Abstract
As large language models (LLMs) are increasingly deployed for text generation, watermarking has become essential for authorship attribution, intellectual property protection, and misuse detection. While existing watermarking methods perform well in high-resource languages, their robustness in low-resource languages remains underexplored. This work presents the first systematic evaluation of state-of-the-art text watermarking methods: KGW, Exponential Sampling (EXP), and Waterfall, for Bangla LLM text generation under cross-lingual round-trip translation (RTT) attacks. Under benign conditions, KGW and EXP achieve high detection accuracy (>88%) with negligible perplexity and ROUGE degradation. However, RTT causes detection accuracy to collapse below RTT causes detection accuracy to collapse to 9-13%, indicating a fundamental failure of token-level watermarking. To address this, we propose a layered watermarking strategy that combines embedding-time and post-generation watermarks. Experimental results show that layered watermarking improves post-RTT detection accuracy by 25-35%, achieving 40-50% accuracy, representing a 3$\times$ to 4$\times$ relative improvement over single-layer methods, at the cost of controlled semantic degradation. Our findings quantify the robustness-quality trade-off in multilingual watermarking and establish layered watermarking as a practical, training-free solution for low-resource languages such as Bangla. Our code and data will be made public.
Abstract (translated)
随着大规模语言模型（LLMs）在文本生成中的应用日益广泛，水印技术已成为作者归属认定、知识产权保护和滥用检测的重要手段。尽管现有的水印方法在高资源语言中表现良好，但在低资源语言中的鲁棒性仍需进一步探索。本文首次系统地评估了三种最先进的文本水印方法（KGW、指数采样法EXP 和 Waterfall）在孟加拉语LLM文本生成过程中跨语言往返翻译(RTT) 攻击下的性能。 在无攻击的正常情况下，KGW和EXP 方法可以实现超过88%的高检测准确率，并且不会导致困惑度(perplexity)或ROUGE值的显著下降。然而，在RTT攻击下，水印的检测准确率急剧降至9-13%，这表明基于单令牌的水印技术在跨语言环境中失效。 为解决这一问题，我们提出了一种分层水印策略，该策略结合了嵌入时间和生成后两种类型的水印方法。实验结果显示，采用分层水印可以将RTT攻击后的检测准确率提高25-35%，达到40-50%的水平，相对于单层方法提高了3到4倍的效果，但代价是可控语义退化。 我们的研究量化了多语言水印技术中鲁棒性和质量之间的权衡，并证明分层水印是一种适用于低资源语言（如孟加拉语）的实际且无需重新训练的方法。我们将在后期公开代码和数据。
URL
https://arxiv.org/abs/2601.04534
