Contents
Yes, and cheaply, though the plain version of that answer has a caveat: a text watermark is genuinely robust to light edits and falls only to strong paraphrase or a cheap adversarial attack. Text is unusual among media because the raw output carries no inherent fingerprint; a sentence is just tokens, and retyping it leaves no trace. So a text watermark is not a mark hidden in a signal but a statistical bias deliberately introduced while the model writes, which means removing it is a question about defeating that bias, not scrubbing a pattern out of pixels or audio.
What the mark is, and why it needs cooperation
The canonical scheme is the green-list watermark of Kirchenbauer, Geiping, Wen, Katz, Miers and Goldstein, “A Watermark for Large Language Models” (ICML 2023). During sampling it softly promotes a pseudo-random “green list” of tokens, leaving a statistical signature that a detector scores with interpretable p-values. The crucial property for removability is that the mark is inserted at generation time, so it exists only if the model’s provider chose to add it. The largest deployment is SynthID-Text (Dathathri, See and colleagues, Nature 2024), which uses Tournament sampling and, in a live experiment reported in the same paper, was A-B tested across nearly 20 million Gemini responses without users rating the watermarked outputs lower in quality. Both schemes are generator-side by design, and that design decision is the first crack a remover can lean on.
Dilution: paraphrase
The first removal class is dilution, and it is where the both-sides truth lives. Rewriting the text spreads and weakens the statistical signal. But the mark is more stubborn than critics assume, because paraphrases, in the words of Kirchenbauer and colleagues in “On the Reliability of Watermarks for Large Language Models” (ICLR 2024), “are statistically likely to leak n-grams or even longer fragments of the original text,” so the watermark can “remain detectable even after human and machine paraphrasing.” The same paper is candid about the cost of that survival: “after strong human paraphrasing the watermark is detectable after observing 800 tokens on average” at a strict false-positive rate, and it degrades as the text gets shorter. So light editing does not reliably kill the mark, but strong, sustained paraphrase over a short passage can. The dedicated paraphrase attacks quantify the top of that range. Krishna, Song, Karpinska, Wieting and Iyyer built an eleven-billion-parameter paraphraser (DIPPER, NeurIPS 2023) that, at a 1% false-positive rate, drops the post-hoc DetectGPT detector from 70.3% to 4.6%. DIPPER targets post-hoc detectors rather than the green-list watermark itself, so it should not be read as a direct watermark result, but it demonstrates the same text-level weakness: change the wording enough and statistical traces tied to that wording collapse. Sadasivan, Kumar, Balasubramanian, Wang and Feizi push into the watermark directly in “Can AI-Generated Text be Reliably Detected?” (2023): recursive paraphrasing drops a soft-watermark detector’s true-positive rate from 99.3% to 9.7% on 300-token passages. Dilution, applied hard enough, works.
Adversarial: stealing the rules
The second class is sharper, because it does not just wash the mark out, it turns the scheme against itself. Jovanović, Staab and Vechev, in “Watermark Stealing in Large Language Models” (ICML 2024), query a watermarked API to approximately reverse-engineer its rules, then mount two attacks at once. The cost is the headline: for a one-time query budget of under $50, about $42 at thirty thousand queries, they scrub and spoof schemes “previously considered safe” with average success “over 80%.” Scrubbing lifts a paraphraser’s success “from almost 0% to over 80%” in the hard long-text setting, where no baseline they tested reaches 25%. And the same stolen knowledge runs the other way as spoofing, making arbitrary or human-written text register as watermarked, which the authors warn “can cause reputational damage to the model owner, or even incriminate a particular user.” A related result closes the loop: Sadasivan and colleagues also degrade a soft watermark’s detection AUROC from 99.8% to 1.3% by inferring its green list. So the injected fingerprint is both removable and forgeable, for the price of a modest API bill.
Adoption: the mark most text never had
The third limit is not an attack at all. Even a perfect, unstealable watermark only marks text from a model whose provider chose to watermark. Text from a non-watermarking model, an open-weight model with the feature switched off, or a person at a keyboard carries no signal to begin with. This is why a negative result is nearly uninformative: the overwhelming majority of text in the world never passed through a watermarking model, so “no watermark found” is the default state of ordinary writing, not evidence of human authorship.
What removability means for trust
Put the three classes together and the verdict matches the rest of the watermarking picture, scoped to the adversary. Against a casual user who copies, lightly edits and pastes, a text watermark is a real deterrent and often survives on n-gram leakage. Against a motivated remover with a strong paraphraser or a spare afternoon and an API key, it does not hold: paraphrase dilutes it, stealing scrubs and forges it for under $50, and much of the text it would need to cover was never marked. Those removal figures are each the attacking paper’s own reported result rather than an independent replication, though several independent groups converge on the same verdict. A present, verified watermark is meaningful evidence of a cooperating model’s origin. An absent one is close to neutral. The deeper case for why generator-side text watermarking is a fragile foundation for detection in the first place is argued on detectai.media, in why AI text watermarking is a bad idea.
Sources
- Kirchenbauer, Geiping, Wen, Katz, Miers, Goldstein (2023). A Watermark for Large Language Models. ICML.
- Kirchenbauer et al. (2023). On the Reliability of Watermarks for Large Language Models. ICLR 2024.
- Krishna, Song, Karpinska, Wieting, Iyyer (2023). Paraphrasing Evades Detectors of AI-Generated Text, but Retrieval is an Effective Defense. NeurIPS.
- Sadasivan, Kumar, Balasubramanian, Wang, Feizi (2023). Can AI-Generated Text be Reliably Detected?
- Jovanović, Staab, Vechev (2024). Watermark Stealing in Large Language Models. ICML.
- Dathathri, See (2024). Scalable Watermarking for Identifying LLM Outputs. Nature.