Open Problems

Watermarking & Deepfake Detection

Cross-Family Generalization and Robustness of Text Watermarking Attacks and Defenses

Scope to testPartly addressed
Possible candidate · 3/5 runs4 papers report this75% from 2025+

Generated automatically from the limitations stated in 4 papers (ACL, ICML, ICLR), listed under Evidence. It is not a paper, and it does not come from papers submitted to CSPaper.

The problem

Existing evaluations of text watermark attacks, detection, and removal methods have almost exclusively tested narrow subsets of logit-based schemes (e.g., KGW and SIR) evaluated on fixed base models like OPT-1.3B. Because no single study has evaluated these attack and defense methods across fundamentally different watermark families—including sampling-based, dynamic-hash, content-adaptive, and error-correction-augmented schemes—practitioners cannot determine whether reported evasion and detection results reflect general properties or family-specific artifacts. Consequently, deployment decisions for provenance tracking in production language models rely on unverified theoretical compatibility claims rather than measured empirical robustness.

Why it matters

Provides the first definitive empirical map of which watermark attacks and defenses genuinely generalize across distinct algorithmic families versus which are restricted to logit-based implementations. This enables developers of provenance systems to choose watermark schemes with verified cross-family robustness profiles.

Ways to approach it

Prior-work checks are free with an account. Results someone already ran are shown to everyone.

  1. 1

    Benchmark existing watermark removal and evasion attacks (e.g., surrogate-based transfer attacks, perturbation oracles, and entropy-weighted detection) across four distinct text watermark families (logit-based KGW/SIR, sampling-based watermarks, dynamic-hash schemes, and adaptive watermarks) across multiple LLM backbones, measuring watermark bit recovery rate, detection $p$-value degradation, and output perplexity.

  2. 2

    Evaluate cross-family attack transferability in settings where surrogate watermarks differ structurally from target watermarks (e.g., attacking a sampling-based or dynamic-hash target using logit-based surrogates), measuring transfer evasion success rates and detection AUC.

  3. 3

    Quantify the empirical effectiveness of defensive error-correcting codes and adaptive hash keys against automated text perturbation attacks, measuring watermark retention thresholds under controlled semantic and edit-distance bounds.

Have a different approach?

Describe how you would tackle this problem and we'll look for papers that already do it. Free; your text stays private.

Free · 3 checks per day

Why it might fail

If transferability across disparate watermark families turns out to be uniformly high due to shared sensitivity to surface-level token edits, the evaluation will confirm baseline expectations without revealing distinct family-specific failure modes. The project could also be limited if emerging production watermarks remain entirely closed-source and cannot be accurately represented by open implementations.

Evidence

Each paper's own statement of the limitation, verbatim.

Nearest existing work

Related open problems

Watermarking & Deepfake Detection

Barrier to removePartly addressed

Black-Box Verification and Trigger Generation for Model Watermarking and Detection

Current watermarking and deepfake detection methods require full white-box access to target model parameters and gradients during trigger construction or verification. When proprietary models are deployed solely behind inference APIs or distributed as encrypted binaries, these techniques cannot be applied at all. This leaves model owners and auditors unable to verify intellectual property theft, track provenance, or detect misuse across commercial black-box deployments.

Possible candidate · 2/5 runs8 papers report this38% from 2025+

Watermarking & Deepfake Detection

Barrier to removeOpen

Black-Box and Model-Agnostic Deepfake and Watermark Verification for Closed-Source Generative Models

Current watermark verification and deepfake detection methods require white-box access to target model parameters, intermediate layer activations, or gradient information. Because leading generative models and vision-language systems are served exclusively behind closed commercial APIs, internal inspection methods cannot be executed by downstream verifiers or auditors. Consequently, defenders cannot detect deepfakes or verify watermarks when the generating model is proprietary, unknown, or inaccessible. Removing the precondition of internal weight and activation access is necessary for auditing real-world deployed models.

Strong candidate · 4/5 runs4 papers report this100% from 2025+

Watermarking & Deepfake Detection

Barrier to removePartly addressed

Black-Box and Architecture-Agnostic Watermarking and Defense for Diffusion Models

Current proactive watermarking, attribution, and anti-customization defenses structurally assume white-box access to target latent diffusion models, requiring direct inspection of latent spaces, VAE fine-tuning, or gradient backpropagation through internal U-Net attention layers. In practical deployment scenarios, defenders and copyright holders must protect content against proprietary black-box APIs, pixel-space diffusion models, or non-VAE architectures where internal activations and weights are inaccessible. Because existing methods are tethered to specific LDM preconditions, there is currently no verified mechanism to provide provenance or anti-fine-tuning protection across arbitrary or black-box diffusion pipelines.

Possible candidate · 3/5 runs4 papers report this100% from 2025+

Watermarking & Deepfake Detection

Scope to testOpen

Benchmarking Watermarking and Deepfake Detection Across Non-Latent and Flow-Matching Generative Architectures

Current watermarking and detection methods in generative media are almost exclusively developed and evaluated on standard latent diffusion models relying on Gaussian noise sampling. Consequently, it is unknown whether these techniques transfer, degrade, or fail entirely when applied to pixel-space diffusion, non-iterative architectures, or modern rectified-flow and flow-matching models such as SD3 and FLUX. As production generative pipelines shift away from standard latent diffusion, safety and provenance mechanisms risk operating under untested assumptions. A systematic evaluation across these architectural families is necessary to establish the empirical boundary of existing detection and watermarking schemes.

Strong candidate · 5/5 runs3 papers report this67% from 2025+
Generated automatically, not curated by hand. Automated prior-work checks catch about a third of existing work, so treat this problem as a lead to investigate.