Output watermarking is offered as the provenance answer for AI-generated text. A cheap paraphrase removes it at near-100% — so does a translation round-trip, and so does reverse-engineering a watermark built to resist exactly that. Provenance needs signing, not a statistical signal.
A team has to mark AI-generated text. The requirement arrives from somewhere with weight behind it — a regulator’s draft rule, a platform’s content policy, an internal commitment that anything the company’s models write should be identifiable as machine-written downstream. The team treats it as a tractable engineering problem, and reaches for the mechanism the field has been advertising for it: an output watermark. During generation, bias the token sampling in a structured way — favor a pseudorandomly chosen subset of the vocabulary at each step — so that later, a detector holding the same secret can score a passage and see the statistical fingerprint that human text would not have.
It works in the test harness. The team generates watermarked text, runs it through the detector, and the detector lights up with high confidence. They generate ordinary human text, run that through, and the detector stays quiet. Clean separation, low false-positive rate, a reproducible signal. The mechanism does exactly what the paper said it would, and the team writes it into the design as the provenance control.
Then someone on the team does the obvious adversarial thing. They take a watermarked passage, paste it into a second, unrelated language model, and ask it to reword the text. The meaning survives the rewording intact. The watermark does not. The detector, run on the paraphrased version, now reports the same thing it reports for human writing — nothing. The provenance signal the whole design rests on was removed by one cheap, ten-second step that any user can perform without understanding what a watermark is.
This post is about why an LLM output text-watermark is removed at a near-100% rate by a cheap paraphrase — why translation does the same, why even a watermark built to resist paraphrasing falls, and why provenance for AI-generated content needs cryptographic signing rather than a statistical signal hidden in token choices.
The mistake is a category error, and it is worth naming precisely, because the word “watermark” carries the wrong intuition.
The word evokes the mark in a banknote or a sheet of letterhead — something embedded in the substrate, hard to remove without destroying the document, present or absent in a way you can check. A physical watermark is bound to the medium. That is the mental model a team imports when it adopts a text watermark, and it is the wrong one.
An LLM text watermark is not bound to a substrate, because digital text has no substrate. It is a statistical bias in the choice of tokens. The watermarking scheme nudges the model, at each generation step, to prefer certain tokens over others according to a secret pattern, and the detector recovers the signal by measuring how strongly a passage’s tokens follow that pattern. The watermark is not in the text the way a fiber is in paper. It is in the specific words chosen — and only in the specific words chosen.
That single fact determines everything that follows. The information that constitutes the watermark is the identity of the tokens. The information that constitutes the meaning is something else — the semantic content, which can be expressed in many different token sequences. Paraphrasing is the operation that holds the second constant and replaces the first. A paraphraser keeps the meaning and swaps the words, and swapping the words is, by construction, swapping out the exact thing the watermark is made of. The watermark does not survive paraphrasing for the same reason a message written in a particular handwriting does not survive being retyped. The content carries over. The carrier does not. A watermark whose entire existence is the token choices cannot outlast an edit that exists to change the token choices.
If watermark removal required a research lab, a watermark would still be a real deterrent. It does not, and that is the load-bearing fact.
Removing a token-choice watermark does not require understanding the watermarking algorithm, holding the secret key, or having access to the model that produced the text. It requires only a second language model and the instruction “say this differently.” The second model rewrites the passage in its own words — its own token choices, which have no relationship to the first model’s watermark pattern. The detector, looking for the original pattern, finds noise. The attacker never had to attack the watermark. They routed around it, by regenerating the text through a process that has no reason to reproduce the signal.
Three properties make this fatal rather than merely inconvenient. The first is cost: a paraphrase pass through a commodity model costs a fraction of a cent per page, and it is one step, available to anyone. The second is that it requires no knowledge of the target: the attacker does not need to know which watermarking scheme was used, or that one was used at all — “reword this” is scheme-agnostic, so a defender cannot stay ahead by keeping the scheme secret. The third is that the meaning is preserved, which is what makes the attack useful to the attacker. A removal technique that garbled the text would defeat the watermark and also defeat the point of having the text. Paraphrasing does not garble. It is a semantics-preserving, watermark-destroying transform, which is exactly the transform an adversary wants and exactly the one a token-choice watermark cannot survive.
Translation is the same attack wearing different clothes. Translate the passage into another language and back, and the round trip regenerates every token twice through models that never saw the watermark pattern. The meaning makes the round trip. The token-level signal does not.
The argument so far is mechanical. The reason it is a post and not a hunch is that the removal has been measured — repeatedly, by separate groups, against the watermarking schemes actually proposed in the literature — and the numbers leave almost no room.
