Pin It on Anyone: Certified Targeted Displacement of Multi-Bit LLM Watermarks Without the Key

Paweł Batorski; Przemysław Spurek; Paul Swoboda

cs.CROct 13, 2026

Pin It on Anyone: Certified Targeted Displacement of Multi-Bit LLM Watermarks Without the Key

Authors: Paweł Batorski, Przemysław Spurek, Paul Swoboda

Organizations: Heinrich Heine University Düsseldorf · Jagiellonian University · IDEAS Research Institute

Abstract

Multi-bit watermarking embeds a message, typically an account identifier, into LLM output so that harmful text can be traced to its origin. We show an attack technique that allows to alter the watermarking message. This allows to, for example, exchange the embedded account ID to an arbitrary different one. The attacker mainly needs access to a few accounts for generating LLM output and model logits, but crucially not the secret key used to watermark. The attacker then rewrites the text, keeping its meaning, so that the watermarking message decoder recovers the watermarking message embedded by the attacker. We are, to our knowledge, the first to propose such an attack, which we call a targeted displacement. Theoretically, we present upper and lower bounds on the probability of our attack succeeding. This bound depends on the number of accounts the attacker has access to, the length of the message and some characteristics of the given text. Our attack can succeed whenever we can bound the ambiguity of the generated text well enough. Empirically, we test our attack technique against five watermarking methods and four LLMs. Attack success tracks our predicted bounds, allowing us to alter watermarking messages in almost all cases with high accuracy, given enough accounts. Our code can be found at https://github.com/Batorskq/PinIt.

Figures & tables

Figure 1: Targeted displacement of a multi-bit watermark. The provider embeds each account’s identifier into generated text, and a decoder recovers it to attribute a text. Text from the attacker’s own accounts is traced back to the attacker. By comparing the tokens its accounts favor with their known message bits, the attacker learns the hidden watermark structure without the key and paraphrases its text, keeping the meaning, so that the decoder outputs any identifier of the attacker’s choice, here that of an innocent user.

Figure 2: Overview of targeted displacement. The attacker wants to rewrite a text that carries watermark message

m

, keeping its meaning, so that the decoder attributes it to a chosen message

m^{\prime}

, without the secret key. It controls accounts with known messages and, at every context used by the rewrite, compares an account’s next-token distribution with the base model to recover the account’s green list (step 1). The recovered green lists are turned into the target’s green list. This succeeds exactly when the target’s relative bits are constant within every twin class; otherwise the ambiguity bound of Theorem 1 caps the success probability (step 2). A paraphraser rewrites the source under a token-level constraint toward the target’s set, and the attacker certifies the rewrite from its own posterior without the key (step 3), so that the provider’s decoder reads the target message. Only step 2 depends on the watermark scheme.

Figure 3: Different hidden permutations and selections can induce the same observable green list set.

Figure 4: Recovering an account’s set for MPAC at one context

c

. Top: the key colors the vocabulary and selects position 1, where account

i

’s message has bit 0, so generation boosts

G_{i}(c)=\{a,c,e\}

. The attacker sees none of this. Bottom: the attacker queries the account and the base model at

c

. By the public rule (P1), every token of the hidden set has its probability multiplied by

e^{\delta}

before renormalization, so the log-ratio

\ell_{i}(v)=\log q_{i}(v)-\log p(v)

takes only two values,

\delta-\log Z_{i}

inside the set and

-\log Z_{i}

outside it, here with

Z_{i}=1+(e^{\delta}-1)\sum_{v\in G_{i}(c)}p(v)=3.9

. The midpoint

\theta_{i}

separates them and returns

\{a,c,e\}

exactly, without the key. The position

J_{K}(c)

and the name of the color stay hidden. Appendix A gives the rule for every scheme.

Figure 5: Building the set of the target

m^{\prime}

from twin classes. Top: two accounts with known messages,

m^{(1)}

as the reference, and the signature

x_{j}

that marks where

m^{(2)}

differs from it. Positions with equal

x_{j}

are twins, here

T_{a}=\{1,2\}

and

T_{b}=\{3,4\}

. The target

m^{\prime}

differs from the reference by

r_{j}

, which is constant on each class, so every class fixes one choice between

G_{1}(c)

and its complement ( 6 ). Middle: at a context

c

the two accounts’ green lists differ, which by ( 4 ) means that their messages differ at the hidden position

j=J_{K}(c)

, so

j\in T_{a}

and the attacker boosts

G_{1}(c)

. Bottom: at a context

c^{\prime}

the sets agree, so

j^{\prime}\in T_{b}

and the attacker boosts the complement of

G_{1}(c^{\prime})

. Neither step needs the position or the names of the colors. Bit 0 is green, bit 1 is orange, and the set to boost is blue.

