Vaporizer: Breaking Watermarking Schemes for Large Language Model Outputs

Researchers have successfully demonstrated methods to remove watermarks from large language model outputs through various text manipulation techniques including paraphrasing and machine translation. The study reveals that current watermarking schemes designed to prevent misuse of LLMs are vulnerable to attack, raising questions about their effectiveness as security measures.

The research presents a critical vulnerability in LLM watermarking systems that were designed to authenticate and control the usage of AI-generated content. By employing semantic-preserving attacks such as lexical substitution, neural paraphrasing, and machine translation, researchers successfully stripped watermarks while maintaining textual coherence and meaning. This findings challenges the industry assumption that these watermarking techniques provide robust protection.

The significance extends beyond academic curiosity. Organizations implementing LLM watermarking as a security or authenticity mechanism now face evidence that these protections are more fragile than previously believed. The attacks maintain semantic integrity—measured through BERT scores and readability metrics—meaning users cannot easily detect whether content has been tampered with. This undermines a key use case for watermarking: proving that sensitive outputs genuinely originated from authorized systems.

For the broader AI industry, this research accelerates ongoing discussions about AI safety and content authenticity. Companies deploying LLMs for high-stakes applications (legal, medical, financial) cannot rely on watermarking alone to ensure responsible usage or prevent misappropriation. The vulnerability suggests that effective LLM governance requires multi-layered approaches beyond cryptographic watermarks. Developers must now reconsider authentication strategies while the research community investigates more resilient alternatives. This work does not necessarily represent an attack on cryptocurrency or blockchain systems, but rather highlights that traditional cryptographic assumptions may not transfer effectively to neural network outputs.

• →Watermarking schemes for LLM outputs can be effectively removed through semantic-preserving text attacks.
• →Current production-grade watermarking techniques demonstrate varying levels of vulnerability across different implementations.
• →Attacks like neural paraphrasing and machine translation can strip watermarks while preserving content meaning and readability.
• →Organizations cannot rely on watermarking alone as a security mechanism for controlling LLM usage.
• →Improved watermarking schemes must account for multi-layered attack strategies to achieve genuine robustness.