AI text watermarks vanish under paraphrasing — and fail as court evidence
A July 2026 study tested KGW, Unigram and SynthID against simple paraphrasing: nearly every detected watermark was stripped, and none met the bar for forensic proof.
What is this?
On 20 July 2026, a paper titled AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation (arXiv:2607.16010) put a widely repeated policy assumption to the test. Governments are increasingly requiring that AI-generated text carry a watermark: the EU AI Act calls for markings that are “sufficiently reliable and robust,” and California’s SB 942 requires disclosure that is “permanent or extraordinarily difficult to remove.” Both mandates rest on the same untested premise — that watermark detection produces evidence trustworthy enough to stand up in court or in a compliance audit.
The study measured that premise directly against three well-known text watermarking schemes — KGW, Unigram and Google DeepMind’s SynthID — and found the premise does not hold. A watermark that a motivated person can remove by rephrasing a paragraph is not a reliable signal of provenance, and a detector that misfires on human writing is not fit to be evidence.
How it works
A text watermark biases a model’s token choices in a statistically detectable pattern, so a later detector can look at a passage and estimate whether it came from a watermarked model. The scheme only works if that pattern survives ordinary handling of the text and if the detector rarely fires on content a person actually wrote.
The paper stresses both halves of that requirement. On robustness, the authors ran 846 valid paraphrase runs across 15 diverse prompts per method. Every initially-detected KGW and Unigram passage lost its watermark after a single round of paraphrasing — a 100% conditional removal rate — and SynthID was only marginally better at 98.3%. No exploit code is needed; rewording is a normal editing operation available to anyone. On reliability, the false-negative rates were already high before any tampering: about 70% for KGW, 83% for Unigram and 80% for SynthID. The SynthID configuration also flagged 5.4% of paraphrased human-written control texts as AI-generated, and exhibited an 18.6% “paradox” rate in which even 80% of its own pristine watermarked output landed in an uncertainty deadband rather than a clear verdict.
To translate this into legal terms, the authors mapped each method against the five Daubert factors that US courts use to weigh scientific evidence. None of the three schemes satisfied more than two of the five. A related information-theoretic analysis, Watermark Forensics for Generative Models (arXiv:2607.13003, 14 July 2026), reaches the same broad conclusion from theory: the detection bounds simply are not tight enough for the certainty a courtroom expects.
Why it matters
Watermarking is being written into law as if it were a settled provenance mechanism, and it is not. If a detector returns a false negative most of the time, the absence of a watermark tells you almost nothing — a real AI-generated document can be presented as human-written with a plausible paraphrase. If a detector fires on genuine human writing several percent of the time, the presence of a “watermark” can wrongly incriminate a person who wrote their own text. Either failure mode is serious when the output is used to decide a copyright claim, an academic-integrity case, an election-disinformation investigation, or an AI Act persistence audit.
This has knock-on effects for anyone building or buying provenance tooling. A vendor claiming “AI-generated content is watermarked and detectable” is making a much weaker promise than it sounds, and organisations that treat a watermark check as a compliance control may be relying on a signal that a first-year removal attack defeats. It also connects to broader regulatory work such as the EU AI Act high-risk classification for agentic systems: a rule is only as strong as the technical mechanism expected to enforce it.
Defenses
Do not treat a single text watermark as proof of origin, in either direction. A negative result should not clear a document, and a positive result should not convict a person; both are probabilistic and both degrade under normal editing. Where provenance genuinely matters, prefer signed, cryptographically-bound provenance captured at generation time (content credentials and manifests) over after-the-fact statistical detection, and combine multiple independent signals rather than relying on one detector — the Verifiable Provenance and Watermarking evidentiary framework (arXiv:2605.21002, May 2026) shows that only a calibrated combination of methods approaches sufficiency, and only against weaker adversaries. Report detector outputs with their measured false-positive and false-negative rates and an explicit uncertainty band, so a decision-maker sees the error rate rather than a bare “AI / not AI” label. Assume a motivated adversary will paraphrase, translate or round-trip text through another model, and test your own pipeline against exactly those transformations before you depend on it. For policy and compliance teams, insist that any watermarking requirement be paired with a documented, independently measured robustness and error-rate threshold, and read the current state of the field — the July 2026 Survey on LLM Watermarking (arXiv:2607.10103) is a useful map — rather than assuming the technology already meets the legal language written around it.
Status
| Item | Detail |
|---|---|
| Disclosure | AI Watermark Evidence Fails Forensic Readiness, arXiv preprint announced 20 July 2026 |
| Nature | Empirical evaluation of text-watermark robustness and reliability, mapped to legal admissibility |
| Schemes tested | KGW, Unigram, SynthID |
| Robustness | Conditional watermark removal after one paraphrase: KGW and Unigram 100%, SynthID 98.3% (846 valid runs) |
| Reliability | Baseline false-negative rates ~70% (KGW), ~83% (Unigram), ~80% (SynthID); SynthID flagged 5.4% of human controls, 18.6% paradox rate |
| Legal test | None of the three methods satisfied more than two of the five Daubert factors |
| Regulatory context | Tests the “reliable and robust” (EU AI Act) and “permanent or extraordinarily difficult to remove” (California SB 942) assumptions |
Figures are from a single preprint measuring specific configurations of three schemes and will not generalise to every watermarking deployment. Treat them as a strong signal that text watermarks are not yet forensic-grade, not as a final verdict on any one product.