Skip to main content
AI Watermark Removal

Research Roundup

AI Watermarking Research: A Map of the Literature

One 2023 paper explains most of this field, and roughly 984 citations later, nearly everything published since either extends it or attacks it. Text watermarking has grown from that single green-list scheme into variants trading unbiased output for a robustness proof, a version aimed at open-weight models, and a running attack-and-defense fight that includes approximating a provider's secret rule for under $50. Media watermarking runs its own parallel race against compression and re-editing. Almost everything here is a proposal no provider has confirmed shipping, with SynthID Text the clear exception, and even it has already drawn independent papers finding real gaps.

Published 2026-08-11Updated 2026-08-11Research/proposal

Key takeaways

  • The foundational 2023 scheme biases sampling toward a pseudorandom green sublist at each step, and detection is a statistical test on green-token frequency that produces interpretable p-values without needing the model at detection time.
  • The major variants each trade something away: a distortion-free version leaves the output distribution unchanged, Unigram-Watermark fixes one green list to earn a robustness proof, a cryptographic definition makes watermarked and unwatermarked text indistinguishable without the key, and a 2024 scheme watermarks model parameters so open-weight models can be marked at all.
  • A stress test found the original watermark survives strong paraphrasing once a detector has roughly 800 tokens, at a 1e-5 false-positive rate. A separate attack paper approximated a provider's secret rule for under $50 and pushed scrubbing success from near 0% to over 85%.
  • Watermarks turn out to be radioactive: fine-tuning a second, unwatermarked model on watermarked output leaves detectable contamination in that second model's own outputs.
  • SynthID Text is Google's deployed instance of this idea, tested internally across nearly 20 million real Gemini responses, and two independent 2025-2026 papers have since found it loses signal under paraphrasing and back-translation.
  • The patent record is lopsided: Google and DeepMind hold a documented family going back to a 2020 filing, while targeted searches for Meta, OpenAI, Microsoft, and Anthropic turned up no comparably specific watermarking patents.

Text watermark workflow

How text watermark removal is evaluated

Generate

Claude, Gemini, or another LLM produces text.

Mark

A watermarking layer can influence token choices or attach provenance.

Clean / transform

Text is normalized, edited, rewritten, or translated.

Check

A detector compares the before and after signal strength.

Why this matters for removal tools

Hidden-character cleanup is immediate. Statistical text watermark removal becomes stronger when paired with provider-specific detection and before/after confidence checks.

The scheme everything else answers

Research/proposal

You'll get the one mechanism you need in your head before the rest of this literature makes any sense.

Text watermarks are applied at generation time, not after the fact. A logits processor sits between the model's raw output and the sampling step.

Before each token is chosen, it pseudorandomly splits the vocabulary into a green sublist and a red sublist, seeded by prior tokens or a key, then softly nudges sampling toward green. Detection scores a passage by checking whether green tokens appear more often than chance predicts.

That test gives an interpretable p-value without needing the model itself at detection time, which is most of why the idea caught on.

The source is Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein's "A Watermark for Large Language Models" (ICML 2023, arXiv:2301.10226), cited roughly 984 times.

Four rebuilds, four trade-offs

Research/proposal

Here's what each major variant gives up in order to get the one property it actually wants.

  • Distortion-free (Kuditipudi, Thickstun, Hashimoto, Liang, arXiv:2307.15593): maps a watermark key through the sampling procedure so the marginal output distribution is unchanged, while staying robust to edits up to a generation-length budget.
  • Unigram-Watermark (Zhao, Ananth, Li, Wang, ICLR 2024): fixes the green and red split constant across every token position instead of re-randomizing it, trading that flexibility for a provable robustness guarantee under bounded editing.
  • Undetectable watermarks (Christ, Gunn, Zamir, COLT 2024): defines watermarking cryptographically, so that without the secret key, watermarked and unwatermarked text are computationally indistinguishable.
  • Open-weight watermarking (Christ, Gunn, Malkin, Raykova, arXiv:2410.18861): embeds the signal in model parameters, because once weights ship to someone else the operator controls decoding and a sampling-time watermark has nothing left to bias.
  • Multi-bit schemes (Yoo, Ahn, Kwak, NAACL 2024; Qu et al., USENIX Security 2025): carry an actual payload rather than a single yes-or-no bit, the second using error-correcting codes for provable recovery under adversarial edits.

Kirchenbauer's own follow-up (ICLR 2024, arXiv:2306.04634) asked the practical question instead: how much text does a detector need? It found the original scheme stays detectable after strong human paraphrasing once roughly 800 tokens are observed, at a 1e-5 false-positive rate.

The attack literature

Research/proposal

You'll see the three results that shape how seriously anyone in this field takes a robustness claim.

Sadasivan, Kumar, Balasubramanian, Wang, and Feizi's widely cited paper (arXiv:2303.11156, roughly 615 citations) introduced a recursive paraphrasing attack and argued watermarking is not reliable against an attacker willing to paraphrase repeatedly.

ETH Zurich's SRI Lab pushed further in "Watermark Stealing in Large Language Models" (ICML 2024). An attacker who approximates a provider's secret green and red rule using ordinary API queries, for under $50, can push scrubbing success from near 0% to over 85% in settings previously believed safe, and forge the watermark onto arbitrary attacker text over 80% of the time.

