When LLM Watermarks Corrupt Medical Texts: ETH Zurich Study Warns of Clinical Risks
> Paper: Marking the Wrong Symptoms: Evaluating LLM Watermarks in Medical Texts > Authors: Melanie Rieff, Robin Staab, Thibaud Gloaguen, Stefan Hegselmann, Martin Vechev (ETH Zurich) > arXiv: 2607.20462 > Venue: FM4LS @ ICML 2026, AI4GOOD @ ICML 2026
This forum post discusses a new ETH Zurich study on a hidden danger of LLM watermarking in medical applications.
Background: What watermarking is and why it matters
LLM watermarks embed statistical biases during text generation—e.g., subtly steering token choices toward a "green list"—so that a detector with the secret key can verify that text came from an AI model. The bias is designed to be imperceptible in general text, where synonyms are abundant and language is redundant.
Why medical text breaks this assumption
Medical text has an extremely high density of low-entropy vocabulary: terms like "myocardial infarction" vs. "myocardial injury" differ by only a couple of characters but imply entirely different pathologies and treatments. Standard watermark evaluations on general benchmarks (fluency, coherence, human preference) do not capture damage to such terms—like measuring only a painting's dimensions while ignoring color and composition.
What the study did
- Evaluated 5 watermarking schemes: KGW (Kirchenbauer et al.), SWEET, DiPmark, EXP-edit, and post-hoc detection (LogRank, DetectGPT)
- Across 11 LLMs and 7 vision-language models
- On single-modal and multimodal clinical reasoning tasks
- With a human-expert-validated pipeline auditing: medical reasoning quality, terminology precision, and induced hallucinations
- Medical AI developers: Watermarking should not be a default-on feature; domain-specific evaluation is mandatory before deployment.
- Regulators: A "watermark verified" flag means provenance, not safety—verification confirms identity, not accuracy.
- Research community: The study calls for domain-adaptive watermarking that recognizes and protects critical domain vocabulary (diagnostic terms in medicine, statute citations in law, technical parameters in engineering).
Key findings
1. Lexical corruption: Watermarking subtly shifts critical terms—e.g., "acute myocardial infarction" toward "acute myocardial injury"—which changes the implied treatment pathway. Branch-point experiments show that when the watermark first acts after a clinical prefix, the direction of the response diverges significantly. 2. Hallucinated terminology: Watermark pressure can invent non-existent medical concepts. In one recorded case, a question about post-streptococcal glomerulonephritis (PSGN) produced descriptions matching focal segmental glomerulosclerosis (FSGS)—a systematic, watermark-induced misattribution rather than random error. 3. Misattribution or omission of imaging findings: In multimodal tasks, watermarks caused findings to be attributed to the wrong pathology or key imaging features to be omitted entirely.
Why aggregate benchmarks hide these failures
Watermark bias is not uniformly distributed—it concentrates on "low-entropy" tokens the model considers obvious, which in medical text carry the most critical information. Aggregate fluency metrics can look fine ("only 2% degradation") while that 2% lands exactly on decisive clinical terms. Clinical reasoning is also chained: an early terminology error can cascade through the entire diagnostic reasoning process.
Implications
Conclusion
The authors' core claim: domain-specific evaluation should be a prerequisite for the safe deployment of watermarked models in medical settings. Watermarking provides valuable traceability, but generic benchmarks can mask clinically consequential failures in high-stakes domains.
References
1. Rieff, M., Staab, R., Gloaguen, T., Hegselmann, S., & Vechev, M. (2026). *Marking the Wrong Symptoms: Evaluating LLM Watermarks in Medical Texts*. arXiv:2607.20462. 2. Kirchenbauer, J., et al. (2023). A Watermark for Large Language Models. *ICML*. 3. Hastuti, R.P., et al. (2025). Factuality beyond coherence: Evaluating LLM watermarking methods for medical texts. *EMNLP 2025 Findings*. 4. Kuditipudi, R., et al. (2024). Robust Distortion-free Watermarks for Language Models. *TMLR*.