Watermarking for large language models (LLMs) embeds a statistical signal during generation to enable detection of model-produced text. While watermarking has proven effective in benign settings, its robustness under adversarial evasion remains contested. To advance a rigorous understanding and evaluation of such vulnerabilities, we propose the \emph{Bias-Inversion Rewriting Attack} (BIRA), which is theoretically motivated and model-agnostic. BIRA weakens the watermark signal by suppressing the logits of likely watermarked tokens during LLM-based rewriting, without any knowledge of the underlying watermarking scheme. Across recent watermarking methods, BIRA achieves over 99\% evasion while preserving the semantic content of the original text. Beyond demonstrating an attack, our results reveal a systematic vulnerability, emphasizing the need for stress testing and robust defenses.

翻译：大语言模型（LLM）水印技术通过在文本生成过程中嵌入统计信号，以实现对模型生成文本的检测。尽管水印技术在良性场景下已被证明有效，但其在对抗性规避下的鲁棒性仍存在争议。为推进对此类漏洞的严谨理解与评估，我们提出了一种具有理论依据且与模型无关的 **偏置反转重写攻击**（BIRA）。该方法在基于LLM的重写过程中，通过抑制可能携带水印标记的对数概率来削弱水印信号，且无需了解底层水印方案的具体细节。在多种近期提出的水印方法上，BIRA在保持原文语义内容的同时，实现了超过99%的规避成功率。除了展示一种攻击方法外，我们的结果揭示了一种系统性漏洞，强调了进行压力测试和构建鲁棒防御机制的必要性。