Multi-Model Token Mixing as a Watermark Evasion Architecture

Multi-model token mixing defeats KGW-family watermark detection not by rewriting words after the fact, but by structurally dispersing the green-token signal across incompatible hash spaces at generation time. The evasion is architectural rather than cosmetic. That is why paraphrasing and logit-inversion attacks stay inherently fragile when you compare them with mixing output across providers at the token level.

How KGW-family watermarks embed a detectable signal at generation time

KGW watermarking works by converting every decoding step into a biased coin flip. A pseudorandom hash of recent context splits the vocabulary into a green subset and a red subset, then adds a logit bonus δ to green tokens before sampling, so the model systematically over-selects from that subset across the whole passage. The distortion is applied at the logit level before softmax, which means it stays invisible to a reader while accumulating statistically across token positions.

The green-list partition is not a fixed vocabulary. Because it derives pseudorandomly from preceding context, any given token can be green in one sentence and red in the next. The signal lives in the aggregate count, not in specific word choices. Detection therefore takes the form of a standard statistical hypothesis test: the detector reconstructs the green set at every position, counts green tokens observed, and computes a z-score against the binomial null. A large positive z-score flags the text as watermarked.

Three parameters control the detectability-quality tradeoff. The green-list fraction γ covers roughly half the vocabulary in the canonical construction, δ sets the logit bias strength, and k fixes the hash context length, or how many preceding tokens are hashed to seed the partition. Confidence grows sublinearly with T, which is why short texts are structurally harder to flag. The detector is measuring one thing: whether the proportion of green tokens in a passage sits far enough above the null expectation to rule out chance.

Why the z-score is the single point of failure that mixing exploits

The watermark's entire strength rests on one number staying elevated. If the proportion of green tokens in a passage is driven back toward the binomial null, the z-score collapses and the detector fails. An attacker does not need the secret key to accomplish this. If there is no watermark, green and red tokens come out even and z stays near zero. The watermark raises z by inflating the green proportion above γ, so any pipeline step that reduces that proportion attacks the signal directly.

The formal result from BIRA sharpens the point. If you reduce the average conditional probability of sampling a green token by a small margin δ, the detector's success rate decays exponentially in δ² relative to text length. A small, sustained nudge is sufficient. A dramatic rewrite is not required. This "small margin" vulnerability sets the attacker's bar remarkably low. You do not need complete inversion, just partial interference with green-token selection, to push z below the detection threshold of 4.

CMU's analysis of KGW on a leading open-weight model demonstrated this empirically. When strategic token selection cut the green-token share, the median post-attack z-score fell to 1.43, well below the threshold of 4, while sentence quality held up. The structural point is what matters here. The detector trusts an aggregate proportion, and an aggregate proportion is exactly the kind of signal that dissolves when a pipeline introduces sources that do not share the same statistical bias.

What token mixing actually does to the green-list signal across incompatible hash spaces

Multi-model token mixing is not just another evasion technique but a structurally different category of attack, because it exploits the z-score vulnerability passively, without targeting the watermark at all. When output tokens are drawn from two or more models whose green lists are keyed to different hash functions, the combined text inherits no single model's green-token elevation. The signal dilutes toward the null expectation by construction, not by intent.

Each KGW-family model derives its green list from its own secret key ξ. A different model with a different ξ produces a statistically uncorrelated partition: tokens green for Model A are randomly distributed across Model B's green and red lists. So a passage built from both models ends up with about the null rate of green tokens under either model's detector. Model A's elevated green count is diluted by Model B's uncorrelated selections, and vice versa. It is not necessary to identify which tokens are green, query the detector, or know the key. The architecture is the attack.

A self-hosted open-source model, a Llama or Mistral variant, has no watermarking infrastructure, so it drops out of the detection graph entirely. Text watermarking requires the generator to participate in the protocol. An unwatermarked intermediate model in a mixing pipeline contributes tokens with no green-list signal at all, accelerating the dilution. The evasion is a byproduct of genuine multi-source authorship, not a post-hoc intervention applied to a single model's output.

Why paraphrasing and logit-inversion attacks remain fragile by comparison

Paraphrasing and logit-inversion attacks reduce the z-score by actively manipulating token choices after generation. The process works, but it carries a fragility that passive architectural dilution does not. Topic-based watermarking research, published in ACL 2026 Findings as TBW, identifies the core weakness of random KGW that paraphrasing exploits: green-list tokens are semantically unrelated to context, so a paraphraser replacing words with synonyms frequently escapes the green partition. Yet this same property is what makes semantic watermarks harder to paraphrase away.

Newer watermark designs directly close the paraphrasing gap. TBW clusters vocabulary into semantically cohesive topic-aligned green lists so that synonyms substituted during paraphrasing fall into the same topic list, preserving the watermark signal despite lexical change. The fragility is asymmetric. Defenders can patch paraphrasing attacks by redesigning the vocabulary partition, as TBW does. Architectural mixing across uncorrelated key spaces cannot be patched at the partition level because the dilution is not a function of what words are chosen but of which models generated them.