Meta and FAIR's "Watermarking Makes Language Models Radioactive" (NeurIPS 2024) found the effect travels further still. Fine-tuning a second, unwatermarked model on watermarked output leaves detectable contamination in that second model's own outputs, a provenance signal that survives distillation.

Where the research meets a shipped product

Research/proposal

Here's the only scheme on this page running at real scale, and what outsiders found when they tested it.

Google's SynthID Text is described in a peer-reviewed Nature paper and open-sourced for developers. Google reports a live experiment assessing user feedback across nearly 20 million real Gemini responses with no detectable quality loss, and cites detection accuracy clearly ahead of prior state of the art at a fixed false-positive rate.

Independent researchers tested it anyway. Han, Li, Ni, and Zulkernine's SynGuard paper (IEEE TrustCom 2025) found it vulnerable to paraphrasing, copy-paste splicing, and back-translation, the same weakness Google's own documentation concedes, and their hybrid defense improved F1 by 11.1% on average.

A newer preprint (Omidi, Dong, Wang, March 2026) proved the mean-score detector grows more vulnerable as sampling layers increase, while the alternative Bayesian-scoring detector, also part of SynthID Text's own design, holds up better.

Every other scheme named on this page remains a proposal no provider has confirmed shipping.

The media side runs its own race

Research/proposal

You'll see how image, audio, and video watermarking differ from the text work, and the one scale number Google reports.

Media watermarking embeds signals directly in pixels, video frames, or an audio waveform, invisible to a viewer but detectable by a matching algorithm, and built to survive compression, cropping, or a screenshot.

Fernandez, Couairon, Jégou, Douze, and Furon's Stable Signature paper (ICCV 2023), from Meta AI and Inria, fine-tunes a diffusion model's decoder so every image it generates carries a watermark recoverable by a pretrained extractor. It stays over 90% accurate at a false-positive rate below 1e-6 even after cropping to 10% of the original image, and at roughly 428 citations it is the most-cited image watermarking paper in this literature.

Google extends the approach across images, audio, video, and text under the SynthID name. A 2025 DeepMind paper reports the system has watermarked over ten billion images and video frames across Google's services, a self-reported figure not independently validated.

OpenAI separately states it uses SynthID as an invisible layer for images from ChatGPT, Codex, and the OpenAI API.

What the patent record shows

Confirmed

Here's the one place the corporate picture is legible: who actually filed, and who apparently didn't.

Google and DeepMind hold a documented patent family. It includes a 2024 filing on multi-stage text watermarking (US 2024/0320529 A1, filed 2024-03-20, assigned to DeepMind Technologies Limited) plus older filings on image watermark encoders and authenticity-verification decoders going back to a 2020 application.

Targeted searches for Meta, OpenAI, Microsoft, and Anthropic found no comparably specific watermarking patents. That is a real negative result with evidentiary weight, not proof none exists, since the searches were not exhaustive across subsidiary entity names, alternate terminology, or non-US jurisdictions.

As on the text side, robustness for media watermarks stays unresolved. These marks survive ordinary sharing and re-compression, while heavy editing and adversarial removal remain an active target rather than a solved problem.

FAQ

Is any of this research actually deployed by AI providers today?

Mostly no. The green and red list scheme, the distortion-free alternative, Unigram-Watermark, the undetectability definition, the open-weight scheme, radioactivity, and the stealing and scrubbing papers are all published academic work no named provider has confirmed shipping as described. The exception is Google's SynthID Text, documented in a peer-reviewed Nature paper and open-sourced, though Google scopes its robustness claim to the Gemini app and web experience and whether the Gemini API applies the same watermark is disputed rather than settled. On the media side, Meta's Stable Signature is research, while Google's SynthID for images, audio, and video and OpenAI's stated use of SynthID for ChatGPT, Codex, and API images are the deployed cases.

Can a watermarked model's output infect a completely different model?

According to one paper, yes. Meta and FAIR's "Watermarking Makes Language Models Radioactive" (NeurIPS 2024) found that fine-tuning a second model on a watermarked model's text leaves detectable contamination in that second model's own outputs, even though it was never watermarked itself. It is a finding about how far a fingerprint travels through a training pipeline, not a claim that any provider uses this today to trace unauthorized fine-tuning.

Does research on attacking watermarks mean they don't work?

No, it means they hold up against some threats and not others, which is normal for any security mechanism. The original scheme survives strong paraphrasing once a detector has roughly 800 tokens. Against a resourced attacker the picture is weaker: one paper approximated a provider's secret rule for under $50 and used it to scrub or forge watermarks at high success rates, and independent red teams found real paraphrasing weaknesses even in Google's deployed SynthID Text. Defenses keep following the attacks, so treat it as an active arms race rather than a settled failure.

If I only read two papers, which two?

Start with Kirchenbauer et al.'s 2023 paper for the mechanism everything else responds to, then read "SoK: Watermarking for AI-Generated Content" (IEEE Symposium on Security and Privacy 2025), whose authors include Nicholas Carlini, Florian Tramèr, and Dawn Song, for the map across text, image, audio, and video plus the connection to regulatory provenance requirements.

Next steps

Sources and citation status