Figure 6: The certified attack on a rewrite

z

, for

L=4

with twin classes

T_{a}=\{1,2\}

and

T_{b}=\{3,4\}

. Top:

z

read as the sequence of pairs

(c_{t},z_{t})

, one vote each, with

\sigma(c_{t},z_{t})=+1

when

z_{t}

lies in the recovered target green list

G_{K}^{m^{\prime}}(c_{t})

and

-1

otherwise. The context

c_{1}

occurs three times, at

t=1,4,9

. Bottom left: the pairs grouped by context with the vote sum of each context. Bottom middle: the attacker knows

J_{K}(c_{1})\in\{1,2\}

but not whether it is

1

2

, so

\Pi_{O}

draws the position of every context uniformly from its class, independently across contexts. Each draw gives the margins

M_{j}(J)

, and

E

holds when every margin is positive.

E

fails when

c_{3}

cancels

c_{2}

(draw 2) or when no pair lands on position

2

(draw 3). Bottom right: the share of draws with

E

is the certificate, a lower bound on the probability that the decoder reads

z

m^{\prime}

. In this small example

\Pr[E]

is computed by hand,

2/8

for

T_{a}

(positions of

c_{1}

and

c_{2}

differ and

c_{3}

joins

c_{1}

) times

6/8

for

T_{b}

(not all three contexts on one position), whereas the experiments estimate it by Monte Carlo over draws of

J

Figure 7: Exact-match success against the number of colluding accounts for five schemes and message lengths

L\in\{8,16,32\}

at 200 tokens per text, mean over the four generators Llama-2-7B, Llama-3.1-8B, Qwen3.5-4B, and Qwen3.5-9B (per-generator panels in Appendix G , 64-bit messages and other text lengths in Appendix H ). Dashed: the upper-bound certificate, the mean scheme-specific symmetry bound over the drawn targets (shaded: ruled out), and the lower-bound certificate, the mean of ( 15 ) over the

\tau=0

rewrites. Circles: the

\tau=0

rule, band: its range over the generators. Diamonds:

\tau=10^{-3}

. Dotted: the decoder’s exact-match rate on the untouched source. CycleShift falls to a single account, so its panels show a random target from one account at

n=1

, extended flat because any larger coalition can use one account, with the chunked variant of Appendix C at 32 bits. Its lower-bound certificate is zero for Llama-2-7B at 16 bits, whose vocabulary is smaller than the

2^{16}

shifts, so one account reveals only part of the keyed set.

		decoding accuracy (%) $\uparrow$						fidelity to the source $\uparrow$
		clean	no attack	own acc. $\to\bar{m}$		$n$ accounts		BERTScore		ROUGE-L		LLM judge (1–5)
Generator	$L$	BA	BA	BA	EM	BA	EM	para.	attack	para.	attack	para.	attack
Llama-2-7B	8	96.5	50.2	100.0	100	100.0	100	0.89	0.84	0.48	0.32	3.4	2.7
Llama-2-7B	16	93.5	49.2	100.0	100	99.9	99	0.90	0.84	0.48	0.32	3.4	2.9
Llama-3.1-8B	8	98.0	49.2	100.0	100	100.0	100	0.90	0.86	0.39	0.28	3.6	3.1
Llama-3.1-8B	16	94.8	49.4	100.0	100	99.9	99	0.90	0.87	0.40	0.29	3.5	3.2

Table 1: Steering binary MPAC on four generators. BA: bit accuracy of the decoded message to the attacker’s target, EM: exact-match rate, both in percent. Every cell averages the 100 watermarked texts of one generator and message length, each rewritten once per condition (800 sources and 2,400 rewrites in all).

\uparrow

: higher is better. Clean : BA of the watermarked source to its own message. No attack : the same paraphraser, with the same 4-gram block but no watermark knowledge, scored against a random target, i.e., chance. Own account : the attacker uses only its own account and targets the complement of its own message

\bar{m}

n

accounts :

n=8

(

L=8

) or

n=12

(

L=16

) colluding accounts and a uniformly random target. Fidelity to the source, for the paraphrase without the attack (para.) and for the

n

-account rewrite (attack): BERTScore F1 and ROUGE-L F1 against the watermarked source, and the mean score of two LLM judges on a 1 to 5 scale (Appendix C ).

	certificate
	$=1$	$\in(0,1)$		$=0$
Scheme	succ. $\uparrow$	cert.	succ.	succ.	flagged $\downarrow$
rule $\tau=0$
MPAC	100	70	77	4	0/104
RSBH	100	8	14	1	6/92
StealthInk	100	60	93	5	0/108

Table 2: Certificate against realized success over all rewrites at 200 tokens under the

\tau=0

and

\tau=10^{-3}

rules (9,200 to 12,900 rewrites per scheme and rule), grouped by certificate value: the success rate where the certificate is one, the mean certificate and the success rate where it lies strictly between zero and one, and the success rate where it is zero, in percent. Flagged: conditions (corpus and account setting) whose mean certificate exceeds the realized success by more than two standard errors.

