Semantic watermarking with order-robust detection on clause units

The researchers propose EDA, an embedding displacement attack against semantic watermarking, and design k-SwordStamp, a new scheme that performs order-robust detection on clause units. Semantic watermarking binds marks to sentence semantics rather than token choices, but rewriting, reordering and re-segmentation all cause embedding displacement, so what is detected is a different vector from the one at watermark embedding time, and the mark may therefore be lost; EDA uses public rewriters and a surrogate encoder to cover all three kinds of edits simultaneously under a single objective, without access to the watermark provider's generator or key. At a 5% false positive rate and a 90% content preservation threshold, EDA successfully removes watermarks from 32.6% to 47.9% of documents across four schemes, the highest among the attacks tested. Against k-SwordStamp, the strongest black-box attack tested is an EDA variant adapted to its design, with an attack success rate of 10.8%; a stronger EDA with access to the detector and key reaches 39.7%, and the same attack achieves 65.5% against k-SemStamp. The code is open-sourced at https://github.com/D-Diaa/SwordStamp。