Forging LLM Authorship Fingerprints with Targeted Rewriting

# Forging LLM Authorship Fingerprints with Targeted Rewriting
Source: [https://arxiv.org/html/2609.38831](https://arxiv.org/html/2609.38831)
Simin ChenAffiliation:George Mason UniversityXi NiuAffiliation:University of North Carolina at CharlotteHanqing GuoAffiliation:Indiana UniversityDepeng XuAffiliation:University of North Carolina at CharlotteHaopeng Zhang††thanks:Corresponding author\.Affiliation:University of North Carolina at Charlotte

###### Abstract

Model\-attribution classifiers can often identify which language model produced a text, making model\-specific writing patterns a signal of provenance\. Accurate attribution on unmodified text, however, does not show whether the prediction still identifies the original source after deliberate rewriting\. We formulate this problem as*targeted fingerprint transfer*: rewriting one model’s output so that attribution classifiers assign it to a chosen target model\. We study summarization, where different models receive the same document and express the same underlying content, providing a controlled setting for conditional generation\. We introduceForgePrint, a search\-then\-distil framework that first searches for rewrites that move attribution toward a target fingerprint, then distils the selected rewrites into a one\-pass44B Student model\. On CNN/DM, the Student reaches70\.2%70\.2\\%target success rate, outperforming both its Teacher \(54\.1%54\.1\\%\) and the strongest of six published rewriting baselines \(39\.3%39\.3\\%\), against held\-out classifiers that are never queried by the attack\. It also reaches68\.3%68\.3\\%target success when transferring summaries from an open model toward chosen commercial models\. These results show that fingerprint detectability should not be conflated with source authenticity, and that text\-only attribution can provide misleading evidence of model identity under targeted rewriting, even when it is accurate on unmodified text\. Our code and evaluation suite will be released at[https://github\.com/HaohanYuan01/ForgePrint](https://github.com/HaohanYuan01/ForgePrint)\.

## 1Introduction

Language models leave model\-specific patterns in generated text, allowing classifiers to identify the source model with high accuracy\([Uchendu et al\., 2020](https://arxiv.org/html/2609.38831#bib.bib28);[Sun et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib12)\)\. We refer to these patterns as*authorship fingerprints*\. Such fingerprints can serve as text\-based provenance signals, for example when auditing whether a service substitutes a cheaper model for a claimed commercial model\([Gao et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib30);[Cai et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib31)\), or presents another model’s outputs as its own\([Anthropic, 2026b](https://arxiv.org/html/2609.38831#bib.bib9)\)\. Accurate attribution on unmodified text, however, does not show whether attribution remains tied to the source model after deliberate rewriting\.

Existing work has mainly studied source\-model attribution on unmodified or generically rewritten text, while attacks on AI\-text and authorship detectors typically aim to hide the original source\([Uchendu et al\., 2020](https://arxiv.org/html/2609.38831#bib.bib28);[Sun et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib12);[Krishna et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib6)\)\. Text style transfer instead moves text toward human\-defined attributes such as formality\([Reif et al\., 2022](https://arxiv.org/html/2609.38831#bib.bib3);[Suzgun et al\., 2022](https://arxiv.org/html/2609.38831#bib.bib4)\)\. These settings do not ask whether rewriting can deliberately redirect model attribution from a known source to a chosen target\.

As shown in Figure[1](https://arxiv.org/html/2609.38831#S1.F1), we formulate a new model\-attribution task,*targeted fingerprint transfer*: given a summary from a source modelSSand a target modelTT, rewrite it so that held\-out attribution classifiers assign it toTTwhile preserving its content\. This differs from*source evasion*, where any prediction other thanSScounts as success\. We study this task in summarization, where different models receive the same source document and summarize the same information, providing a controlled setting for comparing model\-specific writing patterns\. Across four domains, our four\-way attribution classifiers achieve85\.9%85\.9\\%average accuracy on unmodified summaries\.

![Refer to caption](https://arxiv.org/html/2609.38831v1/fig_teaser.png)Figure 1:Targeted fingerprint transfer through rewriting\. Starting from a Claude summary, existing rewriters largely preserve the Claude fingerprint, whereasForgePrintshifts attribution toward the chosen GPT fingerprint\.We introduceForgePrint, a search\-then\-distil framework for targeted fingerprint transfer\. Because direct source\-to\-target rewrite supervision is not available, the search stage constructs it offline\. For each source–target path, the Teacher combines path\-specific operators with retrieved examples to generate multiple candidate rewrites, and an attacker\-side surrogate selects candidates that move attribution toward the target fingerprint\. The selected rewrites provide SFT targets and DPO preference pairs for the Student\. We then refine the Student with factuality\-aware GRPO\([Shao et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib8);[Tan et al\., 2026](https://arxiv.org/html/2609.38831#bib.bib25)\)on its own samples\. At inference, the Student performs the transfer in one pass using only the source summary and the source and target model names, without the operator bank, retrieved examples, or surrogate\.

We evaluateForgePrintacross four summarization domains using four held\-out attribution architectures that are never queried during attack development\. Across the four domains,ForgePrintreaches60\.8%60\.8\\%target ASR, compared with33\.1%33\.1\\%for the strongest published baseline and50\.7%50\.7\\%for the Teacher\. On CNN/DM, the Student reaches70\.2%70\.2\\%, compared with39\.3%39\.3\\%for the strongest published baseline\.ForgePrintalso reaches68\.3%68\.3\\%target ASR when rewriting an open model toward commercial models\. Further analyses show that transfer difficulty varies by target and domain, and thatForgePrintcontinues to outperform the baselines after controlling for rewrite quality\.

#### Contributions\.

Our main contributions are: \(i\) We propose a new model\-attribution task,*targeted fingerprint transfer*: rewriting a source model’s output so that attribution moves to a chosen target model while preserving its content\. \(ii\) We introduceForgePrint, a search\-then\-distil framework that searches for successful source\-to\-target rewrites and distils them into a lightweight one\-pass Student\. \(iii\) Across four domains,ForgePrintreaches60\.8%60\.8\\%target ASR, compared with33\.1%33\.1\\%for the strongest published baseline, and the44B Student outperforms its Teacher\. \(iv\) Further analyses show that transfer difficulty varies substantially across target models and domains, and thatForgePrintstill outperforms the baselines after controlling for rewrite quality\.

## 2Related work

#### Model attribution and provenance\.

We briefly discuss the most critical related works here\. A detailed version is given in Appendix[A](https://arxiv.org/html/2609.38831#A1)\. Classifiers trained on model\-labelled corpora can attribute text to its source model\([Uchendu et al\., 2020](https://arxiv.org/html/2609.38831#bib.bib28)\), and these signals can persist under untargeted paraphrase, translation, or summarisation\([Sun et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib12)\)\. We ask whether targeted rewriting can instead move attribution to a chosen model\. Other work identifies deployed models through active probing\([Pasquini et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib10);[Hu et al\., 2026](https://arxiv.org/html/2609.38831#bib.bib11);[Wu et al\., 2026](https://arxiv.org/html/2609.38831#bib.bib48)\)or audits APIs with statistical tests\([Gao et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib30);[Cai et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib31)\); our setting uses only the generated text\. Watermarking similarly distinguishes removing a mark from spoofing one\([Shen et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib1);[Gloaguen et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib13);[Cheng et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib47)\)\. Unlike fingerprints, however, watermarks are inserted by design and decoded with a key, while provenance systems that survive rewriting can bind identity to an execution trace\([Gao et al\., 2026](https://arxiv.org/html/2609.38831#bib.bib49)\)\. We therefore do not treat watermark attacks as baselines\.

#### Rewriting attacks and style transfer\.

Attacks on authorship classifiers\([Brennan et al\., 2012](https://arxiv.org/html/2609.38831#bib.bib26);[Shetty et al\., 2018](https://arxiv.org/html/2609.38831#bib.bib27);[Xing et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib46)\)and machine\-text detectors\([Krishna et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib6);[Sadasivan et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib29);[Nicks et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib40);[Hu et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib41)\)mainly pursue source evasion: any label other than the original counts as success\. Our attack instead targets a chosen label and relies on transfer from a surrogate to unseen evaluators\([Papernot et al\., 2017](https://arxiv.org/html/2609.38831#bib.bib23)\)\. Prompted style transfer\([Reif et al\., 2022](https://arxiv.org/html/2609.38831#bib.bib3);[Suzgun et al\., 2022](https://arxiv.org/html/2609.38831#bib.bib4)\), planning\-based transfer\([Zhang et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib2)\), and dedicated rewriters\([Horvitz et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib5)\)define style through human\-interpretable attributes such as formality\. Our target is the model\-specific fingerprint itself, specified only by the target model label\. Together with DIPPER\([Krishna et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib6)\), these methods form our six published baselines\.

## 3Targeted authorship fingerprint transfer

### 3\.1Problem formulation

Letddbe a source document and𝒴=\{M1,…,MN\}\\mathcal\{Y\}=\\\{M\_\{1\},\\ldots,M\_\{N\}\\\}the set of candidate models\. A source modelS∈𝒴S\\in\\mathcal\{Y\}produces a summaryxS=S⁡\(d\)x\_\{S\}=S\(d\)\. Given a target modelT∈𝒴T\\in\\mathcal\{Y\},T≠ST\\neq S, a rewriter takesxSx\_\{S\},SS, andTTas input and produces a rewritex^\\hat\{x\}\. At deployment, the rewriter does not access the source documentdd\.

To define attack success, letℰ\\mathcal\{E\}denote the held\-out attribution classifiers used for evaluation, and lete⁡\(x\)e\(x\)be the label predicted by evaluatoreefor textxx\. Targeted transfer succeeds for evaluatoreewhene⁡\(x^\)=Te\(\\hat\{x\}\)=T\. Our primary experiments instantiate this setting withN=4N=4and𝒴4=\{Gemini,Claude,Grok,GPT\}\\mathcal\{Y\}\_\{4\}=\\\{\\text\{Gemini\},\\text\{Claude\},\\text\{Grok\},\\text\{GPT\}\\\}\. Appendix[H\.2](https://arxiv.org/html/2609.38831#A8.SS2)further studies evaluators with additional labels beyond𝒴4\\mathcal\{Y\}\_\{4\}\.

### 3\.2Targeted transfer versus source evasion

![Refer to caption](https://arxiv.org/html/2609.38831v1/fig_two_criteria.png)Figure 2:Source evasion and targeted transfer can disagree on the same rewrite\. A GPT summary rewritten toward Gemini is classified as Grok: source evasion succeeds, but targeted transfer fails\.Figure[2](https://arxiv.org/html/2609.38831#S3.F2)illustrates the difference between targeted transfer and source evasion\. For each test document, source–target pair, and evaluatore∈ℰe\\in\\mathcal\{E\}, targeted transfer succeeds whene⁡\(x^\)=Te\(\\hat\{x\}\)=T, while source evasion succeeds whene⁡\(x^\)≠Se\(\\hat\{x\}\)\\neq S\. We measure these two objectives using target attack success rate \(ASR\) and source\-evasion rate \(SrcEv\), respectively:

ASR\\displaystyle\\mathrm\{ASR\}=Pr\[e\(x^\)=T\],\\displaystyle=\\Pr\\\!\\left\[e\(\\hat\{x\}\)=T\\right\],\(1\)SrcEv\\displaystyle\\mathrm\{SrcEv\}=Pr\[e\(x^\)≠S\]\.\\displaystyle=\\Pr\\\!\\left\[e\(\\hat\{x\}\)\\neq S\\right\]\.\(2\)
The probabilities are empirical averages over the 12 ordered source–target pairs, test documents, and evaluators inℰ\\mathcal\{E\}\. Thus, source evasion only requires the prediction to leave the source, whereas targeted transfer requires it to reach the chosen target\. We report both metrics throughout the paper\.

### 3\.3Threat model and evaluation separation

Evaluation uses only the returned text, without server\-side logs, signed model identity, or other provenance records\. The attacker has its own model\-labeled corpus, including the corresponding source documents, and trains a surrogate classifier on these data\. The attacker never queries the held\-out evaluators and has no access to their parameters or training examples\. At deployment, the rewriter receives onlyxSx\_\{S\},SS, andTT; it does not access the source documentdd\.

We treat this as a grey\-box setting\. The attacker knows the source and target model identities considered by the task, which is necessary for choosing a target in a targeted attack, but it does not know the evaluators’ exact label space\. In our experiments, the surrogate is trained with five labels, including Human, whereas the primary evaluators use the four LLM labels in𝒴4\\mathcal\{Y\}\_\{4\}\. We additionally evaluate settings in which the held\-out evaluators contain extra labels\. Thus, the attack does not rely on knowing the evaluator’s exact set of classes, architecture, parameters, or training data\.

To separate attack development from evaluation, we construct two disjoint corpora\.*Corpus A*is used to develop the attack and train the surrogate, while*Corpus B*is used only to train the held\-out evaluators and evaluate the attack\. The two corpora cover the same source and target LLMs and the same domains, but share no documents or classifier training examples\. Moreover, we use domain\-matched evaluators to avoid confounding transfer success with the loss of attribution accuracy caused by domain shift\([Yuan and Zhang, 2025](https://arxiv.org/html/2609.38831#bib.bib22)\)\.

Finally, the rewrite must preserve the information in the source summary\. Otherwise, higher target attribution could simply result from changing the answer itself\. We therefore incorporate factuality into Student training in Section[4\.4](https://arxiv.org/html/2609.38831#S4.SS4)and evaluate rewrite quality separately\.

## 4ForgePrint

![Refer to caption](https://arxiv.org/html/2609.38831v1/fig_n-method.png)Figure 3:ForgePrintfollows a search\-then\-distil design\. \(a\) The offline search builds and filters source→\\totarget operators\.\(b\)The Teacher combines these operators with ICL examples to generate candidate rewrites, which provide SFT targets and DPO preference pairs\.\(c\)These selected rewrites are distilled into a Student with SFT, DPO, and GRPO on its own samples, then deployed in one pass without the bank or surrogate\. Table[1](https://arxiv.org/html/2609.38831#S4.T1)summarizes the stages\.Targeted rewrite supervision is not directly available, soForgePrintfirst constructs it offline\. As shown in Figure[3](https://arxiv.org/html/2609.38831#S4.F3)\(a\), for each source–target path, we build a bank of rewrite operators\. The Teacher combines these operators with retrieved ICL examples\([Dong et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib16)\)to generate candidate rewrites, and the surrogate selects SFT targets\([Ouyang et al\., 2022](https://arxiv.org/html/2609.38831#bib.bib24)\)and DPO preference pairs\([Rafailov et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib7)\)\. The Student learns from this supervision with SFT and DPO, followed by GRPO\([Shao et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib8)\)using factuality and target guidance\. At deployment, the Student receives onlyxSx\_\{S\},SS, andTTand produces one rewrite without the operator bank or surrogate\.

### 4\.1Path\-specific operator bank

For each directed pathS→TS\\\!\\to\\\!T, we build a frozen operator bankℬ\[S→T\]\\mathcal\{B\}\[S\\\!\\to\\\!T\]\. The bank contains natural\-language instructions thatsuppresssource\-associated patterns,injecttarget\-associated patterns, orrestructuresentence and discourse form\. Facts, entities, numbers, and statement polarity are recorded separately as preservation constraints\. For example, a GPT→\\toGemini operator adds demonstratives such as “this” or “also”, while another splits long sentences into shorter ones\.

We induce candidate operators from paired Corpus A summaries of the same documents written bySSandTT\. Each candidate is then evaluated on a separate Corpus A development set using the surrogate target margin

m⁡\(c\)=pg​\(T∣c\)−maxy≠T⁡pg​\(y∣c\),m\(c\)=p\_\{g\}\(T\\mid c\)\-\\max\_\{y\\neq T\}p\_\{g\}\(y\\mid c\),\(3\)wherepg​\(y∣c\)p\_\{g\}\(y\\mid c\)is the surrogate probability for labelyy\. We retain an operator only if it increases the average target margin over leaving the source summary unchanged\.

