← 返回 2026-05-13

PASA：面向语义不变攻击的、基于嵌入空间的原则化大语言模型文本水印方法 PASA: A Principled Embedding-Space Watermarking Approach for LLM-Generated Text under Semantic-Invariant Attacks

Zhenxin Ai, Haiyun He 📅 2026-05-09 👍 10 2026-07-13 08:36
LLM水印 假设检验 失真自由 嵌入空间聚类 语义不变攻击 释义鲁棒性
arXiv HuggingFace PDF

将水印锚定在潜在语义聚类而非词表上，理论保证失真自由并抵抗释义攻击。

前置知识

LLM文本水印（Text Watermarking）

在LLM生成文本的过程中嵌入人类不可察觉但可被统计检测的信号，从而区分机器生成文本与人类撰写文本。经典方法如KGW将词表随机划分为绿/红列表并在采样时偏向绿词，检测端用z检验统计p值。但这类基于token级别身份的方法在释义改写时极易失效，因为token表面被改写但语义不变。

本文的研究对象就是水印，读者需了解绿色列表、统计检测、失真自由、释义攻击等基本概念，才能理解PASA的动机和创新点。

语义不变攻击（Semantic-Invariant Attack）

保持文本语义不变、但改变表面token序列的对抗性修改，包括同义词替换、句子重排、释义改写、基于T5的token替换（mask ratio r∈{0.3, 0.5}）和DIPPER释义（控制词序多样性Ord与词汇多样性Lex）等。这类攻击对token级水印是致命的，但对语义级水印影响较小。

本文的核心研究问题是抵御此类攻击，必须理解攻击如何运作、为什么它们能破坏token级水印，才能体会PASA将水印锚定在语义层面的价值。

词嵌入与潜在语义空间（Token Embedding & Latent Semantic Space）

LLM将每个token映射为高维向量（如4096维），使语义相近的token在向量空间中距离也近。本文用gte-Qwen2-7B-instruct对token做编码并ℓ2归一化，使相似度由余弦相似度衡量，再通过K-means聚类把整个词表分成K个语义簇（默认K=4）。

PASA的全部机制建立在潜在语义空间之上：语义映射f：V→[K]把每个token指派到一个语义簇，检测时只比较簇索引而非具体token，因此能抗释义。

伪随机函数与共享密钥同步（PRF & Secret-Key Synchronization）

伪随机函数（PRF）以密钥key和一段公开上下文为输入，输出伪随机比特。生成端用seedt = PRF(key, {f(xj)}t-wj=t-1)产生种子，再用Gumbel-Max等机制从辅助分布Pζt中采样ζt；检测端用同一密钥和观察到的语义历史重现seedt，重新采样ζt。密钥保证第三方无法伪造水印。

PRF是PASA检测端能恢复生成端随机序列的关键，没有它就无法对齐统计量，整个水印体系无法运行。

二值假设检验与受控FA率（Binary Hypothesis Testing with FA Constraint）

水印检测建模为H0（人写）vs H1（机器含水印）的二元检验，本文把虚警率FA作为硬约束α∈(0,1)，把漏检率MD作为优化目标。这与统计检测中的Neyman-Pearson范式一致：固定一类错误率、最小化另一类。

理解最优化问题P的目标函数（最小化MD、约束FA≤α、失真≤ε）是阅读Theorem 1和Theorem 2的前提。

研究动机

现有LLM水印方法几乎全部运行在token词表空间，KGW、DAWA等通过偏置logit或扰动采样让特定token出现得更频繁，再用z检验或p值统计检测。但这类token级水印在面对释义改写、同义词替换、句法重排等语义不变攻击时非常脆弱：攻击者可以把'The movie has an interesting plot'改写成'The film features a fascinating tale'，表面token几乎全变但语义完全一致，于是水印的统计信号被同步抹除。论文中Table 1显示，DAWA在Llama-2-13B上遭遇T5-Large替换攻击时TPR@1%FPR从1.0暴跌到0.3300，KGW也跌到0.7350；Table 2中DAWA遭遇DIPPER（Ord=80）释义时TPR@1%FPR仅0.0200，几乎失效。此外，启发式的语义感知方法（AWTI、Exp-edit）虽提升了鲁棒性，但本质仍是token级偏置，必然改变生成分布、抬高困惑度，Exp-edit PPL高达23.40，无法满足'失真自由'要求。

