Chainwash: Multi-Step Rewriting Attacks on Diffusion Language Model Watermarks

# Chainwash: Multi-Step Rewriting Attacks on Diffusion Language Model Watermarks
Source: [https://arxiv.org/html/2605.05503](https://arxiv.org/html/2605.05503)
Mohd Ruhul Ameen1Akif Islam2Nadim Mahmud3Md\. Ekramul Hamid2 1College of Engineering and Computer Science, Marshall University, Huntington, WV, USA 2Department of Computer Science and Engineering, University of Rajshahi, Rajshahi, Bangladesh 3Miami University, Oxford, OH 45056, USA ameen@marshall\.edus1910776135@ru\.ac\.bdmahmudm2@miamioh\.eduekram\_hamid@ru\.ac\.bd

###### Abstract

Statistical watermarking is the leading approach for verifying whether text was written by a language model\. Most existing schemes assume autoregressive generation, where tokens are produced left to right and contextual hashing is well defined\. Diffusion language models \(DLMs\) generate text by denoising tokens in arbitrary order, so these schemes cannot be applied directly\. A recent watermark by Gloaguen et al\. \(ICLR 2026\), built on the red–green logit bias framework, addresses this gap and reports true positive detection above 99% on LLaDA\-8B\-Instruct outputs\. The associated robustness study evaluates the watermark on paraphrased and back\-translated text, finds that detectability drops, and shows that the signal can be recovered when the text is long enough\. This paper studies what happens when watermarked text is rewritten not once but several times\. Using the same watermark configuration on LLaDA\-8B\-Instruct, 1,605 watermarked completions of about 300 tokens each are produced across five WaterBench domains\. Each completion is then rewritten by four open\-weight language models, from 1\.5B to 8B parameters, none of which know the watermark key\. Five rewrite styles are tested: paraphrase, humanize, simplify, academic, and summarize\-expand\. Each rewriter is run on its own, and every style is chained for up to five hops, producing 160,500 rewritten texts in total\. The reported metrics are detection rate, chainwash success on the originally detected texts, drop in detector signal, and a laundering efficiency score that compares signal loss against semantic preservation\. The watermark is detected on 87\.9% of the original 1,605 outputs at the standard significance threshold\. After a single rewrite, detection falls to between 14% and 41% depending on the rewriter and style\. After five chained rewrites, detection falls to 4\.86%, meaning 94\.76% of the originally detected texts are no longer flagged\. After three rewrites, the detector score has dropped 86% of the way from its watermarked baseline toward the null distribution\. Repeated rewriting is therefore a much stronger attack than a single rewrite, and the result holds across all four rewriters tested\.

## 1Introduction

As language models become widely used for writing, summarization, coding, and content generation, it becomes increasingly important to know where a piece of text came from\(Tanget al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib23); Wuet al\.,[2025](https://arxiv.org/html/2605.05503#bib.bib26)\)\. One proposed solution is statistical watermarking: during generation, the model slightly changes its token choices in a secret, key\-dependent way, so that a detector can later test whether the text was likely produced by that model\. Most of the early and widely studied text watermarks were designed for autoregressive language models, where tokens are generated from left to right, one token at a time\(Kirchenbaueret al\.,[2023](https://arxiv.org/html/2605.05503#bib.bib6); Aaronson and Kirchner,[2022](https://arxiv.org/html/2605.05503#bib.bib1); Kuditipudiet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib9); Dathathriet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib4)\)\. In that setting, the watermark can use previously generated tokens as context for deciding which next tokens should carry the hidden signal\.

Diffusion language models \(DLMs\) break this assumption\. Instead of generating text strictly from left to right, DLMs start from a sequence containing masked positions and gradually denoise it by filling in tokens, sometimes in arbitrary order\(Austinet al\.,[2021](https://arxiv.org/html/2605.05503#bib.bib2); Louet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib10); Nieet al\.,[2025](https://arxiv.org/html/2605.05503#bib.bib12)\)\. When a token is generated, the “previous” context that an autoregressive watermark would normally use may still be masked, so autoregressive watermarks cannot be transferred to DLMs directly\. Recent work addresses this gap with watermarks designed for the diffusion setting\.Gloaguenet al\.\([2026](https://arxiv.org/html/2605.05503#bib.bib5)\)propose a DLM\-tailored red–green watermark for LLaDA\-style generation that applies the watermark in expectation over possible contexts and biases tokens that help future tokens become green\. The detector remains close to the familiar red–green binomial test, the generation\-time watermark is adapted to arbitrary\-order denoising, and the reported true\-positive detection rate exceeds99%99\\%on fresh DLM outputs\. The same study examines robustness under natural modifications such as paraphrasing and back\-translation, and finds that detectability drops but can be partially recovered when the generated sequence is long enough\.

This paper studies a complementary and more persistent attack setting\. In practice, a user who wants to remove a watermark will rarely edit text by hand or rewrite it only once\. Instead, they can pass the watermarked text through another instruction\-tuned language model and ask for a paraphrase, a humanized version, a simpler version, a more formal version, or a summarize\-and\-expand pass\. The rewriter model does not need to know the watermark key, the original DLM, or the detector\. We refer to this setting as*model\-mediated rewriting*\. The central question is whether a DLM watermark survives repeated rewriting by external LLMs while the meaning of the text is largely preserved\.

To answer this question, we evaluate the DLM red–green watermark ofGloaguenet al\.\([2026](https://arxiv.org/html/2605.05503#bib.bib5)\)under multi\-step rewriting attacks\. We generate1,6051\{,\}605watermarked completions with LLaDA\-8B\-Instruct across five WaterBench domains\(Tuet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib16)\)\. Each completion is then rewritten by four open\-weight instruction\-tuned rewriter models, ranging from1\.51\.5B to88B parameters, under five rewrite styles: paraphrase, humanize, simplify, academic style transfer, and summarize\-expand\. Each style is chained for up to five hops, producing160,500160\{,\}500rewritten texts in total\. This setup allows us to measure not only whether one rewrite weakens the watermark, but also how watermark detectability changes as the same text is repeatedly rewritten\.