The banks are induced on CNN/DM and reused unchanged on ArXiv, SAMSum, and WikiHow, allowing us to test whether operators learned from news transfer across domains\. Implementation details, bank statistics, and complete operator examples are provided in Appendices[C\.1](https://arxiv.org/html/2609.38831#A3.SS1),[C\.3](https://arxiv.org/html/2609.38831#A3.SS3), and[I](https://arxiv.org/html/2609.38831#A9)\.

### 4\.2ForgePrintTeacher: candidate generation and selection

For each source–target path, we set aside part of the Corpus A data as a dedicated ICL pool\. GivenxSx\_\{S\},SS, andTT, the Teacher retrieves examples from the same path by similarity toxSx\_\{S\}\. A frozen rewriter then receivesxSx\_\{S\}, the path\-specific operator bankℬ\[S→T\]\\mathcal\{B\}\[S\\\!\\to\\\!T\], and the retrieved examples\.

The Teacher generates several candidates with different edit strengths, from light edits to larger structural changes\. It ranks them using the target marginm⁡\(c\)m\(c\)from Equation[3](https://arxiv.org/html/2609.38831#S4.E3)\. The highest\-margin candidate becomes the SFT targetx^\\hat\{x\}, while the highest\- and lowest\-margin candidates form the DPO preference pair\(x\+,x−\)\(x^\{\+\},x^\{\-\}\)\. The margin provides a graded measure of how strongly each candidate moves toward the chosen target\. Retrieval, candidate\-generation, and prompting details are provided in Appendix[C\.1](https://arxiv.org/html/2609.38831#A3.SS1)\. Section[6\.2](https://arxiv.org/html/2609.38831#S6.SS2)ablates the Teacher components\.

Table 1:Inputs, outputs, and training signals for the stages in Figure[3](https://arxiv.org/html/2609.38831#S4.F3)\.ggdenotes the attacker’s surrogate, andJJis a frozen LLM judge for factuality\.StageInputOutputSignal\(a\) Operator bankpairedS/TS/Tsummariesℬ\[S→T\]\\mathcal\{B\}\[S\\\!\\to\\\!T\]gg: filter rules\(b\) TeacherxS,S,Tx\_\{S\},S,T; bank; ICL examplesx^\\hat\{x\};\(x\+,x−\)\(x^\{\+\},x^\{\-\}\)gg: select rewrite/pair\(c\) Student: SFT→\\toDPOTeacherx^\\hat\{x\};\(x\+,x−\)\(x^\{\+\},x^\{\-\}\)student policyTeacher supervision\(c\) Student: GRPOstudent samplesrefined policyJJ: factuality;gg: target\(c\) Student: deploymentxS,S,Tx\_\{S\},S,Tx^\\hat\{x\}–
### 4\.3ForgePrintStudent: training with SFT and DPO

The Teacher generates multiple candidates and uses the surrogate to select among them for each input\. We use this supervision to train a Student that produces the rewrite directly\. Letz=\(xS,S,T\)z=\(x\_\{S\},S,T\)denote the Student input andπθ\(⋅∣z\)\\pi\_\{\\theta\}\(\\cdot\\mid z\)the Student policy\.

We first use the Teacher\-selected rewritex^\\hat\{x\}as the target for supervised fine\-tuning:

ℒSFT​\(θ\)=−𝔼\(z,x^\)​\[log⁡πθ​\(x^∣z\)\]\.\\mathcal\{L\}\_\{\\mathrm\{SFT\}\}\(\\theta\)=\-\\mathbb\{E\}\_\{\(z,\\hat\{x\}\)\}\\left\[\\log\\pi\_\{\\theta\}\(\\hat\{x\}\\mid z\)\\right\]\.\(4\)
We then apply direct preference optimization \(DPO\)\([Rafailov et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib7)\)\. For each Teacher call, the highest\-margin candidate is treated as the preferred rewrite and the lowest\-margin candidate as the rejected rewrite:

x\+=arg⁡maxi⁡m⁡\(ci\),x−=arg⁡mini⁡m⁡\(ci\)\.x^\{\+\}=\\arg\\max\_\{i\}m\(c\_\{i\}\),\\qquad x^\{\-\}=\\arg\\min\_\{i\}m\(c\_\{i\}\)\.
To simplify the DPO objective, define

qθ​\(x∣z\)=log⁡πθ​\(x∣z\)πSFT​\(x∣z\),q\_\{\\theta\}\(x\\mid z\)=\\log\\frac\{\\pi\_\{\\theta\}\(x\\mid z\)\}\{\\pi\_\{\\mathrm\{SFT\}\}\(x\\mid z\)\},whereπSFT\\pi\_\{\\mathrm\{SFT\}\}is the frozen SFT checkpoint\. The DPO objective is

ℒDPO​\(θ\)=−𝔼\(z,x\+,x−\)​\[log⁡σ⁡\(β⁡\[qθ​\(x\+∣z\)−qθ​\(x−∣z\)\]\)\]\.\\mathcal\{L\}\_\{\\mathrm\{DPO\}\}\(\\theta\)=\-\\mathbb\{E\}\_\{\(z,x^\{\+\},x^\{\-\}\)\}\\left\[\\log\\sigma\\\!\\left\(\\beta\\left\[q\_\{\\theta\}\(x^\{\+\}\\mid z\)\-q\_\{\\theta\}\(x^\{\-\}\\mid z\)\\right\]\\right\)\\right\]\.\(5\)Here,σ\\sigmais the logistic function andβ\\betacontrols the preference strength\.

The surrogate is used to construct the Teacher supervision and the preference pairs, but it is not queried by the deployed Student\. At deployment, the Student receives onlyxSx\_\{S\},SS, andTTand generates a single rewrite without the operator bank, ICL examples, or surrogate\.

### 4\.4ForgePrintStudent: Factuality\-aware GRPO refinement

Optimizing only for target margin can encourage aggressive rewrites that alter the source content\. We therefore refine the Student on its own samples using both factuality and target guidance\.

A frozen copy of the Teacher rewriter serves as a factuality judgeJJ\. For each candidatecc, it reads the source document, original summary, and candidate, and assigns one of three ordered factuality levels,τ⁡\(c\)∈\{0,1,2\}\\tau\(c\)\\in\\\{0,1,2\\\}, with larger values indicating higher factuality\. The surrogate supplies the target marginm⁡\(c\)m\(c\)from Equation[3](https://arxiv.org/html/2609.38831#S4.E3)\.

For each group ofGGStudent samples, we rank candidates first by factuality and then by target margin:

ri=rank↓⁡\(τ⁡\(ci\),m⁡\(ci\)\),Ai=sri,r\_\{i\}=\\operatorname\{rank\}\_\{\\downarrow\}\\bigl\(\\tau\(c\_\{i\}\),m\(c\_\{i\}\)\\bigr\),\\qquad A\_\{i\}=s\_\{r\_\{i\}\},\(6\)wheresris\_\{r\_\{i\}\}maps each rank to a fixed group\-relative advantage\. A higher factuality level always ranks first, while target margin breaks ties within the same level\.

Starting from the DPO checkpoint, we optimize

ℒGRPO\(θ\)=𝔼z\[−1G∑i=1GAilogπθ\(ci∣z\)\+βKLDKL\(πθ\(⋅∣z\)∥πDPO\(⋅∣z\)\)\]\.\\mathcal\{L\}\_\{\\mathrm\{GRPO\}\}\(\\theta\)=\\mathbb\{E\}\_\{z\}\\left\[\-\\frac\{1\}\{G\}\\sum\_\{i=1\}^\{G\}A\_\{i\}\\log\\pi\_\{\\theta\}\(c\_\{i\}\\mid z\)\+\\beta\_\{\\mathrm\{KL\}\}D\_\{\\mathrm\{KL\}\}\\\!\\left\(\\pi\_\{\\theta\}\(\\cdot\\mid z\)\\,\\\|\\,\\pi\_\{\\mathrm\{DPO\}\}\(\\cdot\\mid z\)\\right\)\\right\]\.\(7\)The DPO checkpoint is used as the KL reference\. The factuality judge and surrogate are used only during training\. Implementation details, including the rank scores and GRPO hyperparameters, are provided in Appendix[C\.1](https://arxiv.org/html/2609.38831#A3.SS1)\.

## 5Experimental setup

#### Data and models\.

We build our corpus from CNN/DailyMail\([Hermann et al\., 2015](https://arxiv.org/html/2609.38831#bib.bib32)\), ArXiv\([Cohan et al\., 2018](https://arxiv.org/html/2609.38831#bib.bib33)\), SAMSum\([Gliwa et al\., 2019](https://arxiv.org/html/2609.38831#bib.bib34)\), and WikiHow\([Koupaee and Wang, 2018](https://arxiv.org/html/2609.38831#bib.bib35)\)\. For each document, we query the official Gemini\([Google, 2026](https://arxiv.org/html/2609.38831#bib.bib18)\), Claude\([Anthropic, 2026a](https://arxiv.org/html/2609.38831#bib.bib19)\), Grok\([xAI, 2026](https://arxiv.org/html/2609.38831#bib.bib20)\), and GPT\([OpenAI, 2026](https://arxiv.org/html/2609.38831#bib.bib21)\)APIs with the same summarization prompt and decoding settings, yielding four model\-labeled summaries of the same content\. Each domain contains two disjoint corpora, each with 800 training, 200 development, and 200 test documents\. We also retain the original human reference summary for each document\. Corpus A is used for attack development and Student training; Corpus B is reserved for the held\-out evaluators and final evaluation\. The main evaluation uses the 200 Corpus B test documents and all 12 directed source–target paths, giving 2,400 instances per domain except CNN/DailyMail, which has 2,397 after three missing generations\. The Teacher uses Gemma\-4\-26B\-A4B, the Student uses Gemma\-3\-4B, and the attacker\-side surrogate is a five\-class RoBERTa\([Liu et al\., 2019](https://arxiv.org/html/2609.38831#bib.bib36)\)trained on Corpus A, with Human reference summaries as the fifth class\. Exact model versions and generation settings are given in Appendix[C\.1](https://arxiv.org/html/2609.38831#A3.SS1)\.

#### Held\-out evaluators\.

Our primary evaluation uses four attribution models trained on Corpus B: RoBERTa, DeBERTa\([He et al\., 2021](https://arxiv.org/html/2609.38831#bib.bib37)\), GPT\-2\([Radford et al\., 2019](https://arxiv.org/html/2609.38831#bib.bib38)\), and a TF\-IDF linear classifier\. Each predicts one of the four labels in𝒴4\\mathcal\{Y\}\_\{4\}, and we train a separate evaluator suite for each document domain\. The attack is scored only by the suite from the same domain\.

We call this setting*4\-LLM*\.Mean4\\mathrm\{Mean\}\_\{4\}averages target ASR over the four evaluator architectures, andMacro4\\mathrm\{Macro\}\_\{4\}further averages across domains\. The evaluator suites achieve85\.9%85\.9\\%average attribution accuracy on unmodified summaries \(Table[6](https://arxiv.org/html/2609.38831#A2.T6)\)\. Additional analyses use five\-class suites that add Human, Gemma\-4\-26B, or Qwen3\.5\-9B as an extra label and can be found in Appendix[H](https://arxiv.org/html/2609.38831#A8)\.

#### Baselines\.

We compare against six published rewriting baselines\. Three follow the prompting setups of[Reif et al\. \(2022\)](https://arxiv.org/html/2609.38831#bib.bib3):*zero\-shot TST*,*5\-shot FC*, and*augmented zero\-shot*\.*Planner TST*reconstructs the plan\-based single\-step ablation of[Zhang et al\. \(2025\)](https://arxiv.org/html/2609.38831#bib.bib2)\. We also include two released rewriter models:*TinyStyler*\([Horvitz et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib5)\)and*DIPPER*\([Krishna et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib6)\)\. DIPPER does not receive a target identity and is therefore an untargeted paraphrasing reference\.

We add two RL controls on the same44B backbone and GRPO setup as the Student, without Teacher supervision\.*Style\-reward RL*, adapted from[Gong et al\. \(2019\)](https://arxiv.org/html/2609.38831#bib.bib14), optimizes the surrogate target margin directly\.*AuthorMist\-T*adapts the detector\-guided training of[David and Gervais \(2025\)](https://arxiv.org/html/2609.38831#bib.bib15)to targeted attribution\. More detailed implementation settings and deviations from the original methods can be found in Appendix[C\.2](https://arxiv.org/html/2609.38831#A3.SS2)\.

#### Metrics\.

We report target attack success rate \(ASR\) and source\-evasion rate \(SrcEv\) for targeted transfer and source evasion, respectively, as defined in Eqs\.[1](https://arxiv.org/html/2609.38831#S3.E1)–[2](https://arxiv.org/html/2609.38831#S3.E2)\. We evaluate rewrite faithfulness with AlignScore\([Zha et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib39)\)and MiniCheck\([Tang et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib17)\)\. AlignScore measures alignment between the rewrite and source document, while MiniCheck measures whether claims in the rewrite are supported by the source\. Table[2](https://arxiv.org/html/2609.38831#S5.T2)reports AlignScore, and Section[6\.3](https://arxiv.org/html/2609.38831#S6.SS3)uses both metrics to control for rewrite quality\. Failed generations count as attack failures and are not replaced by the source summary\. Table[2](https://arxiv.org/html/2609.38831#S5.T2)reports 95% confidence half\-widths obtained by document\-clustered bootstrap resampling over the test set, using documents as the resampling unit\.

Table 2:Main results on targeted fingerprint transfer across four domains\. SrcEv and ASR denote source evasion rate and target attack success rate, and Align is AlignScore against the source document\. Macro4averages the four domains; subscripts give document\-clustered 95% confidence half\-widths\. The99B backbone control is in Appendix[D\.1](https://arxiv.org/html/2609.38831#A4.SS1)\.

## 6Results

### 6\.1Targeted fingerprint transfer attack

Table[2](https://arxiv.org/html/2609.38831#S5.T2)shows the main result\. Against evaluators that the attack never queries,ForgePrint\-4B reaches70\.2%70\.2\\%target ASR on CNN/DM, compared with54\.1%54\.1\\%for the Teacher and39\.3%39\.3\\%for the strongest published baseline\. The same ordering holds across all four domains:ForgePrint\-4B reaches60\.8%60\.8\\%Macro4ASR, compared with33\.1%33\.1\\%for the strongest published baseline\. It also holds across all four evaluator architectures\. Appendix[D\.3](https://arxiv.org/html/2609.38831#A4.SS3)gives the per\-evaluator results\.

Source evasion gives a much less separated view of the same methods\. Across Table[2](https://arxiv.org/html/2609.38831#S5.T2), Macro4source evasion ranges from61\.3%61\.3\\%to85\.7%85\.7\\%, while target ASR ranges from20\.4%20\.4\\%to60\.8%60\.8\\%\. Planner TST andForgePrint\-4B differ by only10\.510\.5points in source evasion \(75\.2%75\.2\\%vs\.85\.7%85\.7\\%\), but by27\.727\.7points in target ASR \(33\.1%33\.1\\%vs\.60\.8%60\.8\\%\)\.

Figure[4](https://arxiv.org/html/2609.38831#S6.F4)provides a representation\-space view of this targeted behavior using a two\-dimensional PCA projection through a held\-out GPT\-2 evaluator\. Successful rewrites tend to move from the source region toward the region of the chosen target model\. This behavior becomes more pronounced from augmented zero\-shot to theForgePrintTeacher andForgePrint\-4B, with the share classified as the intended target increasing from44%44\\%to66%66\\%and78%78\\%\. The visualization therefore shows directed movement toward the chosen target representation, beyond simply leaving the source region\. Appendix[D\.4](https://arxiv.org/html/2609.38831#A4.SS4)provides the full analysis\.