\uparrow

(

\downarrow

): higher (lower) is better.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Watermarked source	Paraphrase without the attack	Attack rewrite
Example 1. Qwen3.5-4B, $L=16$ , 12 colluding accounts. Target $1001000100100101$ , decoded $1001000100100101$ . Paraphrase / attack rewrite: judge 5.0 / 4.0, ROUGE-L 0.53 / 0.51, BERTScore 0.93 / 0.93.
Google Music will continue to be free to download in the U.S., but the service is shutting down for free users in all of Europe, except for Italy. Apple Music, now in beta testing, seems to be getting the best of all worlds. It offers a monthly subscription service like Spotify and Google Music, but the company is also offering an option to buy your music from the App Store. Apple Music is available for testing in the U.S. only for now and it will be available as an in-app purchase on both iOS and Mac for users in beta. So there are a lot of choices for mobile music consumers, and Google Music is a strong contender for those looking for a cloud music experience. Does the “cloud music” label mean that it’s only available on mobile devices? No. You can use the Google Music app on your iPhone and Android. You can also access the service through a web browser. How much of your music is stored on your computer	Google Music remains free to download within the U.S.; however, the service is ending for free users across all European countries except Italy. Apple Music, currently in beta, appears to combine the best features of both worlds: it offers a monthly streaming subscription similar to Spotify and Google, while also allowing users to purchase individual tracks from the App store. For now, Apple Music is available exclusively for testing in America, where beta users can access it as an in-purchase on both iOS devices and Mac computers. Consequently, mobile music consumers have numerous options, with Google Music serving as a strong choice for those seeking a cloud-based music experience. The term "cloud music" does not imply the service is limited to mobile devices; users can stream via the app on iPhones and Android phones, as well as through any web browser.	Users will still be able to download Google Music for free from America. However, in every part Europe other except for Italy, free access to music is shutting down. Apple Music, which is now in beta, appears to combine the best of both options: a subscription service that works the type of Spotify and Google plus an option to purchase songs from Apple Store. Apple is available only for testing right now in America. It is available as an on-the-floor, in-app store purchase to iOS and MAC users who participate in beta testing the service. So there are many options for mobile consumers and Google Music remains a very strong contender if people are searching out the best cloud-based music experience. The label "cloud music" does not mean it is only for mobile phones or tablets. You can utilize Google Music on an iOS and Android phone, plus on the web. So much of your personal library stored on the personal computer.
Example 2. Llama-3.1-8B, $L=16$ , 12 colluding accounts. Target $1100000001010101$ , decoded $1100000001010101$ . Paraphrase / attack rewrite: judge 4.0 / 4.0, ROUGE-L 0.41 / 0.40, BERTScore 0.91 / 0.89.
They also collected money for those in struggle and leafleted with information. The event went on for two hours. The speakers at the rally included a young man from Afghanistan, who said, “The U.S. has been bombing my country for 16 years. We don’t want this war. We don’t support this war. We support peace, not war.” The speaker from the Philippines, who is also a veteran of the U.S.’ wars there, said, “The people of the Philippines have been resisting the U.S. for more than 120 years. The American imperialists have never been able to subjugate the Filipino people, and they never will.” The IAC also set up an anti-imperialist book table on Wilshire Boulevard at the corner of Western. The table was staffed by IAC members who spoke to passers-by about the U.S. war in Afghanistan, the U.S. wars in Korea and the Philippines, and the U.S. attack on	The event featured fundraising efforts for those affected by conflict, as well as the distribution of informational leaflets. The rally itself lasted for two hours. Speakers at the event included a young Afghan man, who emphasized that the U.S.’s 16-year bombing campaign in his country has been met with opposition. He stated that the Afghan people do not support the ongoing war and instead advocate for peace. A speaker from the Phillipines, who has also experienced U.S. military involvement firsthand, noted that the Phillipine people have been resisting U.S. influence for over 120 years, with the U.S.-led imperialist efforts ultimately proving unsuccessful. The IAC set up an information table on Wilhire Boulevard at Western Avenue, where members engaged with passersby about U.S. involvement in various conflicts, including Afghanistan, Korea, and the Phillipines.	The demonstration featured fundraising efforts for communities impacted by war. In conjunction, participants distributed leaflets with relevant informational materials during the two-hours-long protest. A speaker at the rally from Afghanistan expressed his country’s prolonged experience of conflict, having been bombed by the U. S for nearly sixteen years. He emphasized that the Afghan people’s opposition to war remains unwavering, with their desire for peaceful resolution being the primary stance. A veteran from the U. s-affected Philippines also shared his views at the rally. He highlighted the long history between the U. and s the Philippine people, with their resistance dating back over more a century. He confidently stated that the U. could never subsume their people under its control. The IAC set-up a book display on Wilhire Boulevard, at the intersection of Western. This display was staffed and monitored by IAC volunteers who spoke with on-looking passers-by, addressing the U. ’S involvement in conflicts in countries including Afghanistan, s Korea, s the U. the U. as and s the U, s the attack.

