Text AI watermarks will always be trivial to remove
TL;DR Highlight
EU AI Act text watermarks can be stripped with a single paraphrase, argues this post
Who Should Read
Backend developers shipping LLM features in the EU who need to plan for AI Act compliance and AI-text labeling
Core Mechanics
- Article 50 of the EU AI Act applies from August
- From August 2026, AI outputs must be "detectable as artificially generated".
- The author reads Recital 133 and the Code of Practice as effectively requiring watermarks.
- Text is hard to watermark
- Text is a compressed medium, so there is almost no room for changes a human won't notice.
- Every change you add lowers output quality.
- Re-running the model to verify doesn't work
- The space of possible Claude answers is far larger than the space of watermarked answers, so human text gets false positives.
- Running every model against every text is also prohibitively expensive.
- SynthID hides a score in token choice
- Each token is scored from its previous tokens, and the sampler picks the top-scoring one among likely candidates.
- Detection just checks whether the aggregate score is suspiciously high, which is cheap.
- With temperature 0, which always picks the most likely token, leaving a fingerprint is hard.
Community Reactions
- Opinion that a secret algorithm makes removal non-trivial
- The argument is that if only the detection API is public and the rule stays hidden, it is hard to reverse-engineer.
- Opinion that it works on long documents
- Commenters say long papers or legal documents are statistically easier to flag, and paraphrasing with another AI adds that AI's own mark, making detection easier.
- Defense from an industry veteran
- A commenter who worked on media and model IP said watermarking is inherently weak security that relies on obscurity.
- They called biased sampling as good as it gets in 2026 and glyph insertion a poor choice.
- Opinions favoring signatures and proof of human
- One commenter noted chunked signing is possible but cannot prove a human wrote the text.
- Others suggested hardware-attested keypresses, or banning raw text in favor of signed text.
- Commenter info that Anthropic announced watermarking for EU-launched models
- The commenter said the description doesn't reveal whether it is SynthID-like or invisible Unicode.
How to Apply
- Check your service's output for hidden Unicode characters
- Today, collect sample LLM responses and script a count of non-standard spaces like U+2004 and U+3000.
- If you find them, decide whether to normalize to plain spaces before storing or displaying.
- Reduce reliance on watermarks in your AI Act plan
- Note in your design doc that text watermarks can't be the only proof mechanism.
- Add signed metadata for file outputs such as PDF and HTML to your list of options.
- Review your self-hosted and third-party inference paths
- If you run inference yourself, decide with legal where a watermark sampler would be applied.
- Don't judge users by detector results alone, given false positives.
Try It
# Paste into a shell: count and normalize non-standard spaces (homoglyphs) in a file
python3 - <<'EOF'
import sys, re, unicodedata
text = open('sample.txt', encoding='utf-8').read()
odd = [c for c in text if c != ' ' and unicodedata.category(c) == 'Zs']
print('non-standard spaces:', len(odd))
print(sorted({hex(ord(c)) for c in odd}))
clean = re.sub(r'[^\S\n]', ' ', text)
open('clean.txt', 'w', encoding='utf-8').write(clean)
EOF
# Next: paste ChatGPT or Claude output into sample.txt and run itTerminology
Related Papers
The Judge Can Debias Itself: Awareness and Self-Debiasing for Reliable LLM-as-a-Judge
Warning an LLM judge about bias or letting it self-critique improved 20 of 21 model–bias combinations.
90% of US working hours are spent on tasks not covered well by AI benchmarks
Mapping 29 benchmarks to job tasks shows 90% of US working hours lack good coverage
Postgres 19 delayed after AI reviewers find more bugs than humans can fix
LLM code review surfaced so many bugs that Postgres 19 slipped to November and 8-10 features were reverted
Show HN: Gemini 4 Argon plays StarCraft
LLMs wrote StarCraft bots in one hour; GPT-6 Astra scored highest.
A Plausible Explanation Is Enough to Mislead Multimodal Judges
Adding plausible explanations to fixed answers cut MLLM judges' wrong-answer rejection by 12.7–13.8 points.
Neural networks are clean
Looking at neurons directly shows most have one main job, challenging superposition.