Figure 4:Representation\-space view of targeted transfer on CNN/DM using a held\-out GPT\-2 evaluator\. PCA is fitted on representations of unmodified training summaries\. Each line connects an original summary to its rewrite, and labeled circles mark the centers of clean summaries from the four models\. Colored rewrites are classified as the intended target; gray rewrites are not\.
### 6\.2Ablation study

Table[3](https://arxiv.org/html/2609.38831#S6.T3)\(a\) examines theForgePrintTeacher\. Removing the path\-specific operators and keeping only retrieved source–target examples reduces target ASR from54\.1%54\.1\\%to35\.8%35\.8\\%\. In contrast, using the operators without retrieved examples still reaches51\.4%51\.4\\%\. Candidate selection also matters: choosing one of the five generated rewrites at random gives48\.2%48\.2\\%ASR, while the full Teacher selects the candidate with the highest surrogate target margin and reaches54\.1%54\.1\\%\. Additional sensitivity analysis shows that a single\-candidate version of the full Teacher reaches53\.7%53\.7\\%, suggesting that the Teacher’s gain does not mainly come from generating more candidates \(Appendix[E\.1](https://arxiv.org/html/2609.38831#A5.SS1)\)\.

Table 3:Ablation study ofForgePrinton CNN/DM\. Red numbers show drops from the shaded reference rows\.\(a\) Teacher components

\(b\) Student training ablations

Table[3](https://arxiv.org/html/2609.38831#S6.T3)\(b\) follows theForgePrintStudent training stages\. SFT first teachesForgePrint\-4B to imitate the Teacher’s selected rewrites and reaches45\.3%45\.3\\%target ASR\. DPO then uses the highest\- and lowest\-margin Teacher candidates as the preferred and rejected responses, raising ASR to63\.9%63\.9\\%\. GRPO further trains the Student on its own generations, ranking candidates first by factuality and then by target margin\. The factuality\-first ranking reaches70\.2%70\.2\\%held\-out ASR, compared with66\.5%66\.5\\%for the strongest margin\-only variant, while AlignScore remains nearly unchanged\. Appendix[E](https://arxiv.org/html/2609.38831#A5)analyzes this difference in more detail\. Finally, replacing Teacher\-generated supervision with summaries directly produced by the source and target models gives only46\.5%46\.5\\%ASR and substantially lower rewrite quality\.

Table 4:Raw and faithfulness\-adjusted Macro4target ASR across four domains\. Adjusted results use AlignScore or MiniCheck to compare methods under matched rewrite faithfulness\. Representative baselines from Table[2](https://arxiv.org/html/2609.38831#S5.T2)are included\.
### 6\.3Attack success rate vs\. rewrite quality

One concern is that higher target ASR may come from less faithful rewrites\. As shown in Table[4](https://arxiv.org/html/2609.38831#S6.T4),ForgePrint\-4B reaches60\.8%60\.8\\%Macro4target ASR, compared with30\.9%30\.9\\%for 5\-shot FC and33\.1%33\.1\\%for Planner TST\. Its AlignScore is nearly identical to 5\-shot FC \(0\.6590\.659vs\.0\.6580\.658\) and close to Planner TST \(0\.6670\.667\), while its MiniCheck score is lower \(0\.6230\.623vs\.0\.6600\.660and0\.6450\.645\)\. We therefore compare the methods after matching rewrite faithfulness\.

We compute faithfulness\-adjusted ASR by placing all methods’ rewrites into the same AlignScore or MiniCheck ranges within each domain, computing ASR in each range, and aggregating with the same range weights\.ForgePrint\-4B reaches60\.6%60\.6\\%Align\-adjusted ASR and61\.6%61\.6\\%MiniCheck\-adjusted ASR, compared with33\.1%33\.1\\%and33\.3%33\.3\\%for Planner TST\. The gaps remain27\.527\.5points \(95%95\\%CI:26\.726\.7–28\.428\.4\) and28\.328\.3points \(27\.527\.5–29\.129\.1\), respectively\.

Although the Teacher has higher AlignScore \(0\.7170\.717\) and MiniCheck \(0\.6670\.667\),ForgePrint\-4B still achieves11\.011\.0and10\.810\.8points higher adjusted ASR under the two metrics\. Additional checks with an independent LLM judge and controls for rewrite length and added content are provided in Appendices[D\.5](https://arxiv.org/html/2609.38831#A4.SS5)and[D\.6](https://arxiv.org/html/2609.38831#A4.SS6)\.

### 6\.4Targeted transfer from an open model to commercial models

Table 5:We rewrite CNN/DM summaries from Gemma\-4\-26B\-A4B toward four commercial models \(Claude, GPT, Gemini, and Grok\), under a five\-class attribution setting that also includes Gemma\. The two adapted students use different backbones and reach68\.3%68\.3\\%and66\.7%66\.7\\%target ASR\. For compactness, Gemma\-4\-26B in the table denotes Gemma\-4\-26B\-A4B\.
![Refer to caption](https://arxiv.org/html/2609.38831v1/fig_target_domain.png)Figure 5:Target ASR \(%\) ofForgePrint\-4B across four domains, averaged over the three source models for each target\. Claude is the hardest target on average, while target difficulty also varies across domains\. Appendix[I](https://arxiv.org/html/2609.38831#A9)provides failure analysis on ArXiv\.

We next test whether targeted transfer also works when the source is an open model\. Gemma\-4\-26B produces the original summaries, and the rewrite is targeted toward one of four commercial models\. The five\-class evaluator also includes Gemma, so success requires moving the prediction from the true source to the chosen commercial target\.

We further trainForgePrint\-4B on the four Gemma→\\rightarrowLLM paths using DPO\. Because both the source model and the 4B Student are from the Gemma family, we also train a Qwen3\.5\-9B Student as a different\-backbone control\. The two Students reach68\.3%68\.3\\%and66\.7%66\.7\\%target ASR, respectively, compared with34\.8%34\.8\\%for the Teacher and14\.7%14\.7\\%for augmented zero\-shot \(Table[5](https://arxiv.org/html/2609.38831#S6.F5)\)\. This shows that open\-to\-commercial transfer is not specific to a Gemma\-family Student\. The 4B Student reaches an AlignScore of0\.5500\.550\. Moreover, the rewrite adds only a small inference cost relative to generating the Gemma summaries\. Appendix[F\.1](https://arxiv.org/html/2609.38831#A6.SS1)gives the full cost analysis\.

### 6\.5Transfer difficulty depends on the target and domain

Our experimental results show that transfer difficulty depends much more on the target model than on the source model, but the difficulty of a target can change substantially across domains\. As shown in Figure[5](https://arxiv.org/html/2609.38831#S6.F5), Claude is the hardest target on average, with39\.7%39\.7\\%target ASR compared with64\.164\.1–70\.3%70\.3\\%for the other three targets\. The difference is also strongly domain\-dependent: transfer to Claude ranges from only5%5\\%on ArXiv to70%70\\%on CNN/DM\.

We further analyze the1212source–target paths across the four domains\. In a descriptive sum\-of\-squares decomposition over the4848path–domain cell means, the source–target path accounts for32\.6%32\.6\\%of the variation in ASR, the domain for14\.0%14\.0\\%, and the path–domain interaction for53\.4%53\.4\\%\. Within the path effect, the target model explains82\.6%82\.6\\%, leaving only17\.4%17\.4\\%to the source model \(Appendix[H\.1](https://arxiv.org/html/2609.38831#A8.SS1)\)\. These results suggest that which model the attack targets matters more than where the rewrite starts, while domain can substantially change the difficulty of that target\.

### 6\.6Targeted transfer under expanded evaluator label sets

We further test how targeted transfer changes when the evaluator includes an additional label\. Using the same saved CNN/DM rewrites, we construct three five\-class evaluator suites that differ only in the added class: Human, Gemma, or Qwen3\.5\-9B\. TheForgePrintTeacher reaches52\.7%52\.7\\%,27\.4%27\.4\\%, and31\.2%31\.2\\%target ASR under Human\-5, Gemma\-5, and Qwen\-5, respectively, whileForgePrint\-4B reaches70\.4%70\.4\\%,41\.4%41\.4\\%, and48\.0%48\.0\\%\(Appendix[H\.2](https://arxiv.org/html/2609.38831#A8.SS2)\)\. As a result, adding an open\-model class makes the original attack more difficult\. We then test whether the attacker can adapt to the added source class\. As shown in Table[5](https://arxiv.org/html/2609.38831#S6.F5), further trainingForgePrint\-4B on Gemma\-source paths raises target ASR to68\.3%68\.3\\%on Gemma→\\rightarrowcommercial transfer under the Gemma\-5 evaluator\. The adapted Student also retains65\.4%65\.4\\%ASR on the original 12 paths under the original 4\-LLM protocol\. Overall, these results show that the attacker can adapt to the newly introduced source class while largely preserving performance on the original paths\.

## 7Conclusion

In this work, we formulate a new model\-attribution task,*targeted fingerprint transfer*, and study whether rewriting can redirect attribution from a source model to a chosen target while preserving its content\. We introduceForgePrint, a search\-then\-distil framework that constructs targeted rewrite supervision before deployment and distils it into a one\-pass44B Student model\. Against held\-out evaluators, the Student achieves4747–70%70\\%target ASR across four domains and reaches68\.3%68\.3\\%when transferring summaries from an open model toward commercial models\. Transfer strength varies substantially with the target, domain, and evaluator label set, while source evasion alone can hide these differences\. These results show that high attribution accuracy on unmodified text does not guarantee that attribution remains tied to the source model after targeted rewriting\.

### AI Use Statement

Large language models are part of the experimental setup and methodology of this work\. Commercial LLM APIs are used to generate the model\-labeled summaries studied in our experiments, and theForgePrintTeacher generates rewrite supervision for Student training\. These uses are described as part of the method and experimental setup\.

Separately, we used generative AI tools during manuscript preparation to improve clarity and readability, including proofreading, grammatical correction, and stylistic refinement\. These tools were not used as a source of scientific evidence or reported experimental results\.

### Ethics Statement

This work studies a dual\-use capability: targeted rewriting can weaken text\-based model attribution and could be misused to disguise backend substitution or misrepresent the origin of model outputs\. Our experiments are conducted in a controlled setting using generated summaries and offline attribution classifiers\. We query the commercial APIs only to generate summaries, which is ordinary use of those services, and we do not test impersonation against any deployed third\-party service or provider infrastructure\.

The source documents come from four public research datasets and are used under their original terms\. Each document’s human reference summary is used only as an additional classifier label \(the surrogate and the Human\-5 suites\); we collect no new human data and run no human subjects study\.

We limit the release of artifacts that directly enable the attack\. The training and evaluation code, the evaluator checkpoints, the frozen evaluation protocol, and the scoring scripts will be released publicly at[https://github\.com/HaohanYuan01/ForgePrint](https://github.com/HaohanYuan01/ForgePrint)to support independent evaluation and defensive research\. The operator banks, the saved rewrites, and the trainedForgePrint\-4B Student adapters will instead be released on request to named researchers, subject to review by the authors’ institution, under a use agreement limited to defense evaluation; the repository states the request procedure\.

Our results also show a limitation of relying on writing style alone for model provenance: high attribution accuracy on unmodified text does not ensure that attribution remains tied to the source after targeted rewriting\. Finally, the cost analysis in Appendix[F\.1](https://arxiv.org/html/2609.38831#A6.SS1)uses published prices to estimate feasibility; it provides no evidence that any model provider engages in substitution\.

### Reproducibility Statement

All headline results follow the fixed evaluation protocol in Appendix[B\.1](https://arxiv.org/html/2609.38831#A2.SS1), using the Corpus B test sets, seed4242, the same1212directed source–target paths, and domain\-matched 4\-LLM evaluators that are disjoint from the attacker’s surrogate\. Failed generations are counted as attack failures and are never replaced by the source summary\. Appendix[C\.1](https://arxiv.org/html/2609.38831#A3.SS1)gives the model versions, decoding settings, and training hyperparameters for every stage\.

Each configuration is trained once, so the confidence intervals we report cover sampling over test documents and not variation across training runs\.

We will publicly release the code, the evaluator checkpoints, the evaluation protocol, the scoring scripts, and the per\-evaluator predictions at[https://github\.com/HaohanYuan01/ForgePrint](https://github.com/HaohanYuan01/ForgePrint), allowing the reported results to be independently audited and recomputed without regenerating model outputs\. The operator banks, the saved rewrites, and the trained Student adapters will be released on request to named researchers, subject to review by the authors’ institution, under a use agreement limited to defense evaluation, as described in the Ethics Statement\.

