Can AI Watermarks Survive Paraphrasing, Translation, and Editing? What the Research Says

A watermark sounds like it should settle the whole AI-writing debate: stamp every machine-made paragraph with a hidden signal, then check for the stamp later. The problem is that text isn’t a photograph, and the “stamp” isn’t ink — it’s a fragile statistical pattern hiding in word choice. So the real question isn’t whether watermarks exist. It’s whether they survive the ordinary things people do to text: rewording it, translating it, editing it into shape.

Key takeaways

• A text watermark isn’t a visible symbol or a hidden character. It’s a bias in *which words the model picked*, spread across the whole passage.
• The research is blunt about it: paraphrasing is the most effective way to remove a watermark, and round-trip translation is nearly as destructive. Both rebuild the text in new tokens.
• Light editing degrades a watermark gradually. The more you change, the lower a detector’s confidence drops — there’s rarely a clean on/off moment.
• Newer schemes like Google DeepMind’s SynthID-Text (Nature, 2024) are designed to shrug off light edits, but DeepMind says confidence falls under heavy rewriting and translation.
• A weak or missing watermark proves nothing about who wrote something. Most text was never watermarked at all.

What a text watermark actually is

To know whether a watermark survives, you need a quick mental model of where it lives. The most-cited approach comes from Kirchenbauer and colleagues in 2023. As the model generates each word, a secret key splits the vocabulary into a “green list” and a “red list,” and the model is nudged to favor green words. Do that across hundreds of tokens and you get a pattern: watermarked text contains slightly more green-list words than chance would predict. A detector with the same key counts the green words and decides whether the lean is too strong to be a coincidence.

Notice what that means. The signal isn’t *in* any single word. It’s in the ratio of green words across a long stretch of text. That detail explains everything that follows. Change enough words and you change the ratio, and the signal fades back toward random noise. This is the same family of statistical reasoning behind ordinary detectors — if you want the deeper version, we wrote a whole piece on the statistics behind AI detectors.

Paraphrasing: the attack the research keeps confirming

If there’s one finding the literature agrees on, it’s this: paraphrasing is the watermark’s biggest weakness. In 2023, Krishna and colleagues built a strong paraphrasing model (nicknamed DIPPER) specifically to test detectors and watermarks. Feeding watermarked text through it drove detection accuracy down sharply across several schemes. The mechanism is exactly what the green-list model predicts — a paraphraser swaps your green words for whatever its own rewording produces, with no idea which list those new words belong to. The ratio collapses.

A quick scenario

Say a student generates a 600-word essay from a watermark-enabled model. Unedited, a matching detector lights up with high confidence. Now the student runs the whole thing through a paraphrasing tool. Sentence structure shifts, synonyms get swapped, clauses get reordered. The meaning survives; the *token choices* don’t. When the detector recounts green words, the lean is gone. That’s not a glitch. It’s the designed behavior of a signal that lives in word selection.

The honest caveat: newer, sturdier watermarks resist *light* paraphrasing better, and on very long passages a detector can sometimes still catch a faint residual lean. But “aggressive paraphrasing weakens watermarks” is about as settled as findings in this field get.

Translation: rebuilding the text from scratch

Round-trip translation — English to, say, Japanese and back to English — is even harder on a watermark than paraphrasing, and for a simple reason. Translation doesn’t tweak the existing tokens; it discards them. The passage is reconstructed word by word in a different language, then reconstructed again coming home. Whatever green-list pattern the original carried is gone twice over.

This isn’t a fringe claim. DeepMind’s published SynthID-Text work acknowledges that detection confidence drops sharply when text is translated. And when OpenAI explained why it built a text-watermarking method but chose not to release it, the company pointed to exactly this: the signal can be circumvented by techniques as ordinary as translation and rewording, which would unfairly disadvantage some groups — like non-native English writers who legitimately translate their drafts — while letting determined users slip through. That fairness worry isn’t hypothetical. A 2023 Stanford study (Liang et al., in *Patterns*) found that GPT detectors were already biased against non-native English writers.

Editing: death by a thousand small changes

Editing is the least dramatic attack and the most realistic, because it’s what normal revision looks like. The research picture here is about *gradual degradation* rather than a sudden break.