We evaluate the attacks along five axes: the watermark detection rate after rewriting, the*chainwash*rate \(the fraction of originally detected texts that become undetected\), the drop in the detector’s continuous signal, the semantic preservation between original and rewritten text, and a watermark removal efficiency score that relates watermark\-signal loss to semantic change\. Across all four rewriters and five rewrite styles, repeated rewriting substantially reduces detectability while semantic content is largely preserved\. None of the rewriters has access to the watermark key, the generator, or the detector\. The result is therefore not driven by a privileged adversary, but by ordinary model\-based rewriting that is already widely available to end users\.

This study is intended to extend, not replace, existing DLM watermark evaluations\. Direct detection on fresh outputs and robustness against a single rewrite remain useful first tests\. However, our findings indicate that they do not by themselves characterize how a watermark behaves once the text has been rewritten several times by external LLMs\. We therefore propose that iterative, multi\-model rewriting should be included as a standard stress test in future DLM watermark evaluations\.

## 2Related Work

Statistical watermarking for language models was first developed mainly in the autoregressive setting, where text is generated from left to right\. The red–green watermark ofKirchenbaueret al\.\([2023](https://arxiv.org/html/2605.05503#bib.bib6)\)partitions the vocabulary into green and red tokens using a key\-dependent hash of the context, gives green tokens a small logit boost during generation, and detects the watermark by comparing the number of green tokens against the expected count under unwatermarked generation\. Other autoregressive watermarking methods explore related ideas with different trade\-offs\. The Gumbel\-max scheme ofAaronson and Kirchner \([2022](https://arxiv.org/html/2605.05503#bib.bib1)\)and the distortion\-free construction ofKuditipudiet al\.\([2024](https://arxiv.org/html/2605.05503#bib.bib9)\)aim to preserve the model distribution more carefully, while SynthID\-Text\(Dathathriet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib4)\)adapts watermarking for large\-scale deployment through tournament sampling\.

A parallel line of work studies how robust these watermarks are after the text is modified\. Autoregressive watermarks can be weakened by paraphrasing, translation, and other text transformations, although the severity of the attack depends on the watermark, the detector threshold, and the length of the text\(Kirchenbaueret al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib7); Zhaoet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib17); Sadasivanet al\.,[2023](https://arxiv.org/html/2605.05503#bib.bib15)\)\. Stronger rewrite attacks, including recursive paraphrasing and learned paraphrase models, further show that surface\-level watermark signals can be diluted while much of the meaning is preserved\(Krishnaet al\.,[2023](https://arxiv.org/html/2605.05503#bib.bib8); Pietet al\.,[2023](https://arxiv.org/html/2605.05503#bib.bib13)\)\. These findings motivate a broader view of watermark robustness: detection on fresh model outputs is useful, but it does not by itself capture what happens after the text is rewritten by another model\.

The most relevant work for our study is the DLM watermark ofGloaguenet al\.\([2026](https://arxiv.org/html/2605.05503#bib.bib5)\)\. Their method adapts the red–green watermarking idea to arbitrary\-order denoising by applying the watermark in expectation over possible contexts and biasing tokens that help future tokens carry the watermark signal\. The detector remains close to the familiar red–green binomial test, while the generation\-time watermark is redesigned for the diffusion setting\. Their experiments report true\-positive rates above99%99\\%on direct LLaDA\-8B generations and evaluate robustness under several natural modifications, including local edits, paraphrasing, and back\-translation\. Other recent works explore watermarking for non\-autoregressive or order\-agnostic generation\. Order\-agnostic schemes such as Unigram\(Zhaoet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib17)\)and PatternMark\(Chenet al\.,[2025](https://arxiv.org/html/2605.05503#bib.bib19)\)avoid depending on a left\-to\-right context, but introduce separate concerns around reliability, security, and susceptibility to scrubbing\. More recent DLM\-oriented methods, such as Gumbel\-style watermarking for discrete diffusion\(Bagchiet al\.,[2025](https://arxiv.org/html/2605.05503#bib.bib3)\)and decoding\-order watermarking approaches such as dgMARK\(Hong and No,[2026](https://arxiv.org/html/2605.05503#bib.bib18)\), study alternative ways to embed provenance signals in diffusion generation\. The main robustness evaluations of these schemes still focus primarily on fresh generations, local text changes, or single\-step transformations\.

Our work is closest in spirit to the robustness literature, but differs in the attack setting\. Rather than asking only whether a DLM watermark can be detected on fresh outputs or after one paraphrase, we ask whether it survives repeated rewriting by external instruction\-tuned LLMs\. The adversary does not need access to the watermark key, the watermarked DLM, or the detector\. They only need a public rewriter model and a natural instruction such as paraphrase, simplify, humanize, or rewrite formally\. We therefore study a multi\-hop watermark removal process in which the output of one rewrite becomes the input to the next\. We use WaterBench\(Tuet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib16)\)as the source of our prompts because it provides a recognized multi\-domain basis for watermark evaluation, but our focus is different from the original benchmark: we generate DLM\-watermarked outputs and study how the watermark behaves under repeated rewriting across multiple rewriter models, rewrite styles, and hops\.

## 3Threat Model: Multi\-Step Rewriting Attacks

We study a black\-box rewriting attack against watermarked diffusion language model outputs\. The starting point is a textx0x\_\{0\}generated by a watermarked DLM\. A detector can test this text and decide whether it carries the watermark\. The adversary’s goal is to produce a new textxhx\_\{h\}that preserves the meaning and usefulness ofx0x\_\{0\}, but is no longer detected as watermarked\.

