Pin It on Anyone: Certified Targeted Displacement of Multi-Bit LLM Watermarks Without the Key

Summary

Researchers present a targeted displacement attack that changes the account identifier embedded in multi-bit LLM watermarks without the secret key. The attacker needs only a few accounts that generate output and model logits, then rewrites the text while keeping its meaning so the decoder recovers the attacker's chosen message. Empirically, the attack succeeds in almost all cases across five watermarking methods and four LLMs, given enough accounts, with success tracking the paper's theoretical bounds.

Related items

• InfoResearchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six DaysSimilar attack · The Hacker News
• MediumAn AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.Similar attack · The Hacker News
• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer