Linguistic Holonomy and Statistical Watermarks: Inner Geometry of Meaning-Preserving Transformations
arXiv:2608.193692026-08-21
AI 글에 심은 워터마크, 어디를 고쳤는지가 얼마나 고쳤는지보다 중요하다
AI가 생성한 글임을 표시하는 통계적 워터마크는 의미가 같은 여러 단어 중 하나를 골라 신호를 심는 방식이라, 뜻은 그대로 두고 표현만 바꾸는 요약·번역·패러프레이즈 공격에 취약하다. 기존 연구는 이런 공격을 '원문과 결과물이 얼마나 비슷한 의미인가'라는 도착점 하나로만 평가했는데, 이 논문은 그 방식이 틀렸다는 것을 수학적으로 증명한다. 저자는 워터마크가 살아남는 비율은 편집이 얼마나 됐는지(비율)가 아니라 어디에 편집이 몰렸는지(위치)에 의해 정해진다는 것을 정확한 공식으로 보이고, 실험으로 소수점 셋째 자리까지 확인했다.
무엇을 했나
- 의미보존 변환(번역, 패러프레이즈 등)의 연쇄를 '언어적 고리'라는 수학적 틀로 분석해, 문장이 처음과 같은 의미로 돌아오더라도 그 사이에 표현이 얼마나 멀리 돌아다녔는지를 별도로 잡아낼 수 있음을 보였다
- 기존 논문이 제안한 '시그니처'라는 지표는 실제로는 하나의 숫자(회전 평면 개수)로 뭉개진다는 것을 증명하고, 대신 '홀로노미'(구면 위에서 경로를 따라 이동한 뒤 방향이 얼마나 틀어졌는가)라는 개념이 진짜 정보를 담고 있음을 보였다. 이는 격자 게이지 이론의 윌슨 루프와 수학적으로 동일한 구조다
- 그린리스트, 유니그램, 지수분포 방식 등 대표적인 워터마크 탐지 통계량이 '시딩 윈도우(단어를 고를 때 참고하는 앞 단어들)가 그대로 남아있는 위치의 개수'에 정확히 비례한다는 항등식을 증명했다
- 같은 비율(예: 절반)의 단어를 편집해도 그 편집이 띄엄띄엄 퍼져있는지 몰려있는지에 따라 남는 워터마크 신호가 원래의 절반, 사분의 일, 또는 완전히 0이 될 수 있음을 실험으로 확인했다(오차 0.3~0.8% 수준)
- 0.5B급 소형 언어모델과 실제 왕복 번역 체인 90개를 이용한 실험에서, 최종 의미가 거의 동일한(의미 손실이 같은) 두 텍스트라도 하나는 워터마크의 99.8%가 남고 다른 하나는 28.5%만 남는 경우를 확인했다
Table 1: Synoptic table of the families of text watermarks. The last column is the one that matters for this article: in every family except the Unigram scheme, an edit damages not only the position it touches but every position that used it as seeding context. It is this asymmetry which the geometry of Section 4 and the identity of Section 5 make precise.| Family | Mechanism | Context h | Output law | What an edit destroys |
|---|
| Green list [7] | logit bias | ≥1 | perturbed | token and its h predecessors |
| Unigram [15] | logit bias | 0 | perturbed | the token alone |
| Exponential [10, 2] | sampling rule | ≥0 | exact | token and seeding context |
| Tournament [5] | sampling rule | ≥1 | exact | token and seeding context |
| Semantic [6] | sentence partition | — | perturbed | the sentence embedding |
Table 2: This table summarizes the independence of the endpoint and path data, in dimension n=64. All seven chains share the same first and last state, so the semantic deficit is constant to the last recorded digit; the holonomy energy is not. Note also that the signature, in the last column, moves in steps and is constant on pairs of rows, exactly as Proposition 3.1 predicts it must.| detours | δ𝒰 | η(𝒰) | sign(In−R𝒰∗) |
|---|
| 0 | 0.12241744 | 0.0000 | (2,0,62) |
| 1 | 0.12241744 | 0.2454 | (2,0,62) |
| 2 | 0.12241744 | 0.5190 | (4,0,60) |
| 3 | 0.12241744 | 0.6898 | (4,0,60) |
| 4 | 0.12241744 | 0.8260 | (6,0,58) |
| 5 | 0.12241744 | 0.9427 | (6,0,58) |
| 6 | 0.12241744 | 1.0465 | (8,0,56) |
Table 3: Residual detector statistic, as a fraction of the original, for the green-list scheme with h=1 under three edit patterns of identical retention rate. Counting the intact-window set directly from each edit pattern, Theorem 5.1 predicts 0.947,0.897,0.797,0.697,0.597,0.496 for the middle column and 0.902,0.802,0.602,0.401,0.201,0.000 for the right-hand one. The largest discrepancy is 0.008 and the typical one 0.003, over 120 sequences per cell; and the periodic pattern at ρ=0.5 is predicted to give exactly zero, and does.| ρ | independent | contiguous block | periodic |
