19 August 2026

Dilute, wash, spoof

Which brings us to how the marks fail. The crude schemes fail first: invisible Unicode or look-alike characters can often be removed by normalisation or find-and-replace. File-level provenance is a separate layer. C2PA records, EXIF and XMP metadata, along with document properties, can travel alongside text in supported file formats and can often be inspected or stripped.

Open-source utilities are already circulating on GitHub that combine these operations. They claim to remove invisible characters and provenance metadata across formats — including images, PDFs, Word files, HTML and Markdown — while also applying rewriting or paraphrasing intended to weaken statistical text-watermarks. Some advertise compatibility with Claude-, Gemini- and OpenAI-related signals, but those claims are not all independently verified.

Over a weekend, I tried to put this to the test. Using a modern AI Assistant, no handwritten code and, less than half an hour, I created utilities for Android, iOS, macOS and Windows that removed the invisible traces from any text. Such demonstrations show that these layers can be comparatively easy to scrub, but they do not establish that every hidden mark can be removed in every format.

The keyed statistical watermark is different. It is not stored in the file as a detachable object; it is expressed through the model’s sequence of word choices. To weaken the signal, one must dilute that sequence through editing, rewriting, translation, truncation or other transformations. The limitation is therefore not merely that a watermark-removal tool lacks a button for the job: without the provider’s detector, successful removal cannot be independently certified.

The statistical kind can fail through manual dilution. Because the expected pattern depends on preceding context, edits alter the evidence associated with later tokens, while a substantial rewrite replaces much of the original marked sequence. Anthropic says light editing may not remove the watermark completely, whereas a complete rewrite replacing every word will; it also emphasises that the mark may indicate Claude’s involvement in editing rather than authorship of the underlying ideas.

The second, more systemic failure mode is washing: routing marked text through a second language model. A preprint published in July tested reference implementations of three schemes against criteria associated with the standards American courts use to assess scientific evidence. It reported that paraphrasing removed the tested SynthID-Text signal in 58 of 59 cases and removed the marks from both schemes in every valid case.

In practical terms, the authors argued that the tested watermark systems fell short on at least three of the five criteria American courts consider when assessing whether scientific or technical evidence is sufficiently reliable (Daubert factors). That result should not be treated as an assessment of Google’s production system, as the study used a reference implementation of SynthID-Text, and its findings may not transfer to every configuration. It nevertheless demonstrates that paraphrasing is a viable class of attack against statistical text-watermarks, and the courtroom framing should give any academic-misconduct panel pause.

The identity of the second model matters. If Claude paraphrases Gemini’s output, the original Gemini signal may be weakened or lost, while Claude may add its own watermark to the replacement tokens. A local open-weight model, such as Meta’s Llama, can, in principle, wash out the first signal without adding a new provider watermark, provided that no watermarking layer is enabled. The user controls the sampling process and does not have to send the text through a provider’s hosted generation service. That may defeat a particular watermark detector, but it does not make the resulting prose universally untraceable: account records, drafts, metadata and stylistic evidence may still exist.

Commercial “humanisers” can have a similar incidental effect. Tools designed to evade stylistic AI detectors often regenerate or substantially paraphrase text, thereby disrupting token-level statistical patterns. This creates a situation in which detector developers adapt to rewriting tools and rewriting tools adapt in turn. The existence of that contest does not prove that every humaniser defeats every watermark, but it illustrates the fragility of relying on a single signal.

The third failure mode is spoofing, the mirror image of removal and arguably the more serious risk. An adversary who learns enough about a scheme’s statistical behaviour may be able to bias human-authored text towards the pattern preferred by a detector, potentially framing an innocent writer or falsely attributing text to a rival model. This remains a threat model rather than a universal practical capability: the feasibility depends on the secrecy of the key, access to the detector, the scheme’s design and the amount of text available.

Keeping the production key secret can reduce straightforward spoofing, but it also concentrates verification power in the provider. The public may then depend on a proprietary detector or interface to determine whether a signal is present. The EU’s implementation framework recognises that text detection is particularly difficult, especially for short passages, and provides for restricted access to some detection solutions during the initial phase.