本文的目标是本文提出PASA，目标是在三个维度上同时达到最优：(i) 在语义不变攻击（释义、token替换、句法重排）下保持高检测率；(ii) 严格保持原模型的逐token NTP分布不变（distortion-free，ε=0）；(iii) 在极低虚警率（1% FPR）下也能给出高真阳率（高TPR@1%FPR），并具备可证明的统计最优性。具体而言，PASA要把水印从'哪个token出现'提升到'落在哪个语义簇'，使统计量对释义天然鲁棒。

与已有工作不同的是，过去工作形成两条互不沟通的路线：经验派（SemStamp/k-SemStamp/CoheMark）尝试用LSH或聚类把句子级或话语级水印嵌入语义空间，但都缺乏理论保证，只能靠调参；理论派（DAWA、Takezawa等）在token级别证明了最优性，但完全没把'语义不变攻击'纳入优化目标。PASA的独特切入点是第一个在'语义簇'这个抽象层级上同时给出'误差-鲁棒性-失真'三方权衡定理（Theorem 1）和'联合最优嵌入-检测对'构造（Theorem 2）的框架，并把理论结果直接实例化为可部署的两阶段采样算法。

核心方法

PASA的整体思路是：把词表V中的每个token通过语义映射f：V→[K]指派到K个语义簇（用gte-Qwen2-7B-instruct编码+K-means聚类得到，默认K=4），然后在生成每个token时分两阶段采样——先在K个簇上依据截断辅助分布Pζt（用PRF+密钥+前w个簇的历史做种子）采样一个簇索引ζt，再在该簇内按原NTP分布重归一化后采样具体token。检测时只需用同一密钥和观察到的语义历史重现ζt，再与观察到的token的簇f(xt)对齐计分。关键直觉：把水印从token身份'升维'到语义簇，攻击者改写表面词但改不掉语义簇，于是水印信号对释义天然鲁棒。

PASA与已有方法的本质区别在于：(1) 锚定层级不同——KGW/DAWA锚定在token身份，Aaronson/Kuditipudi锚定在采样分布的逆变换上，SemStamp锚定在句子级LSH区域，而PASA锚定在token级语义聚类，这是首个把生成端和检测端统一对齐到同一抽象层级（cluster-level shared randomness）的方法；(2) 失真自由性来自严格的理论保证——Theorem 2证明其条件采样分布P(Xt|xt-1,ζt)对ζt取期望后恰好等于原NTP分布Qt，与θ和AWTI依赖启发式logit偏置有本质不同；(3) 引入'溢出状态'ζ̃控制FA——辅助分布Pζt(k)=min{Qft(k),α}对每个簇截断，把溢出质量累计到ζ̃，检测时ζ̃对应的token直接跳过，这种截断机制使得FA被严格夹在α以下。

方法步骤详情

PASA算法的具体步骤为：**(G0) 准备阶段**：用预训练编码器gte-Qwen2-7B-instruct对词表V中所有token做编码并ℓ2归一化，再用K-means聚成K=4个簇，得到语义映射f：V→[K]。**Stage 1辅助分布构造与采样（G1-G3）**：在生成第t个token时，先(G1)把NTP分布Qt按簇聚合得到Qft(k)=Σx:f(x)=k Qt(x)；再(G2)按FA阈值α构造截断辅助分布Pζt(k)=min{Qft(k),α}，把溢出质量1-Σk min{Qft(k),α}累计到溢出态ζ̃；再(G3)用seedt=PRF(key, {f(xj)}t-1j=max{t-w,1})（默认w=3，密钥key为共享密钥）作为随机种子，从Pζt中采样ζt。**Stage 2簇内采样（G4）**：若ζt=k∈[K]，则按重归一化分布Qt(x)·1{f(x)=k}/Qft(k)在簇k内采样Xt；若ζt=ζ̃，则按Qt(x)·(Qft(f(x))-α)+/Qft(f(x))在所有簇上采样以保持期望分布。**检测端（D0-D3）**：用一个轻量代理模型SLM（Llama-2-7B或Mistral-7B）得到近似NTP分布Q̃t，重构Q̃ft和P̃ζt；用同一密钥和观察到的f(xt)历史重现seedt和ζ̃t；计分1{f(xt)=ζt}，ζ̃t=ζ̃或f(xt)≠ζt时跳过该token。

