# Regulators just mandated a robust watermark that a proof says cannot exist.

A compliance lead at a model provider reads Article 50 of the EU AI Act and treats it as a build ticket. The requirement is clear enough to scope: anything the company's models generate — audio, image, video, text — has to be marked so a machine downstream can detect it as artificially generated. There is a date attached — 2 August 2026, already in force — and a phrase that reads like acceptance criteria: the marking has to be _robust and reliable_. The lead routes the ticket to engineering as "ship a robust watermark by the deadline," and engineering, reasonably, starts evaluating watermarking schemes.

Somewhere down the hall, a researcher who has read a different document is uneasy. The document is a proof. It argues that, under assumptions that look entirely natural for a deployed generative model, _strong watermarking is impossible_ — not hard, not expensive, not unsolved, but ruled out by an attack that any motivated user can run. The two documents are about the same object. One demands a robust mark by a date. The other says the robust version of that mark cannot be built. They cannot both be straightforwardly right, and the seam where they meet is five words long.

This post is about that collision: what the regulation actually commands, what the impossibility result actually proves, why the feasibility question is not settled but genuinely _disputed_ at the level of theorems and counter-experiments, and what the five-word carve-out in the statute is silently doing to hold the whole thing together.

## The statute commands a property, then quietly takes it back

Start with what Article 50 actually says, because the obligation and its escape hatch live one clause apart, and most readings notice only the first.

The duty is affirmative and specific. Under [Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems](https://artificialintelligenceact.eu/article/50/), a provider generating "synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated." That is not a labeling-for-humans requirement — it is a requirement that a _machine_ can read the mark back out, which is precisely the property a watermark detector is supposed to provide. The transparency obligations under Article 50 became fully enforceable on 2 August 2026, so this is not a horizon item; it is a live obligation.

Then comes the standard the mark must meet, and it is exactly the language an engineer would write into a spec: providers "shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible." Read the first six words and you have a hard requirement — effective, interoperable, robust, reliable. Read the next five and the requirement bends: _as far as this is technically feasible_. The statute names the property it wants and, in the same breath, ties the obligation to whatever the current state of technology can deliver. The robustness is not absolute. It is indexed.

Indexed to what, the Act also says. The feasibility judgment is to be made "taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art." So "robust and reliable" is explicitly relative — to content type, to cost, and to the acknowledged state of the art. The regulation does not assert that a robust mark exists. It asserts that providers must deploy one to the extent the field can produce one. The whole weight of the mandate now rests on a single empirical question the statute does not answer: how robust _can_ a watermark be made? And that is the question a proof has tried to settle in the negative.

## The proof says the robust version cannot exist

The reason the researcher down the hall is uneasy is that the negative answer is not a hunch. It is a theorem with an attack attached.

[_Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models_](https://arxiv.org/abs/2311.04378) (arXiv 2311.04378) states its result without hedging: "We prove that, under well-specified and natural assumptions, strong watermarking is impossible to achieve." Strong watermarking, here, is the property the statute is reaching for — a mark that survives an adversary trying to remove it while keeping the output useful. The paper's claim is that this property is not merely unachieved but unachievable under the stated conditions, which is a categorically different kind of obstacle than "nobody has built it well yet."

The mechanism is what makes the impossibility bite, and it is worth stating exactly because it is the same mechanism the statute's robustness clause runs into. The attack rests on two assumptions: "(1) The attacker has access to a 'quality oracle' that can evaluate whether a candidate output is a high-quality response to a prompt, and (2) The attacker has access to a 'perturbation oracle' which can modify an output with a nontrivial probability of maintaining quality, and which induces an efficiently mixing random walk on high-quality outputs." Put plainly: if you can tell whether a candidate output is still good, and you can make small quality-preserving edits, then you can wander randomly through the space of good outputs until you land on one that no longer carries the mark — without ever degrading the thing below usefulness. The watermark washes out; the content survives. That is the random walk the thesis points to, and modern models, with a second model standing in as the quality judge, supply both oracles cheaply.

Two further details close the obvious escape routes. The attack is not confined to the whiteboard: "The same attack successfully removes the watermarks planted by all three schemes, with only minor quality degradation" — three real, published LLM watermarking schemes, stripped, with the output still usable. And the impossibility holds in the setting a defender would consider strongest: "This holds even in the private detection algorithm setting, where the watermark insertion and detection algorithms share a secret key, unknown to the attacker." Keeping the scheme secret does not save it. So the paper's claim, against the statute's, is stark: the property Article 50 names — a mark robust against someone trying to remove it — is, under natural assumptions, the property this proof rules out.