The adversary does not need access to the watermark key, the watermarked DLM, or the detector\. Instead, the adversary only has the generated text and access to an external instruction\-tuned language model used as a rewriter\. This matches a practical setting: a user can copy a watermarked answer into another LLM and ask for a rewrite using an ordinary natural\-language instruction\. The rewriter is therefore key\-naive: it does not know that the input text is watermarked and does not optimize against the detector directly\.

Formally, letx0x\_\{0\}denote the original watermarked text and letRRbe a rewriter model\. A one\-step rewriting attack produces

x1=R​\(x0,a\),x\_\{1\}=R\(x\_\{0\},a\),whereaais a rewrite instruction such as paraphrase, simplify, humanize, or rewrite in an academic style\. A multi\-step rewriting attack repeats the same process:

xh=R​\(xh−1,a\),h=1,…,H\.x\_\{h\}=R\(x\_\{h\-1\},a\),\\qquad h=1,\\dots,H\.We call each rewriting step a*hop*\. In our experiments, we evaluate up toH=5H=5hops\. The same rewrite style is kept fixed along a chain so that the effect of increasing the number of rewrites can be measured directly\.

The attack succeeds when the final rewritten text is not detected by the watermark detector while still preserving the original response meaning\. IfD​\(⋅\)D\(\\cdot\)denotes the detector andp​\(⋅\)p\(\\cdot\)its returnedpp\-value, then the original text is detected whenp​\(x0\)<0\.05p\(x\_\{0\}\)<0\.05\. After rewriting, the attack is successful for that sample if

p​\(x0\)<0\.05andp​\(xh\)≥0\.05\.p\(x\_\{0\}\)<0\.05\\quad\\text\{and\}\\quad p\(x\_\{h\}\)\\geq 0\.05\.This condition captures the core watermark removal event: a text that was originally flagged as watermarked becomes unflagged after rewriting\.

We refer to this process as*chainwash*: the watermark signal is washed out through a chain of model\-mediated rewrites\. Unlike token\-level deletion, substitution, or manual editing, chainwash is generative\. The output is not formed by small local changes to the original text, but by repeatedly regenerating the text through another language model\. This makes the attack different from a single paraphrase: each hop can introduce new lexical choices, new sentence structure, and new ordering of ideas, while still aiming to keep the same semantic content\.

## 4Experimental Setup

Our evaluation studies whether a DLM watermark remains detectable after the watermarked text is repeatedly rewritten by external language models\. The pipeline has four stages\. First, we assemble a fixed prompt set from WaterBench\. Second, we generate watermarked responses with LLaDA\-8B\-Instruct using the DLM watermark ofGloaguenet al\.\([2026](https://arxiv.org/html/2605.05503#bib.bib5)\)\. Third, we rewrite each watermarked response using external instruction\-tuned LLMs under several rewrite styles and hop counts\. Finally, we re\-score every original and rewritten text with the same watermark detector\. Figure[1](https://arxiv.org/html/2605.05503#S4.F1)summarizes the full pipeline\.

1,605 prompts5 domainsWatermarkedLLaDA\-8BRewrite4 models5 styles5 hopsDetectorg^\\hat\{g\},ppDetection, chainwashWSD, SPS, LESdirect scoreFigure 1:Experimental pipeline\. We generate watermarked DLM outputs from a fixed WaterBench prompt set, rewrite each output with key\-naive external LLMs across styles and hops, and re\-score original and rewritten texts with the same watermark detector\.### 4\.1Relationship to the Original Watermark Configuration

Our setup followsGloaguenet al\.\([2026](https://arxiv.org/html/2605.05503#bib.bib5)\)closely, but differs in two intentional ways\. First, we use watermark strengthδ=3\\delta=3rather thanδ=4\\delta=4\. The original paper reports above99%99\\%true\-positive detection near300300tokens atδ=4\\delta=4, while ourδ=3\\delta=3setting gives an original detection rate of87\.91%87\.91\\%on1,6051\{,\}605LLaDA\-8B\-Instruct outputs\. This setting evaluates a still\-detectable watermark with lower expected quality distortion\. Second, instead of using one closed\-source paraphraser, we use four open\-weight rewriters from1\.51\.5B to88B parameters under five rewrite styles\. Therefore, our single\-hop numbers should not be read as a direct comparison to the original robustness results\. The contribution is the multi\-hop trajectory: repeated rewriting continues to remove watermark signal after the first rewrite\.

### 4\.2Source Prompts

We use1,6051\{,\}605prompts from five WaterBench subsets\(Tuet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib16)\), covering open\-ended explanatory question answering, personal\-finance question answering, multi\-document news summarization, query\-based meeting summarization, and general instruction following\. This gives the evaluation a mixture of short prompts, prompts with short context, and prompts with long source documents\. Table[1](https://arxiv.org/html/2605.05503#S4.T1)reports the prompt distribution\. The same prompt set is used for all rewriter models, rewrite styles, and hop counts\.

Table 1:Source prompt distribution\. “Avg\. ctx\.” denotes average context length in characters\.
### 4\.3Watermarked DLM Generation

We generate the initial watermarked texts with LLaDA\-8B\-Instruct\(Nieet al\.,[2025](https://arxiv.org/html/2605.05503#bib.bib12)\)\. The watermark is the DLM red–green watermark proposed byGloaguenet al\.\([2026](https://arxiv.org/html/2605.05503#bib.bib5)\)\. We use SumHash seeding, Bernoulli green\-list assignment withγ=0\.25\\gamma=0\.25, green\-token biasδ=3\.0\\delta=3\.0, and top\-k=50k=50candidate selection\. For DLM generation, we use300300denoising steps, generation length300300, block length2525, sampling temperature0\.50\.5, and CFG scale0\. Generation is run in bfloat16 on a single NVIDIA RTX 5090 GPU\. For each prompt, we save the prompt identifier, source subset, generated watermarked text, generated length, detector green\-list fractiong^\\hat\{g\}, detectorpp\-value, and binary watermark decision at the standard thresholdp<0\.05p<0\.05\. These original detector scores are used as the reference point for all post\-rewrite measurements; in particular, chainwash is computed relative to the texts that were detected as watermarked before rewriting\.

