水印应被视为一种监控原语
Watermarking Should Be Treated as a Monitoring Primitive
AI 导读
一篇 NeurIPS 2026 立场论文提出，生成模型水印除防删改与伪造外，还应作为监控原语来评估和治理，因为同一信号可将输出内容追溯到生成它的实体。研究显示，持有检测器的内部观察者即便在零比特水印下，只要各实体持有独立密钥也能归属输出；外部观察者在所测配置中无需密钥即可识别未见过的文本和图像输出的来源。作者呼吁评估报告归属与识别准确率，并治理密钥绑定粒度与检测器访问权限。
正文 · 原文
Abstract:Watermarking is a primary means for providers of generative models to meet legal requirements to mark synthetic content. A watermark embeds a hidden signal into generated content that a detector holding a secret key can later recover. Its security is evaluated primarily against adversaries who remove or forge this signal in individual outputs. We argue that watermarking should also be evaluated and governed as a \emph{monitoring primitive}, because the same signal can link outputs to the entity that generated them. We show that (i) internal observers with detector access attribute outputs to individual entities even under zero-bit watermarks, which encode no identity, when each entity holds its own key, and (ii) external observers without keys or detectors identify the source of unseen text and image outputs in the configurations we test. Both depend on deployment choices that evaluations do not report, namely how fine-grained and persistent the bindings between keys and entities are and who may query the detector. We call for evaluations to report attribution and identification accuracy alongside robustness, and for governance to limit these bindings and detector access.
| Comments: | Accepted to NeurIPS 2026 (Position Track) |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computers and Society (cs.CY); Machine Learning (cs.LG) |
| Cite as: | arXiv:2605.13095 [cs.CR] |
| (or arXiv:2605.13095v4 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2605.13095 arXiv-issued DOI via DataCite |
Submission history
From: Toluwani Aremu [view email]
[v1]
Wed, 13 May 2026 07:10:04 UTC (697 KB)
[v2]
Thu, 14 May 2026 13:23:50 UTC (697 KB)
[v3]
Sat, 26 Sep 2026 12:44:23 UTC (710 KB)
[v4]
Thu, 22 Oct 2026 20:11:53 UTC (1,321 KB)
来源：arXiv cs.AI · arxiv.org