Start with the adaptive paraphrase attack. Optimizing Adaptive Attacks against Watermarks for Language Models (arXiv 2410.02440) treats watermark removal as an optimization problem — tune a paraphrase attack against the watermark — and reports that the resulting adaptive attacks evade every watermark surveyed at an evasion rate of at least 96.6%. Two details make that number worse than it first reads. An attack trained against one watermark transfers to unseen watermarks, so a defender cannot escape by switching schemes. And the full attack runs in under 7 GPU hours, at a cost under $10. The price of removing a watermark from this paper’s results is a single-digit dollar figure and an afternoon of compute.
The second result drives the cost down further and the success rate up. Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks (arXiv 2505.05190) introduces an attack called SIRA and runs it against seven recent watermarking methods. It achieves near-100% attack success, at a cost of about $0.88 per million tokens — not per page, per million tokens. The per-method numbers for SIRA-Large are the section’s sharpest evidence, because they are not an average hiding a weak case: KGW-1 at 100%, Unigram at 100%, EWD at 100%, DIP at 100%, EXP at 99.8%, UPV at 99.6%, SIR at 98.8%. Seven schemes, the lowest success rate among them 98.8%. And the attack is black-box — it needs no access to the watermark algorithm or to the watermarked model, and it transfers to any model used as the attacker. The watermarking method a team picks is, against this attack, not a variable that matters; the column is near-100% regardless of the row.
Translation closes a different escape route — the hope that a watermark survives if the adversary stays inside the document and merely moves languages. Can Watermarks Survive Translation? On the Cross-lingual Consistency of Text Watermark for Large Language Models (arXiv 2402.14007) defines a round-trip translation attack, the Cross-lingual Watermark Removal Attack, and reports that it removes watermarks and drops detection AUC to a random-guessing level with no performance loss — the text still says what it said, and the detector can no longer tell it from human writing. The post-attack AUCs collapse: KGW falls to 0.61, UW falls to 0.54. An AUC of 0.5 is a coin flip, and these are at or near it. The same paper notes one watermark, SIR, is more resistant — but more resistant means 0.67, a degraded signal, not a surviving one. Translation drops watermark detection to chance.
The last result demolishes the strongest remaining defense — the watermark engineered specifically to resist paraphrasing. Revisiting the Robustness of Watermarking to Paraphrasing Attacks (arXiv 2411.05277) shows that even watermarks deliberately designed to resist paraphrasing fall once an attacker reverse-engineers them from black-box samples. With only about 200K tokens of watermarked output — a modest corpus, collectible by anyone with query access — the watermark’s green list can be predicted at over 0.8 F1. Once that internal structure is recovered, detection collapses: Unigram’s true-positive rate at a 1% false-positive rate falls from 99.3 to 0.2, and SIR’s falls from 93.3 to 3.8. A watermark built to survive paraphrasing did not survive an attacker who first learned what the watermark was and then erased it.
Read the four together. Adaptive paraphrasing: at least 96.6% evasion, under $10. Self-information rewrite: near-100%, with no scheme above 1.2% survival, at $0.88 per million tokens. Translation: detection dropped to a coin flip. Robust-by-design watermarks: reverse-engineered from 200K tokens and then broken. There is no row in this table where the watermark wins against an adversary willing to spend a few dollars.
Four results that all point the same way invite a conclusion broader than they actually support.
The numbers do not say watermarking is useless. They say something narrower, and the narrower thing matters. Every result above is a measurement against an adversary — someone who deliberately runs a paraphraser, sets up a translation round-trip, or collects samples to reverse-engineer the scheme. That is the threat model the attacks inhabit, and against that threat model the watermark loses. But not every downstream consumer of text is that adversary.
A watermark does raise the cost of casual, low-effort passing-off. The user who copies a model’s output verbatim into an assignment, a review, or a submission — and does nothing else, because it did not occur to them, or because the friction of one more step was enough — is caught by a watermark detector. That user is not negligible; a great deal of undisclosed AI text in the wild is exactly that lazy. Against the unsophisticated, a watermark is a working deterrent and a working filter. It catches the people who would have been caught by any speed bump, and there are a lot of them.
So the honest claim is a claim about the threat model, not a claim that the mechanism does nothing. Watermarking is a weak deterrent — it deters the casual and the careless. It is not a provenance guarantee, because a guarantee has to hold against someone trying to break it, and against someone trying, the watermark is removed for under a dollar. The failure is specific and it is total: it is the failure against a motivated adversary. A team may legitimately deploy watermarking to raise friction for the lazy majority. The error — the only error this post is calling an error — is writing a watermark into a design as the provenance mechanism, as the thing that will answer “did a machine write this” when the person asking is motivated to make the answer come out wrong. For that question, against that person, watermarking has no answer.