### 4\.4Rewriter Models

We evaluate four open\-weight instruction\-tuned LLMs as external rewriters: Gemma\-4\-E4B\-it, Llama\-3\.1\-8B\-Instruct\(Grattafioriet al\.,[2024](https://arxiv.org/html/2605.05503#bib.bib11)\), Qwen2\.5\-1\.5B\-Instruct, and Qwen2\.5\-7B\-Instruct\(Qwen Team,[2024](https://arxiv.org/html/2605.05503#bib.bib14)\)\. The rewriters are key\-naive: they are not given the watermark key, the DLM weights, the watermarking algorithm, or the detector score\. Each rewriter only receives the text to be rewritten and a natural\-language rewrite instruction\. Each rewriter is evaluated independently, so a five\-hop chain uses the same rewriter at every hop and we do not mix different rewriter models inside the same chain\. All rewriters are run locally in bfloat16 with sampling temperature0\.70\.7, top\-p=0\.9p=0\.9, and a maximum of360360new tokens\.

### 4\.5Rewrite Styles and Hop Chains

We test five rewrite styles that represent common ways a user might ask an LLM to revise text:

- •Paraphrase:rewrite the text using substantially different wording while preserving the same meaning\.
- •Humanize:rewrite the text so that it sounds more natural, human\-written, and conversational\.
- •Simplify:rewrite the text in simpler language for a general audience\.
- •Academic:rewrite the text in a more formal academic style\.
- •Summarize\-expand:first compress the content, then expand it back into a coherent rewritten response with the same main meaning\.

For each original watermarked text, each rewriter model, and each rewrite style, we run a chain of up to five hops\. Letx0x\_\{0\}denote the original watermarked output,MMdenote a rewriter model, andaadenote a rewrite style\. The rewritten text at hophhis

xh=M​\(xh−1,a\),h=1,…,5\.x\_\{h\}=M\(x\_\{h\-1\},a\),\\qquad h=1,\\dots,5\.
The rewrite style and rewriter model are fixed within a chain\. Thus, hop11measures a single rewrite, while hops22through55measure the effect of repeatedly rewriting the previous output under the same style, which isolates the role of hop count\. The full experiment produces1,605×4×5×5=160,5001\{,\}605\\times 4\\times 5\\times 5=160\{,\}500rewritten texts\. Each rewritten text is scored with the same detector used for the original DLM outputs\.

### 4\.6Evaluation Metrics

We report binary detection, chainwash, continuous signal drop, semantic preservation, and watermark removal efficiency\. Detection rate is the percentage of rewritten texts still flagged atp<0\.05p<0\.05:

DetectionRate​\(a,h\)=1N​∑i=1N𝟏​\[p​\(ya,h\(i\)\)<0\.05\]\.\\mathrm\{DetectionRate\}\(a,h\)=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\!\\left\[p\(y^\{\(i\)\}\_\{a,h\}\)<0\.05\\right\]\.Chainwash measures how many originally detected texts become undetected after rewriting\. Let𝒟0=\{i:p​\(x0\(i\)\)<0\.05\}\\mathcal\{D\}\_\{0\}=\\\{i:p\(x^\{\(i\)\}\_\{0\}\)<0\.05\\\}denote the originally detected subset\. Then

Chainwash​\(a,h\)=1\|𝒟0\|​∑i∈𝒟0𝟏​\[p​\(ya,h\(i\)\)≥0\.05\]\.\\mathrm\{Chainwash\}\(a,h\)=\\frac\{1\}\{\|\\mathcal\{D\}\_\{0\}\|\}\\sum\_\{i\\in\\mathcal\{D\}\_\{0\}\}\\mathbf\{1\}\\\!\\left\[p\(y^\{\(i\)\}\_\{a,h\}\)\\geq 0\.05\\right\]\.We also track watermark signal drop using the detector’s green\-list fractiong^\\hat\{g\}, semantic preservation score \(SPS\) using sentence\-embedding cosine similarity between the original and rewritten text, and watermark removal efficiency score \(LES\), which normalizes detector\-score drop by semantic change\. Full metric definitions are given in Appendix[B](https://arxiv.org/html/2605.05503#A2)\.

## 5Results

This section evaluates how the watermark behaves after repeated rewriting\. We first verify the direct detection baseline, then study how detection changes with rewrite hops, rewriter models, attack styles, semantic preservation, and WaterBench domain\. Unless otherwise stated, detection uses the standard thresholdp<0\.05p<0\.05\.

### 5\.1Direct Detection Baseline

Before rewriting, the watermark is detected in87\.91%87\.91\\%of the original1,6051\{,\}605LLaDA\-8B\-Instruct outputs at the standard thresholdp<0\.05p<0\.05\. The mean detector score isg^=0\.3743\\hat\{g\}=0\.3743, which is substantially above the null green\-list rateγ=0\.25\\gamma=0\.25\. This confirms that the watermark is active and clearly detectable before any rewriting attack is applied\.

This direct detection rate is lower than the above\-99%99\\%figure reported byGloaguenet al\.\([2026](https://arxiv.org/html/2605.05503#bib.bib5)\)atδ=4\\delta=4, and is consistent with our use of the weakerδ=3\\delta=3setting \(Section[4\.1](https://arxiv.org/html/2605.05503#S4.SS1)\)\. This difference does not affect the main goal of our experiment, which is to measure how the watermark signal changes as the same watermarked outputs are repeatedly rewritten\.

