Perturbation, Not Provenance: Why Activation Steering Does Not Make a Robust Text Watermark

Sergey Pletenev

cs.CLOct 13, 2026

Perturbation, Not Provenance: Why Activation Steering Does Not Make a Robust Text Watermark

Authors: Sergey Pletenev

Organizations: AIRI · Skoltech

Abstract

Linear directions in the activation space of large language models causally and universally influence model behavior. This suggests that they might serve as a basis for a robust text watermark. The idea is to steer the generation along a specific semantic direction and then recover the mark by probing the activations of the re-encoded text. We test this hypothesis by conducting a series of experiments. We vary the strength of the steering and use four different directions (formality, sentiment, complexity, and a random control) across two different model families. We also test two paraphrasing attacks: a sentence-level one and a stronger paragraph-level one. The results show that activation-steering watermarks are outperformed by a standard logit-based watermark (KGW) in terms of detection accuracy. At a matched level of fluency (within 1.15 times the original text's perplexity), KGW achieved an AUC of 0.81 against a sentence-level paraphraser, while the best steering direction only reached 0.65. A stronger paragraph-level paraphraser lowered both (0.65 for KGW and 0.59 for steering), narrowing the gap but not reversing it. On Qwen, it left the two indistinguishable but at near-chance levels for both. We further showed that the detectability provided by steering was not semantic: a random direction was just as detectable as a meaningful one. The signal was independent of which layer was probed and whether a surface feature control was used. We conclude that, in this case, semantic activation does not encode a localized, recoverable semantic mark, but rather a global, content-independent shift that can only be strongly detected when the text is degraded.

Figures & tables

Deployable regime ( $\leq 1.15\times$ ppl)
Methods	Ppl.	$d$	AUC ${}_{\text{Peg}}$	AUC ${}_{\text{DIP}}$
KGW ( $\delta{=}3$ )	$1.06$	$0.06$	$\mathbf{0.81}$	$\mathbf{0.65}$
sentiment ( $\alpha{=}0.1$ )	$1.03$	$0.03$	$0.65$	$0.59$
random ( $\alpha{=}0.2$ )	$1.13$	$0.12$	$0.61$	$0.57$
complexity ( $\alpha{=}0.4$ )	$1.03$	$0.03$	$0.59$	$0.55$
formality ( $\alpha{=}0.2$ )	$1.05$	$0.05$	$0.57$	$0.52$

Table 1: Llama-3.2-1B, best point per method within each case, under the Pegasus (Peg) and DIPPER (DIP) attacks. Ppl. is the ratio to unsteered and

d=\lvert\log(\text{ppl ratio})\rvert

Figure 1: Detection-versus-distortion frontier (Llama-3.2-1B)

Figure 2: Detection-versus-distortion frontier (Qwen3-1.7B)

Figure 3: Post-paraphrase detectability against probe layer on Llama-3.2-1B. Rings mark each direction’s peak layer; the dash-dotted line is the layer that was steered. "low" is

\alpha{=}0.1

and "strong" is

\alpha{=}0.4

Figure 4: Post-paraphrase detectability against probe layer on Qwen3-1.7B

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Method	$\alpha/\delta$	Ppl.	$d$	AUC ${}_{\text{Peg}}$	AUC ${}_{\text{DIP}}$
unsteered	–	$1.00$	–	$0.50$	$0.50$
formality	$0.1$	$1.03$	$0.03$	$0.514$	$0.536$
	$0.2$	$1.05$	$0.05$	$0.568$	$0.519$
	$0.4$	$1.23$	$0.20$	$0.698$	$0.589$
	$0.6$	$1.73$	$0.55$	$0.914$	$0.831$
	$0.8$	$11.9$	$2.47$	$0.999^{\dagger}$	$0.999^{\dagger}$

Appendix

Table 2: Llama-3.2-1B, all operating points, under the Pegasus (Peg) and DIPPER (DIP) attacks. Bold marks the best KGW point inside the deployable band.

\dagger

excluded from the frontier by the perplexity rule.

Method	$\alpha/\delta$	Ppl.	$d$	AUC ${}_{\text{Peg}}$	AUC ${}_{\text{DIP}}$
unsteered	–	$1.00$	–	$0.50$	$0.50$
formality	$0.1$	$0.90$	$0.10$	$0.567$	$0.534$
	$0.2$	$0.84$	$0.18$	$0.676$	$0.592$
	$0.4$	$0.72$	$0.33$	$0.900$	$0.772$
	$0.6$	$1.15$	$0.14$	$0.985^{\dagger}$	$0.956^{\dagger}$
	$0.8$	–	–	$0.987^{\dagger}$	$0.977^{\dagger}$

Appendix

Table 3: Qwen3-1.7B, all operating points, under the Pegasus (Peg) and DIPPER (DIP) attacks. Ratios below

1

are homogenization, not error. “–” marks generations too degenerate to score. Bold marks the best KGW point inside the deployable band.

\dagger

excluded from the frontier by the perplexity rule.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 110 papers

Adversarial Robustness of Activation Steering in Large Language Models
Jun 5, 2026Kien Le, Thai LeLLM Evaluation Language Model Steering
Independent Researcher · Indiana University
Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs
May 28, 2026Zhihao Wu, Gracia Gong, Qinglin Zhu +2Watermark Removal LLM Watermarking
Department of Informatics, King’s College London, UK · Department of Mathematics, Imperial College London, UK · Department of Statistics, University of Warwick, UK.
Robust Text Watermarking for Large Language Models via Dual Semantic Embeddings
Jun 30, 2026Jonas Schäfer, Cezary Pilaszewicz, Gerhard WunderText Watermarking LLM Watermarking
Department of Mathematics and Computer Science Freie Universität Berlin Berlin, Germany

Jun 5, 2026J/K move · Enter open · S save

Adversarial Robustness of Activation Steering in Large Language Models

Kien Le, Thai Le

Independent Researcher · Indiana University

LLM Evaluation Language Model Steering Neural Network Robustness Adversarial Robustness of Language Models

Open paper AskPDF arXiv

Activation steering has become a popular training-free method to control LLM behavior by injecting precomputed direction vectors into the model's residual stream at inference time. Yet its robustness to realistic input variation remains unstudied. We present the first systematic evaluation of activation steering robustness under adversarial text perturbations on the inputs, covering four extraction methods, three attack strategies, six personas from Anthropic Model-Written Evaluation Dataset, and five models ranging from 1.5B to 30B parameters. Attacks succeed broadly across all settings: directional robustness drops by up to 64%, post-attack confidence collapses near or below 0.25 across all methods and models, and steering strength degrades on nearly every steerable input. Layer selection is equally fragile, with the optimal layer identified by an automated method on clean inputs shifting by up to 17 positions under perturbation, a failure that compounds the vector-level breakdown. Extracting vectors from adversarially perturbed inputs partially recovers steerability for PCA and MD on mid-to-large models, but they consistently fail to locate the improved optimal layer, limiting the practical benefit of this mitigation. Together, these findings reveal that the brittleness of activation steering is structural rather than method-specific, and that current layer selection strategies are not robust enough for real-world deployment.

Abstract

LLM Watermarking

Explore similar work

Adversarial Robustness of Activation Steering in Large Language Models

Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

Robust Text Watermarking for Large Language Models via Dual Semantic Embeddings