--- title: Text AI watermarks will always be trivial to remove description: The EU AI Act's Article 50 will soon require LLM providers to watermark AI-generated text so it's detectable as artificially generated. Text watermarking is... canonical: https://daily.dev/posts/text-ai-watermarks-will-always-be-trivial-to-remove-hflwedvwn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Text AI watermarks will always be trivial to remove | daily.dev og:description: The EU AI Act's Article 50 will soon require LLM providers to watermark AI-generated text so it's detectable as artificially generated. Text watermarking is... og:url: https://daily.dev/posts/text-ai-watermarks-will-always-be-trivial-to-remove-hflwedvwn og:image: https://api.daily.dev/og/posts/hFlWEDVWN.png og:image:alt: Text AI watermarks will always be trivial to remove og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Text AI watermarks will always be trivial to remove **[Hacker News](https://daily.dev/sources/hn)** · 12 min read · 0 upvotes · 0 comments ## Summary The EU AI Act's Article 50 will soon require LLM providers to watermark AI-generated text so it's detectable as artificially generated. Text watermarking is fundamentally harder than image watermarking because text can't absorb imperceptible noise the way images can. Google's SynthID biases token sampling toward tokens with a particular mathematical score, which can be detected cheaply by re-scoring text. OpenAI and Anthropic appear to use Unicode homoglyph substitutions (e.g., swapping regular spaces for visually identical but differently-coded Unicode spaces) as a lighter-weight fingerprinting technique, evidenced by Claude Code's use of homoglyphs to tag suspicious requests and stray Unicode showing up when pasting ChatGPT output into VSCode. Both approaches can be defeated: homoglyphs by normalizing characters, and SynthID by paraphrasing the text with any weak un-watermarked model. C2PA metadata signing, often proposed as a solution, only works for files and doesn't apply to plain chat output. The prediction is that AI providers will adopt SynthID-style sampling for compliance while technical users will always be able to strip such watermarks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Google's SynthID watermark AI-generated text? SynthID biases the token sampling process during text generation rather than altering finished text. Each candidate token gets a score computed from a function of its ID and the IDs of preceding tokens, combined with a random seed and multiple scoring methods; the model then samples from its top-k most likely tokens by preferring the one with the highest SynthID score. Detection works by computing the aggregate SynthID score of a passage and checking if it's suspiciously high. _Engineers evaluating AI content detection tools can track SynthID and watermarking approaches as they evolve on daily.dev._ ### Can you remove an AI text watermark like SynthID or Unicode homoglyph tagging? Yes, both are trivially removable. Unicode homoglyph watermarks can be stripped by replacing special-space characters with their normal equivalents, while SynthID-style watermarks can be removed by paraphrasing the text with any weak, un-watermarked LLM, since the watermark depends on subtle vocabulary choices that rewording destroys. A free public watermark-testing tool would let anyone iterate until detection returns negative. _Teams weighing AI content compliance risks can follow watermarking and detection developments through daily.dev._ ### Does C2PA metadata satisfy the EU AI Act's requirement for watermarking AI-generated text? No, C2PA Content Credentials only apply to files such as images, audio, video, or containerized text, and cannot sign plain chat output like a ChatGPT or Claude response since there's no file artifact to attach signed metadata to. The AI Act still requires actual watermarking for plain text output separate from any C2PA file-signing scheme. _Developers navigating AI Act compliance for text-generating products can keep up with C2PA and watermarking rules via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 5 discussions and 132 comments across hackernews (as of 2026-08-16). **TL;DR:** Most agree the technical premise is right — text watermarks (Unicode tricks or SynthID-style sampling bias) are easy to strip via normalization, paraphrasing, translation, or local models — and many see the EU mandate as regulatory theater akin to cookie banners, though some argue a leaky deterrent still has value against lazy misuse. **Sentiment:** 10% positive · 30% mixed · 60% skeptical **The case for** - A watermark that only catches casual, low-effort copy-pasting is still useful as a 'sane default' filter against spam and lazy cheating. - Even trivially bypassable rules have value since