This baseline is important for interpreting the rest of the results\. A rewriting attack can only remove detection from samples that were detected in the first place\. Therefore, we report both detection rate after rewriting and chainwash rate\. Detection rate measures how many rewritten texts remain flagged, while chainwash measures how many originally detected texts are no longer flagged after rewriting\.

### 5\.2Detection Drops Rapidly Under Repeated Rewriting

Figure[2](https://arxiv.org/html/2605.05503#S5.F2)\(a\) shows the detection rate after each rewrite hop, averaged over the five rewrite styles for each rewriter model\. The dashed line shows the original detection rate before rewriting\. All four rewriters cause a large drop after the first hop, and additional hops keep the detection rate low\.

The first rewrite is already strong\. Across rewriter models, the average detection rate after hop 1 falls far below the direct baseline\. Gemma\-4\-E4B starts with the highest hop\-1 detection among the four rewriters, while Llama\-3\.1\-8B and Qwen2\.5\-7B are stronger single\-hop rewriters\. However, after multiple hops, all models converge to a low\-detection region\. By hop 5, the mean detection rate for each rewriter is close to the low\-teens percentage range\.

### 5\.3Hop\-5 Chainwash Depends on Rewriter and Rewrite Style

Figure[2](https://arxiv.org/html/2605.05503#S5.F2)\(b\) reports the hop\-5 chainwash rate for each rewriter and rewrite style\. This figure uses the all\-output chainwash rate, where the denominator is the full set of1,6051\{,\}605original outputs\. Since the direct detection baseline is87\.91%87\.91\\%, an all\-output chainwash rate near83%83\\%corresponds to removing detection from almost all originally detected samples\.

![Refer to caption](https://arxiv.org/html/2605.05503v1/x1.png)\(a\)Detection rate by rewriter model across rewrite hops\.
![Refer to caption](https://arxiv.org/html/2605.05503v1/x2.png)\(b\)Hop\-5 chainwash rate by rewriter and rewrite style\.

Figure 2:Detection decay and hop\-5 chainwash under repeated rewriting\. \(a\) Detection rate atp<0\.05p<0\.05across rewrite hops, averaged over the five rewrite styles for each rewriter model\. The dashed line shows the original detection rate before rewriting\. \(b\) Hop\-5 all\-output chainwash rate over the full set of1,6051\{,\}605outputs\. Higher values indicate that more originally detected watermarked texts become undetected after five rewrite hops\.The strongest hop\-5 settings are Gemma\-4\-E4B with paraphrase and summarize\-expand, each reaching an all\-output chainwash rate of83\.3%83\.3\\%\. Because the original detection rate is87\.91%87\.91\\%, this corresponds to removing the watermark decision from approximately94\.8%94\.8\\%of the originally detected outputs\. This matches the central claim of the paper: repeated rewriting can wash out the detector decision for most samples that were initially detected as watermarked\.

Table 2:Hop\-5 all\-output chainwash rate \(%\)\. Values are computed over all1,6051\{,\}605original outputs\. The maximum observed rate is83\.3%83\.3\\%, achieved by Gemma\-4\-E4B under paraphrase and summarize\-expand\.Several patterns are visible\. First, paraphrase, simplify, academic rewriting, and summarize\-expand are consistently strong across models\. Second, humanize is weaker for Gemma\-4\-E4B, reaching only54\.8%54\.8\\%all\-output chainwash at hop 5\. This suggests that not all natural rewriting instructions remove the watermark signal equally\. Third, model size alone does not explain attack strength: Qwen2\.5\-1\.5B is often competitive with Qwen2\.5\-7B, and Gemma\-4\-E4B is the strongest model for some styles but not all\.

### 5\.4Meaning Is Largely Preserved Across Hops

A strong rewriting attack should not simply destroy the text\. It should remove the watermark signal while preserving meaning\. Figure[3](https://arxiv.org/html/2605.05503#S5.F3)\(b\) shows the semantic preservation score \(SPS\) across rewrite hops\. SPS is computed between the original watermarked text and the rewritten text\. Higher values indicate stronger semantic preservation\.

![Refer to caption](https://arxiv.org/html/2605.05503v1/x3.png)\(a\)Watermark signal drop across rewrite hops\.
![Refer to caption](https://arxiv.org/html/2605.05503v1/x4.png)\(b\)Semantic preservation across rewrite hops\.

Figure 3:Signal removal and semantic preservation under repeated rewriting\. \(a\) The detector\-score drop increases from hop 1 to hop 5, showing that repeated rewriting removes more of the underlying watermark signal\. \(b\) Mean semantic preservation score remains high across rewrite hops, with the shaded region showing one standard deviation\. Even after five hops, rewritten texts remain semantically close to the original watermarked outputs\.The mean SPS remains high throughout the chain\. It starts above0\.920\.92after one rewrite and remains around0\.860\.86even after five rewrite hops\. This means that the observed detector failure is not caused by completely changing or destroying the text\. The rewritten outputs remain close in meaning to the original watermarked outputs while the watermark signal is reduced\.

### 5\.5The Continuous Watermark Signal Drops With Hops

Binary detection only shows whether a text is flagged or not\. To understand whether the underlying watermark signal is actually being removed, we measure the drop in detector score\. Figure[3](https://arxiv.org/html/2605.05503#S5.F3)\(a\) shows that the mean detector\-score drop increases with rewrite hop\.