技术新颖性

PASA的技术新颖性体现在三个层面。理论层面，论文把水印设计提升到序列级（整个X_T而非单token），把'语义不变攻击'显式形式化为等价类Bf(xT)={x̃T : f(x̃T)=f(xT)}，从而推导出误差-鲁棒性-失真的精确权衡公式β*f,1=Σk ΣxT:f(xT)=k (QXT(xT)-α)+，并证明两阶段采样即达此下界。算法层面，截断+溢出态的辅助分布Pζt巧妙地保证了detector只需在簇索引层面对齐，避开了token级精确匹配的脆弱性；同时溢出态让低熵token被概率性地跳过，进一步压低FA。系统层面，本文首次把gte-Qwen2-7B-instruct这类通用文本嵌入模型用作token级语义编码器，并仔细设计K=4、w=3、α=0.4的默认值，通过消融研究验证K∈[3,100]均较鲁棒。

Left: Illustration of PASA, a principled watermarking approach operating in the latent embedding space on semantic clusters. By anchoring shared randomness to semantic clusters via a secret key, PASA remains robust against semantic-invariant attacks (e.g., paraphrasing) while ensuring distortion-free generation. Right: Quantitative results demonstrating that PASA outperforms standard vocabulary-space watermarking baselines across varying paraphrase strengths in both AUC-ROC and TPR@1%FPR.
Figure 1: Left: Illustration of PASA, a principled watermarking approach operating in the latent embedding space on semantic clusters. By anchoring shared randomness to semantic clusters via a secret key, PASA remains robust against semantic-invariant attacks (e.g., paraphrasing) while ensuring distortion-free generation. Right: Quantitative results demonstrating that PASA outperforms standard vocabulary-space watermarking baselines across varying paraphrase strengths in both AUC-ROC and TPR@1%FPR.
Overview of PASA. Left: Construction of the semantic mapping function f, which partitions the latent token embedding space into K semantic clusters. Right: Top (Generation). (G1) At each step t, the NTP distribution Qt is transformed into the cluster distribution Qft. (G2) The auxiliary distribution Pζt is truncated by a threshold α and contains an overflow state ζ̃ to ensure FA error control. (G3) Auxiliary sampling of ζt uses a seedt generated by a PRF with a secret key and w semantic history as input. (G4) The sampled auxiliary random variable ζt guides the sampling of the next token xt within the selected semantic cluster. Bottom (Detection). (D0-D2) For a potentially modified observed token sequence, the detector approximates the generation distribution through an SLM. (D3) The detection score accumulates based on the alignment between the resampled ζt and the observed semantic cluster f(xt).
Figure 2: Overview of PASA. Left: Construction of the semantic mapping function f, which partitions the latent token embedding space into K semantic clusters. Right: Top (Generation). (G1) At each step t, the NTP distribution Qt is transformed into the cluster distribution Qft. (G2) The auxiliary distribution Pζt is truncated by a threshold α and contains an overflow state ζ̃ to ensure FA error control. (G3) Auxiliary sampling of ζt uses a seedt generated by a PRF with a secret key and w semantic history as input. (G4) The sampled auxiliary random variable ζt guides the sampling of the next token xt within the selected semantic cluster. Bottom (Detection). (D0-D2) For a potentially modified observed token sequence, the detector approximates the generation distribution through an SLM. (D3) The detection score accumulates based on the alignment between the resampled ζt and the observed semantic cluster f(xt).

