Tested SynthID Text Watermark: Survives Translation and Edits, Paraphrase Kills Facts
Imaginary_Dinner2710 · reddit · 2026-08-24
The author reproduced the SynthID text watermarking scheme on Qwen2.5-14B and tested its robustness against various attacks. The results were counter-intuitive:
- Translation failed: Round-trip translation (e.g., via German or Chinese) left the watermark signal nearly intact, as back-translation leans into the model's habitual word choices.
- Synonym editing partially worked: While signal strength dropped by half, the detector still flagged 80% of texts. Unchanged 5-grams act as a strong proxy for the watermark score (r=0.988).
- Full paraphrase works but is dangerous: Tools like DIPPER can remove the watermark but silently introduce factual errors in 25% of cases, which are invisible to the naked eye.
The conclusion is that removing watermarks is extremely difficult without risking factual integrity. Code, data, and a live demo are open-sourced.
More from Safety
- Beyond Final Weights: The Value of Stage-Level Checkpoint Transparency — creditme7 · 2026-08-24
- California law mandates AI disclosure for bar exam questions — ocean_protocol · 2026-08-24
- Study: AI chatbots link pregnant users to anti-abortion sites without disclosure — The Decoder · 2026-08-24
- Autonomy and Innovation: The Hugging Face Incident and the Need for Automated Defense — Stratechery · 2026-08-24
- Hackers claim theft of 12.9M Salesforce records from CyrusOne — TechNadu · 2026-08-24
- Teachers Targeted by Student-Made Deepfakes Face Accountability Crisis — nordicinst · 2026-08-24