Sieve or Shield? : Why AI Text Watermarks are Remarkably Easy to Scrub

 

In a nutshell (TL;DR)...

While AI text watermarks such as Google DeepMind's SynthID-Text are legally mandated by the EU AI Act to identify synthetic content, independent security research demonstrates that they are technically fragile and easily scrubbed using inexpensive paraphrasing tools. This vulnerability highlights a major divide between regulatory ambitions and technical reality, proving that existing watermarking techniques cannot serve as a reliable defense for content verification.

When the European Union drafted the transparency rules for the EU AI Act, regulators envisioned a digital ecosystem where artificially generated text would be permanently and reliably stamped. Under Article 50(2), AI providers are legally required to mark their synthetic outputs in a machine-readable format so that downstream detection tools can identify AI-generated content.

To comply, companies like Anthropic have deployed advanced statistical watermarking frameworks like Google DeepMind’s SynthID-Text globally. But while these watermarks have sparked outrage over potential drops in writing quality, independent security research has revealed an even deeper, structural flaw: for motivated bad actors, AI text watermarks are incredibly easy to erase.

The Illusion of "Robust" Marks

On paper, statistical text watermarking is designed to be highly resilient. Because the watermark is embedded directly into the statistical patterns of word choice, rather than as a hidden character or metadata tag, it travels with the text when copied, pasted, or slightly modified. Anthropic and DeepMind note that the watermark can survive mild paraphrasing, minor word substitutions, and cropping.

However, "surviving mild editing" is a far cry from being cryptographically secure.

Independent researchers at the SRI Lab at ETH Zurich conducted a comprehensive, adversarial audit of the open-source SynthID-Text framework. Their findings were stark: while SynthID-Text is highly resistant to "spoofing", meaning it is very difficult for an attacker to forge Claude’s watermark and falsely attribute human-written text to the AI, it is remarkably fragile when it comes to "scrubbing" (completely removing the watermark).

According to the SRI Lab evaluation, even naive adversaries using off-the-shelf, baseline paraphrasing tools can easily bypass or strip SynthID-Text watermarks. In their tests, standard rewriting tools successfully "scrubbed" the watermarks from text, rendering them completely undetectable to the watermark classifiers.

The $50 Attack: How Watermarks are Bypassed

Why is a watermark so easy to wash away? The vulnerability lies in the very nature of language.

When an AI watermarking algorithm like SynthID-Text generates text, it is essentially applying a slight mathematical bias (using its secret g-function) to favor certain words over others. But as soon as that text is fed into a secondary AI model, such as a paraphrasing tool or a translation engine, that secondary model completely replaces those biased word choices with its own, unbiased vocabulary distributions.

The SRI Lab research demonstrated that an attacker can use a technique called a "stealing attack". By sending a series of black-box queries to the watermarked LLM, the attacker can learn the statistical pattern of the watermark. Once the attacker understands the boundary of the watermark, they can apply "assisted scrubbing".

The results are devastating for the watermark’s credibility: the scrubbing success rate soared to above 90%, and in some cases reached nearly 100%. The financial barrier to executing these attacks? Academic researchers noted that a successful attack could be carried out for under $50.

Furthermore, the researchers found that DeepMind's use of "tournament sampling" actually made the watermark more sensitive to rewrites and easier to scrub than more basic watermarking schemes, as the mathematical g-values are highly fragile when sentences are reorganized.

The Rise of GitHub Bypasses

This academic vulnerability is already playing out in the real world. ZDNET recently reported a massive public backlash against watermarking, which has triggered a sudden surge of "watermark-removal" and "re-humanizing" tools on GitHub.

One notable tool, Declaude, was specifically designed to strip the statistical markings left by Claude’s models. James Padolsey, the developer behind Declaude, criticized the underlying EU watermarking mandate as an arbitrary, "feel-good" regulation. Padolsey pointed out that the policy mostly penalizes ordinary, law-abiding users who get flagged for using AI for benign tasks like proofreading, while doing virtually nothing to stop deliberate bad actors from using simple scripts to scrub watermarked text before deploying it in misinformation or phishing campaigns.

The Regulatory Disconnect

The ease of scrubbing reveals a deep chasm between European regulatory ambitions and computer science realities. Under the EU AI Act, regulators are developing a voluntary Code of Practice on Transparency that demands "robust" and "reliable" watermarking technologies.

Yet, as DeepMind itself admits, a watermark’s confidence score is heavily degraded the moment a text is thoroughly rewritten, translated into another language, or mixed with human-written text.

For businesses and compliance officers, this technical reality means they cannot treat watermarking as a silver bullet for content verification. If a company's compliance strategy relies solely on detecting watermarks to prevent AI-generated misinformation from slipping through its pipeline, its defenses are effectively a sieve.

