Perturbation, Not Provenance: Why Activation Steering Does Not Make a Robust Text Watermark

Summary

Researchers tested whether steering LLM activations along semantic directions (formality, sentiment, complexity, and a random control) could make a robust text watermark, comparing it against the standard logit-based KGW watermark. At matched fluency (within 1.15 times the original perplexity), KGW reached an AUC of 0.81 against a sentence-level paraphraser while the best steering direction reached 0.65. A random direction was as detectable as a meaningful one, so the signal was not semantic.