European AI Text Watermarks Remain Easy to Remove Despite New Legal Requirements

Article 50 of the European AI Regulation, which becomes enforceable in August 2026, obliges providers of generative AI systems to embed detectable signals in AI‑generated content, "to the extent technically possible." The clause was intended to give authorities a forensic foothold against undisclosed synthetic text.

In practice, the requirement collides with the nature of text as a highly compressible medium. Changing a word while preserving meaning, style and readability leaves very little invisible space for a hidden pattern, unlike images where subtle pixel alterations can survive compression.

Token‑Based Statistical Watermarks

Google’s SynthID exemplifies a probabilistic token‑selection approach. By biasing the choice of certain tokens during generation, the system creates a statistical fingerprint that can be detected by a trained classifier without any visible mark.

The method’s reliability hinges on the exact sequence of vocabulary choices. When a downstream user rewrites or paraphrases the output, the fingerprint collapses because the altered token order no longer matches the expected distribution.

Unicode Homoglyph Watermarks

Another proposed technique inserts Unicode homoglyphs—characters that look identical to standard ones but have different code points, such as a non‑breaking space that appears as a regular space. By sprinkling these invisible characters throughout a document, a low‑cost pattern can be embedded.

Standard text‑processing pipelines routinely normalise Unicode, converting all variants to their canonical forms. This automatic normalisation strips the homoglyph pattern without affecting the visible text, effectively erasing the watermark.

Metadata and C2PA Signatures

Content Authenticity Initiative (C2PA) signatures can certify provenance when attached to a file. However, plain‑text copied from a chat window loses the accompanying metadata file, and the signature can be removed simply by stripping the container that holds it.

• Token‑bias watermarks (e.g., SynthID) rely on statistical token distribution
• Homoglyph insertion uses visually identical Unicode characters
• Both techniques can be removed by paraphrasing or Unicode normalisation
• C2PA metadata is detached when text is copied and can be discarded

Sean Goedecke’s blog post notes that some providers may experiment with homoglyph watermarks, but he frames the observation as speculation rather than confirmed practice. The lack of official confirmation underscores the uncertainty surrounding industry adoption.

The EU’s emphasis on interoperability and transparency, while intended to simplify legitimate verification, paradoxically weakens any protection that depends on secrecy of the watermarking algorithm. If the detection method is publicly known, adversaries can more easily devise removal tools.

For English‑speaking organisations, the practical upshot is modest. Compliance teams must document that their AI systems attempt to embed a detectable signal, yet they cannot rely on the signal to survive routine editing, copy‑paste operations, or standard text‑processing pipelines.

Consequently, legal risk assessments should focus on disclosure policies and audit trails rather than on the technical durability of watermarks. This shift aligns with the broader regulatory trend of emphasizing process over product.

The technical community has already produced open‑source tools that can strip both token‑bias fingerprints and Unicode homoglyphs with a few lines of code, confirming that removal is indeed trivial for a determined actor.

Regulators, aware of these capabilities, have begun drafting guidance that stresses the importance of maintaining original generation logs, which can serve as evidence even when the visible text has been altered.

In the meantime, AI developers continue to explore hybrid approaches that combine statistical watermarks with cryptographic signatures, hoping to create a multi‑layered defence that survives basic transformations.

However, such hybrid schemes remain experimental and are not yet mandated by the EU AI Act, leaving a gap between legislative ambition and technical feasibility.

As of the publication date, no major AI provider has publicly declared full compliance with the watermarking requirement, and industry surveys indicate a mixed level of implementation across the sector.

En résumé, bien que la législation européenne impose désormais l’insertion de marques détectables dans les textes générés par IA, les méthodes actuelles restent fragiles et faciles à éliminer, ce qui contraint les autorités à s’appuyer davantage sur les processus internes des fournisseurs que sur des preuves techniques indélébiles.