Large‑Language‑Model Providers Use Logit Laundering to Evade Watermark Audits
arXiv: 2611.09446v1
Researchers have shown that a technique called Logit Laundering lets non‑compliant model builders hide the use of copyrighted data. The method works by reshaping the logits – the raw raw output scores – that the model produces at inference time. It integrates a statistical bias estimator to detect watermark signals and a confidence‑aware scaling module that weakens those signals only when the model is very confident, so learning is largely untouched.
Figure 4. Logit Laundering: Stage 1 continual pretraining on corpora containing unauthorized data followed by Stage 2 logit reshaping at inference time using a statistical bias estimator and confidence‑aware scaling to suppress watermark signals while keeping weights unchanged.Hu, Ruihan, Luo, Wei, Shang, Yu-Ming, Wang, Jiakai, Zhang, Chuxuan, Li, Mei et al. · arXiv:2611.09446v1 · Figure 4. · CC BY 4.0
In experiments with five popular foundation models, Logit Laundering raised the p‑values of two state‑of‑the‑art auditing tools (STAMP and Radioactive) above the 0.05 threshold, meaning the tests could not prove infringement. At the same time, the models retained up to 42 % more copyrighted knowledge compared to the unaltered baselines.
Table showing that after Logit Laundering the p‑values of STAMP and Radioactive exceed 0.05 and the copyright retention increases by up to 42 % compared with base models.
STAMP Detection
LLAMA-3.2-1B-Instruct
LLAMA-3.2-3B-Instruct
Qwen-2.5-1.5B-Instruct
Gemma-2-2B-IT
Stable-LM-2-1.6B-Chat
Metrics
pt-value ↑
t-statistic
pt-value ↑
t-statistic
pt-value ↑
t-statistic
pt-value ↑
t-statistic
pt-value ↑
t-statistic
Non Evasion
1.778×10−3
-5.371
4.076×10−3
-4.213
1.250×10−5
-10.420
2.624×10−3
-4.364
1.990×10−4
-5.564
Data-level Evasion
Char (homoglyph)
1.985×10−3
-5.217
4.134×10−2
-2.840
1.465×10−6
-10.704
5.131×10−1
0.024
5.077×10−2
-2.472
Char (insertion)
1.670×10−3
-5.701
3.550×10−2
-2.952
1.644×10−6
-10.658
4.492×10−1
-0.234
5.186×10−2
-2.435
Char (typo)
1.893×10−3
-5.328
3.893×10−2
-2.890
1.388×10−6
-10.760
4.578×10−1
-0.204
4.602×10−2
-2.522
Token Swap
1.507×10−3
-6.417
2.729×10−2
-3.142
5.597×10−7
-11.003
1.233×10−3
-4.712
7.992×10−5
-5.890
Token Synonym
1.517×10−3
-6.485
2.212×10−2
-3.347
1.030×10−7
-11.687
4.374×10−4
-5.368
3.294×10−5
-6.256
Paraphrase
1.525×10−3
-5.970
2.354×10−2
-3.137
3.259×10−10
-12.494
1.157×10−3
-4.721
3.891×10−5
-6.097
Translation
1.518×10−2
-3.511
1.149×10−1
-1.981
3.499×10−4
-9.202
8.301×10−2
-2.274
1.647×10−3
-4.476
Model-level Evasion
Rank-Swap (2S)
1.635×10−3
-5.068
5.963×10−3
-3.952