Query-based attacks, inferring the green list via repeated detector queries, are impractical for text of unknown provenance. They require access to the watermarked model or partial knowledge of the scheme. Realistic content teams cannot rely on this. The contrast is durable: paraphrasing attacks operate inside the watermark's design space and can be answered by a better design. Mixing operates outside that space entirely.

How model merging and open-source watermarks change the threat landscape for both sides

Open-source model merging, combining multiple fine-tuned checkpoints into one set of weights, erases watermarks embedded in any individual constituent model. Experimental results from prior work confirm that current LLM watermarking techniques do not survive model merging, while model fingerprinting techniques are more robust in this setting. But fingerprinting requires actively querying a suspect model and cannot inspect already-published text, so it is no use as a production-time content audit mechanism.

ETH Zürich's SRI Lab introduced Merge-Adversarial Training (MAT) at NeurIPS 2026, which bakes watermark durability into model weights by simulating merging during the training process, so the digital signature survives post-release modifications. The approach outperforms all baselines with up to +51 percentage points TPR and a substantial average gain while preserving downstream capabilities. MAT represents a genuine advance for closed-model watermarking, but it is a training-time intervention requiring the model developer to adopt it. Open-source models "allow users full control over the decoding process," a setting the research community acknowledges as understudied and unsolved.

The open-source blind spot is structural. A pipeline that routes through a self-hosted model with no watermarking infrastructure produces tokens with no green-list signal, and no detection system can read what was never written. Content teams operating mixed pipelines today are operating in that gap.

What provenance standards like C2PA and SynthID can and cannot detect about mixed-model output

C2PA and SynthID establish provenance by recording what a participating generator declared at signing time. They cannot detect content from generators that opted out of the protocol, which means a multi-model pipeline with any unwatermarked stage has no detectable signal at all. C2PA does not detect AI-generated content. It records what was declared at signing time. A missing C2PA credential is not evidence content is human-made, and a present credential is not evidence the declared information is accurate. The shared blind spot is explicit in both Google's and OpenAI's documentation: content from a generator that opted into neither standard has no signal to read at all.

On May 19, 2026, OpenAI announced it was joining C2PA and embedding Google DeepMind's SynthID watermarks into every image produced by ChatGPT and the OpenAI API, and previewing a public verification tool. At I/O 2026, Google said SynthID and C2PA content credentials are going straight into Chrome and Google Search. Microsoft began adding C2PA metadata to M365 content in February 2026. These are significant adoption milestones for closed-model output, but they do not close the blind spot.

Adoption gaps remain. Midjourney does not embed C2PA credentials. Nikon's C2PA implementation was suspended after a signing vulnerability required full certificate revocation. The CA trust infrastructure runs about $289 to $600 per year from paid CAs such as DigiCert and Trufo, but SSL.com added a free Level 1 Claim Signing Certificate tier in mid-2026. The institutional layer built on top of watermarking has its own blind spots, and multi-model pipelines fall into them by default.

Why architectural evasion requires multi-model output to read as a single coherent voice

Dispersed multi-model authorship and a unified output voice are not in conflict. The structural properties that dilute watermark signals do not require the tokens to be randomly assembled. A judge-panel selection layer can keep the voice consistent without restoring any single model's fingerprint. For the z-score to dilute, the final token sequence only has to draw from sources with uncorrelated green lists. It does not require random or unedited interleaving. A best-line-selection pass picks the most coherent token sequence from a pool of model drafts, so it achieves dilution while optimizing for voice.

Running content through distinct models at each stage, rather than one model checking its own work, can meaningfully reduce hallucinated statistics and tone drift. The provenance tracing problem and the quality problem are not the same problem, but a multi-model architecture can address both simultaneously. The practical constraint is that each handoff between models is also a watermark-dilution event. The architecture that produces compliance is structurally the same as the architecture that produces quality cross-checks. They reinforce rather than trade off against each other.

What content teams need to evaluate when choosing between architectural and surface-level evasion approaches

The right evaluation question for any watermark evasion approach is not whether it reduces the z-score today but whether the evasion is durable under watermark redesign. That question has a structural answer, because it splits architectural mixing from surface-level rewriting. Surface-level approaches, paraphrasing, logit inversion, post-hoc rewriting, are effective against current KGW designs but are patchable by defenders. TBW and MAT are already published responses. If a content team adopts a surface-level tool, it is betting on staying ahead of the watermark design cycle.

Architectural mixing is not patchable at the partition level. No redesign of the green-list vocabulary partition can make uncorrelated hash keys correlate, because the dilution is a mathematical consequence of key independence, not a property of any specific watermark design. Quantitative proof should be the evaluation standard. Z-score benchmarks run against real KGW-family detectors, with named threshold values, are the only reproducible evidence that evasion has occurred. Adjectives and claimed "undetectability" without benchmarks are not verifiable.

Workflow preservation matters for adoption. If a content team already has working briefs, approved outlines, and reliable drafts, it should not have to rebuild its process to reach compliance. The evasion architecture should fit into the existing pipeline, not replace it. Provider diversity is a signal of architectural genuineness. Mixing that draws from models across different providers, with structurally uncorrelated key spaces, is not the same as mixing two outputs from models that share watermarking infrastructure. A tool claiming multi-model output should be able to specify which providers it draws from and how key independence is maintained.