实验结果

PASA在所有测试场景下都接近或刷新了SOTA。**(1) 干净文本与token替换**：在C4数据集上、Llama-2-13B和Mixtral-8×7B两个模型下，PASA对干净文本均达到ROC-AUC=1.0000、TPR@1%FPR=1.0000的完美检测。在T5-Large（r=0.3）替换攻击下，Llama-2-13B上PASA取得TPR@1%FPR=0.9296，显著超过KGW（0.7350）和DAWA（0.3300），与AWTI（0.9978）相当；在T5-XXL更强攻击下仍保持0.8040，优于KGW的0.6800。**(2) 释义攻击鲁棒性**：DIPPER释义（Lex=60，Ord∈{0,20,80}）下PASA在Ord=0/20/80分别取得TPR@1%FPR=0.5900/0.5693/0.5377，Ord=80下DAWA已跌至0.0200、KGW跌至0.3100、Exp-edit跌至0.1150，PASA比次优基线AWTI（0.1350）高出约4倍。**(3) 文本质量**：PASA的PPL=11.44，与无水印基线12.41和人类文本10.41极为接近，明显优于Exp-edit（23.40）和AWTI（19.77），略逊于DAWA（8.41）但PASA具有鲁棒性。**(4) 计算效率**：PASA生成时间13.35s（vs无水印12.93s、AWTI 24.24s、DAWA 13.56s），检测时间0.27s是所有方法中最低（Exp-edit 2.41s、AWTI 10.52s、KGW 0.04s因简单计数），检测内存2892MB、GFLOPs 6.21×10²低于AWTI的2.85×10⁵。**(5) 消融**：K=4为最优，过细（K>500）水印退化为token级，过粗则丧失区分度；w=3最优，w从3增到8时TPR@1%FPR从0.7236降至0.1508。**(6) 泛化**：ELI5长文本QA上PASA对T5-Large攻击ROC-AUC=0.9980、TPR@1%FPR=0.9750（vs DAWA 0.5150）；SLM失配下同家族模型仍保持近完美检测（ROC-AUC≥0.9995）。