|---|
| 0.95 | 0.904 | 0.947 | 0.903 |
| 0.90 | 0.806 | 0.897 | 0.802 |
| 0.80 | 0.637 | 0.795 | 0.595 |
| 0.70 | 0.492 | 0.697 | 0.399 |
| 0.60 | 0.362 | 0.594 | 0.196 |
| 0.50 | 0.247 | 0.488 | −0.005 |
Table 4: The six chains; medians over the ninety passages of the three schemes, except the last column, which counts the chains still detected above z=4. Ordered by semantic deficit, every column moves monotonically: the meaning drifts, the path lengthens, the surface is retained less and the mark fades, all together. That is precisely why the endpoint alone cannot be read as a measure of attack strength, and why the test below holds it fixed.| chain | L | δ𝒰 | η(𝒰) | ρ | |I|/T′ | residual | detected |
|---|
| Spanish | 2 | 0.064 | 0.083 | 0.767 | 0.679 | 0.680 | 84/90 |
| German | 2 | 0.071 | 0.092 | 0.733 | 0.651 | 0.633 | 83/90 |
| French | 2 | 0.073 | 0.094 | 0.722 | 0.616 | 0.625 | 82/90 |
| German twice | 4 | 0.082 | 0.101 | 0.692 | 0.598 | 0.591 | 82/90 |
| German, French | 4 | 0.109 | 0.118 | 0.644 | 0.531 | 0.554 | 67/90 |
| French, German, Spanish | 6 | 0.116 | 0.129 | 0.594 | 0.501 | 0.496 | 66/90 |
Table 5: Theorem 5.1 against the 538 chains whose statistic is finite; medians. The measured intact-window fraction predicts the median residual to within one hundredth for the context-free scheme, three for the green-list scheme and seven for the exponential one. The independent-edit corollary ρh+1, which needs no measurement of the attacked text at all, happens to fall closer for the green-list scheme and much further for the exponential one, where it is off by twelve hundredths; and chain by chain it is the measured fraction that follows the residual, correlating +0.67 with it against +0.54 for the retention rate. The median absolute error per chain is 0.083, 0.054 and 0.088, which the length correction of (6.1) moves to 0.086, 0.067 and 0.081: at this depth of translation the length is preserved in the median, and the correction has little to do.| scheme | h | ρ | ρh+1 | |I|/T′ | Tatt′/T0′ | (6.1) | observed |
|---|
| green-list | 1 | 0.700 | 0.490 | 0.542 | 0.972 | 0.553 | 0.509 |
| unigram | 0 | 0.694 | 0.694 | 0.694 | 0.972 | 0.708 | 0.685 |
| exponential | 1 | 0.692 | 0.478 | 0.531 | 0.978 | 0.535 | 0.601 |
Table 6: The preregistered regression. The predictors are standardised, so that the coefficients may be compared; the corrected threshold is 3.3×10−3. The last column is a robustness check which the clause did not ask for: the same coefficient with a standard error clustered on the base passages, of which there are only thirty, so that the check is a severe one. Under it the unigram scheme still clears the threshold and the green-list scheme no longer does.| scheme | n | R2 | βρ | βδ | βη | pη | clustered |
|---|
| green-list | 180 | 0.41 | +0.051 | −0.023 | −0.070 | 1.7×10−3 | 3.5×10−2 |
| unigram | 180 | 0.49 | +0.064 | +0.278 | −0.145 | 4.0×10−9 | 8.2×10−4 |
| exponential | 178 | 0.34 | +0.116 | −0.060 | −0.014 | 0.74 | 0.77 |