In Part 3 of this series, we will step out of the technical sandbox and look at the legal and financial hammer that the European Union is preparing to swing at companies that fail to master these transparency rules.

The Wordplay Police — Does AI Watermarking Ruin Good Writing?

 

In a nutshell (TL;DR)...

Anthropic has introduced mandatory, invisible watermarking for Claude models to comply with the EU AI Act. Using a technique called SynthID-Text, the system subtly biases word selection to create a detectable statistical pattern. Critics argue this process compromises semantic precision and nuance, particularly in creative writing, while Anthropic maintains the effect is imperceptible. Notably, factual and constrained writing remains largely unaffected by these adjustments.

Having just got back from a lovely vacation, it just wasn't in me to write an article last week, I hope you can forgive me...

As of August 2, 2026, a silent transformation occurred across the artificial intelligence landscape. Every piece of text, line of code, and structured document generated by Anthropic’s newest Claude models began carrying a hidden digital signature. Rolled out globally with no opt-out available, this watermarking policy represents the first massive, model-level deployment designed to meet the strict transparency rules of the European Union’s AI Act.

But as users adjust to this new reality across the Claude Platform, API, Claude Code, and Claude Cowork, a fierce debate has erupted among writers, software engineers, and language experts. The core question: In forcing AI models to sign their work, are we inadvertently destroying the quality of the writing itself?

How Claude Writes with a Secret Key

To understand the controversy, we have to look under the hood of text watermarking. Unlike images or video, where watermarking can involve embedding signed cryptographic metadata or altering pixels, watermarking text is a much more delicate mathematical dance.

Large language models (LLMs) generate text by predicting the next word (or "token") in a sequence, one by one. For any given word, the model calculates a probability distribution, a list of potential next words, each with a score indicating its likelihood. Normally, the model chooses from these top candidates with a degree of natural randomness.

To embed a watermark, Anthropic utilizes a technique based on Google DeepMind’s open-source SynthID-Text approach. This method acts as a "logits processor" in the text generation pipeline. Rather than inserting hidden characters or visible labels, SynthID-Text uses a pseudo-random mathematical formula, known as a g-function to subtly adjust or "bias" the probability scores of candidate words.

The resulting pattern of adjusted word scores represents the watermark. While individual word choices appear completely natural to a human reader, a computer classifier trained on the secret cryptographic key can analyze a passage and calculate whether the word choices match the expected statistical pattern of the watermark.

The Synonyms Trade-Off: Precision vs. Provenance

Anthropic has repeatedly insisted that this statistical watermarking process is entirely imperceptible and has no negative effect on the content, creativity, or readability of Claude's responses.

However, critics are highly skeptical. Prominent tech blogger John Gruber, the co-creator of Markdown and voice of *Daring Fireball*, has launched a scathing critique of this approach. Gruber argues that a fundamental rule of writing is that no two synonyms carry the exact same meaning. Context, nuance, tone, and subtext dictate the "perfect" word choice.

When a watermarked model is forced to choose its next word, the pseudo-random g-function might artificially boost the probability of a secondary, slightly inferior synonym simply because it fits the watermarking key, while depressing the likelihood of the semantically perfect word. For instance, Gruber points out that if the model must decide between "grey" and "overcast," and the watermarking algorithm forces "grey" to satisfy the mathematical key, writing precision is compromised.

Gruber even suggests that Google Gemini’s reputation for being slightly weaker or more robotic than its competitors could stem from the fact that SynthID has been active in Gemini’s web and app versions for some time.

The Fact-Heavy Exception

Interestingly, there is one area where watermarking leaves writing untouched: highly factual prose. Both Anthropic and Google DeepMind acknowledge that watermarking is significantly less effective on factual or highly constrained text.

If you prompt Claude to answer, "What is the capital of France?" or to recite a classic William Wordsworth poem, there is little to no room for stylistic variation. Adjusting the token distribution in those scenarios would risk generating false facts or corrupting the text. As a result, the watermarking algorithm automatically dials itself back, leaving fact-heavy, technical, or legal passages largely unwatermarked.

This fact-heavy exception highlights the central irony of the "Wordplay Police." The more creative, nuanced, and stylized your writing is, the more heavily the watermarking algorithm must manipulate Claude’s vocabulary to leave a detectable trace. For professional writers using AI as a collaborative partner, this means the very qualities they value most, stylistic fluidity and semantic precision, are the ones most targeted by the watermarking key.

The Road Ahead

For average users, the watermarks remain entirely invisible. You can copy and paste text from Claude, and the watermark will travel silently with those words because the mathematical pattern is woven into the text itself.

But as the EU AI Act’s enforcement tightens, the tension between maintaining pure prose quality and enforcing government-mandated "content hygiene" is only going to grow. In the next part of this series, we will look at whether these controversial watermarks are actually secure, or if they are easily bypassed by the very bad actors they are designed to catch.