Skip to main content
AI Watermark Removal

Text Watermark Robustness

Paraphrasing AI Watermarks: What One Rewrite Actually Does

Paraphrasing is the attack every text watermark gets measured against, and the results point in opposite directions depending on the scheme. One 2023 paper argues with a mathematical bound that no watermark survives a determined paraphrasing attacker. A 2026 preprint found one production-grade scheme losing its signal on 98.3% of texts after a single pass, while the original green-list watermark survived strong human rewriting as long as detectors had roughly 800 tokens. None of it adds up to a universal bypass, and all of it depends on which scheme, which paraphraser, and how much text survives.

Published 2026-08-11Updated 2026-08-11Research/proposal

Key takeaways

  • How much damage paraphrasing does depends on the specific scheme, not just on how much of the wording changed.
  • A widely cited 2023 paper (Sadasivan, Kumar, Balasubramanian, Wang, and Feizi) introduced a recursive paraphrasing attack and argued, using a bound on how close human and AI text distributions can get, that watermarking cannot be made reliably robust against a determined paraphrasing attacker.
  • Google says SynthID Text tolerates mild paraphrasing, but a 2026 preprint testing an open-source reimplementation found 98.3% of initially detected texts lost their signal after one DIPPER-style paraphrasing pass, alongside a 5.4% false-positive rate on paraphrased human writing.
  • Independent testing of the older green list and red list watermark found the opposite pattern under a milder attack: still statistically detectable after strong human paraphrasing once detectors could see roughly 800 tokens, at a strict 1-in-100,000 false-positive rate.
  • Researchers are already building watermarks meant to survive paraphrase specifically, including one that ties the green-list choice to sentence meaning rather than exact wording, later reused as a component in a 2025 hybrid defense for SynthID Text itself.
  • Paraphrasing attacks are getting cheaper to mount: reconstructing a provider's secret watermarking rule from public API queries for under $50 pushed a scrubbing attack's success from near 0% to over 85% in one 2024 study.

Robustness spectrum

How much editing does it take to lose the signal?

This maps Google's own robustness description for SynthID Text: mild edits can leave signal intact, while thorough rewriting or translation greatly reduces detector confidence. It is not a claim that any exact edit threshold is documented; the boundary between "mild" and "thorough" is not precisely defined by Google. Click a stage below for why it lands where it does.

Typo fix

Signal intact

Reformatting

Signal intact

Mild paraphrase

Uncertain, may partly survive

Thorough rewrite

Confidence greatly reduced

Translation

Confidence greatly reduced

An early, unreplicated data point

A 2026-07-17 AIES preprint using an independent SynthID Text reimplementation (MarkLLM) reported that 98.3% of initially-detected watermarked texts lost their signal after DIPPER-style paraphrasing, with a 5.4% false-positive rate flagging paraphrased human text as AI-generated. This is early-stage, not peer-reviewed, and not independently replicated. It is reported here as a data point from ongoing research, not as an established measurement of SynthID Text's real-world robustness.

The paper that framed the argument

Research/proposal

You'll get the claim every later paraphrasing result, for or against, still gets measured against.

Long before anyone tested SynthID Text, Sadasivan, Kumar, Balasubramanian, Wang, and Feizi published a 2023 paper making a sweeping claim: AI-generated text cannot be reliably detected, watermark or no watermark, against a sufficiently motivated attacker.

Their method was a recursive paraphrasing attack, running text through a paraphraser repeatedly, paired with a theoretical bound on how close human and AI text distributions can get. Push those distributions close enough together, they argue, and no detector can separate them reliably.

It is now the most-cited adversarial paper in this space, at roughly 615 citations. It is also why nobody in serious watermarking research treats "survives paraphrasing" as a settled property of any scheme.

Mild versus thorough, in Google's own words

Official announcement

Here's the exact wording of the only paraphrasing claim a major provider has published, and the footnote it arrives with.

Google's documentation describes SynthID Text as robust to mild paraphrasing, while saying detector confidence can be greatly reduced by thorough rewriting or translation. The claim is scoped to the Gemini app and web experience.

A Google-affiliated reply on the company's developer forum, dated 2026-08-05, goes further in a different direction. It states plainly that text generated through the Gemini API is not SynthID-watermarked and that native text watermarking is not planned at the moment, contradicting the DeepMind SynthID page. No official source has reconciled the two.

Mechanically, SynthID Text runs as a logits processor during generation. After Top-K or Top-P sampling narrows the candidate pool, it nudges which token gets picked, and detection scores whether those word choices match the expected pattern more often than chance predicts.

Google open sourced the scheme, which is why outside teams can test these claims instead of taking them on faith. The next two sections are what they found.

When paraphrasing lost

Research/proposal

Here's the stress test where a watermark survived a real human rewrite, and the exact condition it needed to do it.

