跳转至

针对大型语言模型的Unicode文本水印方法安全性与可检测性分析

文章背景与核心概要

随着大型语言模型的广泛应用，数字文本的安全性变得日益重要，这主要源于机器学习训练集中的数据所有权争议，以及区分模型生成内容与人类撰写文本的挑战。数字水印通过在受保护的数据中嵌入不可见的标记，提供了一种有效的安全保障手段。

本文评估了十种现有的Unicode文本水印方法在六个主流大型语言模型（包括GPT-5、GPT-4o、Teuken 7B、Llama 3.3、Claude Sonnet 4和Gemini 2.5 Pro）下的表现，旨在探究当前数字文本水印技术针对大模型的安全性和隐蔽性。研究表明，虽然现代推理模型能够成功检测出水印文本的存在，但在未提供具体实现细节（如源代码）的情况下，它们无法提取出隐藏的水印。

Security and Detectability Analysis of Unicode Text Watermarking Methods against Large Language Models

Security and Detectability Analysis of Unicode Text Watermarking Methods against Large Language Models

Summary

Summary

本文评估了十种现有的Unicode文本水印方法在六个大型语言模型（GPT-5、GPT-4o、Teuken 7B、Llama 3.3、Claude Sonnet 4和Gemini 2.5 Pro）上的表现，研究了文本水印的安全性与可检测性。研究证明，现代推理模型虽然能够成功检测出水印文本的存在，但若不提供具体的实现细节（如源代码），它们便无法提取出隐藏的水印。

This paper investigates the security and detectability of text watermarking by evaluating ten existing Unicode text watermarking methods across six large language models (GPT-5, GPT-4o, Teuken 7B, Llama 3.3, Claude Sonnet 4, and Gemini 2.5 Pro). The research demonstrates that while modern reasoning models can successfully detect the presence of watermarked text, they are unable to extract the hidden watermark unless specific implementation details (such as source code) are provided.

Metadata

Metadata

  • arXiv ID: arXiv:2512.13325 [cs.CR]
  • Authors: Malte Hellmeier
  • Primary Subject: Cryptography and Security (cs.CR)
  • Secondary Subjects: Artificial Intelligence (cs.AI), Machine Learning (cs.LG)
  • Conference: Accepted and presented at ICISSP 2026
  • Submission History:
  • [v1] Mon, 15 Dec 2025
  • [v2] Thu, 13 Aug 2026 (Current)
  • DOI: 10.48550/arXiv.2512.13325
  • Related DOI: 10.5220/0014268700004061

Abstract

Abstract

由于大型语言模型的广泛使用，数字文本的安全性正变得愈发重要，这主要受到机器学习训练集数据所有权问题以及区分模型生成内容与人类撰写文本这一挑战的推动。数字水银（注：此处指数字水印）通过在受保护的数据中嵌入不可见的水印，提供了一种安全防护措施。

Securing digital text is becoming increasingly relevant due to the widespread use of large language models, driven by concerns regarding data ownership in machine learning training sets and the challenge of distinguishing model-generated output from human-written text. Digital watermarking offers a safeguard by embedding an invisible watermark within protected data.

为了评估当前数字文本水印技术是否安全且能躲避大型语言模型的检测，本研究构建了一个包含三个实验的受控测试平台。研究实现了十种Unicode文本水印方法，并针对六个大模型进行了分析： * GPT-5 * GPT-4o * Teuken 7B * Llama 3.3 * Claude Sonnet 4 * Gemini 2.5 Pro

To evaluate whether current digital text watermarking techniques are secure and hidden from large language models, this study establishes a controlled testbed consisting of three experiments. Ten Unicode text watermarking methods were implemented and analyzed against six LLMs: * GPT-5 * GPT-4o * Teuken 7B * Llama 3.3 * Claude Sonnet 4 * Gemini 2.5 Pro

核心发现： 1. 可检测性： 最新一代的推理模型有能力检测出带有水印的文本。 2. 提取抵抗力： 所有测试模型在未提供实现细节（如源代码）的情况下，均无法提取嵌入的水印。

Key Findings: 1. Detectability: Latest-generation reasoning models are capable of detecting watermarked text. 2. Extraction Resistance: All tested models fail to extract the embedded watermark unless implementation details (such as source code) are provided.

论文最后讨论了对安全研究人员和从业者的启示，并针对应对新兴安全挑战提出了建议。

The paper concludes with a discussion on the implications for security researchers and practitioners, alongside recommendations for addressing emerging security challenges.