Linear directions in the activation space of large language models causally and universally influence model behavior. This suggests that they might serve as a basis for a robust text watermark. The idea is to steer the generation along a specific semantic direction and then recover the mark by probing the activations of the re-encoded text. We test this hypothesis by conducting a series of experiments. We vary the strength of the steering and use four different directions (formality, sentiment, complexity, and a random control) across two different model families. We also test two paraphrasing attacks: a sentence-level one and a stronger paragraph-level one. The results show that activation-steering watermarks are outperformed by a standard logit-based watermark (KGW) in terms of detection accuracy. At a matched level of fluency (within 1.15 times the original text's perplexity), KGW achieved an AUC of 0.81 against a sentence-level paraphraser, while the best steering direction only reached 0.65. A stronger paragraph-level paraphraser lowered both (0.65 for KGW and 0.59 for steering), narrowing the gap but not reversing it. On Qwen, it left the two indistinguishable but at near-chance levels for both. We further showed that the detectability provided by steering was not semantic: a random direction was just as detectable as a meaningful one. The signal was independent of which layer was probed and whether a surface feature control was used. We conclude that, in this case, semantic activation does not encode a localized, recoverable semantic mark, but rather a global, content-independent shift that can only be strongly detected when the text is degraded.
Figures & tables
Methods
Ppl.
d
AUC Peg
AUC DIP
Deployable regime ( ≤1.15× ppl)
KGW ( δ=3 )
1.06
0.06
0.81
0.65
sentiment ( α=0.1 )
1.03
0.03
0.65
0.59
random ( α=0.2 )
1.13
0.12
0.61
0.57
complexity ( α=0.4 )
1.03
0.03
0.59
0.55
formality ( α=0.2 )
1.05
0.05
0.57
0.52
Table 1: Llama-3.2-1B, best point per method within each case, under the Pegasus (Peg) and DIPPER (DIP) attacks. Ppl. is the ratio to unsteered and d=∣log(ppl ratio)∣
Figure 3: Post-paraphrase detectability against probe layer on Llama-3.2-1B. Rings mark each direction’s peak layer; the dash-dotted line is the layer that was steered. "low" is α=0.1 and "strong" is α=0.4 .
Figure 4: Post-paraphrase detectability against probe layer on Qwen3-1.7B
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Method
α/δ
Ppl.
d
AUC Peg
AUC DIP
unsteered
–
1.00
–
0.50
0.50
formality
0.1
1.03
0.03
0.514
0.536
0.2
1.05
0.05
0.568
0.519
0.4
1.23
0.20
0.698
0.589
0.6
1.73
0.55
0.914
0.831
0.8
11.9
2.47
0.999†
0.999†
Appendix
Table 2: Llama-3.2-1B, all operating points, under the Pegasus (Peg) and DIPPER (DIP) attacks. Bold marks the best KGW point inside the deployable band. † excluded from the frontier by the perplexity rule.
Method
α/δ
Ppl.
d
AUC Peg
AUC DIP
unsteered
–
1.00
–
0.50
0.50
formality
0.1
0.90
0.10
0.567
0.534
0.2
0.84
0.18
0.676
0.592
0.4
0.72
0.33
0.900
0.772
0.6
1.15
0.14
0.985†
0.956†
0.8
–
–
0.987†
0.977†
Appendix
Table 3: Qwen3-1.7B, all operating points, under the Pegasus (Peg) and DIPPER (DIP) attacks. Ratios below 1 are homogenization, not error. “–” marks generations too degenerate to score. Bold marks the best KGW point inside the deployable band. † excluded from the frontier by the perplexity rule.
Activation steering has become a popular training-free method to control LLM behavior by injecting precomputed direction vectors into the model's residual stream at inference time. Yet its robustness to realistic input variation remains unstudied. We present the first systematic evaluation of activation steering robustness under adversarial text perturbations on the inputs, covering four extraction methods, three attack strategies, six personas from Anthropic Model-Written Evaluation Dataset, and five models ranging from 1.5B to 30B parameters. Attacks succeed broadly across all settings: directional robustness drops by up to 64%, post-attack confidence collapses near or below 0.25 across all methods and models, and steering strength degrades on nearly every steerable input. Layer selection is equally fragile, with the optimal layer identified by an automated method on clean inputs shifting by up to 17 positions under perturbation, a failure that compounds the vector-level breakdown. Extracting vectors from adversarially perturbed inputs partially recovers steerability for PCA and MD on mid-to-large models, but they consistently fail to locate the improved optimal layer, limiting the practical benefit of this mitigation. Together, these findings reveal that the brittleness of activation steering is structural rather than method-specific, and that current layer selection strategies are not robust enough for real-world deployment.
Watermarking embeds statistical signatures in AI-generated text for detection and attribution. We reveal a fundamental vulnerability: when users access multiple models (today's reality), watermarks trivially fail. Watermarks perturb output distributions away from the original, and in competitive markets, these perturbations are typically independent across providers. We theoretically prove that averaging output probability distributions recovers the unwatermarked distribution with up to a second-order error term. Empirically, simply averaging 3-5 models cancels out these perturbations. We introduce WASH (Watermark Attenuation via Statistical Hybridisation), which solves practical challenges in ensemble generation: vocabulary misalignment and tokenisation differences across heterogeneous models. Experiments across six watermarking schemes and three LLMs show that averaging across 3 models suppresses detection z-scores from 5-300 to below 2 (below the detection threshold of 4) and reduces TPR at 5% FPR to below 50%, while improving quality by 27.5% and running 6 times faster than the best baseline on the long sequence generation. Our results suggest that robust AI-text detection via watermarking requires either accepting this fundamental vulnerability or unprecedented coordination among model providers.
Zhihao Wu, Gracia Gong, Qinglin Zhu +2
Department of Informatics, King’s College London, UK · Department of Mathematics, Imperial College London, UK · Department of Statistics, University of Warwick, UK.
This work presents Dual-Embedding Watermarking (DEW), a semantic watermarking scheme for large language models (LLMs) that leverages contextual and token-level embeddings to enhance robustness against paraphrasing and translation. DEW utilizes a signal-processing methodology, applying algebraic vector-space operations to token and context embeddings to derive a watermark signal that degrades gracefully under semantic shifts. The method obfuscates the watermark by projecting embedding vectors through pseudo-random matrices seeded with a secret key. Relevant distributions derived from the underlying algebra are evaluated and employed for statistical testing and benchmarking of DEW. Experimental results across multiple LLMs indicate that DEW improves post-paraphrase detection while maintaining competitive text quality, and remains detectable after translation, even when prior semantic watermarks degrade significantly. These findings position DEW as a practical and robust solution for safeguarding LLM-generated text and addressing critical issues in responsible AI deployment.
Jonas Schäfer, Cezary Pilaszewicz, Gerhard Wunder
Department of Mathematics and Computer Science Freie Universität Berlin Berlin, Germany