most people won't bother circumventing them. - Making cheaters jump through extra hoops (paraphrasing, translation) at least degrades the quality of the evasion, aiding detection of low-effort slop. **The pushback** - If verification is public, anyone can iteratively tweak text until it passes, defeating the watermark; if private, only the provider can check it, undermining the law's transparency goal. - A detection system with any meaningful false-positive rate would be dangerous in high-stakes contexts like university cheating accusations. - The law is compared to cookie consent regulations: performative compliance that doesn't meaningfully solve the underlying problem. - Local, open-weight models make watermarking moot since they can both generate unwatermarked text and strip watermarks from other models' output, raising fears of future restrictions on general-purpose computing. - Watermarking gives a false sense of trustworthy verification, which is arguably worse than having no system at all. **By community** - hackernews (skeptical): Broad agreement that watermarking is easily defeated and largely symbolic, with a heated side-thread over local models, general-purpose computing freedom, and whether any of this is even enforceable. **Hottest debate:** Whether a partially-bypassable watermark is still worth deploying as a deterrent, or whether an unreliable/bypassable system is actively harmful by creating false confidence in text authenticity. **Open questions** - How would verification work if the detection signal must stay secret to prevent trivial bypass, yet the law seems to assume public verifiability? - Can a watermark survive heavy paraphrasing, translation, or partial (non-one-shot) generation without collapsing detection accuracy? - What happens to false positive rates at scale, and who bears the consequences (e.g., students, researchers) when they occur? **Highlights** > Suppose I gave you a series of 1000 coin flips. I tell you they were generated by a fair coin. You’re suspicious, you think I hid a watermark in them. But you look at the sequence and 485 are heads, close enough to 50%. You look at the correlation between a coin flip and the next and it’s 0.0433. Close to zero. You do a bunch more stats and everything checks out. So you’re convinced. Then I tell you: calculate the average of every 3rd flip minus the average of every second. It should come out close to zero, and unlikely to be higher than +/- 30 but for my sequence it comes out to +89. Ok, that’s very unlikely. So from now on we share this secret. Whenever I generate sequences of coin flips they all came out with this particular statistic out of whack, but unless you’re looking for it, you can’t detect it. In fact, in the real world I use cryptography such that unless you know my secret key, the specific statistic in question is mathematically undetectable. Now use this sequence of coin flips to pick amongst next tokens in an LLM. It doesn’t change the distribution of words used in the LLM. It doesn’t change its writing style. In fact, unless you know the secret key you cannot detect the watermark. So it’s not that some words are used more often. That would be detectable. It’s just that if you translate back to a series of 0’s and 1’s the average of every 3rd bit minus the average of every 2nd is out of whack. > — [ruilov on hackernews · 2 comments](https://news.ycombinator.com/item?id=49293827) > Local models enable: - watermark-free generation - the stripping of watermarking from the output of SAAS models Any discussion of watermarking is dead in the water in a world where we are permitted to have these things. I fear for the future. > — [dTal on hackernews · 2 comments](https://news.ycombinator.com/item?id=49287734) > It's worse than that. It's a straight-up moral panic promulgated by the companies themselves. It's not the government doing this -- but the model providers are seemingly begging for the kind of regulatory state that you're talking about. Setting aside watermarking for the moment, which is bad enough, the oppressiveness of the model companies' censorship regimes in the name of "safety" has lead to a place where I'm constantly second-guessing my queries, out of fear of the dreaded "we take steps to keep you safe" doublespeak rejection messages. I'm running into these things constantly, to the point where any even halfway "blue" query that would be fine in a PG-rated movie gets censored instantly. This is untenable. Open models are the only way forward. > — [timr on hackernews](https://news.ycombinator.com/item?id=49293503) > It's worse than nothing because it gives people the false impression that there exists a system they can trust to tell them what information is authentic and what isn't. The incentive for governments and other interests to undermine that system to push false narratives and disinformation is just too great. > — [krapp on hackernews](https://news.ycombinator.com/item?id=49290462) > And students could just verify their ai generated code doesnt have the mark. Im very confused how this is even supposed to work at face value. 