HN Debrief

Text AI watermarks will always be trivial to remove

  • AI
  • Regulation
  • Security
  • Privacy
  • Developer Tools

The post argues that text watermarking is much weaker than image or video watermarking because text has no stable container. Once output becomes ordinary words in an email, document, or chat, anyone can strip formatting, paraphrase it, translate it, or ask another model to rewrite it. That makes hidden signals fragile by design. The piece contrasts steganographic watermarking, like token-choice biasing or invisible characters, with cryptographic signing, which can prove provenance only if the signature travels with the text artifact. For plain text pasted around the internet, that artifact usually does not exist.

Do not plan compliance, moderation, or trust systems around AI text watermarking as a durable control. At best it is a cheap friction layer for unsophisticated abuse, so pair it with process checks, provenance where users opt in, and human accountability.

Discussion mood

Mostly skeptical and resigned. People saw text watermarking as politically driven and technically brittle, though a sizable minority still valued it as a low-grade deterrent for lazy cheating, spam, and copy-paste misuse.

Key insights

  1. 01

    Lazy misuse is still a big target

    The strongest defense of watermarking was not that it survives an adversary, but that most abusers are not adversaries in the serious sense. Students, spammy recruiters, fake social profiles, and low-effort content mills routinely leave obvious traces already. A detector that only works on raw or lightly edited output can still be operationally useful because it catches the huge volume of people who will never bother to paraphrase, translate, or run a cleanup pass.

    Use watermarking only where the abuse is cheap and repetitive. It fits triage queues, school integrity workflows, inbox filtering, and PR spam screening far better than anything high-stakes.

      Attribution:
    • josephg #1 #2
    • bonoboTP #1
    • pavon #1
  2. 02

    The real gap is failed review

    For legal briefs, research papers, and policy documents, the problem is not just hidden AI use. It is that institutions already do a poor job checking authorship, review quality, and factual support. Adding a watermark does not fix nepotistic authorship, rubber-stamp journals, or professionals who sign off on work they did not truly verify. In that setting, watermarking looks like a patch for broken governance rather than a trust mechanism.

    If your business depends on expert review, tighten the review chain instead of outsourcing trust to model vendors. Require accountable sign-off, source checks, and process evidence that survives even when text origin cannot be proved.

      Attribution:
    • simon84 #1
    • avaer #1 #2
  3. 03

    Signing and watermarking solve different problems

    Several comments clarified a distinction the post only touched briefly. Cryptographic signatures can prove that a specific tool or provider emitted text, but only when the signature remains attached to the artifact, as with a file format or a provenance wrapper like C2PA. Steganographic watermarking tries to hide that provenance inside the wording itself. Once text is copied into plain email, chat, or a web form, signatures drop away and only the much weaker hidden-signal approach remains.

    If provenance actually matters, keep content in a signed container from creation to verification. Do not expect plain pasted text to carry trustworthy origin metadata on its own.

      Attribution:
    • jerf #1 #2
    • zahlman #1
    • clemlesne #1
  4. 04

    Output databases create a privacy mess

    The alternative idea of skipping watermarking and checking whether a paragraph matches something a model previously generated ran into obvious problems. Providers do not retain every output, they often should not under privacy rules, and a searchable archive of generated text would become a surveillance tool. It could leak sensitive prompts, be gamed with quoted source material, and become expensive to query at the scale of all model output.

    Avoid provenance schemes that require indefinite retention of user prompts and outputs. They create compliance and privacy risk that may be worse than the problem you are trying to solve.

      Attribution:
    • mirashii #1
    • bonoboTP #1
    • rsynnott #1
    • johnnyo #1
    • echoangle #1
  5. 05

    Editing breaks the meaning of removal

    A hidden text mark is not like a padlock. Ordinary editing can destroy it without any deceptive intent at all. That weakens the moral and legal framing that stripping a watermark is itself suspicious behavior. It also creates a false sense that passing or failing a detector cleanly maps to honesty, when in practice innocent revision and malicious laundering can look similar.

    Do not make policy that treats missing watermarks as evidence of bad faith. Use them as one weak signal among others, not as a basis for accusations or automated penalties.

      Attribution:
    • ramesh31 #1
    • burnte #1
    • krapp #1

Against the grain

  1. 01

    A hidden scheme could be tougher than claimed

    A few comments pushed back on the post's certainty. If the watermarking rule is secret and spread across many token choices, not just Unicode tricks or obvious word tells, then building a generic `removeWatermark(text)` may be much harder than the article suggests. That still does not make it durable against wholesale rewriting, but it does leave room for practical schemes that survive casual paraphrase and catch unmodified reuse.

    Do not assume every watermark looks like invisible characters or obvious stylistic tics. If you test vendor claims, include secret-key statistical schemes in your threat model and benchmark against casual, not just maximal, edits.

      Attribution:
    • andy_xor_andrew #1
    • johnjwang #1
    • recursivecaveat #1
    • fwip #1
  2. 02

    Human provenance is even harder

    The proposal to solve this from the other side with hardware-attested proof of keypresses showed how ugly the deeper problem is. Even if you could prove a person typed every character, you still could not prove they were not transcribing model output from another screen. Stronger provenance quickly turns into invasive monitoring without actually certifying human thought.

    Be wary of "proof of human creation" products that promise certainty. They tend to demand surveillance while still failing to establish genuine authorship or judgment.

      Attribution:
    • defen #1
    • layman51 #1
  3. 03

    Local models make regulation leaky

    Some comments treated local models as the real story. Hosted-model watermark mandates may mostly constrain large vendors that need EU access, while local models remain watermark-free generators and convenient laundering tools for hosted output. Others insisted that is a feature, not a bug, because local models preserve user autonomy and reduce provider lock-in. Either way, the policy only bites where providers can be regulated.

    Expect watermark rules to shift usage toward local or less regulated tools if the friction gets high enough. If you run a platform or enterprise policy, plan for mixed-origin content rather than assuming vendor-side controls are universal.

      Attribution:
    • dTal #1 #2
    • dpoloncsak #1
    • thisoneworks #1

In plain english

C2PA ↩
Coalition for Content Provenance and Authenticity, an industry standard for attaching verifiable provenance metadata to digital media.
EU ↩
European Union, the political and economic union of member countries in Europe.

Reference links

Watermarking analysis and vendor docs

Provenance tooling

  • c2patxt
    An implementation of C2PA for raw text, offered as a practical provenance tool distinct from hidden watermarking.