Linguistic Holonomy and Statistical Watermarks: Inner Geometry of Meaning-Preserving Transformations

arXiv:2608.193692026-08-21

给AI文本加的水印,编辑位置比编辑数量更关键

给AI生成文本打标的统计水印,是靠在含义相近的词里选一个来藏信号,所以只改措辞、不改含义的改写或翻译会削弱它。以往研究只用改写前后文本的语义相似度这一个终点指标来衡量攻击强度,本文证明这个指标是错的。作者用几何方法证明,水印残留信号取决于编辑落在哪些位置,而不只是编辑了多少,并用实验精确到小数点后三位验证了这一点。

他们做了什么

论文把翻译、改写等保持原意的一连串变换建模为'语言学闭环',证明即使文本兜了一圈又回到原来的含义,它中途走过的路径也留下了可单独测量的痕迹
此前有论文提出用'符号'（signature）作为这类变换链的不变量,本文证明它其实退化成一个单一数字（秩），真正携带信息的是'和乐/holonomy'——方向沿路径在球面上平移后发生的旋转,这与格点规范理论中的Wilson loop在数学上完全一致
论文证明了一个精确恒等式:对绿名单、Unigram和指数分布等主流水印检测方法,残留的检测统计量正比于'种子窗口'（生成下一个词时参考的前几个词）完整保留下来的位置数量
实验证实,在相同的整体编辑比例下,水印残留信号可以是原来的一半、四分之一,或者恰好为零,完全取决于编辑位置如何分布（误差在0.3%到0.8%之间）
用一个0.5B参数的指令微调模型生成的90段往返翻译链的真实实验中,两条最终含义几乎相同的翻译链,水印残留分别高达99.8%和仅28.5%

Table 1: Synoptic table of the families of text watermarks. The last column is the one that matters for this article: in every family except the Unigram scheme, an edit damages not only the position it touches but every position that used it as seeding context. It is this asymmetry which the geometry of Section 4 and the identity of Section 5 make precise.
Family	Mechanism	Context h	Output law	What an edit destroys
Green list [7]	logit bias	≥1	perturbed	token and its h predecessors
Unigram [15]	logit bias	0	perturbed	the token alone
Exponential [10, 2]	sampling rule	≥0	exact	token and seeding context
Tournament [5]	sampling rule	≥1	exact	token and seeding context
Semantic [6]	sentence partition	—	perturbed	the sentence embedding

Table 2: This table summarizes the independence of the endpoint and path data, in dimension n=64. All seven chains share the same first and last state, so the semantic deficit is constant to the last recorded digit; the holonomy energy is not. Note also that the signature, in the last column, moves in steps and is constant on pairs of rows, exactly as Proposition 3.1 predicts it must.
detours	δ𝒰	η⁡(𝒰)	sign⁡(In−R𝒰∗)
0	0.12241744	0.0000	(2,0,62)
1	0.12241744	0.2454	(2,0,62)
2	0.12241744	0.5190	(4,0,60)
3	0.12241744	0.6898	(4,0,60)
4	0.12241744	0.8260	(6,0,58)
5	0.12241744	0.9427	(6,0,58)
6	0.12241744	1.0465	(8,0,56)

Table 3: Residual detector statistic, as a fraction of the original, for the green-list scheme with h=1 under three edit patterns of identical retention rate. Counting the intact-window set directly from each edit pattern, Theorem 5.1 predicts 0.947,0.897,0.797,0.697,0.597,0.496 for the middle column and 0.902,0.802,0.602,0.401,0.201,0.000 for the right-hand one. The largest discrepancy is 0.008 and the typical one 0.003, over 120 sequences per cell; and the periodic pattern at ρ=0.5 is predicted to give exactly zero, and does.
ρ	independent	contiguous block	periodic
0.95	0.904	0.947	0.903
0.90	0.806	0.897	0.802
0.80	0.637	0.795	0.595
0.70	0.492	0.697	0.399
0.60	0.362	0.594	0.196
0.50	0.247	0.488	−0.005

Table 4: The six chains; medians over the ninety passages of the three schemes, except the last column, which counts the chains still detected above z=4. Ordered by semantic deficit, every column moves monotonically: the meaning drifts, the path lengthens, the surface is retained less and the mark fades, all together. That is precisely why the endpoint alone cannot be read as a measure of attack strength, and why the test below holds it fixed.
chain	L	δ𝒰	η⁡(𝒰)	ρ	\|I\|/T′	residual	detected
Spanish	2	0.064	0.083	0.767	0.679	0.680	84/90
German	2	0.071	0.092	0.733	0.651	0.633	83/90
French	2	0.073	0.094	0.722	0.616	0.625	82/90
German twice	4	0.082	0.101	0.692	0.598	0.591	82/90
German, French	4	0.109	0.118	0.644	0.531	0.554	67/90
French, German, Spanish	6	0.116	0.129	0.594	0.501	0.496	66/90