Splice in a few sentences of your own. Cut a paragraph. Reorder two ideas. Fix the clunky transitions. Each change replaces some watermarked tokens with un-watermarked ones, and the green-word ratio drifts a little closer to random. There’s usually no single edit that flips the verdict — instead, detector confidence slides down as the proportion of original tokens shrinks. Three patterns show up again and again:

• Length matters. Short text is easy to scrub because there were never enough tokens to carry a strong pattern. Long documents hold a watermark more stubbornly.
• Proportion matters. Replacing 10% of the words barely moves the needle; replacing 60% usually guts the signal.
• Constrained text is weaker. Highly factual or formulaic writing — where word choice is limited anyway — carries a fainter watermark to begin with.

This is also why “robust” watermarks aren’t magic. SynthID-Text was explicitly engineered to survive light edits while keeping the writing readable, and on that narrow goal it does well. But DeepMind is candid that the mark weakens once text is heavily rewritten or translated. There’s an unavoidable tug-of-war: crank the watermark stronger and you constrain word choice enough to hurt the writing; keep the writing natural and the watermark stays easy to strip.

So — are AI watermarks removable?

Short answer: yes, and the research has shown several reliable ways to do it. Honest answer: “removable” is doing a lot of work in that sentence. You don’t peel a watermark off the way you’d erase a pencil mark. You remove it by changing enough of the text that the statistical pattern no longer holds — which usually means you’ve genuinely rewritten the thing.

That distinction matters for how you think about your own work. Rewriting a draft until it’s clearly yours isn’t a loophole; it’s editing. The same revision that happens to weaken a watermark — varying sentence length, swapping in specific details, blending in your own phrasing — is the same revision that makes writing read as human in the first place. If you’re curious how that plays out across different needs, our plans page lays out what each plan handles.

What this means for you (and what it doesn’t)

Two practical points cut through the noise.

First, watermark detection almost certainly isn’t what’s flagging you today. Verifying a watermark requires the provider’s secret key, which schools and third-party tools don’t have. What they use are probabilistic AI detectors that guess from writing patterns — and those guess wrong often enough that OpenAI retired its own classifier in July 2023 for low accuracy. A watermark check and an AI detector are completely different systems with different failure modes.

Second, absence of a watermark proves nothing. Everything humans write is un-watermarked. So is output from any model that doesn’t add one. A “no watermark found” result is the default state of almost every document on earth, which is why it can’t be evidence of human authorship — the same way a low AI-detector score isn’t proof. If you want the broader landscape, you can browse the rest of our writing on detection.

Frequently asked questions

Are AI watermarks removable in practice? Yes, with varying difficulty. Statistical text watermarks live in the specific words a model chose, so anything that changes enough of those words — paraphrasing, translation, heavy editing — degrades the pattern. The catch is that “removing” a watermark this way usually means rewriting so much that it’s no longer the same draft, which is closer to genuine revision than to a trick.

Does paraphrasing always defeat a watermark? Not always, but it’s the most effective attack studied. Krishna and colleagues (2023) showed a strong paraphrasing model could drive watermark detection down sharply across several schemes. More robust watermarks resist light paraphrasing better, and detectors can sometimes catch a weak residual signal in long passages. Short text is easiest to scrub.

What about translating the text into another language and back? Round-trip translation is one of the harshest things you can do to a token-level watermark. It rebuilds the passage in a different language and then again on the way back, so almost none of the original token choices survive. DeepMind says SynthID-Text confidence drops under translation, and OpenAI cited translation and rewording as reasons it held its own tool back.

If my essay has no detectable watermark, am I safe from accusations? A clean watermark check proves little on its own, because nearly all text carries no mark by default. Schools and freelance platforms overwhelmingly rely on probabilistic AI detectors, not watermark checks, and those make mistakes in both directions. The real protection is understanding how detection works and writing in a way that genuinely reads like you.

Will watermarks eventually become impossible to remove? Unlikely for text. There’s a built-in tension: a stronger watermark constrains word choice and hurts quality, while a natural-sounding one stays easy to strip. Researchers keep improving robustness, but every published scheme so far has a paraphrase or translation attack that weakens it.

The bottom line

Watermarks are a real, improving technology — and on the narrow job of catching unedited output from a cooperating model, they work. But the research on paraphrasing, translation, and editing all points the same way: a signal that lives in word choice doesn’t survive having its words changed. The most reliable way to “remove” one is also just good editing.

If your goal is writing that reads like a person wrote it — because a person did the thinking — that’s the work worth doing. You can try PaperBleach and see how your own draft holds up.