The clearest positive result comes from Kirchenbauer and coauthors' follow-up study (ICLR 2024) on the original scheme, where the vocabulary splits into a favored green list and a disfavored red list before each token. They attacked it three ways:

  • Human rewriting, with real people rewording the passage
  • LLM-generated paraphrases produced by another model
  • Dilution, hiding watermarked text inside a longer mixed document

The watermark held. It stayed statistically detectable after strong human paraphrasing, but only once detectors could observe roughly 800 tokens, at a false-positive rate of one in 100,000.

Shorter passages fared worse. That is a real, citable threshold instead of a vague "it depends," and good evidence that paraphrasing's effect is partly a function of how much text survives.

When paraphrasing won

Research/proposal

You'll see what two independent teams found when they pointed the same attack at a newer, shipped scheme.

A 2026 preprint tells a rockier story. Using MarkLLM's open-source reimplementation of SynthID Text, researchers found 80% of freshly generated watermarked texts already sat inside SynthID's own uncertain confidence band before anyone touched them.

After one pass through DIPPER, a well-known paraphrasing model, 98.3% of initially detected texts lost their signal entirely. The same test measured a 5.4% false-positive rate, flagging paraphrased human writing as AI-generated, and ranked SynthID Text lowest of the three schemes tested on its composite score.

A peer-reviewed EMNLP 2025 Findings paper reached a related conclusion by a different route. Testing SynthID Text against paraphrase and translation attacks, it found the scheme's resilience "similar to the TGRL baseline," a much older and simpler watermark, meaning no measurable advantage from the more sophisticated design.

Neither paper claims to have tested Google's actual production deployment. Both test the open-sourced algorithm and reimplementations Google has never confirmed match what ships.

Watermarks designed to survive a rewrite

Research/proposal

You'll see the one design idea aimed squarely at paraphrasing, and where it has already been bolted onto a shipped scheme.

Because paraphrasing is a known weak point, researchers such as Liu, Pan, Hu, and Mo build around it instead of only testing against it. Their semantic invariant watermark assigns the green list from the meaning of the preceding context, captured through a semantic embedding, rather than hashing the exact prior tokens.

The goal is a mark that survives synonym swaps and meaning-preserving rewrites that would break any scheme keyed to literal wording.

What actually decides the outcome

Research/proposal

Here's the short list of variables that settle whether a rewrite kills a watermark, so you can stop asking the question in the abstract.

Four things move the result, and any claim that skips them is not worth much:

  • Which scheme is in play, since a fixed-green-list design and a context-seeded one fail differently
  • Which paraphraser did the rewriting, and how aggressive it was allowed to be
  • How much text the detector gets to see afterward, with roughly 800 tokens as the only published threshold worth quoting
  • Whether the attacker knows the secret rule, because approximating one for under $50 pushed scrubbing success from near 0% to over 85% in ETH Zurich's 2024 study

Treat any claim of guaranteed removal, or guaranteed survival, as unproven until it has been tested against the specific scheme in question. Ideally by someone other than the company that built it.

FAQ

Does paraphrasing an AI-written passage reliably remove its watermark?

Not reliably, and not predictably. Google says thorough rewriting can greatly reduce detector confidence for SynthID Text, and one preprint reported 98.3% signal loss after a single paraphrase pass. Testing on a different, older scheme found the opposite under a milder attack, staying detectable as long as detectors had roughly 800 tokens. The effect depends on the watermark, the paraphraser, and how much text survives.

How much watermarked text does a detector need after paraphrasing?

One stress test of the original green and red list watermark found it remained detectable after strong human paraphrasing once detectors had roughly 800 tokens to examine, at a false-positive rate of one in one hundred thousand. Shorter paraphrased passages fared worse.

Are researchers building watermarks specifically to resist paraphrasing?

Yes. A semantic invariant watermark proposed by Liu, Pan, Hu, and Mo assigns its green list from the meaning of prior context rather than exact token hashes, aiming to survive synonym swaps and meaning-preserving rewrites. It is a published research proposal, not a scheme any major provider has confirmed deploying, though the 2025 SynGuard defense already reuses the idea as a component grafted onto SynthID Text, reporting an 11.1% average F1 improvement.

Is there a theoretical reason paraphrasing might always be a threat?

Yes, and it predates any specific scheme being tested. The 2023 paper by Sadasivan, Kumar, Balasubramanian, Wang, and Feizi argues, using a bound on how close human and AI text distributions can get, that no scheme can be made reliably robust against a sufficiently motivated paraphrasing attacker. It is the most-cited adversarial paper in this field, and the reason "robust to paraphrase" gets treated as a claim to keep testing rather than a property to take on faith.

Next steps

  • See how robustness holds up against edits and translation more broadly, not just rewriting. Text watermark robustness
  • Look at the flip side of the $50 attack, where the same stolen rule is used to forge a watermark instead of erase one. AI watermark spoofing
  • If your question is really about Gemini specifically, start with what is confirmed and what is contested there. Remove Gemini watermark
  • Read the DIPPER-pass evaluation directly, including the uncertain-band numbers behind the 98.3% headline. AIES 2026 SynthID-Text evaluation

Sources and citation status