Watermarks Without Verification: AI Text Watermarking After the EU AI Act

• URL: http://arxiv.org/abs/2609.09604v1
• Date: Wed, 09 Sep 2026 01:56:17 GMT
• Title: Watermarks Without Verification: AI Text Watermarking After the EU AI Act
• Abstract summary: Article 50 of the EU AI Act requires generative AI providers to mark the content their systems produce and ensure it can be detected as AI-generated.<n>Anthropic disclosed that every Claude model released after that date embeds a watermark based on SynthID-Text in all generated text, enabled by default with no user opt-out.<n>We argue that neither the objections nor the assurances can currently be verified and that this unverifiability, rather than watermarking itself, is the substantive governance failure.
• Score: 49.51124343181601
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: On August 2, 2026, the obligations of Article 50 of the EU AI Act took effect, requiring generative AI providers to mark the content their systems produce and ensure it can be detected as AI-generated. Days later, Anthropic disclosed that every Claude model released after that date embeds a watermark based on SynthID-Text in all generated text, enabled by default with no user opt-out; Google has deployed SynthID-Text in Gemini since 2024. Users objected that the watermark degrades quality, particularly for code, that it secretly encodes identifying information, and, in mutual contradiction, that it is easily removable and inescapable; the vendor answered with assurances of unchanged quality, no identifying information, and robustness to light editing. In this work, we argue that neither the objections nor the assurances can currently be verified and that this unverifiability, rather than watermarking itself, is the substantive governance failure. We sort the contested assertions by what it would take to settle each and evaluate the open-source SynthID-Text implementation on two open-weight models, because no public tool can test the deployed systems. On prose, the measured effect of the watermark does not exceed that of changing the sampling seed. On code, the cost is three points of correctness on one model and below measurement on the other, while detection remains near chance, a limitation of detectability rather than quality. The remaining gaps trace to withheld access or missing institutions and we map each to a requirement: release of matched outputs, configuration disclosure, accredited audits, a shared evaluation protocol, and interoperable detection.

Related papers

• Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks [68.64050157343334]
  Existing watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution.<n>We introduce an innovative watermark that jointly provides provenance and tamper evidence.<n>The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes.
  arXiv  Detail & Related papers  (2026-08-13T01:55:16Z)
• AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation [0.0]
  We evaluate three representative watermarking methods against the Daubert admissibility criteria and the NIST SP 800-86 digital forensic process.<n>We focus on meaning-preserving paraphrase as the attack vector, since it is both legally realistic and difficult to dismiss as evidence tampering.<n>We find that the point-based scoring system, despite working as designed, cannot fully capture forensic uselessness.
  arXiv  Detail & Related papers  (2026-07-17T14:45:53Z)
• VOW: Verifiable and Oblivious Watermark Detection for Large Language Models [4.920744236528847]
  We propose a new protocol that achieves both privacy-preserving and cryptographically verifiable watermark detection.<n>VOW is practical for short texts and provides a crucial reassessment of watermark robustness against modern paraphrasing attacks.
  arXiv  Detail & Related papers  (2026-04-30T10:02:18Z)
• On Google's SynthID-Text LLM Watermarking System: Theoretical Analysis and Empirical Validation [29.19181601635414]
  Google's SynthID-Text is a production-ready generative watermark system for large language models.<n>This paper presents the first theoretical analysis of SynthID-Text, with a focus on its detection performance and watermark robustness.
  arXiv  Detail & Related papers  (2026-03-03T17:49:01Z)
• Authenticated Contradictions from Desynchronized Provenance and Watermarking [48.47756819432157]
  This work formalizes and empirically demonstrates the $textitIntegrity Clash$, a condition in which a digital asset carries a cryptographically valid C2PA manifest asserting human authorship.<n>We propose a cross-layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy across 3,500 test images.
  arXiv  Detail & Related papers  (2026-03-02T20:42:12Z)
• Watermarking Language Models for Many Adaptive Users [47.90822587139056]
  We study watermarking schemes for language models with provable guarantees. We introduce multi-user watermarks, which allow tracing model-generated text to individual users. We prove that the undetectable zero-bit scheme of Christ, Gunn, and Zamir (2024) is adaptively robust.
  arXiv  Detail & Related papers  (2024-05-17T22:15:30Z)
• An Unforgeable Publicly Verifiable Watermark for Large Language Models [84.2805275589553]
  Current watermark detection algorithms require the secret key used in the watermark generation process, making them susceptible to security breaches and counterfeiting during public detection. We propose an unforgeable publicly verifiable watermark algorithm named UPV that uses two different neural networks for watermark generation and detection, instead of using the same key at both stages.
  arXiv  Detail & Related papers  (2023-07-30T13:43:27Z)
• Who Wrote this Code? Watermarking for Code Generation [53.24895162874416]
  We propose Selective WatErmarking via Entropy Thresholding (SWEET) to detect machine-generated text. Our experiments show that SWEET significantly improves code quality preservation while outperforming all baselines.
  arXiv  Detail & Related papers  (2023-05-24T11:49:52Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.