Paraphrasing AI Watermarks: What One Rewrite Actually Does

Long before anyone tested SynthID Text, Sadasivan, Kumar, Balasubramanian, Wang, and Feizi published a 2023 paper making a sweeping claim: AI-generated text cannot be reliably detected, watermark or no watermark, against a sufficiently motivated attacker.

Their method was a recursive paraphrasing attack, running text through a paraphraser repeatedly, paired with a theoretical bound on how close human and AI text distributions can get. Push those distributions close enough together, they argue, and no detector can separate them reliably.

It is now the most-cited adversarial paper in this space, at roughly 615 citations. It is also why nobody in serious watermarking research treats "survives paraphrasing" as a settled property of any scheme.

Google's documentation describes SynthID Text as robust to mild paraphrasing, while saying detector confidence can be greatly reduced by thorough rewriting or translation. The claim is scoped to the Gemini app and web experience.

A Google-affiliated reply on the company's developer forum, dated 2026-08-05, went further in a different direction. It stated plainly that text generated through the Gemini API is not SynthID-watermarked and that native text watermarking is not planned at the moment, contradicting the DeepMind SynthID page. On 2026-08-19 the same account withdrew that and asserted the opposite. No official documentation has reconciled any of it.

Mechanically, SynthID Text runs as a logits processor during generation. After Top-K or Top-P sampling narrows the candidate pool, it nudges which token gets picked, and detection scores whether those word choices match the expected pattern more often than chance predicts.

Google open sourced the scheme, which is why outside teams can test these claims instead of taking them on faith. The next two sections are what they found.

The clearest positive result comes from Kirchenbauer and coauthors' follow-up study (ICLR 2024) on the original scheme, where the vocabulary splits into a favored green list and a disfavored red list before each token. They attacked it three ways:

• Human rewriting, with real people rewording the passage
• LLM-generated paraphrases produced by another model
• Dilution, hiding watermarked text inside a longer mixed document

The watermark held. It stayed statistically detectable after strong human paraphrasing, but only once detectors could observe roughly 800 tokens, at a false-positive rate of one in 100,000.

Shorter passages fared worse. That is a real, citable threshold instead of a vague "it depends," and good evidence that paraphrasing's effect is partly a function of how much text survives.

A 2026 preprint tells a rockier story. Using MarkLLM's open-source reimplementation of SynthID Text, researchers found 80% of freshly generated watermarked texts already sat inside SynthID's own uncertain confidence band before anyone touched them.

After one pass through DIPPER, a well-known paraphrasing model, 98.3% of initially detected texts lost their signal entirely. The same test measured a 5.4% false-positive rate, flagging paraphrased human writing as AI-generated, and ranked SynthID Text lowest of the three schemes tested on its composite score.

A peer-reviewed EMNLP 2025 Findings paper reached a related conclusion by a different route. Testing SynthID Text against paraphrase and translation attacks, it found the scheme's resilience "similar to the TGRL baseline," a much older and simpler watermark, meaning no measurable advantage from the more sophisticated design.

Neither paper claims to have tested Google's actual production deployment. Both test the open-sourced algorithm and reimplementations Google has never confirmed match what ships.

Because paraphrasing is a known weak point, researchers such as Liu, Pan, Hu, and Mo build around it instead of only testing against it. Their semantic invariant watermark assigns the green list from the meaning of the preceding context, captured through a semantic embedding, rather than hashing the exact prior tokens.

The goal is a mark that survives synonym swaps and meaning-preserving rewrites that would break any scheme keyed to literal wording.

Four things move the result, and any claim that skips them is not worth much:

• Which scheme is in play, since a fixed-green-list design and a context-seeded one fail differently
• Which paraphraser did the rewriting, and how aggressive it was allowed to be
• How much text the detector gets to see afterward, with roughly 800 tokens as the only published threshold worth quoting
• Whether the attacker knows the secret rule, because approximating one for under $50 pushed scrubbing success from near 0% to over 85% in ETH Zurich's 2024 study

Treat any claim of guaranteed removal, or guaranteed survival, as unproven until it has been tested against the specific scheme in question. Ideally by someone other than the company that built it.