Detection performance on clean text and under semantic-invariant token-replacement attacks. Comparisons of ROC-AUC, TPR@1%FPR, and TPR@10%FPR across Llama2-13B and Mistral-8×7B architectures. T5-Large and T5-XXL are used as attackers.
Table 1: Detection performance on clean text and under semantic-invariant token-replacement attacks. Comparisons of ROC-AUC, TPR@1%FPR, and TPR@10%FPR across Llama2-13B and Mistral-8×7B architectures. T5-Large and T5-XXL are used as attackers.
Detection performance under semantic-invariant paraphrasing attacks (DIPPER). Results are reported for three configurations with increasing structural perturbation (Order Diversity), ranging from Ord = 0 to Ord = 80, with fixed lexical diversity Lex = 60.
Table 2: Detection performance under semantic-invariant paraphrasing attacks (DIPPER). Results are reported for three configurations with increasing structural perturbation (Order Diversity), ranging from Ord = 0 to Ord = 80, with fixed lexical diversity Lex = 60.
Comparison of generation quality and computational efficiency. We report Perplexity (PPL) on GPT-NeoX-20B to validate the distortion-free property, alongside the average Generation Time and Detection Time per sample.
Table 3: Comparison of generation quality and computational efficiency. We report Perplexity (PPL) on GPT-NeoX-20B to validate the distortion-free property, alongside the average Generation Time and Detection Time per sample.
Detection performance on ELI5 dataset under token-replacement attacks. Comparisons of ROC-AUC, TPR@1%FPR, and TPR@10%FPR using the LLAMA-13B-hf architecture. For token-replacement attacks with replacement ratio r = 0.5, we use T5-Large as the attacker.
Table 4: Detection performance on ELI5 dataset under token-replacement attacks. Comparisons of ROC-AUC, TPR@1%FPR, and TPR@10%FPR using the LLAMA-13B-hf architecture. For token-replacement attacks with replacement ratio r = 0.5, we use T5-Large as the attacker.
Additional robustness comparison under diverse paraphrasing attacks. We compare ROC-AUC, TPR@1%FPR, and TPR@10%FPR under the clean setting and three semantic-invariant attacks, including DIPPER, OPT-2.7B paraphrasing, and WM-removal.
Table 5: Additional robustness comparison under diverse paraphrasing attacks. We compare ROC-AUC, TPR@1%FPR, and TPR@10%FPR under the clean setting and three semantic-invariant attacks, including DIPPER, OPT-2.7B paraphrasing, and WM-removal.
Detection performance with and without prompts. We compare ROC-AUC, TPR@1%FPR, and TPR@10%FPR on C4 and ELI5. 'Without prompt' denotes detection on the generated continuation only, while 'Mixed with prompt' denotes detection after prepending the human-written prompt to the watermarked continuation.
Table 6: Detection performance with and without prompts. We compare ROC-AUC, TPR@1%FPR, and TPR@10%FPR on C4 and ELI5. 'Without prompt' denotes detection on the generated continuation only, while 'Mixed with prompt' denotes detection after prepending the human-written prompt to the watermarked continuation.
Detection performance under surrogate LM mismatch. We evaluate detector-side SLM mismatch and base/instruction-tuned mismatch within the LLAMA-2 family. ROC-AUC, TPR@1%FPR, and TPR@10%FPR are reported. No per-distribution calibration is used.
Table 7: Detection performance under surrogate LM mismatch. We evaluate detector-side SLM mismatch and base/instruction-tuned mismatch within the LLAMA-2 family. ROC-AUC, TPR@1%FPR, and TPR@10%FPR are reported. No per-distribution calibration is used.
Memory requirements and computational costs. All methods use the same generation backbone, which requires 25,376 MB of GPU memory under our setup. We report detection-side memory usage and GFLOPs.
Table 8: Memory requirements and computational costs. All methods use the same generation backbone, which requires 25,376 MB of GPU memory under our setup. We report detection-side memory usage and GFLOPs.
Examples of watermarked text generated by PASA across diverse domains.
Table 9: Examples of watermarked text generated by PASA across diverse domains.
Ablation study on hyper-parameters. (a) Impact of semantic cluster granularity (K) on robustness across log-scale cluster counts. (b) Impact of synchronization window size (w) on robustness. The plots compare the baseline (Original) against T5-based token replacement attacks (r = 0.3, 0.5).
Figure 3: Ablation study on hyper-parameters. (a) Impact of semantic cluster granularity (K) on robustness across log-scale cluster counts. (b) Impact of synchronization window size (w) on robustness. The plots compare the baseline (Original) against T5-based token replacement attacks (r = 0.3, 0.5).
Detection performance across various generated text lengths. The ROC-AUC and True Positive Rate (TPR) exhibit rapid convergence, achieving near-perfect detection beyond 300 tokens.
Figure 4: Detection performance across various generated text lengths. The ROC-AUC and True Positive Rate (TPR) exhibit rapid convergence, achieving near-perfect detection beyond 300 tokens.
查看结构化数据
任务指标本文基线提升
干净文本检测 (C4 realnewslike, Llama-2-13B) ROC-AUC / TPR@1%FPR / TPR@10%FPR 1.0000 / 1.0000 / 1.0000 KGW 0.9990/0.9950/0.9950；DAWA 0.9950/0.9950/0.9950；AWTI 1.0000/1.0000/1.0000；Exp-edit 1.0000/1.0000/1.0000 PASA与最优基线持平，达到完美检测
T5-Large token替换攻击 (Llama-2-13B, r=0.3) TPR@1%FPR 0.9296 KGW 0.7350；DAWA 0.3300；AWTI 0.9978；Exp-edit 0.9400 PASA较DAWA提升约2.8倍，较KGW提升约26%，与AWTI/Exp-edit同处第一梯队
T5-XXL token替换攻击 (Llama-2-13B) TPR@1%FPR 0.8040 KGW 0.6800；DAWA 0.1450；AWTI 0.7950 PASA较DAWA提升约5.5倍，超过KGW与AWTI
DIPPER释义攻击 (Lex=60, Ord=80, Llama-2-13B) TPR@1%FPR 0.5377 KGW 0.3100；DAWA 0.0200；AWTI 0.1350；Exp-edit 0.1150；SIR 0.2900；SynthID-Text 0.0200 PASA较DAWA提升约27倍，较AWTI提升约4倍，刷新强释义下的SOTA
DIPPER释义攻击 (Ord=0) ROC-AUC 0.9132 KGW 0.9032；AWTI 0.8835；Exp-edit 0.6291；DAWA 0.4551 PASA较DAWA提升约一倍AUC
OPT-2.7B释义攻击 (Llama-2-13B) TPR@1%FPR / ROC-AUC 0.9146 / 0.9931 SIR 0.5950/0.9623；AWTI 0.8400/0.9659；SynthID-Text 0.4350/0.9483 PASA较SIR提升约54% TPR@1%FPR
WM-removal攻击 (Llama-2-13B) TPR@1%FPR / ROC-AUC 0.9598 / 0.9972 SIR 0.8550/0.9908；AWTI 0.7050/0.9635；SynthID-Text 0.6500/0.9772 PASA较AWTI提升约36% TPR@1%FPR
ELI5长文本QA (LLAMA-13B, T5-Large攻击) ROC-AUC / TPR@1%FPR 0.9980 / 0.9750 DAWA 0.8784/0.5150；AWTI 0.9975/0.9550；Exp-edit 0.9737/0.9650 PASA较DAWA提升约89% TPR@1%FPR，泛化性最强
文本质量 (PPL via GPT-NeoX-20B) Perplexity 11.44 人类 10.41；无水印 12.41；DAWA 8.41；KGW 11.81；AWTI 19.77；Exp-edit 23.40 PASA接近无水印和人类基线，验证distortion-free
计算效率 (检测时间/样本) Latency (s) 0.27s KGW 0.04s；DAWA 0.31s；Exp-edit 2.41s；AWTI 10.52s PASA较AWTI提速约39倍，仅慢于KGW简单计数

