Text Watermark Robustness: What Actually Survives an Edit

Google documents SynthID Text as robust to milder paraphrasing, with detector confidence greatly reduced by thorough rewriting or translation. The claim is scoped to the Gemini app and web experience, not to everything Google ships.

Then it gets strange. A Google-affiliated reply on Google's own developer forum, dated 2026-08-05, answering a question about Article 50(2) of the EU AI Act, says flatly that text generated through the Gemini API is not SynthID-watermarked and that native text watermarking is not planned at the moment.

That conflicts directly with the DeepMind SynthID page, which says SynthID watermarks text generated by the Gemini app and web experience. Nobody at Google has reconciled the two in a primary source.

The clearest data point comes from Kirchenbauer and coauthors' follow-up study, "On the Reliability of Watermarks for Large Language Models" (ICLR 2024). They stress-tested the original green list and red list scheme against three things:

• Human rewriting, where real people reworded the text themselves
• LLM paraphrasing, where another model did the rewriting
• Dilution, where watermarked text was mixed into a longer human-written document

Even after strong human paraphrasing, the watermark stayed detectable once a detector could observe roughly 800 tokens, at a false-positive rate of 1 in 100,000.

Length matters because the signal is probabilistic. One sentence carries a faint tilt toward green tokens that a few rewritten words can erase, while hundreds of tokens accumulate into a pattern a statistical test can separate from chance.

Google's robustness claim rests on Google's own testing. Four independent teams have since run the experiment themselves, and the answers do not all agree with the product page.

• "Watermark under Fire" (EMNLP 2025 Findings, from Stony Brook, NUS, and Zhejiang University) tested SynthID Text under paraphrase and translation attacks and found its resilience "similar to the TGRL baseline," meaning no clear advantage over a far simpler, older watermark.
• SynGuard (Han, Li, Ni, and Zulkernine, IEEE TrustCom 2025) found SynthID Text "susceptible to meaning-preserving attacks, such as paraphrasing, copy-paste modifications, and back-translation," and their own hybrid beat it by an average of 11.1% on the F1 metric.
• A March 2026 preprint from Illinois Tech researchers went after the detector's math, proving that SynthID Text's mean-scoring detection grows more vulnerable as tournament sampling layers are added, while the alternative Bayesian-scoring detector Google itself built in is provably more robust to that attack.
• An AIES 2026 preprint from July 2026 reported 98.3% of initially detected texts losing their signal after one DIPPER-style paraphrase pass, a 5.4% false-positive rate on paraphrased human writing, and the lowest composite "Forensic Readiness Score" (35 out of 60) of the three schemes it tested.

None of the four claims to have broken Google's production deployment. All of them test the open-sourced algorithm or reimplementations like MarkLLM, not the real Gemini keys and configuration, which Google has never published.

That cuts both ways. Google's own robustness claim has never been independently verified against production either.

Zhao, Ananth, Li, and Wang's Unigram-Watermark (ICLR 2024) fixes the green list and red list split across the whole vocabulary for an entire generation, instead of reseeding it at every position from prior context.

That constant split is what makes a mathematical guarantee possible. The authors prove the scheme stays robust to editing as long as the number of edited tokens stays under a bounded threshold relative to text length.

Schemes that reseed from context fall out of sync the moment an edit changes what came before, because the detector and the generator stop agreeing on which tokens count as green. A fixed split has no such failure mode.

Step back from any single scheme and a 2023 paper by Sadasivan, Kumar, Balasubramanian, Wang, and Feizi makes a harder claim: no watermarking scheme, however clever, can be reliably robust against a sufficiently motivated paraphrasing attacker.

They pair a recursive paraphrasing attack with a theoretical bound on how close human and AI text distributions can get. Push those distributions close enough together and detection reliability hits a ceiling that engineering alone cannot lift. It is the single most-cited adversarial paper in this space.

Watermark stealing research gives that argument teeth. Once a provider's secret green-list rule was approximated for under $50 in ordinary API queries, a scrubbing attack that barely worked (near 0% success) jumped past 85% against the reconstructed rule.

Robustness proofs describe what a scheme guarantees against a defined class of edits. They say nothing about what happens after the rule leaks.

A 2025 systematization-of-knowledge paper, "SoK: Watermarking for AI-Generated Content," comes from a security-heavy author list including Nicholas Carlini, Florian Tramèr, and Dawn Song. It maps threat models across text, image, audio, and video watermarking and ties the state of the art to regulatory content-provenance requirements like the EU AI Act.

Alongside the ACM Computing Surveys review and the ACL Anthology's taxonomy, all three list paraphrasing, translation, and adversarial editing as attack categories no scheme fully closes.

They also note that gains against one attack usually cost something elsewhere. Everything above is real progress on specific schemes under specific attacks, not a general solution.