Table 3:Mean detector scoreg^\\hat\{g\}across rewrite hops, averaged over all rewriters and rewrite styles\. The null green\-list rate isγ=0\.25\\gamma=0\.25\. By hop 3, the mean detector score has dropped about85%85\\%of the way from the watermarked baseline toward the null rate\.The detector\-score drop grows from0\.0930\.093at hop 1 to0\.1080\.108at hop 5\. In absolute terms \(Table[3](https://arxiv.org/html/2605.05503#S5.T3)\), the mean detector scoreg^\\hat\{g\}falls from the baseline of0\.3740\.374to0\.2820\.282after one rewrite, and continues falling to0\.2670\.267after five rewrites\. The null green\-list rate isγ=0\.25\\gamma=0\.25, so by hop 3 the mean detector score has lost approximately85%85\\%of its initial gap above null\. The watermark signal is therefore not merely weakened but largely removed across the corpus, while remaining slightly above the null distribution\. The largest reduction occurs between hop 1 and hop 3, after which the curve flattens, suggesting that most of the watermark signal is removed within the first few rewrites\.

Together with the SPS result, this shows a clear trade\-off: repeated rewriting reduces the detector signal while maintaining high semantic similarity\. This is precisely the behavior expected from a practical rewriting attack\. A full scatter plot of detector\-score drop against semantic preservation for all model\-style\-hop settings is provided in Appendix[B\.1](https://arxiv.org/html/2605.05503#A2.SS1)\. The effect also holds across all five WaterBench domains, with domain\-level results reported in Appendix[B\.2](https://arxiv.org/html/2605.05503#A2.SS2)\. Overall, the direct detector identifies87\.91%87\.91\\%of the original outputs\. After five rewrite hops, the strongest settings chainwash83\.3%83\.3\\%of all outputs, corresponding to approximately94\.8%94\.8\\%of the originally detected subset\. Mean SPS remains around0\.860\.86at hop 5, while the mean detector\-score drop reaches approximately0\.1080\.108\.

## 6Discussion

#### Implications for evaluation\.

Direct detection gives an incomplete picture of DLM watermark robustness\. The watermark is clearly active before rewriting, with87\.91%87\.91\\%detection on the original LLaDA\-8B\-Instruct outputs\. However, after five rewrite hops, the strongest settings remove the watermark decision from83\.3%83\.3\\%of all outputs, corresponding to approximately94\.8%94\.8\\%of the originally detected subset\. This does not mean that the studied watermark is ineffective on fresh generations\. Rather, it shows that direct detection and single\-rewrite robustness do not fully describe deployment behavior\. Future DLM watermark evaluations should include multi\-hop rewriting, multiple rewriter models, multiple rewrite instructions, semantic preservation, and continuous signal\-drop metrics\.

#### What the attack reveals\.

Repeated rewriting is different from a single rewrite because each hop regenerates the surface form of the text\. Most signal loss occurs within the first few hops, after which detection remains low\. Rewriter size alone does not explain the effect: Qwen2\.5\-1\.5B is often competitive with Qwen2\.5\-7B, and Gemma\-4\-E4B gives some of the strongest hop\-5 results\. Rewrite style also matters\. Paraphrase, simplify, academic rewriting, and summarize\-expand are strong across models, while humanize is weaker in some settings\. Since mean SPS remains around0\.860\.86at hop 5, the watermark is weakened without simply destroying the original meaning\.

## 7Conclusion

This paper studied whether a recent diffusion language model watermark remains detectable after repeated model\-mediated rewriting\. Using the same watermark configuration on LLaDA\-8B\-Instruct, we generated1,6051\{,\}605watermarked outputs of about300300tokens and rewrote them using four key\-naive open\-weight LLMs, five rewrite styles, and up to five rewrite hops, producing160,500160\{,\}500rewritten texts\.

The watermark is detected on87\.91%87\.91\\%of the original outputs before rewriting\. After repeated rewriting, detection falls sharply\. In the strongest hop\-5 settings,83\.3%83\.3\\%of all outputs are chainwashed, corresponding to approximately94\.8%94\.8\\%of the originally detected subset\. At the same time, semantic preservation remains high, showing that the watermark is weakened without simply destroying the original meaning\. These results show that multi\-hop rewriting is a stronger and distinct robustness setting for DLM watermarks\. Future watermark evaluations should therefore measure not only direct detection on fresh generations, but also survival under repeated rewriting by external LLMs\.

## Reproducibility Statement

We provide the full experimental pipeline needed to reproduce the study: WaterBench prompt construction, watermarked generation with LLaDA\-8B\-Instruct, multi\-hop rewriting with open\-weight rewriter models, detector re\-scoring, and metric computation\. The released artifacts include the original watermarked generations, rewritten outputs, detector scores, semantic preservation scores, chainwash summaries, and plotting scripts for all reported figures and tables\. All rewriting experiments are run with fixed decoding settings for each model and style\. The full pipeline is designed to run on a single high\-memory consumer GPU, with the watermarked generation and rewrite stages executed in bfloat16\.

## Ethics Statement

This work evaluates the robustness of an existing DLM watermark under realistic rewriting behavior\. The attack setting uses ordinary open\-weight language models and natural rewrite instructions, without access to the watermark key, the detector, or the original DLM internals\. The goal is not to encourage misuse, but to measure a practical weakness that watermark evaluations should account for\. Since watermarking is increasingly discussed as a tool for content traceability, it is important that robustness claims reflect how text may be rewritten after generation\. We report the results to support more reliable future watermark design and evaluation\. We do not release tools intended for harmful evasion beyond the research pipeline needed to reproduce the reported experiments\.

