What Watermark Spoofing Is and Why It Could Frame Innocent Writers

AI watermark spoofing is the attack that runs the system in reverse: instead of stripping the hidden signal out of machine text, an attacker plants it in text a model never wrote — making a human’s essay test positive as AI output. Removal gets all the attention, but spoofing is the scarier failure mode, because it turns the tool built to catch machines into a weapon that can be aimed at people.

Key takeaways

• A statistical watermark is a learnable pattern in word choice — and anything learnable is imitable. That’s the whole vulnerability.
• Researchers have demonstrated practical spoofing: querying a watermarked model enough times reveals its word preferences well enough to forge the mark, no secret key required.
• The attack inverts the harm. Removal lets a cheater slip through; spoofing manufactures false evidence against an innocent writer.
• Spoofing also corrodes the system itself: once fake marks circulate, a positive watermark check stops being proof of anything.
• The defense that holds up isn’t cryptographic — it’s procedural. Marks should corroborate process evidence, never replace it.

A quick refresher on where the mark lives

To see why spoofing works, you need one mental picture. Production text watermarks — the Kirchenbauer green-list scheme and its descendants, including the ideas behind Google’s SynthID-Text — bias the model’s word choices using a secret key. Watermarked text leans on “green-listed” words slightly more than chance; a detector holding the key counts the lean. The signal is not stored anywhere. It *is* the word choices, spread thin across the passage. We’ve covered how fragile that makes the mark under paraphrasing and editing; spoofing exploits the same fact from the other side.

If a lean toward certain words is all the detector checks, then anyone who knows — or can guess — which words are green can produce that lean on purpose, in any text they like.

How AI watermark spoofing actually works

The obvious objection: the green list is derived from a secret key, so how would an attacker know which words to favor? The answer, demonstrated in the research, is that the model itself leaks the secret every time it speaks.

Sadasivan and colleagues raised spoofing as a practical threat in 2023: an adversary can learn a scheme’s token preferences by observing enough watermarked output, then compose text that triggers the detector. The sharper result came at ICML 2024 from Jovanović, Staab and Vechev, whose paper title says it plainly — “Watermark Stealing in Large Language Models.” By querying a watermarked model and analyzing which words it favors in which contexts, they built an approximate copy of the hidden preference pattern. With that stolen approximation they could do both attacks at once: scrub real watermarks more effectively *and* spoof convincing fake ones — and the query cost they reported was in the tens of dollars, not some nation-state budget.

Note what the attacker never needed: the key, the model weights, or any insider access. Just an API and statistics. The watermark’s own visibility to its detector is what makes it visible to a thief.

Why spoofing is the nastier direction

Removal and spoofing sound symmetric — one deletes the mark, one adds it — but their harms aren’t remotely symmetric.

Removal is a cheater’s tool. It lets AI text pass as human, which is bad, but it’s the *same* problem ordinary detectors already face from paraphrasing, an arms race we’ve mapped in the known limits of adversarial attacks on detectors. The system fails toward missing offenders.

Spoofing fails toward convicting innocents. Picture the scenarios the researchers worry about. A rival pastes a spoofed version of your submitted article into circulation, and the “authoritative” watermark check says a model wrote it. A student’s essay, run through a spoofing tool by anyone with a grudge and a shared doc, suddenly carries Google-grade “proof” of AI authorship. The entire selling point of watermarks over probabilistic detectors — *this isn’t a guess, the mark is really there* — becomes the weapon. The stronger institutions believe the mark, the more damage a forged one does.

And there’s a second-order harm: spoofing at scale destroys the mark’s meaning entirely. If fake-watermarked text circulates freely, a positive check proves nothing, and the multi-year regulatory push — the EU AI Act’s machine-readable marking obligations among them — rests on a signal anyone can counterfeit.

The uncomfortable design tension

Can’t the schemes just be hardened? Somewhat, and DeepMind’s published work on SynthID-Text discusses robustness at length — but spoofing resistance fights the watermark’s other requirements. Make the pattern subtler and harder to steal, and it becomes harder for the *legitimate* detector to read, especially on short text. Make it strong enough to survive editing, and it’s exactly the kind of loud, learnable bias a thief can extract from queries. Rotate keys frequently and you complicate your own verification at scale.

There are proposals — cryptographic schemes with formal unforgeability properties, detection restricted to rate-limited official endpoints — and they help. But every published production-style scheme so far has fallen to some version of learn-then-imitate, and the economics favor the attacker: stealing costs API queries; defending costs quality.

What this means in practice

For writers and students, the immediate exposure is low for a mundane reason: almost nobody is checking text watermarks yet. Classroom and workplace verdicts today come from probabilistic detectors, a different technology with different failure modes. The spoofing risk arrives *with* watermark adoption — the moment a mark is trusted as proof, forging it pays.

The durable protections are the unglamorous ones. Keep version history and drafts; a forged watermark can’t fake three weeks of document edits. Institutions should write policies now that treat any single technical signal — score or watermark — as corroboration requiring process evidence, never as a standalone verdict. And everyone should keep calibrated expectations about what these systems can prove: check your own writing against a detector before a gatekeeper does — you can try it on your own text for free, or see what each plan handles for volume work — and remember the score is a signal, not a court.

For the broader landscape of marks, detectors, and their failure modes, browse the rest of our writing on detection.

Frequently asked questions

What is AI watermark spoofing? Spoofing is the reverse of watermark removal: instead of scrubbing a real watermark out of AI text, an attacker adds a fake one to text the model never wrote — making human writing, or another model’s output, test positive as watermarked. It works because statistical watermarks are just patterns in word choice, and a pattern that can be detected can, with enough queries, be learned and imitated.

How can someone spoof a watermark without knowing the secret key? By observation. Researchers showed that querying a watermarked model many times lets an attacker statistically reverse-engineer which words the scheme favors — approximating the green list without ever seeing the key. With that approximation, they can compose or rewrite text to lean on favored words until a detector reads it as watermarked. The attack cost published for one scheme was on the order of tens of dollars in queries.

Why would anyone spoof a watermark instead of removing one? Removal helps you pass off AI text as yours; spoofing weaponizes the system against others. Planting a watermark in someone’s human-written essay or article makes the strongest possible ‘evidence’ of AI use appear where none existed. It also lets attackers damage a watermark’s credibility itself — flood the world with fake-watermarked junk and the mark stops meaning anything.

Does spoofing mean watermark evidence can’t be trusted? It means watermark evidence can’t be treated as proof on its own. A positive watermark check is strong evidence only if spoofing is harder than the stakes justify — and research keeps showing it’s cheaper than expected. Any serious process should treat a watermark hit like any other signal: corroborate it with process evidence before acting on it.

Should students and writers worry about being framed this way? Not today in practice — text watermark checks are barely deployed anywhere, so there’s no verdict to spoof in most classrooms or workplaces. The worry is forward-looking: as regulators push watermarking into production and institutions start trusting the marks, the incentive to spoof appears exactly where the trust does. The protective habit is the same one that already works: keep drafts and version history that show your process.

The bottom line

Watermark spoofing flips the story we’re usually told about AI text marks. The pattern that lets a provider recognize its own model’s words is observable, and observable means stealable, and stealable means forgeable — against people, not just against platforms. None of this makes watermarking useless; it makes watermark *evidence* conditional, trustworthy only inside a process that checks how the writing was actually made. The signal can be faked. Your drafts, history, and voice are much harder to forge.