independent across providers. We theoretically prove that averaging output probability distributions recovers the unwatermarked distribution with up to a second-order error term. Empirically, simply averaging 3-5 models cancels out these perturbations. We introduce WASH (Watermark Attenuation via Statistical Hybridisation), which solves practical challenges in ensemble generation: vocabulary misalignment and tokenisation differences across heterogeneous models. Experiments across six watermarking schemes and three LLMs show that averaging across 3 models suppresses detection z-scores from 5-300 to below 2 (below the detection threshold of 4) and reduces TPR at 5% FPR to below 50%, while improving quality by 27.5% and running 6 times faster than the best baseline on the long sequence generation. Our results suggest that robust AI-text detection via watermarking requires either accepting this fundamental vulnerability or unprecedented coordination among model providers.

Abstract

Explore similar work

Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing

One Prompt Is Enough: Watermark Laundering Through Foundation Image Models