7.428×10−4
-9.264
5.573×10−3
-4.172
8.325×10−4
-5.140
Rank-Swap (SS)
8.572×10−2
-2.123
1.403×10−1
-1.616
7.384×𝟏𝟎−𝟏
1.447
1.791×10−1
-1.331
3.696×10−1
-0.561
Rank-Swap (SK)
1.862×10−3
-4.761
8.557×10−3
-3.729
3.062×10−3
-8.497
8.371×10−3
-3.833
1.696×10−3
-4.779
Logit Laundering
7.482×𝟏𝟎−𝟏
1.132
8.905×𝟏𝟎−𝟏
2.073
4.117×10−1
-0.882
7.056×𝟏𝟎−𝟏
0.798
9.645×𝟏𝟎−𝟏
2.593
Radioactive Detection
LLAMA-3.2-1B-Instruct
LLAMA-3.2-3B-Instruct
Qwen-2.5-1.5B-Instruct
Gemma-2-2B-IT
Stable-LM-2-1.6B-Chat
Metrics
pz-value ↑
z-score
pz-value ↑
z-score
pz-value ↑
z-score
pz-value ↑
z-score
pz-value ↑
z-score
Non Evasion
1.995×10−4
7.289
7.526×10−3
5.654
2.965×10−6
8.853
3.220×10−4
11.551
5.947×10−5
12.293
Data-level Evasion
Char (homoglyph)
2.131×10−3
6.777
3.049×10−1
1.561
5.930×10−2
4.282
8.423×10−2
4.930
6.314×10−1
-0.741
Char (insertion)
5.667×10−4
7.657
2.039×10−1
2.292
4.882×10−2
4.173
8.795×10−2
4.782
7.178×10−1
-1.302
Char (typo)
6.921×10−4
7.330
1.715×10−1
2.497
8.805×10−2
3.761
7.526×10−2
5.530
5.358×10−1
-0.260
Token Swap
9.819×10−4
8.353
1.245×10−1
2.926
1.709×10−2
5.377
4.266×10−5
10.905
1.239×10−3
12.144
Token Synonym
5.779×10−4
8.342
7.121×10−2
3.500
1.391×10−3
6.652
1.957×10−5
11.221
5.810×10−9
14.677
Paraphrase
2.633×10−2
5.072
4.184×10−1
0.735
3.649×10−1
0.897
2.659×10−6
10.955
5.869×10−4
11.878
Translation
6.539×10−1
-1.310
6.956×10−1
-1.739
7.614×10−1
-1.763
2.750×10−2
5.495
2.221×10−2
7.353
Model-level Evasion
Rank-Swap (2S)
2.368×10−3
7.235
2.603×10−2
4.508
1.856×10−6
8.215
1.963×10−3
10.424
3.665×10−9
12.652
Rank-Swap (SS)
1.278×10−2
4.620
3.485×10−2
3.819
6.782×10−4
4.795
2.564×10−4
8.840
4.127×10−13
13.507
Rank-Swap (SK)
2.977×10−2
4.307
1.209×10−1
2.571
1.929×10−3
7.419
8.923×10−5
10.535
1.094×10−4
10.030
Logit Laundering
9.948×𝟏𝟎−𝟏
-5.118
9.914×𝟏𝟎−𝟏
-7.157
9.999×𝟏𝟎−𝟏
-7.448
9.074×𝟏𝟎−𝟏
-3.588
9.983×𝟏𝟎−𝟏
-7.687
Table 5. STS‑COMPLETE P‑VALUES UNDER LOGIT LAUNDERING: for all five foundation models, STAMP and Radioactive auditing methods produce p‑values above 0.05, and the models retain up to 42 % more copyrighted knowledge relative to unaltered baselines.Hu, Ruihan, Luo, Wei, Shang, Yu-Ming, Wang, Jiakai, Zhang, Chuxuan, Li, Mei et al. · arXiv:2611.09446v1 · Table 5. · CC BY 4.0
A small drop in general task performance was observed: for instance, a Llama‑3.2‑1B model’s ARC‑Challenge accuracy fell from 0.310 to 0.290.
This study demonstrates that current watermark‑based audits can be sidestepped by inference‑time logit manipulation, and that such manipulation only slightly hurts overall model quality.
Large‑Language‑Model Providers Use Logit Laundering to Evade Watermark Audits | arXiv News
