LLM Output Watermarks Are Bypassable. The EU Deadline Is August.

Vendors deploying LLM output watermarking to satisfy EU AI Act Article 50 compliance have a problem: the techniques they’re using can be reliably defeated by an adversary willing to spend a few additional inference calls. Academic research dating back to 2023 and expanding rapidly through 2025 has documented bypass techniques that work in practice, and the August 2026 enforcement date for GPAI transparency obligations is arriving before the field has produced a robust solution.

This isn’t a theoretical concern. Watermarking is now being deployed as the primary machine-readable content marking mechanism by major AI providers. If the detection side of those systems can be circumvented by threat actors generating AI content for phishing, disinformation, or regulatory evasion, the compliance framework is only as strong as its weakest technical assumption.

How Current Watermarking Schemes Work

The most widely cited approach is the token-biasing watermark introduced by Kirchenbauer et al. in 2023 (arXiv:2301.10226). The mechanism is conceptually simple: a pseudorandom function seeded by context divides the model’s vocabulary into a “green” list and a “red” list at each generation step. The model is then biased to prefer green tokens during sampling, by adding a small positive value (delta) to green token logits before the softmax step.

Detection works statistically. For a given text, a verifier recomputes the green-red partition at each token position and counts the proportion of green tokens. Human-written text will show roughly 50% green token usage by chance. Watermarked model output shows significantly higher green token density. A hypothesis test determines whether the observed green proportion is unlikely to have occurred by chance, flagging the text as watermarked when the result is statistically significant.

The appeal is that this approach doesn’t require changing the model architecture, works at inference time without additional training, and introduces minimal quality degradation at small delta values. Several commercial implementations and open-source variants (including extended versions that use larger context windows for the seeding function) have shipped on this general design.

A second approach, Christ et al.’s “undetectable” watermark (arXiv:2306.05284), uses a cryptographic construction to embed the signal in a way that is provably indistinguishable from unwatermarked output to an adversary without the secret key. This provides stronger theoretical guarantees but is computationally more expensive and has seen less deployment than the biasing approach.

The Bypass Landscape

Research on watermark removal and evasion has produced several reliable techniques.

Paraphrasing attacks are the most straightforward. Since the watermark is embedded in token-level statistics, any transformation that changes the specific tokens while preserving semantic content tends to remove or substantially weaken the signal. Krishna et al. (2023) demonstrated that running watermarked text through a separate LLM with a paraphrasing instruction produces output that detectors consistently fail to flag as AI-generated, while maintaining readability and factual accuracy. The cost is roughly one additional inference call per generated document.

The scaling economics here are unfavorable for defenders. A threat actor generating thousands of phishing emails adds one paraphrasing pass to their pipeline. The computational cost is marginal relative to the benefit of evading AI content detectors. Detection systems relying on watermarking alone provide no protection against this.

Token substitution attacks exploit the structure of the green-red biasing approach specifically. If an adversary can query the watermarking system, they can probe which tokens are in the green list for a given context by observing what the model prefers to generate. Having identified green tokens, they can substitute them with semantically similar red tokens. The resulting text reads normally but falls below the detection threshold. This attack requires more queries to the target system but is effective against deployed implementations that reuse predictable pseudorandom seeds.

Spoofing attacks work in the opposite direction: making human-written text appear to be AI-generated. Since detection relies on green token statistics, an adversary who understands the biasing function can rewrite human text to increase its green token density, causing false positive detections. This has applications in harassment campaigns (framing human communications as AI-generated to discredit the author) and in adversarial testing of detection systems.

Quality-preserving beam search bypass is a more subtle technique targeting the delta parameter. At low delta values, the watermark signal is weak enough that statistical tests require substantial text length to reach significance. Shorter outputs, particularly those under 200 tokens, may not produce detectable watermark signal even when legitimately watermarked. Adversaries generating short AI content segments (individual paragraphs, targeted sentences) may fall below the detection threshold by design.

What This Means for the Compliance Picture

Article 50’s machine-readable marking requirement was drafted with technical implementability in mind, and watermarking was identified in the drafting process as the leading candidate mechanism. The enforcement guidance that followed hasn’t substantially engaged with the bypass literature.

The result is a potential gap between what compliance requires on paper (“AI-generated content is marked in a machine-readable format”) and what detection systems can actually verify. A vendor whose watermarking implementation can be stripped by a paraphrasing pass is technically compliant with Article 50 but practically unable to support the detection use cases the regulation is designed to enable.

For security teams, this matters because the downstream use cases for AI content detection overlap with security functions. Identifying AI-generated phishing emails, detecting synthetic disinformation content, verifying the provenance of code suggestions from AI coding assistants: these all depend on detection working reliably. Compliance theater on the production side provides no security benefit on the detection side.

The research community has proposed several hardening approaches. Longer context windows for the seeding function reduce the effectiveness of local token substitution by making the green-red partition less predictable from observation. Multi-bit watermarks encode additional information that can be used to verify specific model identity rather than just presence of watermarking. Semantic watermarks, which operate at the meaning level rather than the token level, are harder to remove by paraphrasing but are more computationally expensive.

None of these are fully robust against an informed adversary. The academic consensus from multiple groups working the problem is that no watermarking scheme can simultaneously satisfy semantic preservation, detectability, and robustness against paraphrasing. The fundamental constraint is information-theoretic: any transformation that preserves meaning while changing surface form will tend to remove the signal embedded in surface form statistics.

Defensive Guidance

For organisations building AI content detection pipelines:

Do not treat watermarking as a gate control. Watermark detection is a probabilistic signal, not a binary truth. Missing a watermark does not mean content is human-generated. Present detections as one input to a broader decision rather than a standalone verdict.

Layer detection signals. Perplexity scoring (AI text tends to be lower-perplexity under the generating model), stylometric analysis, and provenance tracking (API-level logging, timestamp correlation, rate pattern analysis) each catch different aspects of AI-generated content that watermark detection alone misses.

Understand your model’s watermark parameters. If you’re relying on a vendor’s watermarking implementation, understand the delta value, seeding strategy, and minimum text length for reliable detection. Short text segments and low delta values will produce high false-negative rates against any bypass attempt.

Monitor for evasion patterns. Systematic paraphrasing of AI output before submission or publication produces characteristic patterns in text statistics. A document that scores low on watermark detection but shows other AI stylometric signatures is a candidate for closer review, not automatic clearance.

Treat compliance evidence and security function separately. Documenting that your system produces watermarked output satisfies Article 50’s marking requirement regardless of whether detection at the receiving end works. The security question (can we reliably detect AI-generated adversarial content?) is a distinct engineering problem that requires a more robust technical stack than watermarking alone provides.

References

• Kirchenbauer, J., Geiping, J., et al. “A Watermark for Large Language Models.” arXiv:2301.10226 (2023)
• Christ, M., Gunn, S., Zamir, O. “Undetectable Watermarks for Language Models.” arXiv:2306.05284 (2023)
• Krishna, K., et al. “Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense.” NeurIPS 2023
• Zhang, H., et al. “On the Reliability of Watermarks for Large Language Models.” ICLR 2024
• EU AI Act Article 50 — Transparency obligations for certain AI systems