局限与改进

**作者承认的局限**：(1) 在极强释义或水印移除攻击下（同时改变语义内容与分布结构）性能会下降，需引入句级/段级语义以提升鲁棒性；(2) 短文本检测仍具挑战性，因为token级统计量随序列长度变短而减弱，论文中50 token时ROC-AUC≈0.95，300 token才接近完美；(3) 检测端SLM与生成端tokenizer必须兼容，否则会削弱跨家族迁移性，建议部署多个轻量SLM并行检测。**笔者观察的额外局限**：(a) 语义聚类质量高度依赖gte-Qwen2-7B-instruct，若生成模型使用与该编码器语义不一致的token空间（如代码或多语种），K-means得到的簇可能不语义对齐，影响水印信号；(b) K=4的默认值在通用文本上最优，但面对专业领域（医学、法律）时粗粒度可能不够——粒度可解释性问题未深入讨论；(c) 实验只在Llama-2和Mixtral-8×7B上评估，未在GPT-4、Claude等闭源模型上验证，蒸馏/黑盒场景的实用性未充分证明；(d) DIPPER释义虽然多样，但实验缺少对最新LLM驱动的GPT-4释义、人机协作改写等更强攻击的测试；(e) PASA的设计高度依赖词表语义聚类，对多语种、code-switching等异质token环境的鲁棒性未评估。