## References

- Watermarking GPT outputs\.Note:PresentationExternal Links:[Link](https://www.scottaaronson.com/talks/watermark.ppt)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p1.1),[§2](https://arxiv.org/html/2605.05503#S2.p1.1)\.
- J\. Austin, D\. D\. Johnson, J\. Ho, D\. Tarlow, and R\. van den Berg \(2021\)Structured denoising diffusion models in discrete state\-spaces\.InAdvances in Neural Information Processing Systems,Vol\.34,pp\. 17981–17993\.External Links:[Link](https://proceedings.neurips.cc/paper/2021/hash/958c530554f78bcd8e97125b70e6973d-Abstract.html)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p2.1)\.
- A\. Bagchi, A\. Bhimaraju, M\. Choraria, D\. Alabi, and L\. R\. Varshney \(2025\)Watermarking discrete diffusion language models\.External Links:2511\.02083,[Link](https://arxiv.org/abs/2511.02083)Cited by:[§2](https://arxiv.org/html/2605.05503#S2.p3.1)\.
- R\. Chen, Y\. Wu, Y\. Chen, C\. Liu, J\. Guo, and H\. Huang \(2025\)A watermark for order\-agnostic language models\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Nlm3Xf0W9S)Cited by:[§2](https://arxiv.org/html/2605.05503#S2.p3.1)\.
- S\. Dathathri, A\. See, S\. Ghaisas, P\. Huang, R\. McAdam, J\. Welbl, V\. Bachani, A\. Kaskasoli, R\. Stanforth, T\. Matejovicova, J\. Hayes, N\. Vyas,et al\.\(2024\)Scalable watermarking for identifying large language model outputs\.Nature634\(8035\),pp\. 818–823\.External Links:[Document](https://dx.doi.org/10.1038/s41586-024-08025-4),[Link](https://doi.org/10.1038/s41586-024-08025-4)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p1.1),[§2](https://arxiv.org/html/2605.05503#S2.p1.1)\.
- T\. Gloaguen, R\. Staab, N\. Jovanović, and M\. Vechev \(2026\)Watermarking diffusion language models\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=3aBWTYGcaT)Cited by:[Appendix C](https://arxiv.org/html/2605.05503#A3.p1.1),[§1](https://arxiv.org/html/2605.05503#S1.p2.1),[§1](https://arxiv.org/html/2605.05503#S1.p4.4),[§2](https://arxiv.org/html/2605.05503#S2.p3.1),[§4\.1](https://arxiv.org/html/2605.05503#S4.SS1.p1.10),[§4\.3](https://arxiv.org/html/2605.05503#S4.SS3.p1.11),[§4](https://arxiv.org/html/2605.05503#S4.p1.1),[§5\.1](https://arxiv.org/html/2605.05503#S5.SS1.p2.3)\.
- A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan, A\. Yang, A\. Fan, A\. Goyal,et al\.\(2024\)The Llama 3 herd of models\.External Links:2407\.21783,[Link](https://arxiv.org/abs/2407.21783)Cited by:[§4\.4](https://arxiv.org/html/2605.05503#S4.SS4.p1.3)\.
- P\. M\. Hong and A\. No \(2026\)dgMARK: decoding\-guided watermarking for diffusion language models\.External Links:2601\.22985,[Link](https://arxiv.org/abs/2601.22985)Cited by:[§2](https://arxiv.org/html/2605.05503#S2.p3.1)\.
- J\. Kirchenbauer, J\. Geiping, Y\. Wen, J\. Katz, I\. Miers, and T\. Goldstein \(2023\)A watermark for large language models\.InProceedings of the 40th International Conference on Machine Learning,External Links:[Link](https://arxiv.org/abs/2301.10226)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p1.1),[§2](https://arxiv.org/html/2605.05503#S2.p1.1)\.
- J\. Kirchenbauer, J\. Geiping, Y\. Wen, M\. Shu, K\. Saifullah, K\. Kong, K\. Fernando, A\. Saha, M\. Goldblum, and T\. Goldstein \(2024\)On the reliability of watermarks for large language models\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=DEJIDCmWOz)Cited by:[§2](https://arxiv.org/html/2605.05503#S2.p2.1)\.
- K\. Krishna, Y\. Song, M\. Karpinska, J\. Wieting, and M\. Iyyer \(2023\)Paraphrasing evades detectors of AI\-generated text, but retrieval is an effective defense\.InAdvances in Neural Information Processing Systems,Vol\.36\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/575c450013d0e99e4b0ecf82bd1afaa4-Abstract-Conference.html)Cited by:[§2](https://arxiv.org/html/2605.05503#S2.p2.1)\.
- R\. Kuditipudi, J\. Thickstun, T\. Hashimoto, and P\. Liang \(2024\)Robust distortion\-free watermarks for language models\.Transactions on Machine Learning Research\.External Links:2307\.15593,[Link](https://openreview.net/forum?id=FpaCL1MO2C)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p1.1),[§2](https://arxiv.org/html/2605.05503#S2.p1.1)\.
- A\. Lou, C\. Meng, and S\. Ermon \(2024\)Discrete diffusion modeling by estimating the ratios of the data distribution\.InProceedings of the 41st International Conference on Machine Learning,External Links:[Link](https://arxiv.org/abs/2310.16834)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p2.1)\.
- S\. Nie, F\. Zhu, Z\. You, X\. Zhang, J\. Ou, J\. Hu, J\. Zhou, Y\. Lin, J\. Wen, and C\. Li \(2025\)LLaDA: large language diffusion models\.External Links:2502\.09992,[Link](https://arxiv.org/abs/2502.09992)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p2.1),[§4\.3](https://arxiv.org/html/2605.05503#S4.SS3.p1.11)\.
- J\. Piet, C\. Sitawarin, V\. Fang, N\. Mu, and D\. Wagner \(2023\)Mark my words: analyzing and evaluating language model watermarks\.External Links:2312\.00273,[Link](https://arxiv.org/abs/2312.00273)Cited by:[§2](https://arxiv.org/html/2605.05503#S2.p2.1)\.
- Qwen Team \(2024\)Qwen2\.5 technical report\.External Links:2412\.15115,[Link](https://arxiv.org/abs/2412.15115)Cited by:[§4\.4](https://arxiv.org/html/2605.05503#S4.SS4.p1.3)\.
- N\. Reimers and I\. Gurevych \(2019\)Sentence\-BERT: sentence embeddings using Siamese BERT\-networks\.InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing,pp\. 3982–3992\.External Links:[Link](https://arxiv.org/abs/1908.10084)Cited by:[Appendix B](https://arxiv.org/html/2605.05503#A2.p2.1)\.
- V\. S\. Sadasivan, A\. Kumar, S\. Balasubramanian, W\. Wang, and S\. Feizi \(2023\)Can AI\-generated text be reliably detected?\.External Links:2303\.11156,[Link](https://arxiv.org/abs/2303.11156)Cited by:[§2](https://arxiv.org/html/2605.05503#S2.p2.1)\.
- R\. Tang, Y\. Chuang, and X\. Hu \(2024\)The science of detecting LLM\-generated text\.Communications of the ACM67\(4\),pp\. 50–59\.External Links:[Link](https://arxiv.org/abs/2303.07205)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p1.1)\.
- S\. Tu, Y\. Sun, Y\. Bai, J\. Yu, L\. Hou, and J\. Li \(2024\)WaterBench: towards holistic evaluation of watermarks for large language models\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),Bangkok, Thailand,pp\. 1517–1542\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.83),[Link](https://aclanthology.org/2024.acl-long.83/)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p4.4),[§2](https://arxiv.org/html/2605.05503#S2.p4.1),[§4\.2](https://arxiv.org/html/2605.05503#S4.SS2.p1.1)\.
- J\. Wu, S\. Yang, R\. Zhan, Y\. Yuan, D\. F\. Wong, and L\. S\. Chao \(2025\)A survey on LLM\-generated text detection: necessity, methods, and future directions\.Computational Linguistics51\(1\),pp\. 275–338\.External Links:[Document](https://dx.doi.org/10.1162/coli%5Fa%5F00549),[Link](https://direct.mit.edu/coli/article/51/1/275/127462/A-Survey-on-LLM-Generated-Text-Detection-Necessity)Cited by:[§1](https://arxiv.org/html/2605.05503#S1.p1.1)\.
- X\. Zhao, P\. Ananth, L\. Li, and Y\. Wang \(2024\)Provable robust watermarking for AI\-generated text\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=SsmT8aO45L)Cited by:[§2](https://arxiv.org/html/2605.05503#S2.p2.1),[§2](https://arxiv.org/html/2605.05503#S2.p3.1)\.

