Watermarking: from Impossibility to Auditable Compliance

Fernando Delbianco; Fernando Tohmé; Hugo Acciarri

cs.CROct 5, 2026

Watermarking: from Impossibility to Auditable Compliance

Authors: Fernando Delbianco, Fernando Tohmé, Hugo Acciarri

Organizations: Departamento de Economía, Universidad Nacional del Sur (UNS), Bahía Blanca, Argentina · Instituto de Matemática de Bahía Blanca (INMABB), CONICET–UNS, Bahía Blanca, Argentina · Departamento de Derecho, Universidad Nacional del Sur (UNS), Bahía Blanca, Argentina

Abstract

Article 50 (2) of the EU Artificial Intelligence Act requires providers of generative systems to make synthetic outputs machine-readable and detectable, while qualifying the effectiveness, interoperability, robustness, and reliability by technical feasibility, cost, content-specific limits, and the state of the art. For free-form text, one important implementation route is the implementation of a generative watermarking procedure, which poses a compliance problem that is hard to address. Strong watermarking is impossible against adaptive removal, while ordinary edits attenuate statistical evidence, and unmarked human text may overlap distributionally with machine output. This article develops an auditable alternative. First, it defines a description-length robustness profile. A finite-sample bound shows that detectable bias decays and that the required sample size grows with the inverse square of the decay rate. This replaces an unidentified Shannon-entropy constant with collision entropy. Second, it constructs label-conditional conformal prediction sets with separate false-attribution and false-exclusion levels, reporting watermark supported,'' not supported,'' or ``inconclusive''. Coverage is obtained as a finite-sample result and is class-conditional under exchangeability. A small reproducible simulation of a tournament watermark confirms both claims and shows that the surviving-token rule overstates the tolerable edit rate roughly twofold. The resulting premarket certificate, signed detector report, and postmarket recalibration protocol operationalize the Commission's 2026 Code of Practice without claiming universal robustness.

Figures & tables

$\Gamma(x)$	Reported result	Controlled error and required interpretation
$\{1\}$	Target watermark supported	If $Y=0$ and exchangeability holds in the declared cell, false attribution is bounded by $\alpha_{0}$ . This supports a provider-specific mark.
$\{0\}$	Target watermark not supported	If $Y=1$ and exchangeability holds, false exclusion is bounded by $\alpha_{1}$ . It does not prove human authorship or absence of other AI assistance.
$\{0,1\}$	Inconclusive	Both labels remain compatible with calibration data. No categorical source claim is warranted.
$\varnothing$	Inconclusive; investigate drift	Both labels are atypical. Map to $\{0,1\}$ for decisions, preserve the anomaly flag, and examine version mismatch, attack, or distribution shift.

Table 1: Permitted interpretation of the conformal prediction set. The target is a specified provider watermark, not human authorship.

Figure 1: Context survival and the corrected frontier. a Observed marked bias after substitution, normalized by the unedited bias

\bar{\varepsilon}

. Simulation values are the marks on the curves representing

(1-\delta)^{h+1}

. b Substitution rate tolerated at

\alpha=.01

1-\beta=.95

in stratum A as a function of the number of scorable contributions. The surviving-token approximation allows roughly twice the edit rate the detector can in fact tolerate.

Figure 2: Label-conditional conformal calibration with

\alpha_{0}=.01

and

\alpha_{1}=.10

. a Empirical false attribution and false exclusion in six calibration cells, averaged over 60 calibration draws of 500 examples per label; error bars are the standard deviation across draws. b False exclusion when the item is scored against a cell calibrated on unedited text but is itself edited at

\delta=.15

, compared with calibration in the tested cell

Figure 3: Decision composition for genuinely marked items at

\alpha_{0}=.01

\alpha_{1}=.10

, using a single calibration draw of 800 examples per label. a By substitution rate at

n=1{,}600

. b By length at

\delta=.10

, with the Code of Practice’s 200-token threshold marked. Evidence loss is absorbed by the inconclusive categories rather than by confident misclassification

Stratum	$\bar{\varepsilon}$	$n$	$\delta$	False attribution	False exclusion	Abstention
A	.095	400	.00	.0086 (.0042)	.0943 (.0169)	.017
A	.095	400	.15	.0089 (.0043)	.0938 (.0139)	.515
A	.095	1,600	.00	.0094 (.0041)	.0959 (.0125)	.053
A	.095	1,600	.15	.0105 (.0050)	.1000 (.0154)	.049
B	.047	1,600	.00	.0094 (.0037)	.0948 (.0149)	.014
B	.047	1,600	.15	.0093 (.0045)	.0950 (.0138)	.519

