Differential privacy watermarks enable LM tracking without individual surveillance

The framing treats population-level privacy as a solution to adoption resistance, but the summary omits a critical detail: does shifting to aggregate analysis actually prevent fine-grained re-identification of individual texts through inference attacks on the population statistics themselves? The paper doesn't address whether an attacker with access to the aggregate model can still reverse-engineer which specific documents contributed to it.

This lands in direct tension with Anthropic's watermark rollout from late October, which exposed how easily compliance mechanisms fail under minimal adversarial pressure (Claude Opus 4.6 could be stripped with a single parameter tweak). That incident showed the gap between theoretical watermark robustness and deployment reality. This new work attempts to sidestep evasion by abandoning individual provenance tracking entirely, but the ScrambleMark paper from yesterday demonstrates that watermark systems face structural vulnerabilities that no privacy framework can fix if detection itself is exploitable. The Red-Green Sequence watermark may be mathematically sound on privacy grounds without solving the adversarial durability problem that already undermines deployed systems.

If researchers successfully extract individual document fingerprints from the population-level statistics using membership inference or gradient-based attacks within six months, the privacy guarantees collapse. Alternatively, if adoption of this framework by major model providers (Anthropic, OpenAI, Meta) stalls because users still distrust aggregate tracking as a proxy for surveillance, that signals the privacy reframing alone doesn't address the core adoption barrier.