Watermarks Without Verification: AI Text Watermarking After the EU AI Act
Alexander Nemecek, Vipin Chaudhary, Erman Ayday
cs.CY · cs.AI · cs.CR
Quick verdict
主张不可验证性（而非水印本身）才是欧盟《人工智能法案》在文本水印方面的真正差距；小规模的家族级评估支持质量对等的说法；政策论据稳健，但证据较为有限。
Summary
本文是一篇探讨 2026 年 8 月 Anthropic 披露其在 Claude 模型中默认启用了基于 SynthID-Text 的水印（正值欧盟《人工智能法案》第 50 条生效之际）所引发的公众争议的立场性论文。作者将用户诉求和供应商保证分为三类（表 I）：公开可测试、需要供应商合作，或需要尚不存在的机构。由于没有公共工具可以探测已部署的系统，他们在两个开放权重模型（Gemma-2-9B 和 Llama-3.1-8B）上评估了开源的 SynthID-Text 实现（非失真配置），采用了一种三臂设计，并与一个种子方差控制组进行了对比。在 500 个文本提示词上，两个模型的困惑度变化均为 -0.3%，小于 Llama 模型上 +1.5% 的种子控制漂移；评审员的胜率为 0.501/0.515。在 364 个编程问题上，Gemma 的 pass@1 变化为 +0.4 分，Llama 为 -3.1 分（CI [−6.0, −0.3]）。代码检测保持在接近随机的水平（AUROC 为 0.55-0.57），而文本检测为 0.78-0.82。作者的结论是，不可验证性——而非水印本身——才是治理上的失败，并提出了五项要求：发布匹配的输出、披露配置、认可审计、共享评估协议以及可互操作的检测。主要局限性在于：仅限于家族级证据、仅测试了两个模型和一种配置、仅使用英语提示词，以及使用 LLM 评审员而非人类裁判。
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Neither the users' objections nor the vendor's assurances about the Claude SynthID-Text watermark can currently be verified from outside, and this unverifiability — not watermarking itself — is the substantive governance failure (Sections I, II, V).
- At the family level, SynthID-Text's non-distortionary configuration has no measurable prose quality cost: its effect does not exceed seed-to-seed sampling variance (perplexity −0.3% vs. +1.5% seed drift on Llama; win rates 0.501/0.515).
- On code, the quality cost is at most 3.1 points of pass@1 on one of two models (Llama, CI [−6.0, −0.3]; Gemma +0.4, within noise), while detection stays near chance (AUROC 0.55-0.57) — a detectability problem for the provider, not a quality cost to users.
- The contradictory circulating objections (easily removable yet inescapable) are symptoms of a debate proceeding without shared evidence, which the Table I taxonomy and the five institutional requirements of Section VI are designed to fix.
Strengths
Verifiability taxonomy as an analytic instrument
Table I sorts twelve contested assertions into (a) publicly testable, (b) vendor-cooperation-required, and (c) requiring non-existent institutions, and cleanly separates watermark-family evidence from deployment evidence — exposing, e.g., the symmetric unfalsifiability of Claim 2 (covert tracing) and Assurance 4 (no tracing).
Seed-control experimental design
Section IV's three-arm design (watermarked / same-seed unwatermarked / different-seed unwatermarked) measures the watermark effect against ordinary sampling variance, with equivalence bounds fixed before the runs: ±5% perplexity, judge win rate 0.45-0.55, pass@1 within five points.
Honest scoping discipline
Assignable policy requirements
Weaknesses
Under-specified LLM judge
Length confound in the code-detection result
Statistical reporting gaps
Limited external validity
Degraded drafting in Section V
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is a policy-position paper with a compact empirical component, occasioned by the 2 August 2026 entry into force of EU AI Act Article 50 and Anthropic's disclosure that post-August Claude models embed a SynthID-Text-based watermark by default. The central claim: neither the four user objections (quality degradation, covert identification, removability, inescapability) nor the five vendor assurances can currently be verified from outside, and this unverifiability — not watermarking itself — is the governance failure. Table I is the analytic core: twelve assertions sorted into (a) publicly testable, (b) requiring vendor cooperation, and (c) requiring institutions that do not yet exist. Section IV tests what is testable at the 'watermark family' level, since no public tool can probe the deployed systems.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
Does watermarking degrade the quality of LLM output?
According to this paper's family-level tests of the open-source SynthID-Text implementation (non-distortionary configuration) on Gemma-2-9B and Llama-3.1-8B: no measurable effect on prose — perplexity changed −0.3%, less than the drift caused by merely changing the sampling seed (+1.5% on Llama). On code, pass@1 dropped 3.1 points on one model and was statistically indistinguishable on the other. These results concern the published method, not any deployed proprietary system, which the paper argues cannot be externally verified.
Can AI text watermarks like SynthID-Text be detected in generated code?
Barely, in this study. Using the mean g-value detector at a 1% false-positive rate, code detection stayed near chance (AUROC 0.55-0.57), versus 0.78-0.82 for prose. The paper attributes this mainly to low per-token entropy in code plus short output length (fewer than one in a hundred Gemma code samples reached 200 tokens), and argues this is a detectability failure for the provider — who owes detectability under EU AI Act Article 50 — rather than a quality cost to users.
What does the EU AI Act require for marking AI-generated text?
Article 50, applicable from August 2, 2026, requires generative-AI providers to mark machine-generated content in a machine-readable way and to ensure it can be detected as AI-generated. This paper's point is that the Act requires no evaluation under a shared protocol, no independent audit of key management, and no detection interface independent of the vendor — which is why the contested claims around Anthropic's Claude watermark cannot currently be settled by anyone outside the company.
Can the Claude watermark be removed, for example with tools on GitHub?
The paper finds no published evidence that any removal tool works on the deployed system. At the watermark-family level, light edits and splicing leave the mark detectable, while paraphrasing with another model substantially reduces detectability and translation removes it — so 'easily removable' and 'inescapable', the two circulating user claims, are mutually contradictory. The authors' point is that in the absence of a scored public detector, no external party can test removal against the actual deployment.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1 and 2 are present only as interleaved axis labels and caption text in the extraction; curve shapes were not visually verifiable and are described here from captions and body text. All tables and quoted numbers extracted cleanly.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.