Table 2: Simulated calibration cells. Levels are

\alpha_{0}=.01

for false attribution and

\alpha_{1}=.10

for false exclusion; entries are means over 60 draws of 500 calibration examples per label, with the standard deviation across draws in parentheses. Abstention is the combined share of inconclusive outputs across both labels

Field	Minimum disclosure	Function
System identity	Provider, model and sampler versions, watermark mode, tokenizer, detector, key epoch or rotation policy	Prevents performance claims from migrating across incompatible versions.
Population	Languages, domains, length bins, entropy regime, decoding settings, exclusions, and intended uses	Defines the exchangeability claim and the scope of effectiveness.
Null and positive labels	Operational construction of $Y=0$ and $Y=1$ , matched prompt protocol, provenance logs	Makes “reliability” a reproducible source-specific test.
Quality	Blind human preference where material, task scores, diversity, latency; uncertainty	Documents the quality–detectability trade-off
Robustness surface	Operation family, token and semantic distances, calibrated edit band, attack knowledge, score/evidence bits, FPR, TPR, and abstention with intervals	Gives a bounded, multidimensional meaning to robustness.
Conformal calibration	Nonconformity function, cells, $n_{0,r}$ , $n_{1,r}$ , $\alpha_{0}$ , $\alpha_{1}$ , realized dispersion, hashes, and validity date	Makes the decision rule and finite-sample resolution auditable.

Table 3: Proposed certificate fields and their compliance function

Attribute	Proposed evidence	What it does not establish
Effectiveness	Coverage of in-scope outputs, detectable-length distribution, TPR and abstention at declared $\alpha_{0},\alpha_{1}$	Universal marking of exempt, truncated, unsupported, or externally generated content
Reliability	Label-conditional error control in declared cells, subgroup results; signed reproducible reports	Pointwise certainty for a disputed document or validity after unmeasured shift
Robustness	Description-length and performance surfaces across named ordinary and adversarial transformations	Resistance to every adaptive, quality-preserving removal strategy
Interoperability	Versioned detector discovery, authenticated access, common schemas, signatures, and retirement notices	Semantic equivalence among different providers’ scores or keys

Table 4: Operational interpretation of Article 50(2)’s four technical attributes

Explore similar work

Watermarks Without Verification: AI Text Watermarking After the EU AI Act
Sep 10, 2026Alexander Nemecek, Vipin Chaudhary, Erman AydayAi-Generated Content Detection Watermarks
Case Western Reserve University
Attribute-based Undetectable Watermarking for Generative AI Models
Aug 4, 2026Miryam Mi-Ying Huang, Chung-Wei Lee, Max Raffel +1Watermarks Ai-Generated Content Detection
Carnegie Mellon University Pittsburgh, PA, USA · Independent Researcher · University of Southern California Los Angeles, CA, USA +1
Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems
Sep 17, 2026Rudrendu Kumar Paul, Sourav NandyCompliance Generative Artificial Intelligence
Boston University, Boston, MA, USA

Sep 10, 2026, cs.CYJ/K move · Enter open · S save

Watermarks Without Verification: AI Text Watermarking After the EU AI Act

Alexander Nemecek, Vipin Chaudhary, Erman Ayday

Case Western Reserve University

Ai-Generated Content Detection Watermarks Generative Artificial Intelligence Text Analysis and Detection Systemverilog Assertions

Open paper AskPDF arXiv

On August 2, 2026, the obligations of Article 50 of the EU AI Act took effect, requiring generative AI providers to mark the content their systems produce and ensure it can be detected as AI-generated. Days later, Anthropic disclosed that every Claude model released after that date embeds a watermark based on SynthID-Text in all generated text, enabled by default with no user opt-out; Google has deployed SynthID-Text in Gemini since 2024. Users objected that the watermark degrades quality, particularly for code, that it secretly encodes identifying information, and, in mutual contradiction, that it is easily removable and inescapable; the vendor answered with assurances of unchanged quality, no identifying information, and robustness to light editing. In this work, we argue that neither the objections nor the assurances can currently be verified and that this unverifiability, rather than watermarking itself, is the substantive governance failure. We sort the contested assertions by what it would take to settle each and evaluate the open-source SynthID-Text implementation on two open-weight models, because no public tool can test the deployed systems. On prose, the measured effect of the watermark does not exceed that of changing the sampling seed. On code, the cost is three points of correctness on one model and below measurement on the other, while detection remains near chance, a limitation of detectability rather than quality. The remaining gaps trace to withheld access or missing institutions and we map each to a requirement: release of matched outputs, configuration disclosure, accredited audits, a shared evaluation protocol, and interoperable detection.

Abstract

Explore similar work

Watermarks Without Verification: AI Text Watermarking After the EU AI Act

Attribute-based Undetectable Watermarking for Generative AI Models

Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems