Watermark Robustness: What Survives Paraphrasing, Translation, and Synonym Swaps

A text watermark isn’t ink. It’s a lean — a faint statistical tilt in which words a model chose, smeared across a whole passage. So when people ask whether a watermark “survives” editing, they’re really asking a much sharper question: how many of those original word choices does a given edit leave standing? Answer that, and you can rank attacks from “barely scratches it” to “wipes it clean.”

This piece does exactly that for the three most common things people do to text: swap synonyms, paraphrase, and translate. They don’t damage a watermark equally, and the reasons why are more interesting than the headline.

Key takeaways

• A token-level watermark is a statistical lean in which words a model picked, not a hidden symbol. Robustness comes down to one question: how many of those original word choices does an edit leave intact?
• The three attacks rank cleanly by destructiveness. Synonym swaps are the weakest, targeted paraphrasing is stronger, and round-trip translation is the most destructive because it rebuilds the text token by token.
• Synonym swaps fail more often than people expect. They leave sentence structure and most function words untouched, so a long enough passage keeps enough of its lean to stay detectable.
• Length is the hidden variable. Short passages have too few tokens to carry a strong signal; long documents resist all three attacks better.
• A weakened or missing watermark proves nothing about authorship, and almost no text you write today is watermarked at all.

First, where the watermark actually lives

The most-cited scheme comes from Kirchenbauer and colleagues in 2023. As a model generates each word, a secret key splits the vocabulary into a “green list” and a “red list,” and the model is nudged to prefer green words. Do that across hundreds of tokens and watermarked text ends up with slightly more green-list words than chance would predict. A detector holding the same key counts green words and asks whether the lean is too strong to be a fluke.

The signal isn’t in any one word. It’s in the ratio of green words across a long stretch of text. That single fact decides everything below. An attack is destructive in proportion to how many original tokens it replaces — and, just as importantly, *which* ones. If that statistical reasoning sounds familiar, it’s cousin to the math behind ordinary detectors, which we unpack in the statistics behind AI detectors.

With that model in hand, the ranking falls out almost mechanically.

Synonym swaps: the weakest attack (yes, really)

Most people assume swapping words is the obvious way to scrub a watermark. It’s the weakest of the three, and the green-list model tells you why.

A synonym swap is surgical. You replace *content* words one at a time — “big” for “large,” “fast” for “rapid” — and leave nearly everything else as the model wrote it. The sentence skeleton stays. Articles, prepositions, conjunctions, auxiliaries — “the,” “of,” “and,” “is” — stay. Plenty of content words you didn’t bother swapping stay too. Every one of those untouched tokens still carries its original green-or-red status.

So the ratio barely moves. Swap a small fraction of the words and most of the original lean is still sitting there for a matching detector to count.

A quick scenario

Picture a watermarked 700-word essay run through a thesaurus tool that changes about one word per sentence. Most of the text — the structure, the function words, the content words you left alone — never changes. When the detector recounts green words, the lean has softened but it hasn’t collapsed. On a passage this long, that residual signal can still clear the detector’s threshold. On a 120-word blurb, the same swap rate might be enough, because there was never much signal to begin with. Length is doing the real work here, not the synonyms.

There’s a craft footnote too: mechanical synonym swapping tends to make writing *worse* — stilted, off-register, weirdly formal. So it’s the attack that does the least to the watermark while doing the most damage to the prose. Bad trade.

Paraphrasing: stronger, because it touches structure

Paraphrasing is a real step up, and the research is consistent about it. In 2023, Krishna and colleagues built a strong paraphrasing model (nicknamed DIPPER) specifically to probe detectors, and running AI-generated text through it pushed detection accuracy down across the schemes they tested.

The reason it beats synonym swapping isn’t subtle. A paraphraser doesn’t just replace content words — it reorders clauses, merges and splits sentences, and rebuilds phrasing. That sweeps away the function words and structural tokens a synonym swap leaves behind. The paraphraser has no idea which words are green and which are red; it just produces fresh phrasing, and the new tokens land green-or-red at roughly chance. The more of the original wording it overwrites, the closer the ratio drifts back to random noise.

The honest caveat: paraphrasing isn’t a guaranteed kill. On long documents, a paraphraser sometimes leaves chunks of original phrasing intact, and a detector can catch a faint residual lean. Sturdier watermarks resist *light* paraphrasing better than the original green-list scheme did. But “aggressive paraphrasing weakens watermarks” is about as settled as findings get in this field.

