LLM Self-Recognition: Watermarking AI Text with Activation Signatures

This post introduces and analyzes the paper LLM Self-Recognition: Steering and Retrieving Activation Signatures by Thibaud Ardoin, Jonas Schäfer, and Gerhard Wunder (BMBF-funded).

• Paper: arxiv.org/abs/2606.06315
• Code: github.com/Thibaud-Ardoin/LLM-Self-Recognition

Key points

LLMs naturally recognize their own text

• Using 8192 BBC news articles from XL-Sum (a low-entropy summarization task), models extract averaged mid-layer activations and classify with LDA.
• AUROC results: Ministral-3-8B 100% (with prompt) / 99.99% (without); Llama-3.1-8B 99.99% / 99.16%; Llama-3.2-3B 99.96% / 99.03%; Llama-3.2-1B 99.82% / 98.58%.
• Perplexity baselines collapse to 32–52% AUROC without the prompt — essentially random — while the activation-based method barely degrades.

Random sparse vector steering

• During inference, a random sparse vector v (99.7% zero dimensions) is added to mid-layer activations: each token's activation gets α·v. Detection extracts activations from text and classifies which steering vector produced it.
• Sparsity minimizes semantic interference while keeping the signal detectable (concentration of measure: random high-dimensional vectors are near-orthogonal to the semantic manifold).
• Instance attribution results (Text F1): Ministral-3-8B 100%, Llama-3.1-8B 99.1%, Llama-3.2-3B 95.5%, Llama-3.2-1B 85.3%. Text-level majority voting outperforms token-level by a wide margin; larger models carry stronger signals.

The signal survives discretization

• Although steering operates in the continuous activation space and generation discretizes it (softmax → sampling → re-embedding), an unsteered model can identify the source steering vector via raw cosine similarity — no trained classifier — at 84.6% text-level accuracy, still 77.8% after DIPPER-XXL paraphrasing.

Sparse vs. dense steering

• At equal detectability, sparse vectors damage text quality far less than dense vectors — the recommended choice for production watermarking.

Robustness to paraphrasing

• After DIPPER-XXL rewriting: KGW watermark F1 drops from ~95% to ~60%; the activation-signature method drops from ~99% to ~89%, because the signal aggregates over many tokens in a higher-level representation space.

Limitations

1. White-box assumption: detection requires internal activation access, ruling out closed-source APIs. 2. Architecture boundary: signatures do not transfer across architectures (Llama-steered text is undetectable by Mistral). 3. Forgery risk: an attacker knowing the steering vector and layer can fake signatures. The authors propose dynamic steering (vectors rotating on a pseudo-random schedule during generation) as a defense.

Takeaways

• AI content auditing: activation signatures are far more reliable than perplexity-based detection for platforms flagging AI-generated content.
• Model provenance: different deployment instances of the same base model can be distinguished via steering vectors.
• Philosophical angle: LLMs leave emergent identity signatures in their internal representations — a "genome" that doesn't affect what the model says, but faithfully marks who said it. The internal high-dimensional geometry is more robust than expected, surviving tokenization and attention layers.

The code is open-sourced and reproducible on Llama-3.1-8B at low cost.