## References

- Anthropic \(2026a\)AnthropicClaude api documentation\.Note:[https://docs\.anthropic\.com/](https://docs.anthropic.com/)Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px1.p1.1)\.
- Anthropic \(2026b\)AnthropicCountering misuse of AI: september 2026\.Note:[https://www\.anthropic\.com/threat\-intelligence\-report\-september\-2026](https://www.anthropic.com/threat-intelligence-report-september-2026)Threat intelligence reportCited by:[§1](https://arxiv.org/html/2609.38831#S1.p1.1)\.
- Brennanet al\.\(2012\)M\. Brennan, S\. Afroz, and R\. GreenstadtAdversarial stylometry: circumventing authorship recognition to preserve privacy and anonymity\.ACM Transactions on Information and System Security15\(3\)\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1)\.
- Caiet al\.\(2025\)W\. Cai, T\. Shi, X\. Zhao, and D\. SongAre you getting what you pay for? auditing model substitution in LLM APIs\.arXiv preprint arXiv:2504\.04715\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2609.38831#S1.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Chenget al\.\(2025\)Y\. Cheng, H\. Guo, Y\. Li, and L\. SigalRevealing weaknesses in text watermarking through self\-information rewrite attacks\.InProceedings of the 42nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.267,pp\. 9982–10009\.Cited by:[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Cohanet al\.\(2018\)A\. Cohan, F\. Dernoncourt, D\. S\. Kim, T\. Bui, S\. Kim, W\. Chang, and N\. GoharianA discourse\-aware attention model for abstractive summarization of long documents\.InProceedings of NAACL\-HLT,Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px1.p1.1)\.
- Cuiet al\.\(2026\)Y\. Cui, Y\. Li, T\. Jiang, and X\. YiConstruction\-driven injection: linguistically\-grounded edit\-based code\-mixing fingerprints for large language models\.arXiv preprint arXiv:2607\.25633\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1)\.
- David and Gervais \(2025\)I\. David and A\. GervaisAuthormist: evading ai text detectors with reinforcement learning\.arXiv preprint arXiv:2503\.08716\.Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px3.p2.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.21.1)\.
- Donget al\.\(2024\)Q\. Dong, L\. Li, D\. Dai, C\. Zheng, J\. Ma, R\. Li, H\. Xia, J\. Xu, Z\. Wu, B\. Chang,et al\.A survey on in\-context learning\.InProceedings of the 2024 conference on empirical methods in natural language processing,pp\. 1107–1128\.Cited by:[§4](https://arxiv.org/html/2609.38831#S4.p1.1)\.
- Duganet al\.\(2024\)L\. Dugan, A\. Hwang, F\. Trhlík, J\. M\. Ludan, A\. Zhu, H\. Xu, D\. Ippolito, and C\. Callison\-BurchRAID: a shared benchmark for robust evaluation of machine\-generated text detectors\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1)\.
- Gaoet al\.\(2025\)I\. Gao, P\. Liang, and C\. GuestrinModel equality testing: which model is this API serving?\.InInternational Conference on Learning Representations,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2609.38831#S1.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Gaoet al\.\(2026\)Z\. Gao, X\. Li, X\. Feng, J\. Jiang, Y\. Song, Y\. Sui, Z\. Xing, and L\. ZhuTRACE: a two\-channel robust attribution watermark via complementary embeddings for LLM\-agent trajectories\.arXiv preprint arXiv:2607\.08400\.Cited by:[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Gliwaet al\.\(2019\)B\. Gliwa, I\. Mochol, M\. Biesek, and A\. WawerSAMSum corpus: a human\-annotated dialogue dataset for abstractive summarization\.InProceedings of the 2nd Workshop on New Frontiers in Summarization,Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px1.p1.1)\.
- Gloaguenet al\.\(2025\)T\. Gloaguen, N\. Jovanovic, R\. Staab, and M\. VechevDiscovering spoofing attempts on language model watermarks\.InInternational Conference on Machine Learning,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Gonget al\.\(2019\)H\. Gong, S\. Bhat, L\. Wu, J\. Xiong, and W\. HwuReinforcement learning based text style transfer without parallel training corpus\.InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics \(NAACL\-HLT\),Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px3.p2.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.22.1)\.
- Google \(2026\)GoogleGemini api: gemini 2\.5 flash\-lite\.Note:[https://ai\.google\.dev/gemini\-api/docs/models/gemini\-2\.5\-flash\-lite](https://ai.google.dev/gemini-api/docs/models/gemini-2.5-flash-lite)Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px1.p1.1)\.
- Heet al\.\(2021\)P\. He, X\. Liu, J\. Gao, and W\. ChenDeBERTa: decoding\-enhanced BERT with disentangled attention\.InInternational Conference on Learning Representations,Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px2.p1.1)\.
- Hermannet al\.\(2015\)K\. M\. Hermann, T\. Kočiský, E\. Grefenstette, L\. Espeholt, W\. Kay, M\. Suleyman, and P\. BlunsomTeaching machines to read and comprehend\.InAdvances in Neural Information Processing Systems,Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px1.p1.1)\.
- Horvitzet al\.\(2024\)Z\. Horvitz, A\. Patel, K\. Singh, C\. Callison\-Burch, K\. McKeown, and Z\. YuTinyStyler: efficient few\-shot text style transfer with authorship embeddings\.InFindings of the Association for Computational Linguistics: EMNLP 2024,pp\. 13376–13390\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px3.p1.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.6.1)\.
- Huet al\.\(2023\)X\. Hu, P\. Chen, and T\. HoRADAR: robust AI\-text detection via adversarial learning\.InAdvances in Neural Information Processing Systems,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1)\.
- Huet al\.\(2026\)Y\. Hu, Z\. Jiang, M\. Li, O\. Ahmed, Z\. Huang, C\. Hong, and N\. GongFingerprinting LLMs via prompt injection\.InProceedings of the Annual Meeting of the Association for Computational Linguistics,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Koupaee and Wang \(2018\)M\. Koupaee and W\. Y\. WangWikiHow: a large scale text summarization dataset\.arXiv preprint arXiv:1810\.09305\.Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px1.p1.1)\.
- Krishnaet al\.\(2023\)K\. Krishna, Y\. Song, M\. Karpinska, J\. Wieting, and M\. IyyerParaphrasing evades detectors of AI\-generated text, but retrieval is an effective defense\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 27469–27500\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2609.38831#S1.p2.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px3.p1.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.5.1)\.
- Liuet al\.\(2019\)Y\. Liu, M\. Ott, N\. Goyal, J\. Du, M\. Joshi, D\. Chen, O\. Levy, M\. Lewis, L\. Zettlemoyer, and V\. StoyanovRoBERTa: a robustly optimized BERT pretraining approach\.arXiv preprint arXiv:1907\.11692\.Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px1.p1.1)\.
- Malik and Awan \(2026\)U\. Malik and M\. S\. AwanThe assistant erased you: measuring loss of authorship signals in AI\-mediated communication\.arXiv preprint arXiv:2608\.00926\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1)\.
- Nickset al\.\(2024\)C\. Nicks, E\. Mitchell, R\. Rafailov, A\. Sharma, C\. D\. Manning, C\. Finn, and S\. ErmonLanguage model detectors are easily optimized against\.InInternational Conference on Learning Representations,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1)\.
- OpenAI \(2026\)OpenAIOpenAI api documentation\.Note:[https://platform\.openai\.com/docs/](https://platform.openai.com/docs/)Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px1.p1.1)\.
- Ouyanget al\.\(2022\)L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray,et al\.Training language models to follow instructions with human feedback\.Advances in neural information processing systems35,pp\. 27730–27744\.Cited by:[§4](https://arxiv.org/html/2609.38831#S4.p1.1)\.
- Papernotet al\.\(2017\)N\. Papernot, P\. McDaniel, I\. Goodfellow, S\. Jha, Z\. B\. Celik, and A\. SwamiPractical black\-box attacks against machine learning\.InProceedings of the 2017 ACM on Asia conference on computer and communications security,pp\. 506–519\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1)\.
- Pasquiniet al\.\(2025\)D\. Pasquini, E\. M\. Kornaropoulos, and G\. AtenieseLLMmap: fingerprinting for large language models\.InUSENIX Security Symposium,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Perrone and Romano \(2026\)G\. Perrone and S\. P\. RomanoARB: a matched authorship\-rewriting benchmark dataset for AI\-text detector evaluation\.arXiv preprint arXiv:2607\.29539\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1)\.
- Radfordet al\.\(2019\)A\. Radford, J\. Wu, R\. Child, D\. Luan, D\. Amodei, and I\. SutskeverLanguage models are unsupervised multitask learners\.Technical reportOpenAI\.Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px2.p1.1)\.
- Rafailovet al\.\(2023\)R\. Rafailov, A\. Sharma, E\. Mitchell, S\. Ermon, C\. D\. Manning, and C\. FinnDirect preference optimization: your language model is secretly a reward model\.InAdvances in Neural Information Processing Systems,Vol\.36\.External Links:[Link](https://arxiv.org/abs/2305.18290)Cited by:[§4\.3](https://arxiv.org/html/2609.38831#S4.SS3.p3.1),[§4](https://arxiv.org/html/2609.38831#S4.p1.1)\.
- Reifet al\.\(2022\)E\. Reif, D\. Ippolito, A\. Yuan, A\. Coenen, C\. Callison\-Burch, and J\. WeiA recipe for arbitrary text style transfer with large language models\.InProceedings of the 60th Annual Meeting of the Association for Computational Linguistics \(Volume 2: Short Papers\),S\. Muresan, P\. Nakov, and A\. Villavicencio \(Eds\.\),Dublin, Ireland,pp\. 837–848\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2609.38831#S1.p2.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px3.p1.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.11.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.16.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.18.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.9.1),[Table 4](https://arxiv.org/html/2609.38831#S6.T4.4.1.5.1)\.
- Sadasivanet al\.\(2023\)V\. S\. Sadasivan, A\. Kumar, S\. Balasubramanian, W\. Wang, and S\. FeiziCan AI\-generated text be reliably detected?\.arXiv preprint arXiv:2303\.11156\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1)\.
- Sawant \(2026\)Y\. G\. SawantPersonalBench: measuring the authorship gap in LLM personalization\.arXiv preprint arXiv:2608\.19746\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1)\.
- Shaoet al\.\(2024\)Z\. Shao, P\. Wang, Q\. Zhu, R\. Xu, J\. Song, X\. Bi, H\. Zhang, M\. Zhang, Y\. K\. Li, Y\. Wu, and D\. GuoDeepSeekMath: pushing the limits of mathematical reasoning in open language models\.arXiv preprint arXiv:2402\.03300\.Cited by:[§1](https://arxiv.org/html/2609.38831#S1.p4.1),[§4](https://arxiv.org/html/2609.38831#S4.p1.1)\.
- Shenet al\.\(2025\)H\. Shen, B\. Huang, and X\. WanEnhancing LLM watermark resilience against both scrubbing and spoofing attacks\.InAdvances in Neural Information Processing Systems,Vol\.38\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Shettyet al\.\(2018\)R\. Shetty, B\. Schiele, and M\. FritzA4NT: author attribute anonymity by adversarial training of neural machine translation\.InUSENIX Security Symposium,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1)\.
- Sunet al\.\(2025\)M\. Sun, Y\. Yin, Z\. Xu, J\. Z\. Kolter, and Z\. LiuIdiosyncrasies in large language models\.InInternational Conference on Machine Learning,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2609.38831#S1.p1.1),[§1](https://arxiv.org/html/2609.38831#S1.p2.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Suzgunet al\.\(2022\)M\. Suzgun, L\. Melas\-Kyriazi, and D\. JurafskyPrompt\-and\-Rerank: a method for zero\-shot and few\-shot arbitrary textual style transfer with small language models\.InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing,Y\. Goldberg, Z\. Kozareva, and Y\. Zhang \(Eds\.\),Abu Dhabi, United Arab Emirates,pp\. 2195–2222\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2609.38831#S1.p2.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.10.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.17.1),[Table 4](https://arxiv.org/html/2609.38831#S6.T4.4.1.4.1)\.
- Tanet al\.\(2026\)Z\. Tan, C\. Zhao, S\. Wang, J\. Li, T\. Chen, and h\. liuProbing to refine: reinforcement distillation of llm reasoners via explanatory inversion\.InInternational Conference on Learning Representations,C\. Vondrick, B\. Hariharan, C\. Raffel, L\. Pinto, D\. Yang, and A\. Faust \(Eds\.\),Vol\.2026,pp\. 28684–28724\.Cited by:[§1](https://arxiv.org/html/2609.38831#S1.p4.1)\.
- Tanget al\.\(2024\)L\. Tang, P\. Laban, and G\. DurrettMinicheck: efficient fact\-checking of llms on grounding documents\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,pp\. 8818–8847\.Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px4.p1.1)\.
- Tramèret al\.\(2016\)F\. Tramèr, F\. Zhang, A\. Juels, M\. K\. Reiter, and T\. RistenpartStealing machine learning models via prediction APIs\.In25th USENIX Security Symposium,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1)\.
- Uchenduet al\.\(2020\)A\. Uchendu, T\. Le, K\. Shu, and D\. LeeAuthorship attribution for neural text generation\.InProceedings of the 2020 Conference on Empirical Methods in Natural Language Processing,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2609.38831#S1.p1.1),[§1](https://arxiv.org/html/2609.38831#S1.p2.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- Uchenduet al\.\(2021\)A\. Uchendu, Z\. Ma, T\. Le, R\. Zhang, and D\. LeeTURINGBENCH: a benchmark environment for Turing test in the age of neural text generation\.InFindings of the Association for Computational Linguistics: EMNLP 2021,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px1.p1.1)\.
- Wallaceet al\.\(2020\)E\. Wallace, M\. Stern, and D\. SongImitation attacks and defenses for black\-box machine translation systems\.InProceedings of the 2020 Conference on Empirical Methods in Natural Language Processing,Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1)\.
- Wuet al\.\(2026\)Y\. Wu, X\. Bai, S\. Li, P\. Hu, Z\. Zhou, Z\. Wang, X\. Ma, S\. Lu, Y\. Li, J\. Xuan, Y\. Wang, D\. Zhang, and B\. B\. ZhuTargeted counterfactual fingerprinting for black\-box LLM ownership verification\.arXiv preprint arXiv:2608\.08195\.Cited by:[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px1.p1.1)\.
- xAI \(2026\)xAIXAI api documentation\.Note:[https://docs\.x\.ai/](https://docs.x.ai/)Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px1.p1.1)\.
- Xinget al\.\(2024\)E\. Xing, S\. Venkatraman, T\. Le, and D\. LeeALISON: fast and effective stylometric authorship obfuscation\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.38,pp\. 19315–19322\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v38i17.29901)Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1)\.
- Yuan and Zhang \(2025\)H\. Yuan and H\. ZhangDomainsum: a hierarchical benchmark for fine\-grained domain shift in abstractive text summarization\.InFindings of the Association for Computational Linguistics: NAACL 2025,pp\. 2219–2231\.Cited by:[§3\.3](https://arxiv.org/html/2609.38831#S3.SS3.p3.1)\.
- Zhaet al\.\(2023\)Y\. Zha, Y\. Yang, R\. Li, and Z\. HuAlignScore: evaluating factual consistency with a unified alignment function\.InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics,Cited by:[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px4.p1.1)\.
- Zhang and Zhang \(2026\)B\. Zhang and Y\. ZhangAssessing deanonymization risks with stylometry\-assisted LLM agent\.arXiv preprint arXiv:2602\.23079\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1)\.
- Zhanget al\.\(2025\)L\. Zhang, Y\. Chuang, G\. Wang, R\. Tang, X\. Cai, R\. Shenoy, and X\. HuA decoupled multi\-agent framework for complex text style transfer\.InFindings of the Association for Computational Linguistics: EMNLP 2025,pp\. 21393–21403\.Cited by:[Appendix A](https://arxiv.org/html/2609.38831#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.38831#S2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2609.38831#S5.SS0.SSS0.Px3.p1.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.12.1),[Table 2](https://arxiv.org/html/2609.38831#S5.T2.4.1.19.1),[Table 4](https://arxiv.org/html/2609.38831#S6.T4.4.1.6.1)\.

## Contents of the appendix

## Appendix overview

The appendix follows the order of the main text\. Appendix[A](https://arxiv.org/html/2609.38831#A1)is the full version of Section[2](https://arxiv.org/html/2609.38831#S2)\. Appendix[B](https://arxiv.org/html/2609.38831#A2)fixes the evaluation protocol and reports the accuracy of every evaluator and of the attacker’s surrogate\. Appendix[C](https://arxiv.org/html/2609.38831#A3)gives implementation details forForgePrintand the six baselines \(Sections[4](https://arxiv.org/html/2609.38831#S4)and[5](https://arxiv.org/html/2609.38831#S5)\)\. Appendix[D](https://arxiv.org/html/2609.38831#A4)expands Table[2](https://arxiv.org/html/2609.38831#S5.T2)with the99B backbone control, document\-clustered intervals, per\-evaluator results, a representation\-space view, an independent LLM judge, and a length check \(Sections[6\.1](https://arxiv.org/html/2609.38831#S6.SS1)–[6\.3](https://arxiv.org/html/2609.38831#S6.SS3)\)\. Appendix[E](https://arxiv.org/html/2609.38831#A5)ablates the Teacher and the training stages \(Section[6\.2](https://arxiv.org/html/2609.38831#S6.SS2)\)\. Appendix[F](https://arxiv.org/html/2609.38831#A6)documents the cost estimates \(Section[6\.4](https://arxiv.org/html/2609.38831#S6.SS4)\)\. Appendix[G](https://arxiv.org/html/2609.38831#A7)contains the Gemma\-source impersonation experiments of Section[6\.4](https://arxiv.org/html/2609.38831#S6.SS4), and Appendix[H](https://arxiv.org/html/2609.38831#A8)the path×\\timesdomain and label\-set analyses\. Appendix[I](https://arxiv.org/html/2609.38831#A9)prints whole rewrites, one where transfer succeeds and one where it fails\. Appendix[J](https://arxiv.org/html/2609.38831#A10)discusses the limitations of the evidence\.

Four scoring protocols recur\.*4\-LLM*is the headline protocol: the four Corpus B evaluators over \{Gemini, Claude, Grok, GPT\} trained on the document domain being attacked, averaged asMean4\\mathrm\{Mean\}\_\{4\}\.*Human\-5*,*Gemma\-5*, and*Qwen\-5*add a fifth Human, Gemma, or Qwen3\.5\-9B class and are used only for the robustness and mechanism analyses that say so and, for Gemma\-5, the open\-model experiment of Section[6\.4](https://arxiv.org/html/2609.38831#S6.SS4), where the true source must be a labelled class\. On CNN/DM theirMean4\\mathrm\{Mean\}\_\{4\}accuracies on unmodified summaries are89\.5589\.55\(Human\-5\),84\.5584\.55\(Gemma\-5\), and84\.1084\.10\(Qwen\-5\)\. Numbers obtained under different protocols, or on different path sets, are not comparable with Table[2](https://arxiv.org/html/2609.38831#S5.T2); each table caption states its protocol\.

## Appendix AExtended related work

This appendix is the full version of Section[2](https://arxiv.org/html/2609.38831#S2)\.

