Perturbation, Not Provenance: Why Activation Steering Does Not Make a Robust Text Watermark
Linear directions in the activation space of large language models causally and universally influence model behavior.
ProofPaper ↗
Key points
- This suggests that they might serve as a basis for a robust text watermark.
- We also test two paraphrasing attacks: a sentence-level one and a stronger paragraph-level one.
- The results show that activation-steering watermarks are outperformed by a standard logit-based watermark (KGW) in terms of detection accuracy.
- We conclude that, in this case, semantic activation does not encode a localized, recoverable semantic mark, but rather a global, content-independent shift that can only be strongly detected when the text is degraded.
Sources (1)
- [1]Perturbation, Not Provenance: Why Activation Steering Does Not Make a Robust Text WatermarkarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 13, 06:36 AM
Linear directions in the activation space of large language models causally and universally influence model behavior.
This suggests that they might serve as a basis for a robust text watermark.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 13, 2026I clustered two old Android phones to run a 27B LLM locally. Bypassed RAM limits via C++ RPC split and Hadamard Ternary math (No overheating)
- Oct 13, 2026Towards Green AI: Evaluating Energy Efficiency for Quantized LLM Inference
- Oct 12, 2026Autoregressive Decoding as a Martingale: Characterizing the Stochastic Dynamics of LLM Generation
- Oct 11, 2026WUSPruner: Second-Moment-Optimal Transforms for Structured Pruning
- Oct 11, 2026Fewer Bits, More Tries: Recovering Capability Under Memory Constraints
- Oct 10, 2026SocraticRepair: Planning-Guided Socratic Tutoring for Program Debugging and Misconception Repair