## Practice is nowhere near the mandate either

Set the theorem aside for a moment, because there is a second, more mundane gap that cuts from the opposite direction. Even if a robust mark were buildable, almost nobody has built one.

[_Adoption of Watermarking for Generative AI Systems in Practice and Implications under the new EU AI Act_](https://arxiv.org/abs/2503.18156) (arXiv 2503.18156) goes and looks. The empirical finding is blunt: "only a minority number of AI image generators currently implement adequate watermarking (38%) and deep fake labelling (18%) practices" — a minority practice for a class of systems the same authors note is governed by an arriving legal duty. The paper frames the obligation directly: "watermarking and AI labelling measures are now becoming a legal requirement in many jurisdictions, including under the 2024 European Union AI Act." The mandate is real; the deployment is not.

The third thing the paper says is the one that should unsettle a policymaker. Before this work, "the practical implications and the current status of implementation of these measures remain largely unexamined." The state of the art the statute defers to was, at the point the duty was written, essentially unmeasured in the field. So Article 50 indexes "robust and reliable" to a state of the art that (a) a theorem argues cannot reach strong robustness and (b) most providers have not implemented even at its current, weaker level. The mandate is ahead of practice and, if the impossibility holds, ahead of possibility. The five-word carve-out is the only thing absorbing both gaps at once.

## The mark cannot satisfy both readers at once

There is a structural reason the gap is not just an implementation lag, and it is worth pulling out because it explains why "try harder" is not the fix.

[_Transparency as Architecture: Structural Compliance Gaps in EU AI Act Article 50 II_](https://arxiv.org/abs/2603.26983) (arXiv 2603.26983) reads the obligation precisely and finds it asks for two things that fight each other. The mandate is dual: "Art. 50 II of the EU Artificial Intelligence Act mandates dual transparency for AI-generated content: outputs must be labeled in both human-understandable and machine-readable form for automated verification." A mark a person can recognize, and a mark a machine can verify — and the paper's claim is that one artifact cannot be both, because the properties are in tension. "Watermarks surviving human inspection risk being learned as spurious features during training, while marks suited for machine verification are fragile under standard data processing." Make the mark robust enough for a human to rely on, and a downstream model can pick it up as a spurious feature; make it suited to machine verification, and routine processing erodes it. A single mark satisfying both is not a tuning target — it is a contradiction.

The paper's framing of the consequence is the part to keep. It argues "provenance tracking is not feasible under iterative editorial workflows and non-deterministic LLM outputs" — that the obstacle is structural, a compliance gap, not a bug an engineer will close next quarter. Editorial workflows edit; models generate non-deterministically; a mark that has to survive both, robustly and reliably, is being asked for something the architecture does not provide. This is the same family of failure as a [text watermark not surviving a paraphrase](/blog/watermarks-dont-survive-paraphrase/) — the mark lives in the malleable layer, and the malleable layer is exactly what gets reworked — and it is continuous with the [provenance manifest and watermark never being cross-checked](/blog/provenance-and-watermark-dont-cross-check/): two authenticity layers, each sound on its own terms, that the deployed system never reconciles. The structural reading says the mandate's "robust and reliable" is not one demanding property but two that cannot share a body.

## The honest part: the impossibility is contested, not settled

Here is where a careful version of this argument has to slow down, because the most important thing about the feasibility question is that it is _open_ — and a post that treats the impossibility theorem as the final word overstates exactly as badly as a compliance memo that treats the mandate as costless.

The same year's literature contains a direct rebuttal. [_Sandcastles in the Storm: Revisiting the (Im)possibility of Strong Watermarking_](https://arxiv.org/abs/2505.06827) (arXiv 2505.06827) goes after the impossibility result on its own terms — the assumptions. It grants the framing and then attacks the premises: "recent theoretical work argues that any watermark can be erased via random walk attacks that perturb text while preserving quality. However, such attacks rely on two key assumptions: (1) rapid mixing ... and (2) reliable quality preservation." The whole impossibility rests on those two oracles behaving as assumed. Sandcastles asks whether they do, in practice, and answers no.

The empirical findings are pointed. On mixing: "100% of perturbed texts retain traces of their origin after hundreds of edits, defying rapid mixing." The random walk the proof needs to wash out the mark does not, in their experiments, mix fast enough. On the quality oracle: "automated walks remove watermarks just 26% of the time -- dropping to 10% under human quality review." The attack the theorem treats as decisive succeeds about a quarter of the time when automated, and around one time in ten once a human checks that quality was actually preserved. Their conclusion inverts the framing: "practical barriers -- slow mixing and imperfect quality control -- reveal watermarking to be far more robust than theoretical models suggest." The assumptions that make the impossibility clean — instant mixing, a perfect quality judge — are, on this evidence, the ones that fail first when you leave the proof and enter the lab.

