Why AI watermarks fail when users edit the text

SynthID, the watermarking system Google DeepMind built for AI-generated content, works by nudging a language model toward specific tokens during text generation. Paraphrase that same text through a second model, or run it through a thesaurus-heavy edit, and the statistical fingerprint often disappears. This is the central problem with text watermarking in 2026: it was never designed to survive contact with a human editor.

That gap matters more now than it did a year ago. According to Bleeping Computer, the EU AI Act's Article 50 will require watermarking on AI-generated text from models launched after August 2, 2026, with penalties reaching 15 million euros or 3% of global turnover. Regulators are betting on a technology that breaks under routine editing. Understanding why requires looking at how watermarks actually work, and what happens when someone tries to strip them out.

This piece covers AI watermark removal detection evasion: how it works, why it's easier than defenders would like, and why removing a watermark doesn't mean the content passes as human-written.

#How Text Watermarks Work, and Why Editing Breaks Them

Text watermarking systems like SynthID don't stamp a visible mark on the output. Instead, according to researcher Sean Goedecke, they score each possible next word based on the words that came before it, then bias the model's sampling toward higher-scoring tokens.

Do this across thousands of tokens and you get a statistical bias. A detector can scan the text, recompute those same scores, and check whether the actual word choices lean toward the "high-score" side more often than random chance would predict. That's the whole mechanism.

The problem is that this bias lives in word choice, not in meaning. Swap "began" for "started," or restructure a sentence with a different clause order, and the score for that token resets. The watermark isn't attached to the idea being expressed. It's attached to the exact sequence of words chosen to express it.

This is why a single pass through a paraphrasing tool, or even manual editing, can quietly erase a watermark that took real engineering effort to embed. The signal is fragile by design, because it has to be invisible to human readers while still being statistically detectable to a machine.

#Watermark Stripping Isn't the Same as Passing as Human

Here's where most coverage of watermark removal gets the story wrong. Beating a watermark detector and beating a comprehensive AI detector are two different problems, and solving the first doesn't solve the second.

According to the paper "Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal," researchers tested six state-of-the-art watermark removal tools against forensic detectors. The removers succeeded at fooling the watermark verifier. But under a strict 1% false-positive budget, forensic detectors still caught the edited content with a true-positive rate above 98%.

In other words, the watermark was gone, but the content still looked machine-generated to a detector that wasn't just checking for the watermark. The researchers call this the difference between "verifier evasion" and "forensic stealth." Verifier evasion means you beat the specific watermark check. Forensic stealth means the content shows no signs of tampering or synthetic origin at all, and almost nothing achieves that.

This distinction matters for anyone evaluating a watermark stripping tool. A tool that claims to "remove AI watermarks" is usually only solving half the problem, and the marketing rarely says so.

#Why Removal Tools Leave Their Own Fingerprints

Stripping a watermark isn't a clean operation. It's an edit, and edits leave traces.

According to the forensic stealth paper, the removal techniques researchers tested fell into four broad categories:

• Distortion-based optimization, which perturbs word choices to reduce the watermark score
• Diffusion-based regeneration, which rewrites passages through a generative model
• Latent-space inversion, which manipulates internal representations before re-decoding
• Stochastic erosion, which introduces controlled randomness to break statistical patterns

Each method solves the watermark problem differently, and each introduces its own detectable side effect. A model used to rewrite a paragraph brings its own statistical habits, which a detector trained on multiple AI systems can pick up. A stochastic erosion approach might smooth out watermark bias but introduce unnatural repetition or oddly flat sentence rhythm.

The forensic stealth researchers found that most tools don't erase the AI signal. They replace one detectable signal with another. You stop looking like "watermarked text" and start looking like "text that's been through a rewriting pass," which is its own red flag to a trained detector.

#The Three-Way Tradeoff Nobody Solves at Once

Anyone building a watermark removal tool is working against three competing goals, and improving one tends to hurt the others.

• Removal success, meaning the watermark detector no longer flags the content
• Content quality, meaning the meaning, tone, and readability stay intact
• Forensic stealth, meaning no other detector picks up signs of editing or synthesis

Push hard on removal success and you often degrade quality, because you're forcing word choices away from what the watermark favors, even when those choices were the most natural ones. Push hard on preserving quality and the watermark tends to survive better, because you're not changing much. Try to thread the needle with light, careful edits, and you often leave forensic evidence of a light, careful edit, which is exactly the pattern a trained detector looks for.

This is true for image watermarks too. According to research on evading watermark-based detection of AI-generated content, attackers can add imperceptible perturbations to watermarked images that fool the watermark check while keeping the image visually intact. But those perturbations are themselves a statistical anomaly, detectable by tools that aren't just checking for the original watermark.

