Text watermarking technology aims to tag and identify content produced by
large language models (LLMs) to prevent misuse. In this study, we introduce the
concept of ''cross-lingual consistency'' in text watermarking, which assesses
the ability of text watermarks to maintain their effectiveness after being
translated into other languages. Preliminary empirical results from two LLMs
and three watermarking methods reveal that current text watermarking
technologies lack consistency when texts are translated into various languages.
Based on this observation, we propose a Cross-lingual Watermark Removal Attack
(CWRA) to bypass watermarking by first obtaining a response from an LLM in a
pivot language, which is then translated into the target language. CWRA can
effectively remove watermarks by reducing the Area Under the Curve (AUC) from
0.95 to 0.67 without performance loss. Furthermore, we analyze two key factors
that contribute to the cross-lingual consistency in text watermarking and
propose a defense method that increases the AUC from 0.67 to 0.88 under CWRA.

我们引入了 “跨语言一致性” 概念，分析了当前文本水印技术在翻译成其他语言后的失效性，并提出了一种跨语言水印移除攻击（CWRA）方法，该方法可以在不降低性能的情况下从 0.95 降低 AUC 至 0.67，同时分析了两个影响跨语言一致性的关键因素，并提出了一种提高 CWRA 下 AUC 至 0.88 的防御方法。

水印是否能幸存于翻译？关于大型语言模型中文本水印的跨语言一致性

Can Watermarks Survive Translation? On the Cross-lingual Consistency of  Text Watermark for Large Language Models

Watermarking has become the tendency in protecting the intellectual property
of DNN models. Recent works, from the adversary's perspective, attempted to
subvert watermarking mechanisms by designing watermark removal attacks.
However, these attacks mainly adopted sophisticated fine-tuning techniques,
which have certain fatal drawbacks or unrealistic assumptions. In this paper,
we propose a novel watermark removal attack from a different perspective.
Instead of just fine-tuning the watermarked models, we design a simple yet
powerful transformation algorithm by combining imperceptible pattern embedding
and spatial-level transformations, which can effectively and blindly destroy
the memorization of watermarked models to the watermark samples. We also
introduce a lightweight fine-tuning strategy to preserve the model performance.
Our solution requires much less resource or knowledge about the watermarking
scheme than prior works. Extensive experimental results indicate that our
attack can bypass state-of-the-art watermarking solutions with very high
success rates. Based on our attack, we propose watermark augmentation
techniques to enhance the robustness of existing watermarks.

本文提出了一种新颖的水印去除攻击方法，能够有效和盲目地破坏水印模型对水印样本的记忆，实现了水印去除，并且提出了一种轻量级的微调策略，以提升模型性能和现有水印的鲁棒性。