独立分析的弱点

**弱点1：聚类粒度K=4的硬编码**：PASA默认K=4由消融实验得出，但这一选择对所有生成场景统一。若应用在低熵领域（如数学推理、表格生成）可能需要更细粒度的K；而面对高熵创意写作则可更粗。具体改进方向：让K根据每步NTP分布的熵自适应调整，或采用层次化聚类（hierarchical clustering）让检测端在多粒度上投票。**弱点2：依赖单一嵌入模型gte-Qwen2-7B-instruct**：若攻击者知道嵌入模型，可以构造性地寻找'同簇异义'的对抗token绕过检测。改进方向：训练阶段使用集成嵌入（ensemble of encoders）或多视图聚类，或在生成端引入随机旋转/扰动让攻击者难以推断簇边界。**弱点3：检测端需要SLM重新计算NTP分布**：每个token位置都需SLM前向一次，虽只需2892MB内存和6.21×10² GFLOPs，但增加了部署门槛。改进方向：对低熵token跳过SLM估计，或用轻量N-gram模型做粗近似，仅在检测失败时升级到SLM。**弱点4：未充分考虑自适应攻击者**：假设攻击者不知道f和key，但攻击者可以迭代地做query-based estimation来推断簇分布。改进方向：周期性更新key和聚类映射、或加入扰动使攻击者的统计估计失效。**弱点5：跨家族迁移性有限**：Table 7显示，当生成模型是LLAMA-2-13B-chat、检测端用LLAMA-2-7B时TPR@1%FPR降至0.8750。改进方向：训练一个与tokenizer无关的通用检测器，或采用对比学习让不同tokenizer的语义空间对齐。

未来方向

**作者提出的方向**：(1) 引入句级或段级语义（如句子嵌入的cluster）以抵抗极强释义攻击；(2) 结合token级与sentence级证据缓解短文本检测问题。**基于成果可延伸的方向**：(a) 把PASA的语义簇概念推广到多模态水印——视觉-语言模型的'语义'可以定义为CLIP空间中的图像-文本联合簇，构造多模态失真自由水印；(b) 用PASA的两阶段采样框架做'可验证的推理链水印'——在Chain-of-Thought推理中对中间步骤嵌入水印，检测时可识别AI推理痕迹；(c) 探索PASA在agent轨迹水印中的应用，每个tool-call的语义类型构成自然簇；(d) 发展分布式密钥管理——把secret key拆成多份交给不同检测方，避免单点泄漏；(e) 把K=4的K-means替换为可微分聚类，让簇边界与下游任务联合训练，进一步提升鲁棒性；(f) 探索PASA在低资源语言水印中的扩展——通过跨语言嵌入对齐实现多语种共享水印。

复现评估

**开源情况**：论文标注'Webpage: PASA'，但正文未明确提供完整代码仓库链接，从实验设计看应包含PASA算法实现、检测脚本、攻击脚本等模块。**数据**：使用公开C4（realnewslike子集）和ELI5数据集，攻击模型T5（Large/XXL）、DIPPER、OPT-2.7B均为公开权重，gte-Qwen2-7B-instruct嵌入模型公开可得。**算力要求**：所有实验在单卡NVIDIA RTX PRO 6000上完成，生成端LLAMA-2-13B和Mixtral-8×7B（生成显存25,376MB），检测端SLM仅需Llama-2-7B或Mistral-7B（显存2,892MB），属中等门槛，独立实验室可复现。**复现难度**：中等。优势在于：(i) 理论结果可独立验证（Theorem 1/2的证明在Appendix C/D）；(ii) 默认超参K=4、w=3、α=0.4明确给出；(iii) 评估协议（ROC-AUC、TPR@1%FPR）和攻击设置（DIPPER Lex/Ord、T5 mask ratio）都标准化。难点在于：(a) K-means聚类依赖随机种子，复现时需固定seed才能保证f完全一致；(b) PRF的具体实现未说明，需自行选择HMAC或AES-CTR等密码学原语；(c) 检测端SLM的选择可能影响NTP分布估计的精度，需要谨慎匹配生成模型家族。

论文图表

figure_1..jpg
figure_1..jpg
figure_2..jpg
figure_2..jpg
figure_3..jpg
figure_3..jpg
figure_4..jpg
figure_4..jpg
table_1..jpg
table_1..jpg
table_2..jpg
table_2..jpg
table_3..jpg
table_3..jpg
table_4..jpg
table_4..jpg
table_5..jpg
table_5..jpg
table_6..jpg
table_6..jpg
table_7..jpg
table_7..jpg
table_8..jpg
table_8..jpg
table_9..jpg
table_9..jpg