The law and the watermark

Why, then, are the labs bothering? The short answer is Brussels. Article 50 of the EU AI Act requires providers of systems that generate synthetic audio, image, video or text to ensure that outputs are marked in a machine-readable and detectable way. Those obligations apply from 2 August 2026. Article 50’s transparency rules are designed to make AI-generated or manipulated content identifiable, giving users and institutions a way to distinguish synthetic media from human-produced material. That capability may help address fraud, impersonation, fabricated reviews and other forms of AI-enabled media abuse at scale.

The accompanying Code of Practice is voluntary, but the statutory obligation in the Act is not. The Code is intended to describe ways for providers to demonstrate compliance. Its treatment of short free-form text reflects the statistical reality that very short passages cannot carry a reliable watermark signal; the reported 200-token threshold should therefore be presented as an implementation rule in the Code, not as a direct exemption stated in Article 50 itself. Token counts also vary by language and text type, so 200 tokens should not be translated into a fixed number of words.

That produces an awkward legal and technical mismatch. Article 50 contains an exception for AI systems performing an assistive function for standard editing, or for uses that do not substantially alter the input or its meaning. Whether a particular workflow qualifies is fact dependent. The technical mechanism, however, operates during token generation rather than by assessing intellectual responsibility.

Ask Claude to translate a 1,000-word human-authored document from French into English, and the model must generate the English tokens itself. The output could therefore carry a fresh statistical signal across much of its length, even though the original ideas and source wording came from a human author. Yet the European Commission’s implementation guidance reportedly treats faithful AI-generated translation as an example of standard editing that can fall within the Article 50 exception, provided it does not materially change the content’s meaning, style or intent.

This creates a practical tension rather than a complete legal contradiction. The law may exempt a faithful translation or a limited copy-edit, while a model-level watermark may still be applied to the generated output. A token-level system cannot reliably distinguish translation, proofreading and original composition: it records how the model generated the output, not who supplied the underlying ideas or whether the use was legally exempt.

The technology measures model involvement; the legislation is concerned with the nature and extent of the alteration. Those are overlapping but different categories.

That is the central oddity: the law may exempt certain assistive uses, while the watermark can still mark the output, because the signal is introduced while the model is choosing tokens rather than stamped onto the text afterwards. Anthropic says its watermarking applies to content generated and processed by Claude, including text that is edited or transformed from material supplied by a user. A positive result could therefore indicate that Claude processed the passage without establishing that Claude originated its argument or that the user’s use fell outside a legal exemption.

Limitations of academia

There is also a possible commercial angle. Researchers use the term “radioactivity” for the possibility that a watermark-related statistical bias may survive when marked outputs are used as training data for another model. In principle, that could help investigate model provenance or unauthorised distillation. Research on watermark inheritance has treated this as a potential way to detect when a student model has learned from watermarked outputs.

In practice, persistence would depend on the volume and composition of the training data, dilution by unmarked material, the training procedure and the detector. The same phenomenon may also create spoofing risks: a downstream model could potentially inherit or imitate a target model’s watermark, weakening the assumption that a detected mark proves direct generation by that model.

Watermark radioactivity may therefore prove more useful as a research tool for studying data lineage and model distillation than as a reliable way to identify individual student misconduct. This remains a potential application, not an established operational capability.

For universities, the deepest flaw has nothing to do with evasion. A watermark can provide evidence that text passed through a particular model or generation pipeline. What an examiner wants to know, however, is often its intellectual origin: who developed the argument, who selected the evidence and whether the student understands the submitted work. Those are different facts, and no property of the text artefact automatically supplies the second.

A student who drafted every claim and requested language polishing, a student who entered a short prompt and submitted the resulting essay, and a dyslexic student using a language model under a documented accommodation could all produce text that contains a positive signal. The detector cannot, by itself, distinguish those cases. Detection strength may vary with length, language, decoding settings and editing, but no threshold converts a model-involvement signal into proof of unauthorised authorship.

A negative result is not exculpatory either. Older models, unmarked providers, local open-weight systems, short passages, highly constrained prose and rewritten text may all produce clean results. Treating a negative as proof of human authorship would reward users who deliberately route their work through a second model or otherwise remove a particular provider’s signal.

The instrument is therefore asymmetrically weak for individual adjudication: a positive is ambiguous, while a negative is limited to the specific watermark and detector tested. That may make watermarking useful for population-level monitoring or provenance investigation, but it makes it unsuitable as a standalone verdict in an individual academic-misconduct case.

