AI Watermarking Standards and How They Fail

AI watermarking has become the technical mechanism that governments point to when they talk about proving a piece of text, an image, or an audio clip came from a machine. The mechanism itself is simple to describe: before a language model samples its next word, a logit processor nudges the odds toward a set of "green" tokens chosen by a pseudorandom function tied to a secret key and the surrounding context. A detector then counts how many green tokens showed up and checks that count against what random chance would give you. That's the whole trick, and it's elegant enough that regulators have built entire compliance regimes on top of it.

The EU AI Act asks for markings that are "sufficiently reliable, interoperable, effective and robust as far as this is technically feasible." U.S. Executive Order 14110 went further, naming watermarking directly and calling for "state-of-the-art" provenance tools, though the Trump-Vance Administration later rescinded that order entirely, a reversal that shows how fast the ground under these rules can move. China's own rules on labeling AI-generated synthetic content follow the same logic. All three regimes treat watermarking as settled infrastructure, as if it were already mature enough to build law around. None of them have been tested against the standard that matters: whether a watermark detection result would hold up as evidence in a courtroom. Studies of robustness lean on machine learning metrics. Policy papers ask whether the infrastructure exists on paper. Neither line of work answers the question a judge would ask, and every mandate built on watermarking so far rests on that same gap.

The Paraphrase Attack

The biggest threat to watermarking is paraphrase, an attack anyone with a web browser can run for free, not some rare, lab-grade adversarial technique. That matters because paraphrase keeps the meaning of a text intact while scrambling the statistical fingerprint a watermark depends on, so a defense attorney doesn't need to tamper with evidence to make a watermark disappear. All they need is a rewrite tool.

Saifur Rahman Tamim and Amir Labib Khan tested this directly across 846 valid paraphrase runs, using 15 varied prompts for each of three watermarking schemes: KGW, Unigram, and the MarkLLM build of SynthID-Text. Every single piece of text that KGW or Unigram had successfully watermarked lost that watermark once it was paraphrased, a complete, 100 percent removal rate, and KGW's false-negative rate was already high before anyone touched it with an attack. Unigram performed even worse on that front, missing watermarks at a higher baseline rate than KGW did even before paraphrasing entered the picture. SynthID-Text held up only slightly better, losing its watermark in the overwhelming majority of cases after paraphrasing, and it carried its own baggage: a meaningful false-positive rate on paraphrased text that humans had written, a sizable share of outputs landing in neither a clear "watermarked" nor "clean" bucket, and most of its own freshly watermarked text falling into that same uncertain middle ground even before any attack touched it.

Separate testing on SynthID Text showed it could catch most raw, unaltered AI text, but changing just three words broke the detector. The WaterPark evaluation pushed the stress test further, running 12 different attack types across three language models, and found the same fragility everywhere it looked: SynthID's true positive rate fell to 0.498 under moderate paraphrasing and dropped again to 0.232 once translation entered the mix. A prosecutor who shows up with a positive watermark detection result is one free online rewrite away from having nothing. The meaning of the text hasn't changed, the watermark has simply vanished, and the court is left without any framework for deciding what that absence means. Tamim and Khan found that none of the three methods they tested satisfy more than two of the five Daubert factors courts use to judge whether scientific evidence belongs in a trial.

Why the standards mandating robustness never define what robustness means

The paraphrase results above aren't a bug waiting on a patch. They trace back to a decision made at the policy level: regulators wrote "robust" into law without ever saying what robust means in practice. Alexander Nemecek, along with Jiang and Ayday, identify this as the foundational hole in current governance. Lawmakers assumed a level of technical feasibility that no deployed watermarking system currently reaches, and they left the robustness requirement itself undefined, so there is no threshold anyone can check against.

