Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

Linear Ensembles Wash Away Watermarks

When we talk about securing AI-generated content, the go-to solution is watermarking. This involves embedding statistical signatures into the text. Detectors then use these signatures to identify if a piece of writing came from an LLM.

However, the current landscape is not a monolith. Most users today interact with a dozen different frontier models through unified platforms. They pull from a variety of providers like OpenAI, Meta, or Mistral. Because these providers are in competition, they use different secret keys and architectures to embed their marks. This paper argues that this very competition creates a loophole. When you average the outputs of multiple models, their individual "secret signatures" tend to cancel each other out.

The Question

The researchers investigated a fundamental vulnerability in distributional watermarking. Can an adversary neutralize a watermark by querying multiple, independently watermarked models? They want to aggregate the output probability distributions (the raw scores assigned to each possible next token).

More specifically, they asked if the statistical perturbations introduced by watermarking are essentially "noise" that vanishes under linear ensembling. They framed this as a mathematical problem of convergence. If we treat watermarking as a stochastic perturbation of a shared underlying distribution, does the average of $N$ such models recover the original, unwatermarked consensus distribution?

Why The Old Answer Was Incomplete

Until now, the prevailing assumption in watermarking research was that an adversary only had access to a single watermarked model. Most defenses were designed to withstand "red-green list" attacks or localized rewriting. However, they assumed the statistical signature would remain intact. This assumes the text follows the model's specific biased distribution.

As shown in, the field viewed watermarking as a persistent offset from the true semantic distribution.

The logic was that if a model is nudged to prefer certain tokens, those preferences would characterize the resulting text. But this view ignores the reality of the multi-provider market. In a competitive environment, there is no reason for Provider A's watermark to correlate with Provider B's. The researchers argue that the field has been solving for a monopoly that doesn't exist. They fail to account for the fact that independent, uncoordinated perturbations behave like zero-mean noise.

What They Did

The authors provided a theoretical proof first. They demonstrated that for any unbiased watermarking scheme with independent perturbations, linear ensembling recovers the consensus distribution. The convergence rate is $O(1/\sqrt{N})$. This means that as you add more models to the ensemble, the watermark signal mathematically converges toward zero.

To move from theory to a functional attack, they solved a massive engineering hurdle: vocabulary mismatch. You cannot simply average the probability distributions of Llama and Qwen if they use different tokenizers (the sub-word units a model uses to process text). To bridge this, they developed WASH (Watermark Attenuation via Statistical Hybridisation).

WASH uses "fluency-aware routing." This mechanism detects when a chosen token exists in the shared vocabulary of all models. It also detects when a token is unique to a "specialist" model. As illustrated in, WASH routes the generation to a subset of models when a token falls outside the shared vocabulary intersection.

It then re-synchronizes the context across the rest of the ensemble. This allows for seamless probability aggregation across heterogeneous architectures.

What They Found

The results are stark. The authors report that the "washing" effect is highly efficient. By averaging just 3 to 5 models, they suppressed detection z-scores. A z-score measures how much a signal deviates from a random distribution. They suppressed these scores from ranges as high as 5–300 down to below 2. Since the standard detection threshold is 4, this renders the watermark statistically undetectable.

In terms of raw performance, the paper finds that WASH is not just an effective attacker, but a high-quality generator. The authors report that WASH improves generation quality by 27.5% compared to existing baselines. It also runs approximately 6× faster than the best current removal methods on long-sequence generation. Even when facing "native sequence detectors" (detectors that look at the final text rather than the logits, or unnormalized log-probabilities), the attack succeeds. The authors show that the True Positive Rate at a 5% False Positive Rate (TPR@5% FPR) drops below 50%. This effectively breaks the attribution mechanism.

Crucially, the researchers performed a control experiment with a "Coordinated Watermark." In this scenario, all models in the ensemble shared the same signal. As seen in [Figure 3(c)], the washing effect failed. The signal persisted because the perturbations were no longer independent. This confirms that the vulnerability is not in the ensembling math itself. Instead, it stems from the lack of coordination between providers.

What This Changes

The implications for the industry are significant. If this generalizes to the broader ecosystem, current watermarking techniques are fundamentally incapable of providing reliable provenance in a multi-model world.

First, for security and copyright teams, this means that "detecting AI" via watermarking is a losing game unless the entire stack is vertically integrated. If a user can pipe a prompt through an ensemble of APIs, the watermark is gone before the text is even finished.

Second, for model providers, the paper suggests a pivot in strategy. To build a robust attribution system, providers cannot rely on independent statistical nudges. They must either accept this vulnerability or move toward "coordinated watermarking." This would be a regime where different providers agree on shared, global signatures that can survive linear averaging.

Finally, for researchers, this shifts the focus. We must move from asking "how do we make a stronger watermark" to "how do we make a watermark that is non-linear or distribution-invariant." A logical follow-up would be to test whether non-linear aggregation methods can preserve a watermark signal while still reaping the quality benefits of ensembling.

Figures from the paper