Table 7: Every numerical claim of Section 6 and the run that produced it. Directory names are the script name prefixed by run_ and suffixed by the stamp of the third column, under 7. Results/Article_LLW/. The corpus was built in three successive invocations, each carrying forward the chains of the one before, so that an interruption on a machine of this size would cost at most one of them; the stamp given is that of the last, whose manifest records the provenance of the other two. The final row is the targeted re-audit of the records which had failed to regenerate, discussed below.| result | script | run stamp |
|---|
| Props. 3.1, 4.2, Cor. 4.3 | exp_geometry_v1 | 20260819T135822 |
| Thm. 5.1, Cor. 5.2, Prop. 5.3 | exp_decay_v1 | 20260819T135047 |
| detector calibration | exp_detector_validation_v1 | 20260819T141737 |
| watermarked corpus and chains | exp_corpus_v1 | 20260819T154350 |
| loop invariants of the chains | exp_indicators_v1 | 20260819T161524 |
| the preregistered test | exp_analysis_v1 | 20260819T163238 |
| audit of the regeneration | exp_corpus_v1 | 20260819T174004 |
왜 중요한가
AI 텍스트 표시 의무(유럽 AI법 50조 등)가 시행되는 지금, 워터마크의 '견고함'을 평가하는 표준 방법 자체가 잘못됐다는 지적은 규제·서비스 설계에 직접 영향을 준다. 공격자가 시딩 윈도우 폭(h)만 알면 절반 이하의 토큰만 바꿔도 탐지 신호를 완전히 0으로 만들 수 있다는 것은, 현재 배포된 워터마크 방식들이 가진 구조적 약점을 정확히 수식으로 드러낸 것이다.
이 논문의 용어
- 통계적 워터마크 · AI가 생성한 텍스트에 통계적으로만 검출 가능한 표식을 은밀히 심는 기법
- 그린리스트 방식 · 비밀키와 직전 단어들을 이용해 어휘의 일부를 '초록색'으로 지정하고 그 단어들이 더 자주 나오게 만드는 워터마크 기법
- 시딩 윈도우 · 다음 단어의 초록/빨강 여부를 정할 때 참고하는 직전 h개 단어의 구간
- 홀로노미 · 구면(또는 곡면) 위의 폐곡선을 따라 방향을 평행이동시켰을 때 원래 방향과 달라지는 정도, 경로의 '휘어진 정도'를 나타내는 기하학 개념
- 윌슨 루프 · 격자 게이지 이론에서 닫힌 경로를 따라 이동시킨 물리량으로, 경로 자체의 기하학적 정보를 담는 값
논문 원문 초록 (영문)
Statistical watermarks for language models live in the freedom of the signifier: they choose among tokens that are nearly equivalent in meaning, and they are therefore eroded by exactly those transformations which move the form of a text while leaving its content in place. The literature measures such transformations by their endpoint, through the semantic similarity between the original and the rewritten text. We show that the endpoint is the wrong statistic. Adapting the formalism of linguistic loops, we prove that the invariant of a chain of meaning-preserving transformations factorises canonically into an endpoint part and a holonomy in the stabiliser of the initial state, the second of which the semantic deficit cannot see; the loop rotation is parallel transport on the unit sphere of the embedding space, so that the analogy with the Wilson loop becomes a theorem rather than a figure of speech. On the side of the detector we prove an exact identity: the residual statistic is proportional to the number of positions whose seeding window survived intact, from which the decay law $\rho^{h+1}$ follows as the independent-edit corollary. The identity has a disconcerting consequence, which we confirm to three decimal places: at one and the same retention rate the surviving signal may be one half of the original, one quarter of it, or exactly nothing, according only to where the edits fall.
저자 · Daniele Corradetti
arXiv에서 원문 보기