#### LLM attribution, fingerprinting, and watermarks\.

Classifiers trained on model\-labelled corpora attribute a*given*text to its model\([Uchendu et al\., 2020](https://arxiv.org/html/2609.38831#bib.bib28)\);[Sun et al\. \(2025\)](https://arxiv.org/html/2609.38831#bib.bib12)separate five chat models at97\.1%97\.1\\%and show that the signal survives naive paraphrase, translation, or summarisation\. That concerns*untargeted*rewriting; we ask whether a targeted rewrite can move the label to a chosen model\. Benchmarks for detecting and attributing machine text\([Uchendu et al\., 2021](https://arxiv.org/html/2609.38831#bib.bib42);[Dugan et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib43)\)evaluate the same classifiers on unmodified or generically paraphrased inputs, and more recent ones pair a text with its rewrite so that detectors can be scored on matched inputs\([Perrone and Romano, 2026](https://arxiv.org/html/2609.38831#bib.bib53)\)\. Adjacent work asks how far a model’s own authorship signal reaches: whether a personalised model writes like the person it is tuned for\([Sawant, 2026](https://arxiv.org/html/2609.38831#bib.bib50)\), whether assistance erases the human author’s signal\([Malik and Awan, 2026](https://arxiv.org/html/2609.38831#bib.bib52)\), and whether deliberate edit\-based marks can be injected into a model’s output\([Cui et al\., 2026](https://arxiv.org/html/2609.38831#bib.bib54)\)\. Other work identifies a*deployed*model by probing it\([Pasquini et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib10);[Hu et al\., 2026](https://arxiv.org/html/2609.38831#bib.bib11)\)or audits APIs for substitution with statistical tests\([Gao et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib30);[Cai et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib31)\); we ask what existing text alone can certify\. Watermarking separates*scrubbing*a mark from*spoofing*one and studies robustness to each\([Shen et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib1);[Gloaguen et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib13)\); our two criteria mirror this split, but a watermark is inserted by design and decoded with a key, whereas an authorship fingerprint exists only as a trained classifier’s decision, so watermark attacks are not baselines for our task\.

#### Evasion, imitation, and style transfer\.

Adversarial stylometry showed that human authors can evade, and to a lesser degree imitate, authorship classifiers\([Brennan et al\., 2012](https://arxiv.org/html/2609.38831#bib.bib26)\); later work automated evasion with learned rewriters\([Shetty et al\., 2018](https://arxiv.org/html/2609.38831#bib.bib27)\)and with edits chosen against stylometric features directly\([Xing et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib46)\), while stylometry\-assisted agents have been used to measure the deanonymisation risk that remains\([Zhang and Zhang, 2026](https://arxiv.org/html/2609.38831#bib.bib51)\)\. For machine text, paraphrasing degrades detectors\([Krishna et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib6);[Sadasivan et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib29)\), and rewriters can be optimised directly against a detector with preference or adversarial training\([Nicks et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib40);[Hu et al\., 2023](https://arxiv.org/html/2609.38831#bib.bib41)\); these attacks pursue an*untargeted*objective that any label other than the original satisfies\. Our attacker instead optimises against a surrogate and relies on transfer to unseen classifiers\([Papernot et al\., 2017](https://arxiv.org/html/2609.38831#bib.bib23)\), toward a chosen label\. Prompted language models perform text style transfer \(TST\) zero\-shot or from a few demonstrations\([Reif et al\., 2022](https://arxiv.org/html/2609.38831#bib.bib3);[Suzgun et al\., 2022](https://arxiv.org/html/2609.38831#bib.bib4)\), planning pipelines decompose harder transfers\([Zhang et al\., 2025](https://arxiv.org/html/2609.38831#bib.bib2)\), and small dedicated models can be steered from a few examples\([Horvitz et al\., 2024](https://arxiv.org/html/2609.38831#bib.bib5)\)\. These methods define style through human\-legible attributes such as formality; our target is whatever distinguishes one model’s summaries from another’s and is specified only by a label\. We evaluate all of them as baselines\. Model extraction and imitation study an adversary who reproduces a paid model’s behaviour\([Tramèr et al\., 2016](https://arxiv.org/html/2609.38831#bib.bib44);[Wallace et al\., 2020](https://arxiv.org/html/2609.38831#bib.bib45)\); we ask whether the substitution can also be hidden from a text\-only auditor\.

## Appendix BEvaluation protocol and evaluators

### B\.1Frozen evaluation protocol

#### Corpora\.

Corpus A \(the attacker’s corpus\) and Corpus B \(the defender’s\) are disjoint, each with800800training,200200development, and200200test documents per domain, seed4242\. Every document in either corpus is summarised bygemini\-2\.5\-flash\-lite,claude\-haiku\-4\-5,grok\-4\-fast\-non\-reasoning, andgpt\-4\.1\-miniat temperature00with a500500\-token cap and the same prompt \(“You are a helpful assistant for text summarization\. Read the following document and generate a concise summary that captures the main points\.”\); the Human label is the document’s reference summary\.

#### Protocol\.

Headline results use the fixed Corpus B test files \(200200documents per domain\), seed4242, and the1212ordered pairs among Gemini, Claude, Grok, and GPT\. CNN/DM contains23972397valid instances, because one empty source summary removes its three directed\-path instances; the other domains contain24002400each\. Each domain is scored with the four 4\-LLM evaluator checkpoints trained on that domain’s Corpus B training split, and the unweighted mean of RoBERTa, DeBERTa, GPT\-2, and TF\-IDF isMean4\\mathrm\{Mean\}\_\{4\}\. Scores from the attacker’s in\-loop surrogate, from the Human\-5 and Gemma\-5 suites, and from evaluators pooled across domains never enter the aggregates of Table[2](https://arxiv.org/html/2609.38831#S5.T2)\. Failed rewrites remain failures and are never replaced by the source\. Saved rewrites and per\-evaluator predictions allow every table to be rescored without regeneration\.

### B\.2Evaluator accuracy and the attacker’s surrogate

Table[6](https://arxiv.org/html/2609.38831#A2.T6)lists the accuracy of every evaluator on unmodified text\. The four domain\-matched suites average85\.9%85\.9\\%\(4\-LLM\) and87\.9%87\.9\\%\(Human\-5\);*Pooled*is one suite trained on all four domains\. Table[7](https://arxiv.org/html/2609.38831#A2.T7)reports macro\-F1 for the Human\-5 suites and for the attacker’s surrogate\. The surrogate is a single RoBERTa trained on Corpus A \(one model, not one per domain; the four domain columns of the surrogate row are held\-out scores\)\. It is five\-class and Human\-inclusive at every stage \(Teacher selection, DPO pairs, and the GRPO reward\)\. It is the only classifier the attack may query and it never scores a reported result\. Its macro\-F1 is listed so that its capability can be compared with the defense it approximates; the two RoBERTa rows are different models trained on disjoint corpora\. SAMSum is the weakest domain for every evaluator, so attack numbers on dialogue are harder to calibrate than elsewhere\.

Table 6:Accuracy \(%\) on unmodified text for the 4\-LLM and Human\-5 suites \(RoBERTa / DeBERTa / GPT\-2 / TF\-IDF\)\. Gemma\-5 and Qwen\-5 classifiers exist only on CNN/DM \(Mean4\\mathrm\{Mean\}\_\{4\}84\.5584\.55and84\.1084\.10; Appendix[H\.2](https://arxiv.org/html/2609.38831#A8.SS2)\)\.Table 7:Macro\-F1 \(%\) for the Human\-5 evaluators and the attacker\-side surrogate\. These are robustness suites, not the primary 4\-LLM evaluators of Table[6](https://arxiv.org/html/2609.38831#A2.T6)\. The surrogate is a single model, so it has no pooled suite\.
### B\.3Why evaluators are domain\-matched

Table[8](https://arxiv.org/html/2609.38831#A2.T8)applies each domain’s evaluators to unmodified text from every other domain\. It contains no attack and reports attribution accuracy on unmodified summaries, not ASR\. Every diagonal entry is the strongest in its row and column, and within a row off\-diagonal accuracy drops by1010to7070points \(transfer is strongest between CNN/DM and WikiHow and weakest from ArXiv to SAMSum\)\. A defender who knows the domain would not deploy an evaluator trained on another one\. The remaining choice is between a domain\-matched suite and one pooled over all domains, which are equally accurate on unmodified text \(Table[6](https://arxiv.org/html/2609.38831#A2.T6)\); we report the domain\-matched suites throughout\.

Table 8:Cross\-domain transfer of the evaluators on unmodified Round\-2 text \(Human\-5 suites\)\. Rows are evaluator training domains; columns are test\-text domains\. Entries areMean4\\mathrm\{Mean\}\_\{4\}attribution accuracy \(%\)\.

## Appendix CImplementation details

### C\.1ForgePrintTeacher and students

#### Operator induction\.

The four operator kinds \(keep,suppress,inject,restructure\) are roles fixed in advance, not post\-hoc clusters\. For each of the1212CNN/DM paths, DeepSeek\-V4\-Pro \(thinking disabled\) writes a contrastive profile from token, phrase, style, syntax, and discourse statistics of paired Round\-1 summaries held out for bank construction\. The system prompt requires directional KEEP/SUPPRESS/INJECT/RESTRUCTURE operators, forbids topic names and outside stereotypes, and returns JSON only\. The model proposes88–2424operators \(target1212–1818\)\. Each operator is then applied on its own to eight held\-out Round\-1 development documents and kept only if it raises the target marginmmof Eq\.[3](https://arxiv.org/html/2609.38831#S4.E3)under an attacker\-side RoBERTa; Round\-2 evaluators are never involved\. The frozen bank keeps99–1212operators per path \(131131total\) and is reused unchanged on ArXiv, SAMSum, and WikiHow\. No test document is used\.

#### Retrieval\.

Exemplars come from a Round\-1 training\-only index with one partition per path\. The representation issentence\-transformers/all\-MiniLM\-L6\-v2with normalised embeddings; similarity is cosine of the query source summaryxSx\_\{S\}against indexed source summaries\. Operators are not retrieved: the full frozen path set is injected\.k=5k\{=\}5except ArXiv, wherek=2k\{=\}2is required for rewriter context length; a post\-hoc sweep with in\-context exemplars only \(ICL\-only\) is flat fromk=3k\{=\}3tok=7k\{=\}7\(Appendix[E\.1](https://arxiv.org/html/2609.38831#A5.SS1)\)\.

#### Teacher prompt\.

System: “You rewrite summaries from one model style into another while preserving all factual content\. Follow the contrastive intervention profile: KEEP protected content, SUPPRESS source cues, INJECT target cues, and RESTRUCTURE when needed\. Follow the examples\. Do not add or remove facts\.” The user message namesSSandTT, lists the path’s operators as JSON, thenkkInput/Outputexemplars, then “Now rewrite this Input:” followed byxSx\_\{S\}\. PackedN=5N\{=\}5asks for five delimited rewrites along the fixed Pareto dose ladder \(light, medium, balanced, strong fact\-locked, strong structural\) in a single call; we call this a*packed*call\. Decoding is greedy,30723072max tokens\. Widths other thanN=5N\{=\}5appear only in the post\-hoc sweep of Appendix[E\.1](https://arxiv.org/html/2609.38831#A5.SS1)\.

#### DPO pairs\.

SFT targets the Teacher’s selected rewritex^\\hat\{x\}\. DPO pairs are built as in Section[4\.3](https://arxiv.org/html/2609.38831#S4.SS3): the highest\- and lowest\-margin candidate of one packed call, after degenerate generations are discarded and after dropping the instance if the two margins are not separated,m⁡\(x\+\)−m⁡\(x−\)\>0m\(x^\{\+\}\)\-m\(x^\{\-\}\)\>0\. AlignScore and BERTScore are not pair filters\. This yields91179117training pairs and480480validation pairs \(document\-group split, four domains mixed\)\. The filter that the two margins differ is not binding: every retained pair already satisfies it\. The gap between the chosen and the rejected margin has a median of1\.731\.73and a tenth percentile of0\.110\.11over the91179117training pairs, so a nontrivial threshold would change the data rather than clean it: requiring a gap above0\.20\.2would drop18\.7%18\.7\\%of them\. Discarding degenerate candidates leaves five candidates for75%75\\%of prompts and three for most of the rest\. The DPO prompt is\(xS,S,T\)\(x\_\{S\},S,T\)only; the frozen SFT adapter is the reference\. Both students run one epoch atβ=0\.1\\beta\{=\}0\.1and a learning rate of5×10−55\{\\times\}10^\{\-5\}, batch11with1616accumulation steps:570570steps for the44B student and200200for the99B backbone control\. All students use LoRA adapters; at inference they decode with beam search \(beam22\) and a256256\-token limit\.

#### Factuality judge and GRPO reward\.

The judge is a frozen copy of the Teacher rewriter,gemma\-4\-26B\-A4B\-itat FP8, queried at temperature00with at most700700new tokens\. Inputs are the source document, the original summaryxSx\_\{S\}, and the candidate rewrite; long documents are truncated to claim\-relevant units capped at18,00018\{,\}000characters\. The system instruction is: treat tagged text as data;passif all important input\-summary propositions remain and no unsupported or contradictory claim is added;minorfor non\-core omission or small imprecision;majorfor unsupported addition, a changed subject, object, number, time, negation, modality, attribution, or cause, or omission of a core event\. The reply is JSON with keyslabel,unsupported\_claims,contradictions,missing\_core\_claims,minor\_omissions\_or\_imprecision,rationale\. Invalid JSON is treated asmajor\. Tiers mapmajor/minor/passtoτ∈\{0,1,2\}\\tau\\in\\\{0,1,2\\\}\. The reward, ranking rule and retry rule are those of Eqs\.[6](https://arxiv.org/html/2609.38831#S4.E6); each reward call scores eight rollouts of one prompt as two independent groups ofG=4G\{=\}4at temperature0\.80\.8, top\-p=0\.9p=0\.9,384384new tokens, and only the first group that contains apassis ranked\. Ranking uses the key \(tier, margin\) with the original index as the final tiebreak, and averages the rank scores over exactly tied candidates; on the logged groups no exact tie occurred, so the averaging never fired\. The KL coefficient isβKL=0\.05\\beta\_\{\\mathrm\{KL\}\}\{=\}0\.05\.

#### GRPO implementation\.

Training uses the TRL group\-relative trainer with one optimisation pass per generation batch, so the clipped importance ratio is one and Eq\.[7](https://arxiv.org/html/2609.38831#S4.E7)is the objective actually optimised\. Reward scaling is off and the ranked group’s rank scores are doubled, because TRL averages over both sampled groups while only one enters the ranking\. The policy and the KL reference are two independently loaded copies of the DPO checkpoint, and adapters are kept unmerged\. The frozen sweep is5050steps over the margin\-only and factuality\-constrained rewards crossed with learning rates\{2,5\}×10−6\\\{2,5\\\}\{\\times\}10^\{\-6\}andβKL∈\{0\.02,0\.05\}\\beta\_\{\\mathrm\{KL\}\}\\in\\\{0\.02,0\.05\\\}, with checkpoints kept at steps2525and5050and at the end; selection reads the four\-domain Round\-1 development set only, and no Round\-2 file is scored before the configuration is frozen\.

#### Judge self\-consistency\.

The judge was re\-run over200200held\-out candidates under an independently worded, blinded prompt: zero JSON failures,82%82\\%exact tier agreement, linear weightedκ=0\.744\\kappa=0\.744, quadratic weightedκ=0\.808\\kappa=0\.808, and86\.3%86\.3\\%recall of the primary pass’smajorlabels\. This establishes that the judge is self\-consistent, not that its tiers agree with human judgement; no human read the rewrites \(Appendix[J](https://arxiv.org/html/2609.38831#A10)\)\. The 4B and 9B students use learning rates5×10−65\{\\times\}10^\{\-6\}and2×10−62\{\\times\}10^\{\-6\}for5050GRPO steps after each size’s DPO adapter \(570570DPO steps on 4B,200200on 9B\)\. The judge enters the reward and the choice of checkpoint on a four\-domain Round\-1 development set; it never scores Round\-2 test data\.

### C\.2Published baselines

Table[9](https://arxiv.org/html/2609.38831#A3.T9)summarises the configurations\. Every baseline rewrites the same200200held\-out documents per domain over the same1212paths, and every saved rewrite is rescored with the domain\-matched 4\-LLM evaluator checkpoints and aggregated asMean4\\mathrm\{Mean\}\_\{4\}\. Exemplars, where a method uses them, come from the training split of the ICL index; no test summary is ever shown to a baseline\. A rewrite that fails to generate is recorded as a failure and never replaced by its source\.

Table 9:Baseline configurations\.*Targeted*marks whether the target identity enters the method at all\. The four prompted methods share the Teacher’s rewriter,gemma\-4\-26B\-A4B\-itat FP8, temperature00,30723072max tokens\.#### Prompted methods\.