Three assumptions baked into these mandates don't hold up once you look at how the technology actually works. Regulators assume robustness can be required without being measured, so no rule specifies how much degradation a watermark can suffer across its lifecycle and still count as compliant. They assume you can audit proprietary systems from the outside, but in practice vendors assert compliance while keeping the technical details closed, so regulators are asked to trust the result rather than verify it. And they assume different vendors' systems will work together, when no such interoperability exists: competing models use incompatible watermarking implementations, and open-source forks can strip the whole mechanism out without breaking any rule written so far.

Jurisdictional fragmentation makes the problem worse. The United States, the European Union, and China are each building their own standards, ranging from voluntary industry commitments to hard legal mandates, with nothing requiring any of them to recognize or interoperate with the others. Nemecek, Jiang, and Ayday point out that the market itself rewards the wrong behavior here: companies gain more by claiming compliance than by building systems whose compliance can actually be checked. The paper calls this symbolic compliance: the language of the law references a technical tool without ever requiring that tool to function as advertised.

The Integrity Clash: how C2PA provenance and watermark detection contradict each other on the same file

A second failure sits apart from fragility under attack. It's a structural contradiction between two systems that were supposed to reinforce each other. C2PA provenance and invisible watermarking are often described as complementary layers of defense, cryptographic metadata on one side, a signal baked into the pixels or tokens on the other. But because neither system checks what the other one says, a single file can pass both checks while telling two opposite stories about where it came from.

Nemecek, He, Cheng, and Ayday call this the Integrity Clash. An AI-generated image can carry a cryptographically valid C2PA manifest asserting a human made it, while the same image's pixels carry a watermark identifying it as AI-generated, and both signals will pass their own verification check without ever being compared against each other. Producing this contradiction doesn't require breaking any cryptography. You only need to leave out one assertion field that the current C2PA specification already permits, something standard editing software can do without raising any flags, in what the paper calls metadata washing workflows.

Wider adoption of both systems makes the problem bigger, not smaller. C2PA manifests now ship in Adobe Photoshop and in camera firmware from Nikon, Leica, and Sony. Invisible watermarking runs at platform scale inside Google and Meta's products. More files than ever carry both signals at once, and no deployed verification workflow checks whether those two signals actually agree with each other. Platforms that show users a C2PA provenance badge don't cross-reference that badge against watermark detection results, and watermark detectors run without any access to a file's declared provenance history. The same structural gap applies wherever two independent authentication layers operate without talking to each other, text included: any pipeline that stacks two separate attribution signals without reconciling them carries this same risk, whether the file in question is an image or a block of prose.

Uneven Detection Bias

Watermarking doesn't fail only when someone attacks it. It fails on its own, unevenly, across the populations it claims to serve. Signal strength and detectability depend on statistical properties of the underlying content, and those properties differ by language, by cultural tradition, and by demographic group, so the burden of being flagged, correctly or not, doesn't land the same way on everyone.

Nemecek and coauthors, in "Who Gets Flagged?", reviewed the major watermarking benchmarks across text, image, and audio and found that, with one exception, none of them report results broken down by language, cultural content type, or population group. Evaluation in this field has been built around one implicit default. Early evidence that does exist shows real disparity: detection rates for the same watermarking setup vary significantly between linguistic communities, and that variation comes from the embedding mechanism itself, not from some flaw in how the detector was calibrated afterward.

A closely related bias appears in AI detectors used for content review generally. Testing peer-reviewed original abstracts written between 2023 and 2025, Pangram flagged 14.9 percent of human-written texts as AI-generated at a commonly used threshold, and that error rate wasn't spread evenly: it differed substantially between STEM and non-STEM fields, meaning general or humanities writing faced a higher risk of being wrongly flagged than technical, jargon-dense copy. If you build or review content pipelines, you're looking at the same bias problem watermarking has, just wearing a different hat. Google's own SynthID Detector carries a built-in blind spot: it only detects content from Google's own AI systems, so a negative result tells a user nothing about whether a different model produced the text, and it's easy to mistake that silence for proof of human authorship. An audit of 50 image generators found a similar pattern at the product level: only a minority included any machine-readable watermark, only a small fraction gave users a visible deepfake disclosure, a minority would even meet the EU AI Act's Article 50(2) bar, and a far smaller number met the stricter visible-labeling standard under Article 50(4).

