Module A: Watermark robustness
How fast does detection fall apart as the text gets edited, and what does a stronger watermark cost? Both sweeps run in your browser.
How it works and its limits
The attacks here are simple structural perturbations: same-category word swaps, deletion, insertion and local reordering. They are not real paraphrasing. A real paraphrase attack, where a model rewrites the text, is expected to be more damaging and is the Attack Lab's job, not this page's.
Seeded, repeatable versions of both sweeps are in the benchmark.
Setup
Robustness under attack
Generates one watermarked passage, applies each attack at increasing strength (the fraction of words affected) and re-detects. The dashed line is the z = 4 detection threshold used across this project.
The z-score for each of the four attacks will chart here.
Bias strength (δ) tradeoff
For each δ, generates a fresh passage and self-detects it. Green fraction stands in for distortion: how far the green-word rate sits above γ, meaning how hard the bias pushed sampling away from unwatermarked text.
Two charts will appear here: detection strength and distortion, each against δ. The toy grammar has no real fluency model, so distortion is a structural proxy, not a measured text-quality cost.