Translation: the most destructive, by design

Round-trip translation — English to, say, Korean and back to English — sits at the top of the destructiveness ladder. The mechanism is the cleanest of the three.

Paraphrasing *edits* the existing tokens. Translation *discards* them. The passage is reconstructed word by word in a different language, where your green list doesn’t even apply, then reconstructed again on the way home. Almost none of the original token choices survive that double rebuild. There’s barely any lean left to measure.

This isn’t a fringe claim. DeepMind’s published SynthID-Text work acknowledges that detection robustness weakens under translation. And when OpenAI explained why it had built a text-watermarking method but chose not to ship it, the company pointed to exactly this: the signal can be circumvented by techniques as ordinary as translation and rewording, which would unfairly disadvantage some users while letting determined ones slip through. That fairness worry isn’t hypothetical. A 2023 Stanford study (Liang et al., in *Patterns*) found AI detectors already biased against non-native English writers — the very people most likely to translate a draft for legitimate reasons.

The robustness ladder

Stack the three side by side and the pattern is consistent:

• Synonym swaps — change isolated content words; leave structure and function words intact; least destructive. A long passage often survives detectable.
• Paraphrasing — rewrites structure and phrasing; overwrites most original tokens; reliably weakens the signal, with faint residue possible on long text.
• Round-trip translation — rebuilds the text in a new language and back; almost no original tokens survive; most destructive.

Two cross-cutting rules sit underneath all three. Length: short text has too few tokens to hold a strong lean, so any attack hits harder. Proportion: changing a handful of words barely moves the needle; overwriting most of them usually guts the signal regardless of method.

Robust watermarks like SynthID-Text raise the floor — they’re built to tolerate light edits and minor swaps while staying readable — but DeepMind is upfront that heavy paraphrasing and translation still chip away at the signal. Every published scheme carries the same tension: a stronger watermark constrains word choice and can hurt the writing; natural-sounding output stays easy to strip. You don’t get both.

What this means for you (and what it doesn’t)

A weakened watermark says nothing about who wrote a document. Neither does a missing one. Everything humans write is un-watermarked, and so is output from any model that doesn’t add a mark — which is most of them, most of the time. “No watermark found” is the default state of nearly every document on Earth.

And the tool flagging your essay almost certainly isn’t a watermark checker. Those need the provider’s secret key. Schools and freelance platforms run probabilistic AI detectors that guess from writing patterns — a different system with different blind spots. For the wider landscape, you can browse the rest of our writing on detection.

Frequently asked questions

Does a single round of synonym swapping remove an AI watermark? Usually not on its own. A synonym swap changes one content word at a time and leaves structure, function words, and untouched content words as the model wrote them. On a short paragraph that can lower confidence, but on a long passage enough green-leaning words tend to survive that a matching detector still sees the pull. It’s the least reliable of the three attacks.

Why is translation harder on a watermark than paraphrasing? Paraphrasing rewrites the existing text and can leave chunks of original phrasing intact. Round-trip translation discards the tokens entirely — the passage is rebuilt in another language and again on the way back, so almost none of the original word choices return. DeepMind’s SynthID-Text paper notes robustness weakens under translation, and OpenAI has cited translation as a reason it held its own tool back.

Do robust watermarks like SynthID-Text change this ranking? They raise the floor, not the ceiling. SynthID-Text tolerates light edits and minor swaps while staying readable, but DeepMind says robustness still weakens under heavy paraphrasing and translation. Every scheme faces the same trade-off: a stronger watermark constrains word choice and can dent quality, while natural output stays easy to wash out.

Is a watermark check what flagged my essay? Almost certainly not. Verifying a watermark needs the provider’s secret key, which schools and third-party tools don’t have. What flags work is a probabilistic AI detector guessing from writing patterns — OpenAI retired its own classifier in July 2023 for low accuracy, and a 2023 Stanford study found detectors biased against non-native English writers.

If editing weakens a watermark, isn’t that just cheating? It depends what you do. The edits that damage a watermark most — rewriting sentences, swapping in specifics, varying structure — are the same edits that make writing read as genuinely yours. If you rewrote a draft until the pattern no longer held, you mostly just rewrote the draft.

The bottom line

Watermark robustness isn’t mysterious once you know the signal lives in word choice. Synonym swaps nibble at it, paraphrasing chews through it, and translation rebuilds the text past recognition. The most reliable way to “remove” one turns out to be plain, honest revision — varying your sentences, adding real detail, making the words yours.

If that’s the work you’re doing anyway, you can test how a revised draft holds up and see where it lands.