One consequence of this scoping is non-negotiable and is stated again in the recommendations: a watermark detector’s negative result is uninformative. Because removal is cheap and silent, a passage that fails to trigger the detector might be human-written, or might be machine-written and paraphrased. The detector cannot distinguish those, and a system that reads a negative as “human” is reading a removed watermark as proof of human authorship — which is precisely the conclusion the cheap attack was designed to manufacture. This is the same trap a media-classifier detector falls into when its measured accuracy is read as coverage, the subject of the coverage debt of deepfake detection — a detector’s confident silence is not a verdict, and treating it as one is how the gap gets hidden.
Watermarking cannot carry provenance against an adversary. Here is what can — and the first thing to be clear about is that this section is the post’s own argument, not a finding lifted from the four papers above. Those papers expose watermarking’s weaknesses or call for more robust watermarking; none of them proposes or evaluates cryptographic content-signing as the alternative. The recommendation to sign is this post’s editorial position. It follows from the evidence, but the papers do not make it for you.
Sign the content cryptographically at creation time. Provenance is an integrity-and-origin problem, and integrity-and-origin problems have a known solution that is not statistical. At the moment a model produces an output, have the producing system sign it — a digital signature over the content, the model identity, a timestamp, and whatever metadata the provenance claim needs, under a key the producer controls. A signature is not a bias in the text that an edit can wash out; it is a separate cryptographic artifact, and it has the property a watermark lacks: tampering is detectable. Paraphrase a signed passage and the signature simply no longer verifies against the new text — which is the correct behavior, because the paraphrased text genuinely is a different artifact, no longer the thing the producer attested to. A signature does not claim “a machine wrote these exact words and you cannot change them.” It claims “this specific content was attested by this specific producer at this specific time,” and it makes any deviation from that content visible. That is what a provenance mechanism is, and a token-choice watermark is not one.
Treat a negative detection result as uninformative, never as a clearance. Wherever a watermark detector remains in the pipeline — and it can, as a low-cost filter for casual misuse — wire it so that a detector hit is treated as weak positive evidence and a detector miss is treated as nothing at all. A miss does not mean human-written. It means the signal is absent, which a paraphrase, a translation, or a human author all produce equally. Any logic of the form “the watermark did not fire, therefore a person wrote this” is broken, because the cheap attack’s whole purpose is to make that exact inference fire falsely.
Put provenance at the layer where the artifact is created and controlled. The watermark fails partly because it lives in the text, the most malleable layer of the stack, where any downstream party can rewrite it. Provenance signals belong higher up — bound to the model and the generating system, attested where that system has authority a downstream editor does not. This is the same reasoning that puts model-lineage attestation in the training and release pipeline rather than in the weights’ surface behavior, the subject of weights provenance, and it is continuous with treating a producing agent as a cryptographically identifiable principal, the subject of the agent identity stack. Sign at the source; do not hide a signal in the artifact and hope it survives handling.
Do not let a provenance commitment rest on a mechanism with a measured near-100% bypass. If a policy, a platform rule, or a regulatory filing commits you to identifying AI-generated content, the mechanism behind that commitment has to survive the threat model the commitment implies. A commitment that is satisfied by watermarking is satisfied by a mechanism that arXiv 2505.05190 removes at near-100% for under a dollar per million tokens. Either the commitment’s threat model genuinely excludes motivated adversaries — in which case say so explicitly, and document watermarking as a casual-misuse deterrent only — or the commitment needs a mechanism that holds against them, which means signing. What you cannot do is let the word “watermark” stand in for “provenance” in a document that will be read as a guarantee.
Before you rely on a text watermark for content provenance:
A watermark in a banknote is bound to the paper, and that is why it works. A watermark in machine text is bound to the words, and the words are the one thing an adversary can replace for under a dollar while keeping everything that made the text worth having. The detector lighting up in your test harness is real — and it is testing the one case that does not matter, the case where nobody tried. Provenance is a question you must be able to answer when someone wants the answer to be wrong. Sign the content, or you do not have provenance — you have a speed bump, and you should call it one. A negative from a watermark detector is the absence of a signal, and the absence of a signal is not a fact about who wrote the text.
A membership-inference attack that separates your book from a held-out one is usually reading the calendar, not the weights. A successful attack is not a sound proof — and the null it would need to test against cannot be sampled.
17 min →
Unlearning promises a model can forget specific data without a full retrain. What it delivers is output suppression: a small benign relearning set — or simply quantizing the model — brings the 'forgotten' knowledge back.
14 min →
The EU AI Act requires AI output to be marked in a robust, reliable way. A formal impossibility theorem says strong watermarking cannot exist. Five words in the statute carry the collision.
13 min →