Zero\-shot TST uses the templateHere is some text: \{x\}\. Here is a rewrite of the text, which is more \{T\}\.The augmented zero\-shot prompt prepends the priming block of task\-irrelevant rewrites from the same paper\. 5\-shot FC supplies five labelled source–target pairs drawn once per path with a fixed seed and decoded once, with neither retrieval nor reranking\. Planner TST caches one plan per target style, drafted from eight target summaries without seeing the input; the planner is resampled up to three times if the plan fails a format check, after which a fallback plan is used and the failure recorded\.

#### Dedicated models\.

TinyStyler conditions a style embedding obtained by mean\-pooling1616target summaries, truncating inputs to512512tokens and sampling256256new tokens; its inference\-time Away/Towards reranker is disabled, since enabling it would introduce a second style signal absent from the other baselines\. DIPPER paraphrases once per \(document, source\) pair and the result is reused across that source’s three targets, so its target ASR is by construction the confusion rate of an untargeted rewrite\.

#### Deviations from the original papers\.

\(i\) The prompted methods were published with GPT\-3 or paper\-specific generators; we substitute the shared rewriter so that the comparison isolates method from generator\. \(ii\) Reif’s original decoding is nucleus sampling atp=0\.6p\{=\}0\.6; we use greedy decoding, and append a trailing brace to adapt the completion\-style template to a chat model\. \(iii\) The prompted methods were designed for human\-legible style adjectives; we substitute the four model identities\. \(iv\) Zhang et al\. release no code, so Planner TST is a reconstruction of their described ablation, not their original strings\. \(v\) TinyStyler’s authorship setting does not fixk=16k\{=\}16; we do, and disable reranking as noted\. \(vi\) DIPPER is run only at60/6060/60diversity\.

#### RL policies\.

*Style\-reward RL*and*AuthorMist\-T*are trained onForgePrint\-4B’s backbone \(Gemma\-3\-4B, LoRA\) with the same GRPO implementation, group sizeG=4G\{=\}4, KL penalty, optimiser and step budget as the student’s refinement stage\. They differ from the student only in what supervises them: neither sees a Teacher rewrite, an operator bank, or an in\-context exemplar, and neither has an SFT or DPO stage, so they start from the instruction\-tuned backbone rather than from a distilled checkpoint\. Style\-reward RL rewards the surrogate’s target marginm⁡\(c\)m\(c\)of Eq\.[3](https://arxiv.org/html/2609.38831#S4.E3); AuthorMist\-T rewards the surrogate’s target probability plus BERTScoreF1F\_\{1\}against the source summary, replacing the detector\-evasion reward of the original\. Neither reward contains a factuality tier, which is the comparison drawn in Section[6\.2](https://arxiv.org/html/2609.38831#S6.SS2)\.

### C\.3An operator bank and successful rewrites

This subsection makes the abstract description of Section[4\.2](https://arxiv.org/html/2609.38831#S4.SS2)concrete: it prints one complete operator bank and rewrites the Teacher produces from it\. The frozen bank for the GPT→\\toGemini path holds twelve operators: foursuppress, fiveinject, and threerestructure\(keepsurvives in this path only as the profile constraint that no fact may be added or removed\)\. Their instructions, in the order the Teacher injects them, are: convert participial clauses into finite clauses or separate sentences; remove source\-typical tokens, reduce participles and subordinators, and shorten sentences; shorten sentences and add attribution verbs, demonstratives, relatives, and quotations; split long sentences; reduce discourse units and avoid deep hierarchy; cut subordinators; add*this*and*also*; prefer passive\-like reporting \(*was reported*,*is expected*\); cut coordinators; add attribution verbs \(*stated*,*believes*,*suggests*\); lightly reduce source\-typical tokens; and use contractions\.

ThreeForgePrint\-4B rewrites on that path, each attributed to Gemini by all four held\-out evaluators \(CNN/DM Round\-2 documents 0, 1, and 3\), illustrate what these operators do\. A GPT summary of a restaurant story — a customer finding a sink plug in a salad, a Facebook backlash, the manager’s response, and a health\-department visit — becomes a sequence of short sentences \(“A customer found …, which led to … The restaurant’s manager … He also stated …”\)\. A cricket summary gains sentence\-initial framing \(“The summary shows that … Graeme Swann also stated …, which means …”\)\. A science\-video summary is cut to two short sentences followed by “The professor also explained that her goal is …”\. Figure[3](https://arxiv.org/html/2609.38831#S4.F3)shows a fourth \(document 24\): “Philip Dunning, a 44\-year\-old shift manager from Bo’ness, West Lothian, won £7\.86 million in the Lotto and showed up for his usual 4am food factory shift the next day to hand in his notice” becomes “A 44\-year\-old man named Philip Dunning won £7\.86 million in the lottery\. He was a shift manager at a food factory in Bo’ness before he decided to quit\.” The edits are structural and lexical rather than topical: content is kept, sentence boundaries move, and Gemini\-typical connectives and attribution verbs appear\.

## Appendix DAdditional main results

### D\.1TheForgePrint\-9B backbone control

Both the Teacher’s rewriter and the44B student’s backbone are Gemma models, so a natural objection is that the recipe works only inside that family\. Table[10](https://arxiv.org/html/2609.38831#A4.T10)answers it with the same three stages on a Qwen3\.5\-9B backbone\.ForgePrint\-9B is above every published baseline in all four domains and above the Teacher in three of them\. It is a control rather than a matched second system: its preference stage ran200200DPO steps against the44B student’s570570, and GRPO then moves its 4\-LLM ASR by less than a point \(Table[18](https://arxiv.org/html/2609.38831#A5.T18)\)\. We therefore read the gap between the two students as a difference in training budget, not in backbone, and we do not treat either number as a scaling result\. Continuing preference training on the original twelve\-path pairs together with four Gemma\-source paths later raises the same adapter to73\.573\.5under the identical 4\-LLM protocol \(Appendix[H\.2](https://arxiv.org/html/2609.38831#A8.SS2)\)\.

The student’s faithfulness is also not a size effect\. On the44B backbone, the prompted baselines of Table[2](https://arxiv.org/html/2609.38831#S5.T2)fall to0\.270\.27–0\.570\.57AlignScore at2323–3333target ASR, whereasForgePrint\-4B holds0\.6590\.659at70\.270\.2\.

Table 10:Per\-domain 4\-LLMMean4\\mathrm\{Mean\}\_\{4\}target ASR \(%\) for the Teacher and both students, plus AlignScore of the rewrite against the source document\.ForgePrint\-9B is a backbone control: its preference stage ran200200DPO steps against570570forForgePrint\-4B, so the two students are not a scaling comparison\.
### D\.2Four\-domain document\-clustered intervals

The intervals of Table[2](https://arxiv.org/html/2609.38831#S5.T2)cluster each domain on its own200200documents \(10,00010\{,\}000bootstrap replicates, seed4242\)\. Per\-domain half\-widths on target ASR run from0\.450\.45to1\.241\.24\.ForgePrint\-4B remains above the Teacher in every domain; the smallest paired gap is ArXiv \(\+2\.51\+2\.51\[1\.05,3\.99\]\[1\.05,3\.99\]\)\.ForgePrint\-9B is nominally below the Teacher on SAMSum, with overlapping intervals \(47\.9247\.92\[46\.69,49\.15\]\[46\.69,49\.15\]versus49\.5249\.52\[48\.32,50\.73\]\[48\.32,50\.73\]\)\. All reported Planner TST results use the regenerated complete run with2,4002\{,\}400instances\.

### D\.3Per\-evaluator target ASR

Table[11](https://arxiv.org/html/2609.38831#A4.T11)breaks Table[2](https://arxiv.org/html/2609.38831#S5.T2), plus theForgePrint\-9B backbone control, down by evaluator\. The ordering baselines<<Teacher<<ForgePrint\-4B holds within every column, so no single evaluator drives the headline; the99B student falls below the Teacher on GPT\-2 only\. Removing RoBERTa, the surrogate’s architecture, leavesForgePrint\-4B at68\.1%68\.1\\%Mean3\\mathrm\{Mean\}\_\{3\}ASR \(the mean of DeBERTa, GPT\-2, and TF\-IDF\) and*raises*augmented zero\-shot from39\.339\.3to40\.040\.0, so dropping it is not a one\-directional correction\.

Part of the remaining spread is mediated by length\. After truncating every rewrite to the length of the summary it replaces, the four evaluators agree to within2\.62\.6points forForgePrint\-4B and4\.34\.3for the Teacher, down from17\.217\.2and20\.420\.4\(Appendix[D\.6](https://arxiv.org/html/2609.38831#A4.SS6)\)\. The student still leads the Teacher by14\.814\.8points after truncation\.

Table 11:Target ASR \(%\) by evaluator, CNN/DM,n=2397n\{=\}2397, domain\-matched 4\-LLM\. Bold marks each method’s most permissive evaluator\.
### D\.4Representation\-space view of transfer

Figure[4](https://arxiv.org/html/2609.38831#S6.F4)in Section[6\.1](https://arxiv.org/html/2609.38831#S6.SS1)projects the representation that a held\-out GPT\-2 4\-LLM evaluator feeds to its classification head\. The projection is fitted on unmodified training summaries only, with rewrites projected and never fitted\. The panel rates are single\-evaluator attributions on800800instances, whereas Table[2](https://arxiv.org/html/2609.38831#S5.T2)reportsMean4\\mathrm\{Mean\}\_\{4\}over four evaluators on all23972397\. In the full768768\-dimensional representation the median Euclidean distance to the target centroid falls from284284before rewriting to130130,8686, and7777for the published baseline, the Teacher, and the44B student\.

### D\.5Faithfulness under an LLM judge

Table[2](https://arxiv.org/html/2609.38831#S5.T2)reports AlignScore, and Table[4](https://arxiv.org/html/2609.38831#S6.T4)already adjusts target ASR for AlignScore and MiniCheck\. An independent judge,gpt\-5\.6\-terra, scores the same question on6060shared CNN/DM documents \(720720rewrites per method, seed4242, balanced over paths\)\. It never sees the training factuality judge, and it labels each rewritesupported,minor, orunsupportedagainst the source document\.

Table 12:Independent LLM judge on6060shared CNN/DM documents \(720720rewrites per method\)\. Pass is the share labelledsupportedorminor; Content is content preservation \(11–55\); ASR all and ASR on passes are 4\-LLM target ASR \(%\) over all scored rewrites and over those the judge passes\. The judge is unvalidated against human annotations, and these ASR numbers are not comparable with Table[2](https://arxiv.org/html/2609.38831#S5.T2)\.ForgePrint\-4B retains70\.6%70\.6\\%target ASR among rewrites passed by the independent judge, at least as high as its69\.3%69\.3\\%over all scored rewrites on this sample\. Pass falls from the Teacher’s0\.7540\.754to0\.3710\.371, so distillation costs faithfulness; the judge covers6060CNN/DM documents and is not validated against human annotations\.

### D\.6Length and target ASR

Table[13](https://arxiv.org/html/2609.38831#A4.T13)gives the length of each rewrite as a fraction of the summary it replaces, in whitespace words, over the CNN/DM rewrites of Table[2](https://arxiv.org/html/2609.38831#S5.T2), together with target ASR inside bins of that ratio\.

The student does not buy transfer with length\. Its median rewrite is0\.890\.89of the source summary and only38\.8%38\.8\\%of its rewrites are longer, against1\.071\.07and60\.1%60\.1\\%for augmented zero\-shot\. The share of rewrite sentences absent from the source summary is0\.4890\.489forForgePrint\-4B against0\.1570\.157for the Teacher\. Inside the length\-matched bin the ordering is unchanged,67\.267\.2for the student against58\.458\.4for the Teacher and38\.938\.9for augmented zero\-shot, and the student is the only one of the three whose ASR is flat across the three bins\.

Hard truncation to the source length costs the Teacher and the student about eleven points each,54\.154\.1to43\.943\.9and70\.270\.2to58\.658\.6, and augmented zero\-shot0\.60\.6\(Table[14](https://arxiv.org/html/2609.38831#A4.T14)\)\. The student still leads the Teacher by14\.814\.8points once both are cut to the source length\.

Table 13:Length ratio of a rewrite to the summary it replaces, in whitespace words, and CNN/DM 4\-LLMMean4\\mathrm\{Mean\}\_\{4\}target ASR \(%\) inside bins of that ratio, over the CNN/DM Round\-2 rewrites of Table[2](https://arxiv.org/html/2609.38831#S5.T2)\.*share\>1\.0\>1\.0*is the fraction of rewrites longer than their source\. The middle bin holds rewrites that keep the source length to within a tenth;nnis in parentheses\. Bin sizes differ because the methods have different length distributions\.Table 14:Every CNN/DM rewrite hard\-truncated to the whitespace\-word length of the summary it replaces, then rescored \(n=2397n\{=\}2397\)\.Mean3\\mathrm\{Mean\}\_\{3\}drops RoBERTa, the surrogate’s architecture\.*Range*is the spread between the most and least permissive of the four evaluators\.

## Appendix ETeacher and student ablations

### E\.1Teacher component ablations

All rows below use the same CNN/DM Round\-2 protocol as Table[2](https://arxiv.org/html/2609.38831#S5.T2)\(1212machine paths,n=2397n\{=\}2397, domain\-matched 4\-LLMMean4\\mathrm\{Mean\}\_\{4\}, seed4242, Gemma\-4 rewriter at temperature00\)\. AlignScore is rewritten summary vs\. source document\.*Hybrid*denotes the full Teacher \(path operators, retrieved exemplars,NNcandidates requested in one packed call, max\-margin selection\)\. The component stack shows where the Teacher’s strength comes from, and the two sweeps show that ASR moves gently with the packed widthNNand is nearly flat in the retrieval depthkk, so the reported Teacher is not an outlier of a fragile setting\. All ablations in this appendix are scored with the held\-out evaluators and were run after the students had been distilled; they are analyses rather than part of the attacker’s tuning loop; the main\-text summary is Table[3](https://arxiv.org/html/2609.38831#S6.T3)\. Every Teacher in the paper, including the Gemma\-source Teacher, usesN=5N\{=\}5andk=5k\{=\}5\(k=2k\{=\}2on ArXiv\); the five requested edit strengths are light, medium, balanced, strong fact\-locked, and strong structural\.

#### Component stack\.

Table[15](https://arxiv.org/html/2609.38831#A5.T15)compares the full Teacher with a variant that uses retrieved exemplars only \(no operators\) and one that uses operators only \(no exemplars, a single candidate\)\. Operators carry most of the attack \(\+15\.6\+15\.6points over exemplars alone\); adding exemplars and packed best\-of\-NNselection contributes the remaining2\.72\.7\. A single\-candidate call of the full Teacher already reaches53\.753\.7\(Table[16](https://arxiv.org/html/2609.38831#A5.T16), run atk=5k\{=\}5\), so wide search is not what the Teacher depends on\.

Table 15:Teacher component stack on CNN/DM Round\-2 \(n=2397n\{=\}2397\)\. ICL uses retrievalk=3k\{=\}3; Hybrid is the paper Teacher \(N=5N\{=\}5,k=5k\{=\}5\)\.
#### Retrievalkkand packedNN\.

Table[16](https://arxiv.org/html/2609.38831#A5.T16)sweeps the retrieval depth for the exemplars\-only variant and the packed width of the full Teacher at fixedk=5k\{=\}5\. ICL\-only target ASR is essentially flat fromk=3k\{=\}3tok=7k\{=\}7\(≈36\\approx\\\!36; span<1<1point\)\. PackedNNstays within1\.81\.8points \(N=5N\{=\}5is54\.0854\.08\)\. Neither sweep was used to choose the paper setting \(k=5k\{=\}5,N=5N\{=\}5; ArXiv keepsk=2k\{=\}2for context length\)\.

Table 16:Teacher sensitivity on CNN/DM Round\-2 \(n=2397n\{=\}2397\)\. Top: ICL\-only retrievalkk\(no operators\)\. Bottom: packed widthNNof the full Teacher at retrievalk=5k\{=\}5\. Both sweeps are post\-hoc and were not used to selectkkorNN\.