Appendix

Table 3: Two example rewrites of binary MPAC under the

\tau=0

rule of Table 1 : the watermarked source, the same paraphraser without the attack, and the

n

-account attack rewrite that decoded to the target. Each example’s line gives the generator, the message length, the number of colluding accounts, the target and decoded messages, and the judge score, ROUGE-L and BERTScore of the paraphrase and of the attack rewrite. Selection as described in Appendix E .

Scheme	$n_{\max}$	Generator	BA $\uparrow$	BA $\uparrow$	BA $\uparrow$	EM $\uparrow$	BA $\uparrow$	EM $\uparrow$	paraphrase	attack	source	attack
			clean	no attack	own acc. $\to\bar{m}$		$n_{\max}$ accounts		BERTScore $\uparrow$		perplexity $\downarrow$
MPAC (binary)	8	Llama-2-7B	96.5	50.2	100.0	100	100.0	100	0.89	0.84	4.9	41.7
		Llama-3.1-8B	98.0	49.2	100.0	100	100.0	100	0.90	0.86	4.4	19.8
		Qwen3.5-4B	99.0	48.0	100.0	100	100.0	100	0.90	0.86	5.8	23.5
		Qwen3.5-9B	98.4	52.5	100.0	100	100.0	100	0.91	0.86	5.4	24.3
		mean	98.0	50.0	100.0	100	100.0	100	0.90	0.86	5.1	27.3

Appendix

Table 4: Steering other multi-bit schemes with 8-bit messages, per generator with the mean over the four generators. Same accuracy metrics as Table 1 , with BERTScore and perplexity under Llama-2-13B (source and attack rewrite) as text metrics.

\uparrow

(

\downarrow

): higher (lower) is better. The colluding column uses the largest number of accounts run for each scheme,

n_{\max}

, and for CycleShift a random target from the own account alone. CycleShift: the payload cyclically shifts one secret set, so one account reveals every payload’s set. RSBH: public segments and an RS(4,2) code over GF(16) whose released decoder falls back to the raw payload when decoding fails. XMark: public blocks from the two previous tokens and two keyed quarterings of the vocabulary, with the 2-bit symbol suppressing one quarter under both. StealthInk: the released 2-bit chunks, for which the accuracy columns report symbol accuracy over the four 2-bit positions, and a binary variant.

Figure 8: Binary MPAC: per-generator version of Figure 7 . Triangles: the soft bias of ( 8 ).

Figure 9: RSBH: per-generator version of Figure 7 . A target is reachable once at most one of its codeword symbols is uncovered by the accounts, which takes 32 accounts for 8-bit messages and 64 for 16-bit ones.

Figure 10: StealthInk with its released 2-bit symbols: per-generator version of Figure 7 . A target becomes reachable once every one of its symbols has been seen at its position by some account.

Figure 11: XMark with its released 2-bit symbols: per-generator version of Figure 7 . Blocks are public, so a target’s symbol at a block is reachable once some account carries it or only one symbol value is unseen there.

Figure 12: CycleShift: per-generator version of Figure 7 . Every target is reachable from the own account, so the panels show the complement

\bar{m}

, targets one and four bits away from

m

, and a uniformly random one.

Figure 13: Exact-match success of the constrained rewrite (

\tau=0

, 4-gram block) against the number of colluding accounts for sources of

T\in\{100,200,400\}

tokens, rewrites of

0.75T

1.24T

tokens, mean over the four generators. Dashed: the mean symmetry bound, the same for every

T

. Shaded: ruled out. Figures 14 and 15 show the same runs in the layout of Figure 7 .