Table 5: Theorem 5.1 against the 538 chains whose statistic is finite; medians. The measured intact-window fraction predicts the median residual to within one hundredth for the context-free scheme, three for the green-list scheme and seven for the exponential one. The independent-edit corollary ρh+1, which needs no measurement of the attacked text at all, happens to fall closer for the green-list scheme and much further for the exponential one, where it is off by twelve hundredths; and chain by chain it is the measured fraction that follows the residual, correlating +0.67 with it against +0.54 for the retention rate. The median absolute error per chain is 0.083, 0.054 and 0.088, which the length correction of (6.1) moves to 0.086, 0.067 and 0.081: at this depth of translation the length is preserved in the median, and the correction has little to do.
scheme	h	ρ	ρh+1	\|I\|/T′	Tatt′/T0′	(6.1)	observed
green-list	1	0.700	0.490	0.542	0.972	0.553	0.509
unigram	0	0.694	0.694	0.694	0.972	0.708	0.685
exponential	1	0.692	0.478	0.531	0.978	0.535	0.601

Table 6: The preregistered regression. The predictors are standardised, so that the coefficients may be compared; the corrected threshold is 3.3×10−3. The last column is a robustness check which the clause did not ask for: the same coefficient with a standard error clustered on the base passages, of which there are only thirty, so that the check is a severe one. Under it the unigram scheme still clears the threshold and the green-list scheme no longer does.
scheme	n	R2	βρ	βδ	βη	pη	clustered
green-list	180	0.41	+0.051	−0.023	−0.070	1.7×10−3	3.5×10−2
unigram	180	0.49	+0.064	+0.278	−0.145	4.0×10−9	8.2×10−4
exponential	178	0.34	+0.116	−0.060	−0.014	0.74	0.77

Table 7: Every numerical claim of Section 6 and the run that produced it. Directory names are the script name prefixed by run_ and suffixed by the stamp of the third column, under 7. Results/Article_LLW/. The corpus was built in three successive invocations, each carrying forward the chains of the one before, so that an interruption on a machine of this size would cost at most one of them; the stamp given is that of the last, whose manifest records the provenance of the other two. The final row is the targeted re-audit of the records which had failed to regenerate, discussed below.
result	script	run stamp
Props. 3.1, 4.2, Cor. 4.3	exp_geometry_v1	20260819T135822
Thm. 5.1, Cor. 5.2, Prop. 5.3	exp_decay_v1	20260819T135047
detector calibration	exp_detector_validation_v1	20260819T141737
watermarked corpus and chains	exp_corpus_v1	20260819T154350
loop invariants of the chains	exp_indicators_v1	20260819T161524
the preregistered test	exp_analysis_v1	20260819T163238
audit of the regeneration	exp_corpus_v1	20260819T174004

为什么重要

随着欧盟《人工智能法案》第50条等AI文本标识义务开始生效,揭示现有水印稳健性评估方法本身存在缺陷,直接关系到监管和产品设计。论文说明,攻击者只要知道种子窗口的宽度,就能在保留大部分文本的情况下把检测信号降到零,这精确暴露了当前已部署水印方案的结构性弱点。

本文术语

统计水印 · 隐藏在AI生成文本中、只能通过统计方法检测出来的标记
绿名单方案 · 利用密钥和前面的词把词表的一部分标记为'绿色'并让生成时更偏向这些词的水印方法
种子窗口 · 用来决定下一个词是否算'绿色'时参考的前面若干个词的区间
和乐（holonomy） · 一个方向沿着曲面上的闭合路径平移一圈后与初始方向相比发生的旋转量,用来刻画路径本身的几何特征
Wilson loop · 格点规范理论中沿闭合路径计算得到的物理量,携带路径相关的几何信息

论文原文摘要（英文）

Statistical watermarks for language models live in the freedom of the signifier: they choose among tokens that are nearly equivalent in meaning, and they are therefore eroded by exactly those transformations which move the form of a text while leaving its content in place. The literature measures such transformations by their endpoint, through the semantic similarity between the original and the rewritten text. We show that the endpoint is the wrong statistic. Adapting the formalism of linguistic loops, we prove that the invariant of a chain of meaning-preserving transformations factorises canonically into an endpoint part and a holonomy in the stabiliser of the initial state, the second of which the semantic deficit cannot see; the loop rotation is parallel transport on the unit sphere of the embedding space, so that the analogy with the Wilson loop becomes a theorem rather than a figure of speech. On the side of the detector we prove an exact identity: the residual statistic is proportional to the number of positions whose seeding window survived intact, from which the decay law $\rho^{h+1}$ follows as the independent-edit corollary. The identity has a disconcerting consequence, which we confirm to three decimal places: at one and the same retention rate the surviving signal may be one half of the original, one quarter of it, or exactly nothing, according only to where the edits fall.

作者 · Daniele Corradetti

在 arXiv 阅读

Linguistic Holonomy and Statistical Watermarks: Inner Geometry of Meaning-Preserving Transformations

他们做了什么

为什么重要

本文术语

最新论文

METAL LAB 最新报道