Diffusion-based cleaning methods like DiffPure attempt to solve this by regenerating the image entirely, but according to research on the forensic cost of watermark removal, these methods are computationally expensive and don't guarantee success. That cost changes the economics of the whole cat-and-mouse game, which we'll get to below.

#Statistical Fingerprints That Survive Even After the Watermark Is Gone

Detectors that don't rely on watermarks at all are still catching a lot of AI-edited content, and this is the part regulation hasn't caught up to.

According to AIcheckr's analysis of AI text watermarks, strong detectors look at perplexity (how predictable a sequence of words is to a language model) and burstiness (how much sentence length and structure vary across a document). Human writing tends to be uneven. Sentences run long, then short. Word choice gets weird sometimes. AI writing, even after editing, tends to smooth these variations out.

Paraphrasing tools built on other language models tend to produce text that's still statistically "AI-like" in these broader senses, even if the specific watermark is gone. You've removed one signature and kept another, because the underlying writing process is still a model predicting likely next words.

This means someone can successfully strip a SynthID-style watermark and still get flagged by a general-purpose AI detector that never checked for that watermark in the first place. The watermark and the detector are solving overlapping but distinct problems, and removing one doesn't disable the other.

#Why Robust Watermarking Is Harder Than It Sounds

SynthID watermarking robustness gets tested against light edits, translation, and some paraphrasing, and Google DeepMind has published results showing it holds up reasonably well against casual tampering. But "reasonably well" is doing a lot of work in that sentence.

The honest limitation is that any watermark embedded at the token level is vulnerable to any process that meaningfully changes token choices. That includes:

• Paraphrasing through a different model
• Manual rewriting by a human editor
• Translation to another language and back
• Summarization and re-expansion

None of these require sophisticated attack tools. They're normal things people do to text every day, for entirely legitimate reasons, and they happen to break the watermark as a side effect.

This is the uncomfortable core of AI-generated content detection limitations: the more natural and common an editing action is, the more likely it is to defeat the watermark, without the editor even trying to evade detection.

#The Incentive Problem Nobody's Solved

Regulators like the EU are pushing hard on watermarking requirements. According to Bleeping Computer, penalties for non-compliance are steep, up to 15 million euros or 3% of global turnover. But the enforcement architecture assumes watermarks are durable, and the research says otherwise.

There's also an asymmetry in who benefits from better tools. Companies building detection systems have commercial incentives (content moderation, plagiarism checking, academic integrity). Attackers building removal tools mostly operate in an unregulated gray market with no accountability for false claims.

According to researchers at the University of Maryland's Trails initiative, this arms race cuts both ways. Their work demonstrated it's possible not just to remove watermarks from AI content, but to add convincing watermark signals to human-written content, triggering false positives. That's arguably more damaging than removal, since it means a detector can wrongly accuse a real person of using AI.

#What Current Testing Gets Wrong

Most watermark removal benchmarks measure one thing: did the removal tool beat the watermark detector? That's an incomplete test, and it's misleading buyers of these tools.

A more honest benchmark, based on the forensic stealth research, would measure three things together:

What Current Testing Gets Wrong

Metric	What it measures	Why it matters
Verifier evasion rate	Does the specific watermark detector get fooled	The narrow, marketed claim
Forensic stealth score	Do other detectors (perplexity, burstiness, model fingerprinting) still flag the content	The real-world outcome
Quality preservation	Does the edited content still read naturally and retain its meaning	Whether the edit is even usable

Tools are almost never evaluated on all three at once, which is why marketing claims about "undetectable AI content" tend to collapse under independent testing. A tool can post a 95% removal success rate on the narrow watermark check and still get caught by a forensic detector nine times out of ten.

#Practical Takeaways

For anyone trying to understand where this technology actually stands:

• Don't treat watermark presence as proof of AI authorship, and don't treat its absence as proof of human authorship. Both signals are unreliable on their own.
• If you're evaluating detection tools for compliance or moderation, ask whether they check for forensic artifacts beyond the watermark itself. A single-signal detector is easy to defeat.
• If you're a writer or editor working with AI-assisted drafts, know that routine editing, not deliberate evasion, is often enough to strip a watermark. That's a structural weakness in the technology, not a loophole you're exploiting.
• If you're tracking regulation like the EU AI Act, watch for how enforcement handles the gap between the letter of the law (watermarking required) and the reality (watermarks are fragile). Expect amendments or supplementary detection requirements as this plays out.
• Expect the arms race to continue. Every improvement in watermark robustness will meet a corresponding improvement in removal techniques, and vice versa. There's no evidence either side wins this outright.

The honest conclusion is that watermarking is a useful signal, not a guarantee. Treating it as a compliance checkbox, rather than one layer in a broader detection strategy, is the mistake most organizations are currently making.