Figure 14: Figure 7 at 100 tokens per text (

\tau=0

rule, since the

\tau=10^{-3}

rule and CycleShift were run at 200 tokens only). Dotted: the decoder’s exact-match rate on the untouched 100-token source.

Figure 15: Figure 7 at 400 tokens per text (

\tau=0

rule, since the

\tau=10^{-3}

rule and CycleShift were run at 200 tokens only). Dotted: the decoder’s exact-match rate on the untouched 400-token source.

Scheme	$L$	$T$	seconds per rewritten text $\downarrow$				queries $\downarrow$	corpus
			Llama-2-7B	Llama-3.1-8B	Qwen3.5-4B	Qwen3.5-9B	per rewrite	(min)
MPAC	8	200	1	2	3	3	120	3
	16	200	1	2	3	3	174	3
	32	200	2	2	4	5	845	2
	64	200	2	3	5	5	1555	2
	8	400	3	3	6	7	276	5

Appendix

Table 5: Wall-clock cost of the attack per rewritten text, in seconds on one H100, for the

\tau=0

rule, the number of oracle queries per rewrite, and the corpus-generation time in minutes (mean over generators).

\downarrow

: lower is better.

Generator	Text	own, $8$	own, $16$	$n$ , $8$	$n$ , $16$	judges $\uparrow$	NLI $\uparrow$	numbers	entities
		exact target match (%) $\uparrow$						facts kept $\uparrow$
Llama-2-7B	paraphrase					4.21	0.74	0.85	0.83
	$\tau=0$ , block incl. source	100	100	100	99	2.76	0.51	0.07	0.21
	$\tau=0$ , rewrite-only block	100	100	100	99	2.76	0.50	0.08	0.24
	+ fact protection	100	90	100	93	3.10	0.59	0.66	0.56
Llama-3.1-8B	paraphrase					4.17	0.75	0.80	0.77

Appendix

Table 6: Per-generator fidelity results for the plain paraphrase, the rule of Table 1 (

\tau=0

, 4-gram block over the whole input), the same rule with the block over the rewrite only, and the latter with fact protection (

\kappa=0.5

). Judges: mean of the two LLM judges. NLI: mean of support and coverage.

\uparrow

: higher is better.

Figure 16: Exact-match success against fidelity (mean of the two LLM judges) for the rewrite rules evaluated in this section, one panel per message length, mean over the four generators and over the own-account and

n

-account rewrites. Blue: the constrained rule from the soft bias to

\tau=0

. Squares:

\tau=0

with either 4-gram block. Stars:

\tau=0

with fact protection. Dashed lines: fidelity of the plain paraphrase, of an unwatermarked completion of the same prompt, and of an unrelated source.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 111 papers

Every Bit, Everywhere, All at Once: A Binomial Multibit LLM Watermark
May 12, 2026Thibaud Gloaguen, Robin Staab, Mark Vero +1Text Watermarking Multi-Bit Watermarking
ETH Zurich
Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks
Aug 13, 2026Xiaoyan Feng, Yanjun Zhang, He Zhang +2Data Provenance LLM Watermarking
Griffith University
LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematization
Jul 11, 2026Huy Phan, Kieu Dang, Ojaswi Dulal +4Data Provenance LLM Watermarking
Truman State University, Kirksville, MO, USA · State University of New York at Albany, Albany, NY, USA

May 12, 2026J/K move · Enter open · S save

Every Bit, Everywhere, All at Once: A Binomial Multibit LLM Watermark

Thibaud Gloaguen, Robin Staab, Mark Vero, Martin Vechev

ETH Zurich

Text Watermarking Multi-Bit Watermarking LLM Watermarking Robust Watermarking

Open paper AskPDF arXiv

With LLM watermarking already being deployed commercially, practical applications increasingly require multibit watermarks that encode more complex payloads, such as user IDs or timestamps, into the generated text. In this work, we propose a fundamentally new approach for multibit watermarking: introducing binomial encoding to directly encode every bit of the payload at every token position. We complement our approach with a stateful encoder that during generation dynamically redirects encoding pressure toward underencoded bits. Our evaluation against 8 baselines on up to 64-bit payloads shows that our scheme achieves superior message accuracy and robustness, with the gap to baseline methods widening in more relevant settings (i.e., large payloads and low-distortion regimes). At the same time, we challenge prior works' evaluation metrics, highlighting their lack of practical insights, and introduce per-bit confidence scoring as a practically relevant metric for evaluating multibit LLM watermarks.

Abstract

LLM Watermarking

Explore similar work

Every Bit, Everywhere, All at Once: A Binomial Multibit LLM Watermark

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematization