Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

This ICML 2026 paper, “Linear Ensembles Wash Away Watermarks,” by Zhihao Wu, Gracia Gong, Qinglin Zhu, Yudong Chen, and Runcong Zhao shows that distributional watermarking for large language models is fundamentally fragile in the modern multi-provider ecosystem. The authors prove that if independently watermarked models from providers such as Meta’s Llama-3.1-8B, Qwen3-8B, and Ministral3-8B are linearly averaged, the ensemble recovers the unwatermarked consensus distribution with ℓ∞ error shrinking as O(1/√N), up to a second-order variance term. Building on this, they introduce WASH, which combines probability averaging with fluency-aware routing and context re-synchronization to handle mismatched vocabularies and tokenizers across heterogeneous models. Across six watermarking schemes, including AAR, DIPMark, ITS-Edit, KGW, Exp-Edit, and Water-Bag, WASH with just 3 models suppresses generation-time z-scores from 5–300 to below 2, below the detection threshold of 4, and reduces final-text detector TPR@5%FPR to below 50%. It also improves generation quality by 27.5% on average and runs about 6× faster than the strongest removal baselines such as De-mark and ToBlend, which often incur 12×–39× latency overhead. The key novelty is not brute-force rewriting but exploiting the independence of watermark perturbations across competing providers, suggesting that robust provenance detection will require coordinated watermark keys or cross-provider standardization rather than model-level defenses alone.