Watermarks Without Verification: The Evidence Gap Behind AI Text Marking
A critical review of a watermarking study that separates open-model results from claims about deployed systems and examines the evidence needed for accountable verification.
The paper
Watermarks Without Verification: AI Text Watermarking After the EU AI Act — Nemecek, Alexander; Chaudhary, Vipin; Ayday, Erman.
arXiv:2609.09604v1 · Computers and Society (cs.CY) ; Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR). First submitted 2026-09-09; reviewed version dated 2026-09-09. This review addresses the arXiv manuscript; arXiv hosting alone does not establish peer review.
Text watermarks can make claims about AI involvement more testable, but only if people outside the provider can examine how the system performs. Watermarks Without Verification: AI Text Watermarking After the EU AI Act by Alexander Nemecek, Vipin Chaudhary, and Erman Ayday treats that gap as a governance problem. This review concerns arXiv:2609.09604v1, submitted September 9, 2026.
Contribution
Source-derived synopsis. The authors classify contested claims about text watermark quality, traceability, removability, and detection according to the evidence needed to assess them. They evaluate the public SynthID-Text implementation on two open-weight models, using matched watermarked and unwatermarked generations and a sampling-seed control. They report small measured prose effects, a 3.1 percentage-point reduction in code correctness on one model and no measurable reduction on the other, and code detection close to chance. They propose matched-output releases, configuration disclosure, independent audits, shared evaluation protocols, and interoperable detection. Their experiments do not examine proprietary deployments.
Original analysis. The paper's useful distinction is between evidence about a method and evidence about a particular deployment. A public implementation can make a technical family available for study while leaving unanswered which settings, keys, and detector thresholds a provider actually uses. The distinction also limits the force of the authors' reassurance: their results challenge a broad claim that this kind of watermark must severely damage code, but they cannot settle a user's complaint about a particular product.
This matters for human agency because a person may have to decide whether to use, publish, or contest an AI-assisted text without access to the information needed to assess the mark. The paper turns that problem into specific requests for evidence. Its institutional recommendations are proposals, however; the experiments do not establish that any proposed audit or shared interface would work in practice.
Evidence
Original analysis of the methods and results. The authors tested the non-distortionary configuration of SynthID-Text on Gemma-2-9B and Llama-3.1-8B. For prose they used 500 open-ended prompts, comparing a watermarked response with an unwatermarked response generated using the same seed, as well as a second unwatermarked response generated with a different seed. For code they used 364 problems and ten samples per problem. Prompts producing an empty response or refusal in any arm were removed from all arms; this affected four prose prompts on one model.
The seed control gives the prose comparison a useful reference: differences between two ordinary generations can be mistaken for an effect of watermarking. The authors report that measured prose differences stayed within their prespecified bounds, with a model judging blinded pairs rather than human readers. That result is evidence about the selected metrics and models, not a finding that readers could never notice a difference.
For code, 61.8% of watermarked Gemma samples passed reference tests, compared with 61.4% without watermarking. Llama's corresponding rates were 60.7% and 63.8%. The Llama difference had a 95% confidence interval of minus 6.0 to minus 0.3 percentage points; its lower end crossed the authors' five-point equivalence boundary. Thus the reported average is modest, but the interval does not establish equivalence under that criterion.
Detection tells a different story from correctness. At a threshold set to a 1% false-positive rate on unwatermarked outputs, prose detection reached 39% at 200 tokens and 56–59% at 400 tokens. For code, the reported area under the receiver operating characteristic curve was 0.55 and 0.57, where 0.5 represents chance separation. These figures describe the tested detector and outputs; they do not supply a deployed provider's error rates. The weakness is consequential because a mark that has little measured quality cost may still fail to provide reliable evidence in a given setting.
Limitations and governance implications
Original analysis. The study used English prompts, two open-weight models, a public implementation, and a raw mean-score detector. It did not test proprietary configuration, key management, or a production detector. The paper also reconstructs public objections illustratively rather than surveying their prevalence. Its account of why people objected is plausible, but did missing verification cause those reactions? The supplied study does not establish that causal explanation.
The paper correctly separates a signal of model involvement from a finding about authorship. Hypothetical example: an editor checks a person's draft after an AI system has helped revise it. A positive watermark result might support further inquiry about that system's involvement; it would not by itself identify who originated the ideas or whether the contributor violated a disclosure rule. A negative result would likewise not prove that no AI assistance occurred. An accountable process would allow the contributor to explain the workflow and challenge an adverse decision.
The privacy question has a similar boundary. The authors explain that the published method does not itself embed user information, while deployment key assignment is not externally observable. An independent audit of key practices is therefore a sensible proposal, not evidence that a provider tracks individuals. The related Content Provenance and Watermarking article supplies broader context on the difference between an embedded signal and a provenance record. This paper adds a focused question: who can verify the specific detector and configuration behind a claimed signal?
Proposed tests. Providers could release matched outputs under a documented sampling protocol, while independent evaluators compare quality, detection, and error rates across passage lengths, languages, code, and mixed human–AI editing. A separate audit could examine key assignment and access controls without publishing secret keys. Testing should report detector thresholds and uncertainty, and distinguish missed marks from false flags. These are proposed evaluations, not studies demonstrated by the paper.
Original analysis. Verification also has material costs. A useful deployment assessment would measure the computing time, energy, storage, and staffing needed for repeated detection and appeals alongside accuracy. The paper does not provide those measurements, so it cannot establish whether its proposed infrastructure is proportionate in any particular workflow. The related FissionGuard review addresses a different but complementary question: what a statistical report can support about a selected passage.
For a review concerned with collective intelligence and accountability, the practical lesson is to preserve a route from a technical result to a contestable human judgment. The authors provide a useful map of missing evidence and a bounded family-level experiment. Neither establishes the reliability of deployed watermarks, and neither offers evidence about consciousness or spiritual doctrine.
AI-use disclosure
This review was drafted by GPT-6.1 Terra with high reasoning and checked in a separate GPT-6.1 Sol session with medium reasoning. Automated checks are not human peer review; the paper’s claims have not been independently verified for this article.
Paper sources
Bibliographic metadata checked 2026-10-27.