So the feasibility question is genuinely two-sided, and the honesty cuts both ways. The impossibility paper has a theorem and a working attack against three real schemes; the rebuttal has large-scale, human-validated experiments showing that same attack underperforming its theoretical promise. Neither side is obviously wrong — they disagree about whether the proof's assumptions describe a deployed system. And notice what that does to Article 50: the statute's "as far as this is technically feasible" defers to a state of the art on which the leading theoretical and empirical results _do not agree_. The rebuttal's own authors call for stronger methods and more realistic attack models — the matter is unsettled by the people closest to it. A regulator has pinned a binding obligation to a feasibility judgment the literature treats as contested, and any claim sharper than "contested" — in either direction — is reading past the evidence.

## Where this leaves the compliance lead

The collision, stated cleanly: a binding rule mandates a robust, machine-readable mark by a near date; a theorem argues the robust version is impossible under natural assumptions; a rebuttal argues those assumptions fail in practice; and an adoption study finds most providers have not shipped even the weaker thing. The phrase holding all four apart is "as far as this is technically feasible."

What that phrase does, once you see it, is move the dispute out of the statute and into a future fact-finding. The Act does not assert robustness is achievable; it requires providers to achieve it _to the extent the state of the art allows_, and defers the measurement of that extent to exactly the contested question above. It is neither a loophole nor a guarantee — it is a placeholder for an answer the field has not produced. A compliance reading that treats "robust and reliable" as a satisfiable checkbox is ignoring the theorem; a reading that treats the theorem as dispositive and the mandate dead-on-arrival is ignoring the rebuttal. The defensible reading is the narrow one: deploy the best available mark, document precisely what threat model it survives and what it does not, and treat the feasibility clause as the live, disputed thing it is. The same discipline a [model-weights provenance](/blog/weights-provenance/) claim demands — say the smaller true thing — is the one a watermark-compliance claim demands, because the larger claim is what a theorem is actively contesting.

The thing not to do is let the word "robust" in the statute and the word "robust" in a vendor's datasheet be assumed to mean the same thing. The statute means "robust as far as feasible," and feasibility is the open question. The datasheet means "robust against the attacks we tested." Between those two sits a proof arguing the property is impossible and a rebuttal arguing it is salvageable, and a compliance position that does not name which one it is betting on has not specified anything yet.

## Reading list

- [Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems](https://artificialintelligenceact.eu/article/50/) — the binding mandate: synthetic outputs must be marked in machine-readable, detectable form, "robust and reliable as far as this is technically feasible," enforceable 2 August 2026.
- [_Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models_](https://arxiv.org/abs/2311.04378) (arXiv 2311.04378) — proves strong watermarking impossible under natural assumptions via a quality-preserving random-walk attack that strips three real schemes with only minor quality loss, even when a secret detection key is held back.
- [_Adoption of Watermarking for Generative AI Systems in Practice and Implications under the new EU AI Act_](https://arxiv.org/abs/2503.18156) (arXiv 2503.18156) — finds only 38% of AI image generators implement adequate watermarking and 18% deep-fake labeling, with the field's status largely unexamined before the study, showing how far the mandate runs ahead of practice.
- [_Transparency as Architecture: Structural Compliance Gaps in EU AI Act Article 50 II_](https://arxiv.org/abs/2603.26983) (arXiv 2603.26983) — argues the dual human-and-machine marking duty is a structural contradiction, since marks robust to human inspection are learned as spurious features while machine-verifiable marks are fragile under standard processing.
- [_Sandcastles in the Storm: Revisiting the (Im)possibility of Strong Watermarking_](https://arxiv.org/abs/2505.06827) (arXiv 2505.06827) — contests the impossibility result empirically: 100% of texts retain origin traces after hundreds of edits, automated attacks remove watermarks only 26% of the time and 10% under human review, suggesting watermarking is more robust than the theory implies.

The compliance lead and the researcher were reading the same object from two ends. One saw an acceptance criterion with a date; the other saw a proof that the criterion names an impossible property — and a rebuttal arguing the proof's assumptions break in the lab. The statute resolves none of it; it inserts five words, "as far as this is technically feasible," and hands the dispute to a future that has to measure a state of the art the field is still arguing about. The mandate and the mathematics are not reconciled. They are deferred, and the deferral has a deadline.