## Appendix AAdditional Results

## Appendix BMetric Definitions

Watermark signal drop is computed as

WSDg^​\(a,h\)=1N​∑i=1N\[g^​\(x0\(i\)\)−g^​\(ya,h\(i\)\)\]\.\\mathrm\{WSD\}^\{\\hat\{g\}\}\(a,h\)=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\left\[\\hat\{g\}\(x^\{\(i\)\}\_\{0\}\)\-\\hat\{g\}\(y^\{\(i\)\}\_\{a,h\}\)\\right\]\.
Semantic preservation score is

SPS​\(a,h\)=1N​∑i=1Ncos⁡\(e​\(x0\(i\)\),e​\(ya,h\(i\)\)\),\\mathrm\{SPS\}\(a,h\)=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\cos\\left\(e\(x^\{\(i\)\}\_\{0\}\),e\(y^\{\(i\)\}\_\{a,h\}\)\\right\),wheree​\(⋅\)e\(\\cdot\)is a sentence embedding model\[Reimers and Gurevych,[2019](https://arxiv.org/html/2605.05503#bib.bib21)\]\.

watermark removal efficiency score is

LES​\(a,h\)=WSDg^​\(a,h\)1−SPS​\(a,h\)\+ϵ,\\mathrm\{LES\}\(a,h\)=\\frac\{\\mathrm\{WSD\}^\{\\hat\{g\}\}\(a,h\)\}\{1\-\\mathrm\{SPS\}\(a,h\)\+\\epsilon\},withϵ=10−3\\epsilon=10^\{\-3\}\.

### B\.1Trade\-off Between Semantic Preservation and Watermark Removal

![Refer to caption](https://arxiv.org/html/2605.05503v1/x5.png)Figure 4:Trade\-off between semantic preservation and watermark removal\. Each point represents a model\-style\-hop setting\. Thexx\-axis shows semantic preservation, and theyy\-axis shows detector\-score drop\. Stronger attacks appear toward the upper\-right\.Paraphrase and summarize\-expand tend to produce larger detector\-score drops, while humanize often preserves meaning well but is not always the strongest at removing the watermark signal\. This confirms that rewrite style affects the balance between semantic preservation and watermark removal\.

### B\.2Domain\-Level Chainwash

![Refer to caption](https://arxiv.org/html/2605.05503v1/x6.png)Figure 5:Mean hop\-5 chainwash rate by WaterBench domain\. Chainwash is highest for long\-form question answering and finance question answering, and lower for multi\-document news summarization\.The attack succeeds across all five WaterBench domains, although the rate varies by task type\. Long\-form question answering and finance question answering show the highest hop\-5 chainwash rates, while multi\-document news summarization is lower\.

## Appendix CLimitations

This study evaluates one DLM, LLaDA\-8B\-Instruct, and one DLM watermarking method, the red–green watermark ofGloaguenet al\.\[[2026](https://arxiv.org/html/2605.05503#bib.bib5)\]\. The exact chainwash rates may differ for other DLMs, watermark designs, or decoding settings\. We evaluate four open\-weight rewriters, but do not test closed\-source commercial humanizers or mixed\-model chains where each hop uses a different rewriter\. Semantic preservation is measured using one sentence\-encoder based metric, so future work should compare multiple semantic metrics and human judgments\. We also do not study false attribution, where rewritten text is tested against a different watermark key\.