Watermark Robustness Analysis on Gemma-2 2B
100Post-attack TPRSLAM
Evaluation results
| Method | Links | ||
|---|---|---|---|
| SLAMAttack=Random walk, Verdict=BL only2026.05 | 100 | 1.1 | |
| KGWAttack=Reorder, Verdict=BL only2026.05 | 100 | -0.7 | |
| EWDAttack=Reorder, Verdict=BL only2026.05 | 100 | -0.7 | |
| UnigramAttack=Reorder, Verdict=BL only2026.05 | 100 | -0.7 | |
| SynthIDAttack=Reorder, Verdict=BL only2026.05 | 100 | -0.7 | |
| SLAMAttack=Reorder, Verdict=BL only2026.05 | 100 | -0.7 | |
| KGWAttack=Synonym sub., Verdict=BL only2026.05 | 100 | -3.3 | |
| EWDAttack=Synonym sub., Verdict=BL only2026.05 | 100 | -3.3 | |
| AdaptiveAttack=Synonym sub., Verdict=BL only2026.05 | 100 | -3.3 | |
| SLAMAttack=Synonym sub., Verdict=BL only2026.05 | 100 | -3.3 | |
| UnigramAttack=Word del., Verdict=BL only2026.05 | 100 | -3.3 | |
| AdaptiveAttack=Word del., Verdict=BL only2026.05 | 100 | -3.3 | |
| SLAMAttack=Word del., Verdict=BL only2026.05 | 100 | -3.3 | |
| AdaptiveAttack=Context syn., Verdict=qual. fail2026.05 | 100 | -5.6 | |
| SLAMAttack=Context syn., Verdict=qual. fail2026.05 | 100 | -5.6 | |
| KGWAttack=Word sub., Verdict=qual. fail2026.05 | 100 | -6.8 | |
| UnigramAttack=Word sub., Verdict=qual. fail2026.05 | 100 | -6.8 | |
| AdaptiveAttack=Word sub., Verdict=qual. fail2026.05 | 100 | -6.8 | |
| SLAMAttack=Word sub., Verdict=qual. fail2026.05 | 100 | -6.8 | |
| UnigramAttack=Synonym sub., Verdict=BL only2026.05 | 99 | -3.3 | |
| KGWAttack=Word del., Verdict=BL only2026.05 | 99 | -3.3 | |
| EWDAttack=Word del., Verdict=BL only2026.05 | 99 | -3.3 | |
| KGWAttack=Context syn., Verdict=qual. fail2026.05 | 99 | -5.6 | |
| KGWAttack=Random walk, Verdict=BL only2026.05 | 98 | 1.1 | |
| EWDAttack=Random walk, Verdict=BL only2026.05 | 98 | 1.1 | |
| UnigramAttack=Random walk, Verdict=BL only2026.05 | 98 | 1.1 | |
| EWDAttack=Context syn., Verdict=qual. fail2026.05 | 98 | -5.6 | |
| UnigramAttack=Context syn., Verdict=qual. fail2026.05 | 98 | -5.6 | |
| EWDAttack=Word sub., Verdict=qual. fail2026.05 | 98 | -6.8 | |
| AdaptiveAttack=Reorder, Verdict=BL only2026.05 | 97 | -0.7 | |
| SynthIDAttack=Context syn., Verdict=qual. fail2026.05 | 88 | -5.6 | |
| SynthIDAttack=Synonym sub., Verdict=BL only2026.05 | 85 | -3.3 | |
| SynthIDAttack=Word sub., Verdict=qual. fail2026.05 | 82 | -6.8 | |
| AdaptiveAttack=Random walk, Verdict=BL only2026.05 | 77 | 1.1 | |
| SynthIDAttack=Random walk, Verdict=BL only2026.05 | 72 | 1.1 | |
| AdaptiveAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 68 | 0.6 | |
| KGWAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 56 | 0.6 | |
| UnigramAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 51 | 0.6 | |
| EWDAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 50 | 0.6 | |
| SynthIDAttack=Word del., Verdict=BL only2026.05 | 50 | -3.3 | |
| SynthIDAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 29 | 0.6 | |
| SAEMarkAttack=Context syn., Verdict=qual. fail2026.05 | 27 | -5.6 | |
| SAEMarkAttack=Random walk, Verdict=BL only2026.05 | 24 | 1.1 | |
| SLAMAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 12 | 0.6 | |
| SAEMarkAttack=Synonym sub., Verdict=BL only2026.05 | 11 | -3.3 | |
| SAEMarkAttack=Reorder, Verdict=BL only2026.05 | 6 | -0.7 | |
| SAEMarkAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 4 | 0.6 | |
| SAEMarkAttack=Word sub., Verdict=qual. fail2026.05 | 3 | -6.8 | |
| SAEMarkAttack=Word del., Verdict=BL only2026.05 | 2 | -3.3 |