AI Watermark Spoofing: Forging Someone Else's Signal

A statistical text watermark like SynthID Text works by quietly biasing which words a model picks during generation, using a secret rule only the provider holds. Spoofing means learning enough of that rule to fake the same bias in text you typed yourself.

If it works, a detector says your writing came from that provider's model. It did not.

A 2025 paper describes a nastier variant that starts from genuine AI text: edit a watermarked paragraph's meaning into something like hate speech, leave the statistical mark untouched, and the provider's own detector confirms the ugly version as authentic output.

• Scrubbing removes a real watermark from real AI-generated text. The goal is to make AI output look human.
• Spoofing adds a fake watermark to human-written text. The goal is to make your writing look like someone else's model produced it.
• Piggyback spoofing keeps a real watermark on real AI text while changing what the text says. The goal is to make a provider look responsible for content it never generated.

All three get filed under "watermark attacks," but they have different costs, different defenses, and different victims. Only the first one is about hiding your own tracks.

The paper is "Watermark Stealing in Large Language Models" (ICML 2024), from ETH Zurich's SRI Lab. It runs in stages, none of which need access to the model's internals.

1. Confirm a watermark is there at all, and work out which family of scheme it belongs to, using ordinary black-box queries.
2. Query the provider's public API until you can approximate its secret green-list rule. Total cost reported in the paper: under $50.
3. Use that approximation to forge the watermark onto arbitrary attacker-written text. Success rate above 80 percent against one tested scheme, SelfHash.
4. Or point the same approximation the other way and scrub genuine watermarks instead, which pushed scrubbing success from roughly 0 percent to over 85 percent in settings previously believed safe.

Gloaguen, Jovanović, Staab, and Vechev followed their own attack with "Discovering Spoofing Attempts on Language Model Watermarks" (ICML 2025). It describes a statistical test that separates genuinely watermarked text from spoofed text, because current spoofing attacks, including their own earlier one, leave detectable artifacts.

Two other groups are working the same problem from different angles.

• Bileve (NeurIPS 2024) proposes a two-layer signature, part statistical and part cryptographic, built specifically so a forged watermark can be told apart from a real one.
• An, Liu, Liu, Zhang, Bu, and Chang (April 2025) target piggyback spoofing, with a green-list assignment trained to be sensitive to meaning-changing edits and tolerant of meaning-preserving ones.

So the honest summary is neither "spoofing works" nor "spoofing is solved." The attack works today, at least one published test catches it, and neither side is deployed at scale.

Before any of the text spoofing papers existed, a 2023 paper by Saberi, Sadasivan, Rezaei, Kumar, Chegini, Wang, and Feizi demonstrated both halves of the idea for images. "Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks" showed that diffusion purification strips a low-perturbation image watermark with minimal visible quality loss, and that black-box access to a watermarking method is enough to make a real, unwatermarked image falsely register as watermarked.

The field has since stopped treating the two as separate problems. "SoK: Watermarking for AI-Generated Content" (IEEE Symposium on Security and Privacy 2025), with Nicholas Carlini, Florian Tramèr, and Dawn Song among its authors, maps text, image, audio, and video watermarking under shared threat models.

That survey defines spoofing as a standard attack category alongside removal, not a text-specific curiosity. Anything built to defend a text watermark now has to answer to a standard the image side has been using since 2023.

A 2025 paper studies how spoofing and scrubbing interact with unauthorized knowledge distillation. The question is whether a student model trained on a watermarked teacher's outputs inherits that watermark, or can be made to falsely inherit one it never carried.

That has real stakes for any provider hoping a watermark survives being copied into someone else's model. The paper's full mechanism has not been independently re-verified here beyond its indexed abstract, so treat its specific findings as provisional.

No source found in this research reports a real spoofing incident against a real provider's users, for text or for images. Every paper above is Research/proposal status: a demonstration of what is technically possible, not a documented attack.

Treat any claim that spoofing is happening to real people right now as unconfirmed. Then take it seriously anyway, for two reasons.

• The cost. Under $50 in API queries is inside the reach of a bored undergraduate, not just a well-resourced actor.
• The asymmetry. One convincing spoofed sample attributed to a major AI provider can do reputational damage long before anyone runs a statistical test on it.