---
title: "Watermark Forensics for Generative Models: An Information-Theoretic Perspective"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.13003v1"
permalink: "https://feed.astralor.com/items/itm_e6b25f11c2ca3500580a1805"
published: "2026-07-14T17:49:52.000Z"
score: 76
channel: "ai"
tags: ["GPT-2","Information theory","Attribution","Watermarking","Generative Models"]
---

# Watermark Forensics for Generative Models: An Information-Theoretic Perspective

## AI commentary

> This paper provides an information-theoretic perspective on watermark forensics with remarkable clarity, especially the tight bound for multi-user attribution, which is highly enlightening for AI security auditors. The detection-attribution gap it reveals is particularly intriguing, showing a fundamental cost difference between mere detection and attribution.

## At a glance

This paper studies watermark forensics in generative model outputs from an information-theoretic perspective, examining detection, attribution, extraction, and localization. It introduces the information profile and derives tight bounds on sample length requirements for multi-user attribution and payload extraction, validated on GPT-2, Pythia-410M, and Qwen2.5. The work reveals a detection-attribution gap and a footprint-resolution uncertainty principle.

## Key points

- Introduces the information profile to unify watermark detection, attribution, extraction, and localization.
- Provides tight bounds on sample length for multi-user attribution (Θ(log N/h)) and payload extraction (Θ(ℓ/h)).
- Reveals a detection-attribution gap and a footprint-resolution uncertainty principle.
- Empirically validates theoretical predictions on GPT-2, Pythia-410M, and Qwen2.5.

## Full text

A watermark in a generative model's output is usually asked only whether a text is machine-made. The same mark can do more: attribute it to the user who produced it, extract a hidden payload, or localize the part that survives editing. These form a forensic ladder, and we ask what each rung costs in the sample length $n$. One object organizes the answers. Let $S$ be the secret the mark carries (a user's identity or payload), and let the information profile $ν(t)=I(S;X_t\mid X_{<t})$ record how much the $t$-th token reveals about $S$ given the earlier ones. Its total mass pays for attribution and extraction; how that mass is spread pays for localization; and detection alone is paid for not by information but by presence, the distance from the marked to the unmarked distribution. The literature's two quality models, a mark subtle on every token and one that stamps a few tokens loudly, are two incomparable ways of capping this profile. Our main theorem settles the ladder's entropy column. For statistically distortion-free schemes, attributing a text to one of $N$ users costs $Θ(\log N/h)$ tokens over every stationary-ergodic source of entropy rate $h$, sharp to a $(1+o(1))$ factor: to our knowledge the first tight entropy-rate law for multi-user attribution (via exact alignment). The natural collision-counting analysis overcharges without bound; only a decoder thresholding each candidate by its own realized surprisal attains the rate while almost never implicating an innocent user. A matching converse makes the law two-sided, and extraction of an $\ell$-bit payload costs $Θ(\ell/h)$. Two gaps are real, not modeling artifacts: a $Θ(\log N)$-token window in which a text is provably machine-made yet unattributable, and a footprint-resolution uncertainty principle. Experiments on GPT-2, Pythia-410M, and Qwen2.5 recover the predicted constants.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_e6b25f11c2ca3500580a1805