xlr8harder/trellismark-qwen3-4b-rephrasing

TrellisMark Qwen3-4B blind rephrasing corpus

This separate release contains the frozen detector-blind rephrasing experiment for [TrellisMark](https://github.com/xlr8harder/trellismark). Its 16,384 source documents are an exact document-ID-preserving subset of the [main TrellisMark Qwen3-4B confirmation corpus](https://huggingface.co/datasets/xlr8harder/trellismark-qwen3-4b). It publishes both rewriters' outcome records, retained rewrite text and token IDs, aligned key-only and model-assisted evidence, and the reports behind the article's countermeasure figures.

The rewriters received only a 200-Qwen-token source projection. They did not receive the watermark key, detector, user address, source prompt, or original preceding conversation. This release is separate from the main corpus because blind rewriting is a countermeasure dataset with its own models, acceptance contract, and failure modes.

TrellisMark demonstrates a surveillance capability. This release exists so the claim and a practical countermeasure can be checked; it is not a recommendation to deploy user-level watermarking.

At a glance

The source pool contains 128 uniformly sampled held-out user addresses with 128 independently prompted responses per address. Canonical source document IDs are unchanged from main-dataset revision v1.0.2, commit c3ed277f6cb167bf8339e404828dcdc9099b04c4.

Frozen rewrite contract

• —Source input: exactly the first 200 Qwen tokens of a marked response.
• —Rewriters: Qwen/Qwen3-4B-Instruct-2507 at revision cdbee75f17c01a7cc42f958dc650907174af0554, and google/gemma-4-12B-it at revision 707f0a3b8a3c7ad586ed01e27eafbad8a27dd0f7.
• —Blindness: no key, detector, address, source prompt, or request history.
• —Acceptance: the first response with at least 200 Qwen tokens and a Qwen-token length between 90% and 110% of the source length.
• —Content attempts: bounded; rows without a length-valid response retain an explicit failure reason.
• —Analysis prefix: the first 200 Qwen tokens of each accepted rewrite.

Length matching controls the amount of text available to the detector. It is not a semantic-quality guarantee. The residual-carry analysis separately reports multilingual embedding similarity and exact word/Qwen-token five-gram overlap, including detector-blind quality screens.

Load the data

from datasets import load_dataset

sources = load_dataset(
    "xlr8harder/trellismark-qwen3-4b-rephrasing",
    "sources",
    split="corpus",
)
rewrites = load_dataset(
    "xlr8harder/trellismark-qwen3-4b-rephrasing",
    "rewrites",
    split="corpus",
)
evidence = load_dataset(
    "xlr8harder/trellismark-qwen3-4b-rephrasing",
    "evidence",
    split="corpus",
)

source_document_id joins this release to the main corpus. rewrite_document_id uniquely identifies a rewriter/job pair. Accepted rows include token IDs in both the rewriter's native tokenizer and the Qwen tokenizer used by the detector. Rejected rows retain the frozen outcome and failure metadata but do not invent a retained rewrite.

Each evidence row contains flattened 32 x 4 matrices under key_only_position_by_symbol_scores and model_assisted_position_by_symbol_scores. Reshape either list to (32, 4) before aggregation and exact Viterbi decoding. The original compressed NPZ copies used by the analysis are under evidence_npz/.

Reproduce the article results

The results/ directory contains:

• —rephrase-curve-qwen3-4b-v1.json and rephrase-curve-gemma4-12b-v1.json: exact full-registry top-1 and top-10 recovery as independent accepted rewrites accumulate;
• —rephrase-residual-carry-v1.csv: row-level embedding similarity, word and Qwen-token five-gram carry, token lengths, language labels, and attribution diagnostics;
• —rephrase-residual-carry-v1.json: frozen thresholds, bootstrap summaries, detector-blind screens, correlations, and interpretation.

The standalone GitHub repository supplies the encoder and exact Viterbi decoder. Reproducing the published curves from cached evidence does not require either rewriter or the Qwen model. Rescoring new text with the model-assisted method does require the frozen Qwen model and scorer configuration.

export-manifest.json records a SHA-256 digest for every release artifact and the source evidence commitments. The source jobs, public rows, accepted rows, and cached evidence sets are checked for one-to-one alignment during export.

Interpreting the quality screens

Embedding similarity is used only as a coarse screen for obvious semantic drift. It is not a factuality judge. Token five-gram carry is the fraction of a rewrite's Qwen-token five-grams that occur anywhere in its frozen source prefix. It is mechanistically relevant because an unchanged five-token span preserves both an observed token and the four preceding tokens used for local watermark synchronization.

The article comparison drops the bottom 10% of embedding similarity, the top 10% of token-five-gram carry, or both, using quality/overlap variables alone. It does not inspect watermark evidence when deciding which rewrites to retain. These are descriptive screens rather than a causal decomposition of what makes watermark evidence survive.

Scope and limitations

• —This is an experimental existence proof and countermeasure study, not a production security system.
• —Both attacks rewrite marked Qwen3-4B text; other source and rewriter models may behave differently.
• —The length-only acceptance rule is intentionally simple and does not ensure factual or stylistic equivalence.
• —Failed content attempts are represented by their frozen failure outcome; the release does not reconstruct or promote rejected attempts as accepted text.
• —Reported recoveries are finite held-out observations, not population guarantees.

Sources, attribution, and licensing

Source and same-family rewrite text use `Qwen/Qwen3-4B-Instruct-2507`, whose model card lists Apache-2.0. Cross-family rewrites use `google/gemma-4-12B-it` under its model terms. Source prompt identifiers derive from `allenai/WildChat`, whose card lists ODC-By; prompt text is not included here.

The Hugging Face license: other label reflects the mixed contents of the repository. Our original TrellisMark contribution is MIT licensed, including the metadata schema, numeric evidence, analysis tables, and result reports. Generated prose and source-derived identifiers may remain subject to applicable upstream terms.

TrellisMark is an independent research project. It is not affiliated with or endorsed by Google, Qwen, AllenAI, Hugging Face, or the Gemma team.