Watermarking is a primary means for providers of generative models to meet legal requirements to mark synthetic content. A watermark embeds a hidden signal into generated content that a detector holding a secret key can later recover. Its security is evaluated primarily against adversaries who remove or forge this signal in individual outputs. We argue that watermarking should also be evaluated and governed as a \emph{monitoring primitive}, because the same signal can link outputs to the entity that generated them. We show that (i) internal observers with detector access attribute outputs to individual entities even under zero-bit watermarks, which encode no identity, when each entity holds its own key, and (ii) external observers without keys or detectors identify the source of unseen text and image outputs in the configurations we test. Both depend on deployment choices that evaluations do not report, namely how fine-grained and persistent the bindings between keys and entities are and who may query the detector. We call for evaluations to report attribution and identification accuracy alongside robustness, and for governance to limit these bindings and detector access.

翻译：暂无翻译