The EU AI Act requires all AI outputs to be "detectable as artificially generated." But as a new essay making waves on Hacker News (132 points) argues, text AI watermarks will always be trivial to remove. The fundamental nature of text makes watermarking a losing arms race — and the regulatory implications are enormous.
Why Text Watermarking Is Hard
It's easy to watermark an image. Digital images contain lots of noise that the human eye can't see. You can hide a watermark in twenty specific pixels, and no one will notice. Text is different. Text is a highly compressed medium — you cannot make any change to a sentence that a human wouldn't notice.
If your watermark is "every fifth letter is an 'e'," applying it naively would make AI output full of typos. You could let the model figure out how to fit the watermark naturally, but that consumes reasoning time that would be better spent on the user's actual problem, and makes the model sound less capable.
Google's SynthID: The Current State of the Art
As far as publicly known, the only AI provider actually watermarking text output is Google, with their SynthID tool. Here's how it works:
- Scoring: Each token gets a "score" based on its previous tokens (for example, sum the token's ID with the IDs of its previous three tokens, then take mod 5).
- Sampling: To apply the watermark, the model adopts a sampling strategy like "out of the top five most likely tokens, pick the one with the top SynthID score."
- Detection: The watermark is detected by calculating the aggregate SynthID score of a block of text. If it's suspiciously high, it's very likely AI-generated.
This is essentially a mathematical version of "AI uses certain words too much," but instead of a list of keywords, it relies on subtle mathematical relationships between words that humans can't identify. The scoring process is trivial, so detection is very cheap.
Why Watermarks Are Trivially Removable
Here's the critical problem: any transformation that changes the text will destroy the watermark.
- Paraphrasing: Ask another AI to rewrite the text in different words. The SynthID scores of the new tokens won't match the original pattern.
- Translation: Translate to French and back. The watermark is gone.
- Manual editing: Change every fifth word to a synonym. The mathematical pattern is broken.
- Reformatting: Add or remove punctuation, change line breaks. Many watermark schemes are sensitive to exact formatting.
The essay's author, Sean Goedecke, points out that this is fundamentally different from image watermarking, where the watermark can survive compression, resizing, and even cropping. Text watermarks cannot survive even simple transformations because text has no "noise" to hide in.
The EU AI Act Problem
The EU AI Act requires AI providers to offer free watermarking services to every EU citizen. But if watermarks are trivially removable, what's the point?
The regulatory intent is clear: citizens should be able to verify whether a piece of text was AI-generated. But if anyone can remove the watermark with a simple "rewrite this" prompt to another AI, the regulation is effectively unenforceable.
This creates a paradox:
- AI providers must implement watermarking (expensive, degrades quality)
- Bad actors can remove watermarks trivially (free, one prompt)
- Legitimate users bear the cost of watermarking they didn't ask for
- Regulators can't actually verify AI content in the wild
Unicode Homoglyphs: The Clever Loophole
The essay mentions one intriguing approach: Unicode watermarks via homoglyphs. Different Unicode characters can look identical but have different code points. For example, the Latin "a" (U+0061) and the Cyrillic "а" (U+0430) look the same but are different characters.
In theory, an AI could replace certain characters with their homoglyph equivalents in a pattern that's invisible to humans but detectable by software. This would survive paraphrasing (the characters don't change) but not translation or manual retyping.
The problem: homoglyph watermarks are invisible, which means they're also undetectable by anyone who doesn't know the exact pattern. And if the pattern becomes known, it can be stripped automatically. There's also the accessibility concern — screen readers might pronounce homoglyphs differently.
Why You Can't Just "Run the Model" to Detect AI Text
One tempting approach: instead of watermarking, just run the text through each model and measure how closely the model's predicted tokens match. If it matches too well, it's probably AI-generated.
This doesn't work for two reasons:
False positives: The space of "all possible Claude answers" is much larger than "all possible human answers." A human who writes clearly and concisely might accidentally produce text that looks like AI output.
Cost: Running every model against a piece of text is prohibitively expensive. The EU AI Act requires free watermarking services — you can't do that with the "run the model" approach.
What This Means for 2026
The implications are significant for several stakeholders:
For AI providers: Implementing watermarking is a regulatory requirement in the EU, but it degrades output quality and is trivially circumvented. The cost is real; the benefit is illusory.
For regulators: The EU AI Act's watermarking requirement may be unenforceable in practice. If watermarks can be removed with a single prompt, requiring them is security theater.
For users: Watermarking adds latency and potentially reduces output quality, with no real protection against AI-generated misinformation.
For developers: Building systems that detect AI text should not rely on watermarks alone. Content provenance (cryptographic signing at creation time) is a more robust approach, though it requires infrastructure that doesn't exist yet.
The Fundamental Tension
The core issue is a tension between two facts:
- Text is a lossless, human-readable medium — any human can read and modify it
- Watermarks require hiding information in a medium that has no room to hide
Images can have watermarks because pixels have noise that humans can't perceive. Audio can have watermarks because frequencies exist above human hearing. Text has neither — every character is meaningful, and every change is visible.
Until we have a fundamental breakthrough in steganography for compressed, human-readable media, text AI watermarks will remain what they are today: a regulatory checkbox that provides no real security.
Based on "Text AI watermarks will always be trivial to remove" by Sean Goedecke.