The burden of error may also be unevenly distributed. Independent research has raised concerns that automated AI detectors can produce higher false-positive rates for non-native English writers and for prose with formulaic or constrained language. Those concerns should not automatically be transferred to every statistical watermarking system, because a watermark detector is not an authorship classifier. They do, however, justify treating language background, disability, assistive technology and reasonable adjustments as relevant fairness considerations.

The accessibility case is particularly sensitive. If a student uses an approved language model as part of a documented reasonable adjustment, a resulting watermark should not be treated as evidence of misconduct merely because it confirms that the tool was used. An institution that penalised permitted assistive use could face serious procedural-fairness and equality-law risks. Whether liability would arise would depend on the accommodation, the institution’s policy, the facts of the case and the applicable law; it should not be stated as an automatic legal outcome.

The sensible prescription is procedural. Watermark evidence should be treated as corroborating at most: it may prompt further inquiry, but it should be considered alongside drafts, source records, version histories, an oral explanation of the work and the applicable assessment policy — and never used alone to establish misconduct. This approach is consistent with emerging higher-education guidance that automated detection results should not independently justify disciplinary sanctions.

That restriction should be written into institutional rules rather than left as informal guidance, because a tool introduced as one input among several can gradually become the input that decides. Policies should also specify how students can challenge a result, what alternative evidence panels must consider, and how approved assistive technologies and reasonable adjustments are handled.

Better still, institutions should frame the issue primarily around permitted use and disclosure. Where AI assistance is allowed, students could be required to identify the tool, describe what it did and explain how they checked or revised its output. Where AI-generated material is prohibited, the relevant offence should be unauthorised use or a dishonest declaration — not the mere presence of a statistical mark. Universities already use declaration-based academic-integrity procedures: Cambridge, for example, requires students to acknowledge permitted AI use and identify the tool and task involved, while Durham requires an AI declaration for summative assignments.

Universities have established processes for investigating false declarations, including evidential standards, hearings and appeals. Routing AI use through that machinery is more defensible than building a new disciplinary system around an instrument that cannot distinguish model involvement from intellectual responsibility. A watermark may help establish that a particular system processed text; it cannot, by itself, establish that a student lacked authorship, understanding or permission.

The viva strikes back

All of which points away from forensic detection as a complete solution. The stylistic gap on which many detectors rely is narrowing from both directions: language models are trained to produce fluent, human-like prose, while humans are also beginning to absorb some of the models’ linguistic habits. A Max Planck Institute-led study examined approximately 740,249 hours of spoken material from academic talks and podcast conversations and found that several words disproportionately associated with ChatGPT — including “delve,” “comprehend,” “meticulous,” “swift” and “boast” — became more common after ChatGPT’s public release. Some increases were reported at roughly 25–50% for particular words.

The findings are consistent with a cultural feedback loop, but they do not show that every speaker consciously copied ChatGPT or that generative AI alone caused each linguistic change. Natural language is shaped by many forces, and causality remains difficult to establish. They do show, however, that polished or AI-associated phrasing is becoming less reliable as evidence of machine authorship. Fluent prose was once treated as a rough proxy for effort; that relationship is weakening, and no detector can restore it by examining style alone.

The more durable answer is to redesign assessment so that it observes process as well as product. Useful measures include staged submissions, documented drafts and feedback, supervised or in-person writing for a component of the mark, oral explanation of submitted work, and a viva or targeted defence in borderline cases. Assessment design should also include clear teaching about AI tools, disclosure requirements, source verification and the responsible use of assistance.

Current assessment frameworks explicitly recommend process documentation, oral defence, authentic tasks and transparent AI-use policies as ways to make learning more observable and assessment more resilient to outsourcing.

This approach costs more than running an automated detector. But adjudicating uncertain machine-generated probabilities also carries costs: licence fees, appeals, staff time, procedural disputes and damage to student and institutional reputations. A short oral defence or a record of staged development may provide more meaningful evidence of understanding than a proprietary score whose interpretation is difficult to verify.

A watermark can, at most, establish that a particular model or generation pipeline probably processed the text. Whether a mind did too is a question no secret key can unlock. For that, education may find that its oldest technology still works best: a chair, a table and a question asked out loud.