### E\.2Surrogate selection on frozen Teacher candidates

Table[17](https://arxiv.org/html/2609.38831#A5.T17)isolates selection from generation: it reselects among the stored candidates of oneN=5N\{=\}5Teacher run with no new generation\. Max\-margin selection gives54\.0854\.084\-LLM ASR\. The first packed candidate is path\-conditioned generation without reranking \(39\.5839\.58\)\. Uniform random selection among the stored candidates has exact expected 4\-LLM ASR48\.2048\.20;100100independent draws average48\.1348\.13\(sd=0\.38\\mathrm\{sd\}=0\.38\)\. Surrogate\-guided selection therefore adds about66points on top of the same path\-conditioned generator, and about14\.514\.5versus taking the first candidate\. Note that the first candidate of a packed call is the lightest of the edit strengths requested, so it is weaker than a fresh single\-candidate call \(theN=1N\{=\}1row of Table[16](https://arxiv.org/html/2609.38831#A5.T16)\)\.

Table 17:Same CNN/DM Teacher candidates \(n=2397n\{=\}2397\), different selection\. 4\-LLMMean4\\mathrm\{Mean\}\_\{4\}is computed over all stored candidates, so the random row is the exact uniform expectation\.
### E\.3Training\-stage trajectories

Table[18](https://arxiv.org/html/2609.38831#A5.T18)follows the saved checkpoints along the training stages\. It is a*trajectory*, not a controlled SFT/DPO/GRPO factorial: DPO duration is not matched across sizes, and both students then use the same GRPO recipe\. On 4B, most of the gap between student and Teacher appears at DPO; GRPO adds another6\.26\.2points\. On 9B, which ran200200DPO steps against the44B student’s570570, GRPO does not move 4\-LLM ASR relative to the DPO adapter, and further preference training later raises the same adapter to73\.573\.5\(Appendix[H\.2](https://arxiv.org/html/2609.38831#A8.SS2)\); the99B row is therefore a backbone control at an unsaturated preference stage, not a converged second system\.

Table 18:CNN/DM domain\-matched 4\-LLMMean4\\mathrm\{Mean\}\_\{4\}along the saved training stages \(n=2397n\{=\}2397\)\. AlignScore is vs\. the source document\. The last row is Table[2](https://arxiv.org/html/2609.38831#S5.T2)\. DPO duration is not matched across sizes\. The99B SFT checkpoint is markedly less faithful than the44B one \(0\.5610\.561against0\.6730\.673\) and recovers only after DPO\.
### E\.4Removing the factuality tier

The GRPO stage ranks each group of candidate rewrites lexicographically: first by a factuality tier, then by the surrogate margin towards the target model\. All policies below start from the same DPO checkpoint \(570570steps\) and are taken at GRPO step5050\. The factuality\-first configuration reaches70\.2%70\.2\\%held\-out ASR, compared with66\.5%66\.5\\%for the strongest margin\-only variant and63\.9%63\.9\\%for the DPO start \(Table[19](https://arxiv.org/html/2609.38831#A5.T19)\)\. AlignScore is unchanged at0\.6190\.619\. The two DEV\-selected checkpoints differ inβ\\betaand in the selection rule—margin\-only was ranked by attack strength, factuality\-first by factuality—so this is not a controlled single\-factor change, and we do not read it as a causal effect of the tier alone\.

Table 19:Factuality\-first GRPO versus the strongest margin\-only variant, both from the same DPO start\. Held\-out ASR is 4\-LLM target ASR \(%\); Align is AlignScore against the source document\. The two DEV\-selected checkpoints differ inβ\\betaand in the selection rule, so the comparison is not a single\-factor ablation\.
### E\.5What the Teacher warm start is worth

Removing the Teacher while keeping everything else isolates what the warm start buys\.*Native\-SFT*fine\-tunes the same backbone on parallelS→TS\\\!\\rightarrow\\\!Tsummaries of the same document from the training split and then runs the identical factuality\-ranked GRPO stage; it never sees a Teacher rewrite and never runs DPO\. It reaches macro41\.941\.9target ASR\[41\.3,42\.4\]\[41\.3,42\.4\]and78\.378\.3source evasion\[77\.9,78\.7\]\[77\.9,78\.7\], but at an AlignScore of0\.2290\.229on CNN/DM against the Teacher’s0\.6820\.682— it moves the label by rewriting far more destructively, which the threat model of Section[3\.3](https://arxiv.org/html/2609.38831#S3.SS3)does not permit; per domain the target ASR is46\.546\.5\[45\.6,47\.5\]\[45\.6,47\.5\]on CNN/DM,39\.239\.2\[38\.0,40\.4\]\[38\.0,40\.4\]on ArXiv,41\.941\.9\[40\.7,43\.1\]\[40\.7,43\.1\]on SAMSum, and40\.040\.0\[38\.9,41\.1\]\[38\.9,41\.1\]on WikiHow, with source evasion81\.081\.0,75\.275\.2,79\.879\.8, and77\.177\.1\. That is well above the RL baselines of Table[2](https://arxiv.org/html/2609.38831#S5.T2), whose macro intervals\[24\.6,25\.2\]\[24\.6,25\.2\]and\[23\.9,24\.6\]\[23\.9,24\.6\]do not come close, and about1919points of macro ASR belowForgePrint\-4B\[60\.3,61\.3\]\[60\.3,61\.3\]\. Aligning the RL objective with ours therefore closes about half the gap those baselines leave open \(17\.317\.3of36\.236\.2macro points\); the remainder is what the Teacher’s rewrites and the preference stage supply\.

## Appendix FCost accounting

### F\.1List prices and compute

#### What the rewrite adds\.

Table[20](https://arxiv.org/html/2609.38831#A6.T20)separates the two terms an intermediary pays\. Substituting the open model is where the money is, and what it costs depends on the hardware\. The disguise is not: one rewrite costs $0\.0120\.012per thousand summaries on a rented consumer card, about3%3\\%of the $0\.380\.38the Gemma summaries themselves cost\. Priced instead on the datacentre card that writes the summaries, the rewrite is $0\.330\.33, between4%4\\%and14%14\\%of the premium rates in the table\. Ratios, not absolute figures, are what survive a change of price list\.

Table 20:Cost of1,0001\{,\}000CNN/DM summaries\. API rows apply list rates to the stored document and summary token counts; GPU rows price the measured GPU\-hours of Table[22](https://arxiv.org/html/2609.38831#A6.T22)on the card named, without re\-timing on it\. All rates were read on 18 September 2026; it is the ratio rather than the absolute figures that we report\.ItemRate or hardware$ /11k*Premium tier: what a reseller claiming that model would bill*Grok 4\.6list2\.342\.34Gemini 3\.1 Prolist3\.233\.23Claude Sonnetlist3\.513\.51GPT\-5\.6 Sollist6\.226\.22Claude Opus 5list8\.788\.78*Substitution: one Gemma\-4 26B summary in place of a commercial one*Gemma\-4 26Brented A100, $1\.991\.99/h0\.380\.38*Disguise: oneForgePrint\-4B rewrite per summary*ForgePrint\-4Brented RTX 5060, $0\.070\.07/h0\.012\\mathbf\{0\.012\}ForgePrint\-4Brented A100, $1\.991\.99/h0\.330\.33All dollar figures are*inference*costs: each new summary pays the API call, or the open\-model summary plus the rewrite\. Adapter training is paid once \(Table[21](https://arxiv.org/html/2609.38831#A6.T21)\) and is not amortised into the per\-thousand figures\. API rows apply list rates to stored document and summary token counts; rewrite rows take the GPU\-hours measured on an H200 \(Table[22](https://arxiv.org/html/2609.38831#A6.T22)\) and price them on the card named\. The estimate excludes the attacker’s one\-time costs — the Round\-1 corpus, operator induction, Teacher data generation, and the1\.331\.33GPU\-hours of student training in Table[21](https://arxiv.org/html/2609.38831#A6.T21)\.

Table 21:One\-time adapter training on one H200 NVL, in GPU\-hours\. This is setup, not the per\-rewrite inference cost of Table[20](https://arxiv.org/html/2609.38831#A6.T20)\. 9B GRPO continues from that size’s DPO adapter; the DPO column is the full DPO job\. The additional training of the Gemma\-source adapters is not included \(Appendix[G\.1](https://arxiv.org/html/2609.38831#A7.SS1)\)\.
#### GPU time\.

Table[23](https://arxiv.org/html/2609.38831#A6.T23)gives the GPU hours behind the cost analysis above\. Teacher and students were timed on the same hardware at the default decoding settings \(students: beam22, batch1616\), not at a saturated batch\. Table[22](https://arxiv.org/html/2609.38831#A6.T22)shows how much cheaper the student becomes when decoding is tuned for throughput, so the cost estimate above is conservative for the attacker\. Batch10241024requires greedy decoding; beam22runs out of memory beyond batch512512\.

Table 22:ForgePrint\-4B decode throughput on one H200 \(n=2397n\{=\}2397\)\. Greedy batch10241024is the cheapest student setting that fit in140140GB\.Table 23:ForgePrintrewrite GPU hours, timed on the same hardware at the default decoding settings \(students: beam22, batch1616\)\. Teacher hours cover candidate generation and surrogate scoring with the frozen CNN/DM\-built bank \(N=5N\{=\}5,k=5k\{=\}5on CNN/DM;k=2k\{=\}2on ArXiv\)\. Student hours are a timed decode of the same23972397CNN/DM instances, including model load\.

## Appendix GGemma as the source: open\-model impersonation

This appendix supports Section[6\.4](https://arxiv.org/html/2609.38831#S6.SS4)\. Gemma\-4 26B writes the CNN/DM summaries and the attack must send each one to Gemini, Claude, Grok, or GPT\. All results use the Gemma\-5 suite, so that the true source is a labelled class and source evasion is defined; they are not on the 4\-LLM scale of Table[2](https://arxiv.org/html/2609.38831#S5.T2)\. The realistic case is the one in which the attacker trains for its own open\-source writer\.

### G\.1Targeted training on a Gemma source

The attacker runs the same Teacher on Gemma→\{Gemini,Claude,Grok,GPT\}\\rightarrow\\\{\\textrm\{Gemini\},\\textrm\{Claude\},\\textrm\{Grok\},\\textrm\{GPT\}\\\}and continues trainingForgePrint\-4B on those pairs by DPO, starting from its factuality\-ranked GRPO checkpoint\. The result, writtenForgePrint\-4B \(Gemma\-source\), is therefore not theForgePrint\-4B checkpoint of Table[2](https://arxiv.org/html/2609.38831#S5.T2)\. It keeps most of what it was trained on before: under the 4\-LLM protocol of Table[2](https://arxiv.org/html/2609.38831#S5.T2)it still reaches65\.465\.4target ASR on the original twelve paths, against the main student’s70\.270\.2\.

*Protocol\.*CNN/DM Round\-2,200200documents×\\times44paths \(n=800n\{=\}800\), Gemma\-5Mean4\\mathrm\{Mean\}\_\{4\}\. These percentages are not on the 4\-LLM scale of Table[2](https://arxiv.org/html/2609.38831#S5.T2)and are not comparable with the main comparison\. Published baselines are regenerated from Gemma summaries with the same Gemma\-4 rewriter as Table[2](https://arxiv.org/html/2609.38831#S5.T2)’s prompted methods\. The DPO hyperparameters \(lr=2×10−6\\mathrm\{lr\}\{=\}2\{\\times\}10^\{\-6\},β=0\.05\\beta\{=\}0\.05\) reuse the99B recipe’s GRPO rate and were not tuned on this task; a learning rate of5×10−65\{\\times\}10^\{\-6\}gives68\.568\.5against68\.368\.3\.

Both students exceed the Teacher in this, the realistic, case\. The headline rates are those of Table[5](https://arxiv.org/html/2609.38831#S6.F5)\. Impersonation is not free on faithfulness—AlignScore0\.5500\.550is below 5\-shot FC \(0\.6360\.636\), the Teacher \(0\.6310\.631\), and the unmodified Gemma summary \(0\.6740\.674\), and PPL is1\.6×1\.6\\timesthat of the Gemma source\.

Figure 6:Further training preventsForgePrint\-9B rewrites from being classified as Gemma\.\(a\)Adding Gemma as a fifth label reduces the originalForgePrint\-9B target ASR from61%61\\%to19%19\\%, while the further\-trained student retains69%69\\%ASR\.\(b, c\)Under the Gemma\-5 evaluator, many rewrites from the original student are classified as Gemma \(72%72\\%\), compared with only1%1\\%after further training\. Hollow points show summaries before rewriting and colored points show their rewrites\. The additional training uses Gemma\-source paths but never a Gemma\-inclusive surrogate\.#### The adapted student on the original twelve paths\.

Gemma\-source training does not cost the student its original ability\. Scored back on the twelve LLM paths under the 4\-LLM suite of Table[2](https://arxiv.org/html/2609.38831#S5.T2), the Gemma\-source 9B adapter reaches73\.4973\.49Mean4\\mathrm\{Mean\}\_\{4\}, above the backbone control \(61\.1461\.14\); this is the adapted student shown in Figure[6](https://arxiv.org/html/2609.38831#A7.F6)\. It starts from the lockedForgePrint\-9B and is trained by DPO on the Gemma\-source four\-path Teacher rewrites together with the original twelve\-path pairs; the extra on\-manifold Gemma\-source data teach the student to leave the open\-model bucket without losing target ASR\. Because it consumes additional training data under a different recipe, it is reported separately from the main comparison\. Table[24](https://arxiv.org/html/2609.38831#A7.T24)splits both adapters by evaluator on that suite and on the four\-path Gemma\-5 suite of Section[6\.4](https://arxiv.org/html/2609.38831#S6.SS4)\. On twelve paths, RoBERTa is the most permissive evaluator for both students \(85\.1985\.19vs\.67\.7567\.75\) and DeBERTa the strictest\. The\+12\.4\+12\.4Mean4lift is uneven:\+17\.4\+17\.4on RoBERTa against\+7\.2\+7\.2on DeBERTa\. On the four Gemma paths the unadapted backbone control collapses \(14\.4114\.41\), and the most permissive evaluator is TF\-IDF \(31\.0031\.00\), not RoBERTa\. The Gemma\-source 9B recovers66\.6966\.69on that same four\-path suite, with RoBERTa again the easiest evaluator \(75\.2575\.25\)\.

Table 24:Target ASR \(%\) by evaluator for theForgePrint\-9B backbone control and the Gemma\-source 9B student\. Top: CNN/DM,1212LLM paths,n=2397n\{=\}2397, domain\-matched 4\-LLM\. Bottom: Gemma\-authored CNN/DM summaries, four Gemma→\\toLLM paths,n=800n\{=\}800, Gemma\-5Mean4\\mathrm\{Mean\}\_\{4\}\. The two rows are different adapters\. Bold: most permissive evaluator in that row\.

## Appendix HMechanism analyses

The analyses in this appendix use different scoring protocols from Table[2](https://arxiv.org/html/2609.38831#S5.T2)\. Absolute values are comparable with that table only where the protocol is 4\-LLM on the twelve LLM paths; elsewhere only within\-analysis differences are interpreted\.

### H\.1Directed\-path and domain effects

Figure[7](https://arxiv.org/html/2609.38831#A8.F7)gives the full1212\-path×\\times44\-domain matrix behind Figure[5](https://arxiv.org/html/2609.38831#S6.F5)forForgePrint\-4B\. An unweighted sum\-of\-squares decomposition over its4848cell means assigns32\.6%32\.6\\%to the directed\-path main effect,14\.0%14\.0\\%to the domain main effect, and53\.4%53\.4\\%to their interaction residual\. Nested inside the path term, the target accounts for82\.6%82\.6\\%of path SS, with source\-within\-target the remainder\. This is a descriptive cell\-mean decomposition, not a nested ANOVA or causal estimate\.

![Refer to caption](https://arxiv.org/html/2609.38831v1/fig_path_domain.png)Figure 7:Target ASR for each directed path \(rows, grouped by target\) in each domain \(columns\), for both students, under domain\-matched 4\-LLMMean4\\mathrm\{Mean\}\_\{4\}\. Difficulty tracks the target more than the domain, but cell means also show a large path×\\timesdomain interaction\. The main\-text heatmap \(Figure[5](https://arxiv.org/html/2609.38831#S6.F5)\) averages the three sources of each target\.
### H\.2Label\-set counterfactual: swapping the fifth class

This analysis asks one question: if every rewrite is held byte\-identical, does the defender’s unused fifth class change measured target ASR? The design is intentionally asymmetric: we fix the attacker and change only the defender\. It is not a matched five\-class attack\.

