Should an LLM’s watermark detector be made public? A dual-key method shows that the risk remains contained

Suppliers keep their watermark detectors secret for fear of them being circumvented. A study proposes publishing half of them: forgery then becomes possible, but remains detectable using the private key.

Watermarking the generated texts is used to find the origin of a chatbot's or agent's outputs, but the detectors almost always remain internal: publishing them would allow an attacker to retouch a text by monitoring the detector's response. An arXiv article of October 8, 2026 calls this caution into question, based on an observation: these watermarks already have a hard time resisting blind alterations.

A public key, a private key

The researchers first measure what a public detector would add as a risk depending on the level of access offered, from the score per token to the simple yes/no verdict. They then propose a split-key watermark: one key is exposed via a public detector, the other remains with the provider for full verification and investigation. An informed attacker can only act on the public signal, which creates an imbalance between the two scores, detected by a dedicated statistical test.

The result of tests on many attacks: the public detector only helps to erase the watermark for small alterations, because a simple reformulation can already do so at a lower cost. On the other hand, it facilitates counterfeiting, which the private channel knows how to spot. For the authors, publishing half of the watermark provides transparency and interoperability without exposing the supplier.