A policy push meets a technical constraint

Text watermarking has returned to the centre of the AI policy debate as providers prepare for transparency duties under the European Union’s AI Act. From 2 August 2026, Article 50 requires providers of generative AI systems to make synthetic text machine-readable and detectable as AI-generated or manipulated, subject to technical feasibility and defined exceptions. Older systems have a limited transition period for marking and detection until 2 December 2026.

That obligation explains the renewed commercial interest in hidden signals embedded in model output. But it does not solve the core problem: written language is unusually easy to alter while preserving its meaning. A watermark can be useful evidence that a particular model produced substantially unmodified text. It is far less reliable as a way to determine who authored a document, whether AI was used in its drafting, or whether a piece of text is trustworthy.

The distinction matters. Public discussion often treats watermarking as though it were a persistent stamp, analogous to a serial number on a physical object. Text systems generally cannot offer that kind of permanence.

How an AI text watermark works

A statistical text watermark is not normally an extra character, an invisible font change or metadata attached to a file. Instead, it operates while a language model chooses the next token in a response.

For any given context, a model has many plausible words or token fragments it could select. A watermarking system uses a secret key to favour a changing subset of those options by a small amount. Across a sufficiently long response, the selected words create a statistical pattern. A detector with the appropriate key can test whether the pattern occurs too often to be explained by ordinary text.

This design has real advantages over conventional metadata. Copying and pasting the text into another document does not remove the signal. It can also avoid visibly changing the prose, and detection can be much cheaper than rerunning the underlying language model.

However, the signal is probabilistic rather than a literal inscription. A positive result means the text has characteristics consistent with output from a particular watermarking system. It does not, on its own, establish that a person did not contribute, that the final writer intended deception, or that every sentence came from the same model.

Rewriting changes the statistical evidence

The central weakness is that language has many ways to express the same idea. A user can ask another model to rewrite a passage, translate it and translate it back, edit sentences manually, summarise it, combine it with original material or regenerate the text from a prompt based on the same facts. Each step changes token choices while potentially preserving the substantive message.

This is not merely a hypothetical loophole. Research has repeatedly found that paraphrasing attacks can sharply reduce the ability to detect statistical watermarks. A 2025 study demonstrated targeted rewrite attacks against several recent watermarking methods without requiring access to the protected model or its watermarking algorithm. NIST’s review of synthetic-content transparency similarly concludes that paraphrasing can often remove text watermarks with limited quality loss, particularly for short material.

Short text is especially difficult. A detector needs enough words for a statistically meaningful result, yet many high-risk communications are brief: a social-media post, scam message, fabricated quotation or short answer in an assignment. Low-entropy passages also give a model little freedom to make watermark-friendly choices. Formulaic phrases, code, lists, quotations and factual statements may therefore be difficult to mark reliably.

Longer output can improve detection because it contains more opportunities to encode redundant evidence. Some watermarking methods have shown meaningful resilience against limited editing and some forms of paraphrasing. But this is a trade-off, not a solution. The same length that supplies more watermark signal also gives an adversary more material to restructure selectively.

Detection is not attribution

Even a technically strong detector answers a narrow question: whether a defined watermark appears in the text presented to it. It cannot reliably answer the broader questions often placed on it.

A missing mark does not prove that text was written by a human. It may have been generated by an unmarked model, produced before a provider adopted watermarking, heavily edited, translated, transcribed from an image, or deliberately rewritten to remove the signal. Conversely, a detected signal is not necessarily proof that the final document was entirely machine-written. A human may have used an AI system to draft, translate or revise only part of it.

The source-specific nature of most systems adds another limit. A watermark deployed by one provider can identify that provider’s outputs, provided the text has survived intact enough. It does not create a common detector for all AI-generated writing. Interoperability would require broad technical and governance agreements on marking, verification, access to detection services and the handling of false results.

There is also an adversarial problem at the other end: spoofing. If attackers can infer the patterns a detector rewards, they may try to generate text that appears to bear a watermark it never received. That could turn a transparency mechanism into a tool for false attribution. Keeping detection keys private can make such attacks harder, but it also limits independent verification and concentrates authority in the provider operating the detector.

Why watermarking still has a role

These weaknesses do not mean statistical watermarks have no value. They can raise the cost of simple copy-and-paste misuse and can provide useful provenance evidence in controlled settings. For example, an organisation may use them alongside secure logs, account records, document history and signed metadata to establish how material moved through its own systems.

Their value is greatest when the question is limited and the threat model is realistic: did this apparently untouched block of text come directly from a participating model? That is very different from asking whether a student, employee, journalist or public speaker used AI at any point in producing a final work.

The most credible transparency approach is therefore layered. Providers can embed machine-readable signals; platforms can preserve provenance metadata where possible; publishers can use visible disclosures in contexts where audiences need them; and investigators can consider process evidence rather than relying on a detector score alone. Human editorial responsibility remains important, particularly for public-interest text, because a technical mark says little about factual accuracy, intent or accountability.

A compliance tool, not a truth machine

The EU rules create a strong incentive to deploy marking systems, and text watermarking is one plausible way to contribute to compliance. Yet the regulation itself recognises practical limits by referring to effectiveness, reliability, robustness and interoperability, as well as the state of the art.

That caution is appropriate. Watermarking can make unaltered AI output more legible to machines, but it cannot create an enduring boundary between human and machine authorship once words are freely editable. Used as one component of a broader provenance system, it may improve transparency. Used as decisive evidence of cheating, misinformation or authorship, it risks overstating what the technology can actually show.

Sources