The attack is the twelve LLM→\\toLLM paths of Table[2](https://arxiv.org/html/2609.38831#S5.T2)\. Three five\-classMean4\\mathrm\{Mean\}\_\{4\}suites on CNN/DM \(n=2397n\{=\}2397\) score the same saved rewrites and differ in one slot: Human, Gemma, or Qwen3\.5\-9B\.

Table 25:CNN/DM target ASR \(%\) for the same saved rewrites under three fifth\-class suites\. Human\-5, Gemma\-5, and Qwen\-5 differ only in the unused fifth label\. The adapted99B student is the only policy trained after those classes were introduced\. This is a defender\-side counterfactual, not a matched five\-class attack\.Changing the fifth class substantially changes measured target ASR\. Relative to Human\-5, Gemma\-5 and Qwen\-5 drop Teacher /ForgePrint\-4B /ForgePrint\-9B by2525–4444points, while source evasion rises because the new class absorbs mass from the intended target\. Human\-5 is nearly inert: RoBERTa assigns none of the students’ CNN/DM rewrites to Human, and methods that never query a surrogate move by at most1\.61\.6Mean4\\mathrm\{Mean\}\_\{4\}points\. The absorbing class is not the attacker’s rewriter\. A Gemma rewriter is absorbed by the Qwen class almost as readily as by the Gemma class \(61\.461\.4against75\.075\.0\), and a Qwen rewriter is absorbed by both \(63\.763\.7and65\.665\.6\)\.

After source\-specific post\-training, the adapted99B student no longer falls into that extra open\-model bucket\. It holdsMean4\\mathrm\{Mean\}\_\{4\}target ASR at73\.573\.5,70\.970\.9,69\.369\.3, and71\.371\.3under 4\-LLM, Human\-5, Gemma\-5, and Qwen\-5, and cuts the absorbed share to0\.8%0\.8\\%and4\.0%4\.0\\%\(Figure[6](https://arxiv.org/html/2609.38831#A7.F6), Appendix[G\.1](https://arxiv.org/html/2609.38831#A7.SS1)\)\.

## Appendix ICase studies and failure analysis

This appendix prints two whole rewrites\. Appendix[C\.3](https://arxiv.org/html/2609.38831#A3.SS3)showed what the operators do on one path; here each case sets one source summary beside the summary the target model itself wrote for the same document and beside the rewrites that two or three systems produced from the source, with the verdict of every held\-out evaluator\. The target’s own summary is the reference a reader can hold the rewrites against; the evaluators never see it during the attack\. Case 1 shows transfer that the strongest published baseline does not achieve \(Appendix[I\.1](https://arxiv.org/html/2609.38831#A9.SS1)\); Case 2 shows a failure that lands on a third model rather than the source \(Appendix[I\.2](https://arxiv.org/html/2609.38831#A9.SS2)\)\. Neither case was chosen by reading the text: each was drawn at random, seed4242, from a pool defined in that subsection\. Orange marks the spans the text refers to\. The line after each label gives the label that each of the four domain\-matched 4\-LLM evaluators assigns to that text, in the order RoBERTa, DeBERTa, GPT\-2, TF\-IDF, in bold when it is the target\.

### I\.1Transfer the baseline does not achieve

Case 1 is a CNN/DM success\. An instance enters the pool when five conditions hold\. The student’s rewrite is attributed toTTby the RoBERTa evaluator\. The rewrite of augmented zero\-shot, the strongest published baseline of Table[2](https://arxiv.org/html/2609.38831#S5.T2), is not\. The student’s probability onTTlies between the 30th and 70th percentiles of its CNN/DM successes, so the case is a typical success and not its best one\. Its AlignScore is at or above the median of those successes\. The rewrite is one of the720720judged CNN/DM rewrites of Appendix[D\.5](https://arxiv.org/html/2609.38831#A4.SS5)\(6060documents×\\times1212paths\), and the judge labels itsupportedorminor\. RoBERTa selects the pool; the case reports all four evaluators\. The middle band is not a weak band: the student’s probability onTTexceeds0\.990\.99at both ends of it\.

Case 1 moves a Grok summary to Gemini\. Gemini’s own summary of the article is plain prose with no evaluative adjectives; three evaluators attribute it to Gemini and DeBERTa to Grok\. The student turns two long sentences into four short ones with one point each, opens with a framing sentence, and drops the free\-kick distance and the adjective*lively*\. The judge records both omissions and passes the rewrite\. Three evaluators name Gemini\. Augmented zero\-shot adds exclamations and evaluative adjectives, keeps the trailing brace of its completion template \(Appendix[C\.2](https://arxiv.org/html/2609.38831#A3.SS2)\), and is read as GPT or Grok\. The Teacher keeps the sentence shape of the source and stays at Grok for three evaluators\.

Case 1 — CNN/DM, Grok→\\rightarrowGemini \(cnndm\_Corpus B:22:Grok\_to\_Gemini\)source summaryevaluators: Grok / Grok / Grok / GrokManchester United will trial MK Dons teenagers Luke Tingey, an 18\-year\-old defender known for a viral 40\-yard free\-kick, and Kyran Wiltshire, a lively 18\-year\-old midfielder\. The pair, part of MK Dons’ Youth Alliance South Cup\-winning U18 side, will train at Carrington ahead of United’s UEFA U19 Youth League campaign\.target’s own summaryevaluators:Gemini/ Grok /Gemini/GeminiManchester United will give trials to MK Dons teenagers Luke Tingey and Kyran Wiltshire\. Tingey, a central defender, gained attention for a long\-range free\-kick, while midfielder Wiltshire has been part of MK Dons’ first\-team friendlies\. Both players, whose U18 team are Youth Alliance South Cup champions, will be assessed at Manchester United’s Carrington training ground to potentially strengthen their squad for the UEFA U19 Youth League\.aug\. zero\-shotevaluators: GPT /Gemini/ Grok / GrokExciting news for football fans\!Manchester United is set to welcome two rising stars, Luke Tingey and Kyran Wiltshire, to Carrington for a special trial\. Tingey, an 18\-year\-old defender who has already captured attention with a viral 40\-yard free\-kick, joins Wiltshire, a dynamic 18\-year\-old midfielder\. Both players bring impressive pedigrees from MK Dons’ trophy\-winning U18 side, and they will be honing their skills ahead of United’s upcoming UEFA U19 Youth League campaign\.It’s a fantastic opportunity to witness the next generation of talent in action\! \}teacherevaluators: Grok /Gemini/ Grok / GrokManchester United will trial two MK Dons teenagers, Luke Tingey and Kyran Wiltshire, ahead of the club’s UEFA U19 Youth League campaign\. Tingey is an 18\-year\-old defender known for a viral 40\-yard free\-kick, and Wiltshire is an 18\-year\-old midfielder\. Both players have been part of the MK Dons U18 side that won the Youth Alliance South Cup and are expected to train at Carrington\.ForgePrint\-4Bevaluators:Gemini/Gemini/Gemini/ GrokManchester United is preparing for its upcoming UEFA U19 Youth League campaign by conducting trials of promising young players\.Specifically,the club will assess 18\-year\-old defender Luke Tingey and 18\-year\-old midfielder Kyran Wiltshire\. Both players are members of the MK Dons U18 squad that recently won the Youth Alliance South Cup\.This trial period will involvetraining sessions at Carrington\.

### I\.2Where the student fails on ArXiv

ArXiv is the student’s weakest domain \(Table[2](https://arxiv.org/html/2609.38831#S5.T2)\), and the target decides the failures\. Under the RoBERTa evaluator the student misses Claude as the target on 579 of 600 ArXiv instances, against 147 of 600 when Claude is the source; Figure[7](https://arxiv.org/html/2609.38831#A8.F7)gives the four\-evaluator view,4\.64\.6–6\.5%6\.5\\%on the three paths into Claude\. Of the 1167 ArXiv misses over all twelve paths, 516 stay at the source and 651 land on a third model\. These counts are one evaluator’s argmax and are not on Table[2](https://arxiv.org/html/2609.38831#S5.T2)’s scale\. Case 2 shows a miss that lands on a third model\. It was drawn at random, seed4242, from the Claude\-involving ArXiv misses of that kind whose top probability lies in the middle band of that class\. There is no LLM judge on ArXiv; the target’s own summary is capped at220220words so that the case fits a page\.

Case 2 aims a Claude summary at Gemini and lands on GPT for three evaluators and Grok for the fourth\. The student halves the length, removes every heading and bullet, and writes one dense paragraph opened by participles and closed by*consequently*: the same GPT register as a successful GPT\-targeted rewrite\. Gemini’s own summary of the paper is three prose paragraphs that open with*This paper investigates*\. The Teacher makes a lighter edit, keeps that same opening sentence from the source, adds a reporting frame, and is read as Gemini by all four\. Suppressing the source is not the same as reaching the target\. This is the pattern behind the miss destinations of Section[3\.2](https://arxiv.org/html/2609.38831#S3.SS2): the rewrite counts as evasion and fails as transfer\.

Case 2 — ArXiv, Claude→\\rightarrowGemini \(arxiv\_Corpus B:60:Claude\_to\_Gemini\)source summaryevaluators: Claude / Claude / Claude / Claude\# SummaryThis paper investigates the off\-shell propagating behavior of photons in atoms during photon\-atom scattering using bound\-state quantum electrodynamics \(QED\)\.\#\# Main Points:1\.Problem Statement: When photons propagate through optical media, they become “off\-shell” \(violating the relativistic energy\-momentum relation\), unlike in vacuum where they are “on\-shell\.” The paper aims to explain this off\-shell behavior during photon\-atom interactions\.2\.Limitations of Existing Models: Standard quantum optics models \(Jaynes\-Cummings, semi\-classical approaches\) rely on the electric dipole approximation, which restricts them to long\-wavelength light and cannot describe photon propagation within atoms\.3\.Proposed Solution: Bound\-state QED with S\-matrix formalism is more suitable because it: – Handles light\-atom interactions at all wavelengths – Naturally describes off\-shell photon propagation through Feynman propagators – Avoids the electric dipole approximation limitations4\.Key Findings: – Only ground\-state bound electrons serve as initial/final S\-matrix states \(excited states decay via spontaneous emission\) – Feynman propagators of bound electrons determine photon propagation properties in atoms – These propagators exhibit superluminal but causality\-preserving amplitudes – The framework explains various scattering processes: Rayleigh, Compton, and Raman scattering5\.Experimental Implications: The approach is particularly valuable for studying short\-wavelength light \(X\-rays, gamma rays\) interactions with atoms, where traditional approximations fail\.target’s own summaryevaluators:Gemini/Gemini/Gemini/GeminiThis paper investigatesthe “off\-shell” behavior of photons propagating within atoms during photon\-atom scattering processes, using the framework of bound\-state quantum electrodynamics \(QED\)\. Traditional quantum optics models, relying on the electric dipole approximation, are limited to long\-wavelength light and cannot accurately describe photon propagation within atoms\. Bound\-state QED, however, offers a more fundamental approach that is valid for all wavelengths and naturally incorporates the off\-shell behavior of photons\.The study utilizes the S\-matrix formalism of bound\-state QED to analyze photon\-atom scattering\. It identifies that only ground states of bound electrons are suitable as initial and final states for the S\-matrix due to spontaneous emission\. Various photon\-atom scattering processes, including Rayleigh, Compton, and Raman scattering, are explained through specific Feynman diagrams within this framework\. The internal electron lines in these diagrams, represented by Feynman propagators, phenomenally describe the off\-shell amplitudes of photons within atoms\. These propagators exhibit a superluminal yet causal property, which is linked to the observed superluminal group velocity of light pulses in atomic media\.The paper also establishes a connection between the bound\-state QED approach and the widely used light\-atom interaction models in quantum optics, showing that the latter can be viewed as an electric dipole approximation of the former\. While quantum optics models are suitable for time\-differential processes, bound\-state QED with its S\-matrix formalism is better suited for time\-integrating processes like photon\-atom scattering, especially for short\-wavelength light where the electric dipole approximation fails\. The research suggests that experimental observations of off\-shell photon propagation, particularly with X\-ray photons, are possible with advanced light sources and experimental setups\.teacherevaluators:Gemini/Gemini/Gemini/GeminiThis paper investigatesthe off\-shell propagating behavior of photons in atoms during photon\-atom scattering using bound\-state quantum electrodynamics \(QED\)\. While photons in a vacuum are “on\-shell,” they become “off\-shell” when propagating through optical media, a phenomenon this research aims to explain\.The study notes thatstandard quantum optics models, such as the Jaynes\-Cummings model, are limited by the electric dipole approximation and cannot describe photon propagation within atoms\. Instead, the research utilizes bound\-state QED with S\-matrix formalism, which handles light\-atom interactions at all wavelengths and naturally describes off\-shell propagation through Feynman propagators\. Key findings indicate that Feynman propagators of bound electrons determine photon propagation properties, exhibiting superluminal but causality\-preserving amplitudes\. This framework successfully explains Rayleigh, Compton, and Raman scattering, offering significant value for studying short\-wavelength interactions like X\-rays and gamma rays\.ForgePrint\-4Bevaluators: GPT / GPT / GPT / GrokThis research investigates the off\-shell propagation of photons within atoms during photon\-atom scattering,utilizing bound\-state quantum electrodynamics \(QED\)to overcome the limitations of standard Jaynes\-Cummings and semi\-classical models\.By employing S\-matrix formalism,the framework avoids the electric dipole approximation and naturally handles light\-atom interactions at all wavelengths\. Although excited states decay via spontaneous emission, only ground\-state bound electrons serve as the initial and final S\-matrix states, with their Feynman propagators determining the properties of photon propagation\. These propagators exhibit superluminal amplitudes that remain causality\-preserving\.Consequently,the framework explains Rayleigh, Compton, and Raman scattering, offering a solution for the study of short\-wavelength light interactions with atoms\.

## Appendix JPotential limitations

This appendix outlines several limitations of the current study and the scope in which the results should be interpreted\.

- •task and model scope\.Our experiments focus on controlled summarisation and closed\-set attribution among four commercial models\. This setting allows different models to express the same underlying content, which helps separate changes in writing style from changes in topic\. We do not test whether the same results extend to open\-ended generation, substantially larger label spaces, or other model tiers\.
- •defender setting\.Our conclusions concern supervised text\-only attribution classifiers trained on unmodified text\. The attack never queries these evaluators and does not use their parameters or training data\. We do not evaluate adaptive classifiers retrained on targeted rewrites, or other provenance mechanisms such as watermarks and execution records, which operate under different assumptions \(Section[3\.3](https://arxiv.org/html/2609.38831#S3.SS3)\)\.
- •training variability\.Each Student configuration is trained once\. The confidence intervals in Table[2](https://arxiv.org/html/2609.38831#S5.T2)therefore measure variation over test documents rather than variation across independent training runs\. All main comparisons use the same frozen evaluation protocol\.
- •rewrite quality\.Rewrite quality is evaluated with AlignScore, MiniCheck, and a separate LLM judge on a subset of CNN/DM \(Appendix[D\.5](https://arxiv.org/html/2609.38831#A4.SS5)\)\. We do not include human evaluation, so these results should be interpreted as metric\-based assessments of faithfulness rather than human judgments of overall rewrite quality\. We also analyze rewrite length and added content, but do not claim to fully separate every surface feature from model\-specific style\.
- •cross\-domain operator transfer\.The operator bank is built once on CNN/DM and then reused unchanged on ArXiv, SAMSum, and WikiHow\. The cross\-domain results therefore measure transfer of a fixed bank; they do not show how much additional gain a domain\-specific bank might provide\.
- •cost estimates\.Appendix[F\.1](https://arxiv.org/html/2609.38831#A6.SS1)reports marginal inference costs using published prices and measured decoding time\. These estimates exclude one\-time data collection and training costs and should not be interpreted as the operating cost of any model provider\.