1) If the verification can be done by anyone, then anyone can bypass it. 2) If it can only be done by anthropic then the government or whomever has the special privilege (not everyone otherwise this is just #1) has to make a specific request Is the point of the legislation to accurately classify text in general or to simply detect the true positives? > — [nonethewiser on hackernews](https://news.ycombinator.com/item?id=49293655) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49287153) · 93 points · 120 comments - [hackernews](https://news.ycombinator.com/item?id=48764022) · 8 points · 8 comments - [hackernews](https://news.ycombinator.com/item?id=49254807) · 4 points · 2 comments - [hackernews](https://news.ycombinator.com/item?id=49251153) · 4 points · 2 comments - [hackernews](https://news.ycombinator.com/item?id=48757466) · 4 points · 0 comments ## Similar posts on daily.dev - [Text AI watermarks will always be trivial to remove](https://daily.dev/posts/text-ai-watermarks-will-always-be-trivial-to-remove-borbz7x9u) · sean goedecke · 6 upvotes · 4 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#ai-governance](https://daily.dev/tags/ai-governance) [View this post on daily.dev](https://daily.dev/posts/text-ai-watermarks-will-always-be-trivial-to-remove-hflwedvwn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Text AI watermarks will always be trivial to remove","url":"https://daily.dev/posts/text-ai-watermarks-will-always-be-trivial-to-remove-hflwedvwn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/text-ai-watermarks-will-always-be-trivial-to-remove-hflwedvwn"},"datePublished":"2026-08-13T15:55:41.411Z","dateModified":"2026-08-16T12:48:13.494Z","description":"The EU AI Act's Article 50 will soon require LLM providers to watermark AI-generated text so it's detectable as artificially generated. Text watermarking is...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/479e95ee2af112c350fa09a341f0c630?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/479e95ee2af112c350fa09a341f0c630?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/text-ai-watermarks-will-always-be-trivial-to-remove-hflwedvwn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"llm,ai-governance","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Text AI watermarks will always be trivial to remove"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/text-ai-watermarks-will-always-be-trivial-to-remove-hflwedvwn#faq","mainEntity":[{"@type":"Question","name":"How does Google's SynthID watermark AI-generated text?","acceptedAnswer":{"@type":"Answer","text":"SynthID biases the token sampling process during text generation rather than altering finished text. Each candidate token gets a score computed from a function of its ID and the IDs of preceding tokens, combined with a random seed and multiple scoring methods; the model then samples from its top-k most likely tokens by preferring the one with the highest SynthID score. Detection works by computing the aggregate SynthID score of a passage and checking if it's suspiciously high. Engineers evaluating AI content detection tools can track SynthID and watermarking approaches as they evolve on daily.dev."}},{"@type":"Question","name":"Can you remove an AI text watermark like SynthID or Unicode homoglyph tagging?","acceptedAnswer":{"@type":"Answer","text":"Yes, both are trivially removable. Unicode homoglyph watermarks can be stripped by replacing special-space characters with their normal equivalents, while SynthID-style watermarks can be removed by paraphrasing the text with any weak, un-watermarked LLM, since the watermark depends on subtle vocabulary choices that rewording destroys. A free public watermark-testing tool would let anyone iterate until detection returns negative. Teams weighing AI content compliance risks can follow watermarking and detection developments through daily.dev."}},{"@type":"Question","name":"Does C2PA metadata satisfy the EU AI Act's requirement for watermarking AI-generated text?","acceptedAnswer":{"@type":"Answer","text":"No, C2PA Content Credentials only apply to files such as images, audio, video, or containerized text, and cannot sign plain chat output like a ChatGPT or Claude response since there's no file artifact to attach signed metadata to. The AI Act still requires actual watermarking for plain text output separate from any C2PA file-signing scheme. Developers navigating AI Act compliance for text-generating products can keep up with C2PA and watermarking rules via daily.dev."}}]} ```