Text AI watermarks will always be trivial to remove

2026-07-01 · Source: All posts - seangoedecke.com RSS feed · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Intermediate, medium

Summary

The EU AI Act, enforceable from August 2026, mandates that AI-generated content be detectable, leading to requirements for LLM text watermarking. Unlike image watermarking, text presents a significant challenge due to its compressed nature, making changes noticeable. Google's SynthID attempts to watermark by influencing token sampling based on mathematical scores, while OpenAI and Anthropic may use Unicode homoglyph patterns. However, the article argues that all text watermarks are trivial to remove; homoglyphs can be replaced, and SynthID watermarks are eliminated by paraphrasing. The Act's interoperability clause further complicates security-by-obscurity. C2PA Content Credentials are not a viable substitute for plain text outputs. Providers are expected to adopt SynthID-like methods, but technical users will easily bypass them.

Key takeaway

For AI Security Engineers evaluating compliance with the EU AI Act's watermarking requirements, you should recognize that current text watermarking techniques like SynthID or homoglyph patterns are easily defeated. Your focus should shift from relying on embedded watermarks to exploring alternative detection or verification methods, or preparing for widespread watermark removal by technical and non-technical users. Do not assume watermarks provide robust content provenance.

Key insights

Text AI watermarks, despite regulatory mandates, are inherently trivial to remove due to text's compressed nature.

Principles

• Text is a highly compressed medium.
• Watermarking text compromises quality or is detectable.
• Security-by-obscurity fails with interoperability.

Method

SynthID watermarks LLM output by assigning tokens scores based on previous tokens, then biasing sampling towards high-scoring tokens from the top options. Detection involves calculating aggregate scores.

In practice

• Replace homoglyphs to remove Unicode watermarks.
• Paraphrase text to strip SynthID watermarks.
• Use free public tools to test watermark removal.

Topics

• EU AI Act
• Text Watermarking
• LLM Security
• SynthID
• Unicode Homoglyphs
• Content Provenance

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Engineer, AI Security Engineer, Legal Professional

Related on AIssential

• Thoughts on Watermarking AI-Generated Content — Watermarking AI-generated content is technically feasible and robust enough for practical use, but requires broad adoption and regulatory coordination to address societal problems.
• AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation — LLM watermarks, as tested, fail forensic admissibility standards due to high error rates and extreme fragility to meaning-preserving paraphrasing.
• How to Detect AI-Generated Text Using Signs of AI Writing — AI text detection can leverage community-curated signs to combat the proliferation of LLM-generated content.
• Google's SynthID AI watermarking tech is being adopted by OpenAI, Nvidia, and more — Google's SynthID offers robust, integrated AI content watermarking, gaining broad industry adoption for detection and provenance.
• Watermarks and Metadata: How to Actually Comply With the EU AI Act's Article 50 Transparency Rules — The EU AI Act's Article 50 transparency rules are operationalized by a new Code of Practice endorsing specific marking and labelling mechanisms.
• Advancing Transparency of AI-Generated Media in the EU Code of Practice — Effective synthetic media transparency requires a multi-layered approach combining technical markings with clear user-facing disclosures.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by All posts - seangoedecke.com RSS feed.