Text AI watermarks will always be trivial to remove

Starting August 2026, the EU AI Act will require AI-generated texts to be recognizable as such. Watermarks are supposed to help. But Sean Goedecke shows text watermarks are fundamentally vulnerable. Homoglyphs and statistical watermarks can be removed with little effort. A perfect solution does not exist.

Overview

The EU AI Act mandates that all AI outputs must be recognizable as artificially generated. This is hard for text. Text is a highly compressed medium – unlike images, you can’t simply alter invisible pixels. Goedecke describes text watermarks as a problem of steganography. The plaintext must not be arbitrarily manipulated without affecting quality. He discusses two approaches: Google’s SynthID, which is based on probabilistic sampling, and Unicode homoglyphs, which OpenAI and Anthropic use. Both can be easily removed – by normalizing characters or by paraphrasing with another language model. The conclusion: text watermarks remain trivial to remove. The EU AI Act imposes a requirement that is technically impossible to fulfill.

Prompt Analysis

The Prompt

The article does not contain any specific prompts. We construct two typical ones: one for removing watermarks by paraphrasing, and one for detecting Unicode homoglyphs.

# Prompt 1: Watermark removal by paraphrasing
Role: You are a professional editor with extensive experience in rewriting texts.
Context: I have received an AI-generated text that is marked with a statistical watermark such as SynthID. I want to keep the content but avoid the watermark-typical token selection patterns.
Task: Paraphrase the following text completely. Use synonyms, change the sentence structure, and adjust the style slightly without altering the meaning. The goal is that a watermark detection no longer classifies the text as AI-generated.
Output format: Output only the rewritten text, without any further comments or explanations.
Constraints: Make sure the rewritten text remains natural and in a consistent style. Avoid recognizable features such as too many em dashes or unusual formulations.

Components

The first prompt follows the pattern of role-based prompts: Assigning an editor profile gives the model a coherent framework for action. The context explains the situation – the invisible watermark – and why paraphrasing is necessary. The task is clearly defined: paraphrase with specific techniques. The output format restricts the answer to the pure text, and the constraints prevent typical artifacts. This structure works: it gives the model freedom but sets quality criteria.

# Prompt 2: Homoglyph detection
Role: You are a text forensics expert specializing in Unicode analysis.
Context: I have a text that may have been marked with invisible Unicode homoglyphs to indicate AI detection. Unusual spaces or special characters may have been used.
Task: Examine the following text for homoglyphs. Identify all characters that do not conform to the usual ASCII or UTF-8 standard, especially alternative spaces (e.g., U+2004, U+3000). List each occurrence with Unicode code point and position.
Output format: Create a table with columns for position, original character, Unicode code point, and replacement recommendation.
Constraints: Be precise and complete. Only address homoglyphs, not other text properties.

Components

The second prompt uses an expert persona to structure the analysis. The context describes the problem – possible homoglyphs – and gives examples of suspicious Unicode characters. The task is precise: investigation and documentation. The table-form output format facilitates machine evaluation. The constraints prevent digressions. Such prompts let you use AI models for forensic tasks – exactly what happens in the watermark debate.

Frequently asked questions

What is the EU AI Act and what does it have to do with watermarks?

The EU AI Act is a regulation of the European Union that aims to regulate the use of AI. Starting August 2026, all AI outputs must be recognizable as artificially generated (Article 50). Providers of language models that want to operate in the EU must then build watermarks into their text outputs. Reference: Article 50 of the EU AI Act and the associated code of conduct.

Why is text watermarking more difficult than image watermarking?

Images contain a lot of noise that is invisible to the human eye and can be used to hide data. Text is different. Any change to a character or word choice would be immediately noticeable. So watermarks in text must be embedded in the linguistic structure itself, which can affect quality.

How does Google’s SynthID work?

SynthID is based on the probabilistic sampling process of large language models. At each token step, each possible token gets a probability value. SynthID assigns a ‘score’ to each token based on previous tokens – for example, via a mathematical function. The model then selects one of the most likely tokens that has the highest SynthID score. This creates a statistical pattern in the text that can be checked with a detection function. Detection is cheap because it only needs to calculate the scores.

What are Unicode homoglyphs and how can they serve as watermarks?

Homoglyphs are characters that have different Unicode code points but look the same – such as normal spaces (U+0020) and three-per-em spaces (U+2004) or CJK spaces (U+3000). You can create a hidden pattern by replacing certain spaces with such alternatives. Since these characters are invisible to the eye, they serve as an invisible watermark. However, they can be easily removed by normalizing all Unicode characters to their standard equivalent.

Why are text watermarks always trivial to remove?

There are two main methods. Homoglyphs can be removed by simply replacing all special characters. Statistical watermarks like SynthID lose their effect when the text is rewritten – even by a simple language model. Since both methods are anchored in the text structure itself, a slight change in sentence structure or word choice is enough to destroy the watermark. This is a fundamental property of text. There is no perfect solution.

Source

Based on this article.