Watermarking Attack Robustness on Gemma 9B v2 (test)
100TPRSLAM
Evaluation results
| Method | Links | ||
|---|---|---|---|
| SLAMAttack=Random walk, Verdict=BL only2026.05 | 100 | 0.7 | |
| KGWAttack=Reorder, Verdict=BL only2026.05 | 100 | -1.4 | |
| SLAMAttack=Reorder, Verdict=BL only2026.05 | 100 | -1.4 | |
| AdaptiveAttack=Synonym sub., Verdict=BL only2026.05 | 100 | -3.8 | |
| SLAMAttack=Synonym sub., Verdict=BL only2026.05 | 100 | -3.8 | |
| AdaptiveAttack=Word del., Verdict=BL only2026.05 | 100 | -4.3 | |
| SLAMAttack=Word del., Verdict=BL only2026.05 | 100 | -4.3 | |
| AdaptiveAttack=Context syn., Verdict=qual. fail2026.05 | 100 | -6.8 | |
| SLAMAttack=Context syn., Verdict=qual. fail2026.05 | 100 | -6.8 | |
| AdaptiveAttack=Word sub., Verdict=qual. fail2026.05 | 100 | -7.7 | |
| SLAMAttack=Word sub., Verdict=qual. fail2026.05 | 100 | -7.7 | |
| KGWAttack=Random walk, Verdict=BL only2026.05 | 99 | 0.7 | |
| UnigramAttack=Reorder, Verdict=BL only2026.05 | 99 | -1.4 | |
| AdaptiveAttack=Reorder, Verdict=BL only2026.05 | 99 | -1.4 | |
| KGWAttack=Synonym sub., Verdict=BL only2026.05 | 99 | -3.8 | |
| KGWAttack=Context syn., Verdict=qual. fail2026.05 | 99 | -6.8 | |
| KGWAttack=Word sub., Verdict=qual. fail2026.05 | 99 | -7.7 | |
| UnigramAttack=Word sub., Verdict=qual. fail2026.05 | 99 | -7.7 | |
| UnigramAttack=Random walk, Verdict=BL only2026.05 | 98 | 0.7 | |
| UnigramAttack=Synonym sub., Verdict=BL only2026.05 | 98 | -3.8 | |
| KGWAttack=Word del., Verdict=BL only2026.05 | 98 | -4.3 | |
| UnigramAttack=Word del., Verdict=BL only2026.05 | 97 | -4.3 | |
| UnigramAttack=Context syn., Verdict=qual. fail2026.05 | 97 | -6.8 | |
| SynthIDAttack=Reorder, Verdict=BL only2026.05 | 96 | -1.4 | |
| EWDAttack=Synonym sub., Verdict=BL only2026.05 | 95 | -3.8 | |
| EWDAttack=Word del., Verdict=BL only2026.05 | 95 | -4.3 | |
| AdaptiveAttack=Random walk, Verdict=BL only2026.05 | 87 | 0.7 | |
| SynthIDAttack=Context syn., Verdict=qual. fail2026.05 | 81 | -6.8 | |
| EWDAttack=Word sub., Verdict=qual. fail2026.05 | 80 | -7.7 | |
| SynthIDAttack=Word sub., Verdict=qual. fail2026.05 | 79 | -7.7 | |
| AdaptiveAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 74 | -1 | |
| SynthIDAttack=Random walk, Verdict=BL only2026.05 | 68 | 0.7 | |
| SynthIDAttack=Synonym sub., Verdict=BL only2026.05 | 68 | -3.8 | |
| KGWAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 64 | -1 | |
| UnigramAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 62 | -1 | |
| EWDAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 46 | -1 | |
| SynthIDAttack=Word del., Verdict=BL only2026.05 | 40 | -4.3 | |
| SynthIDAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 14 | -1 | |
| SAEMarkAttack=Synonym sub., Verdict=BL only2026.05 | 11 | -3.8 | |
| SLAMAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 10 | -1 | |
| SAEMarkAttack=Random walk, Verdict=BL only2026.05 | 10 | 0.7 | |
| SAEMarkAttack=Context syn., Verdict=qual. fail2026.05 | 10 | -6.8 | |
| SAEMarkAttack=Word sub., Verdict=qual. fail2026.05 | 10 | -7.7 | |
| SAEMarkAttack=Word del., Verdict=BL only2026.05 | 8 | -4.3 | |
| EWDAttack=Reorder, Verdict=BL only2026.05 | 6 | -1.4 | |
| EWDAttack=Context syn., Verdict=qual. fail2026.05 | 6 | -6.8 | |
| EWDAttack=Random walk, Verdict=BL only2026.05 | 5 | 0.7 | |
| SAEMarkAttack=Reorder, Verdict=BL only2026.05 | 3 | -1.4 | |
| SAEMarkAttack=DIPPER, Verdict=evaded (SLAM qual. ↓)2026.05 | 2 | -1 |