How adversarial multi-model architectures dissolve the watermark signal

Multi-model pipelines built to beat watermark detectors exist already, and they work. The SHADE framework, short for Stochastic Human-like generation via Adversarial Detector Evasion, treats detector evasion as an optimization problem, fine-tuning an instruction-tuned LLaMA model with Group Relative Policy Optimization and feedback from a surrogate detector modeled on the PAN 2025 mdok system. It succeeds at what it sets out to do. The text it produces stops carrying a detectable watermark signal.

The surviving text reveals the catch. Writing that evades detection at a high rate turns out to be shorter, simpler, and less varied in word choice than writing that doesn't bother trying to evade anything. Winning against the detector means flattening the writing, not refining it. For anyone running a content pipeline where voice matters, that's the number that should give pause: a system built to beat a classifier will cost measurable stylistic ground to do it, and there's no way around that tradeoff built into how these evasion methods work.

The ELOQUENT Voight-Kampff shared task tracks how fast this arms race has moved. In the 2024 edition, the best system's fool rate against the detector panel was 0.049. By 2025, that number jumped roughly 13-fold, driven entirely by prompting tricks that required no retraining at all: Hindi back-translation paired with an explicit instruction to "be imperfect," and a rotation across nine languages. The 2026 results pushed further still, and used structural attacks that push generated text outside the range a detector was ever trained to recognize. Researchers at that event identified something close to a law of the field: pushing text out of a detector's training distribution reliably beats it, no matter how the detector was built. Two new attack families, one built on cross-decade shifts in register and one built on modernist stream-of-consciousness form, produced dramatically higher fool rates while still reading naturally to a human, and the obvious fix, training detectors on more historical prose, didn't close the gap.

A pipeline built to beat a detector and a pipeline built to sound like a given brand's voice are not the same project, and optimizing for one does not get you the other for free. Some multi-model architectures are built around a different target altogether: not evasion, but convergence on quality, where output gets passed through rounds of drafting, critique, and vote across many models until it settles into something that reads as human because it survived real scrutiny, not because it was stripped down to dodge a classifier. Letterwrite's writing kernel works this way, routing drafts through adversarial critique and voting cycles across dozens of models until they converge, built around that quality target rather than the evasion target, and that difference is the one worth checking for in any AI writing infrastructure under serious evaluation.

The Forensic Readiness Evaluation

Tamim and Khan built a tool meant to settle the question these mandates have left open: does watermark detection produce evidence a court could actually use? Their Forensic Readiness Score framework scores a watermarking method against 12 criteria, three mandatory gates, and a 60-point scale modeled on the Daubert standard and the NIST SP 800-86 digital forensic process. KGW, the best performer of the three schemes tested, scored 37 out of 60. Unigram and SynthID-Text scored lower still, and even the framework's authors note that the numeric score understates how unusable these systems would be in an actual legal proceeding.

That finding closes the loop this piece has been tracing. Governance frameworks in the EU, the U.S., and China all point to watermarking as proof of AI content provenance. A free, publicly available paraphrase tool erases that proof while leaving the underlying meaning untouched. The standards that demand robustness never say what robustness means, so there is no bar a vendor has to clear to claim compliance. Provenance metadata and watermark signals can openly contradict each other on the same file with no system in place to notice. Detection works unevenly across languages and content types because of how the signal gets embedded, not by accident. And multi-model architectures built to beat detection pay a real cost in the writing itself when they succeed. The forensic readiness score puts a number on what all of that adds up to: not a technology that needs tuning, but one that hasn't yet met the bar the law already assumes it clears.