Why watermarking breaks the words

Text watermarking nudges a model toward particular word choices so that a detector can later recognise the pattern.² Platforms and some regulatory proposals now call for it.¹ The proof of origin is mixed into the content itself. For factual or technical text, changing the words to carry a signal is the wrong trade.

How statistical watermarks alter thought

To understand why text watermarks cause trouble, we must look at how digital assistants write. An artificial intelligence model does not speak in fully formed thoughts. It generates language one piece at a time, predicting which word or fragment is most likely to follow the previous ones.

At each step, the model considers a list of candidate words. Some choices fit the context naturally. Other choices sound awkward, irrelevant, or inaccurate.

Statistical watermarking interferes directly with this choice. To embed a hidden pattern into the text, the watermarking algorithm uses a secret mathematical key to split the dictionary into two buckets: a favored green list and a discouraged red list.²

Whenever the model prepares to choose a word, the watermarking system nudges it toward the green list. If the most accurate, truthful word happens to fall on the red list, the system penalizes it. The assistant is forced to select an inferior synonym just to satisfy the hidden watermark detector.

In casual banter or playful fiction, choosing a slight synonym rarely matters. Swapping the word "glad" for "pleased" does no harm. But in high-consequence work, language must be exact.

Consider a patient portal summarizing a surgical recovery plan. An assistant reading hospital discharge papers should quote exact medication dosages, recovery timelines, and warning signs. If the watermarking filter nudges a dosage threshold or alters a clinical instruction, it introduces confident misinformation. The assistant hallucinates errors not because it lacked the facts, but because the watermark forced it to bend the words.

The illusion of durable protection

Supporters of statistical watermarking often argue that hidden patterns survive even when a user copies text into another application. But recent security research reveals that this durability is an illusion.

Automated software agents can readily detect and erase statistical watermarks. By running text through a lightweight paraphrasing filter or querying the model across boundaries, an attacker can strip the watermark with near-perfect success.³

Worse still, embedding secret watermarking keys creates privacy risks. A malicious model provider can make a watermark depend on what a user said earlier in a conversation, so that a later, unrelated image reveals, for example, that the user mentioned depression.⁴

This creates an upside-down outcome. People with malicious intentions strip the watermarks in milliseconds using freely available tools. Meanwhile, honest doctors, teachers, researchers, and public servants are stuck with degraded, unreliable answers.

The alternative: A seal on the envelope

Human society solved this verification problem centuries ago. We do not authenticate deeds by tampering with the parchment. We place a seal upon the envelope.

In modern digital architecture, this approach is known as out-of-band cryptographic provenance.⁵ Instead of distorting the generation process, the assistant generates text naturally, selecting the most accurate and truthful words possible.

Once the response is complete, the local device creates a cryptographic receipt. This receipt contains a secure mathematical hash of the generated text, signed by an attested hardware key held on the device. The signature travels alongside the document as an open metadata envelope.

This separation provides three profound advantages:

First, truth comes first. The model is free to quote source documents verbatim without artificial steering. Numbers, dates, and dosages remain completely unperturbed.

Second, verification is deterministic. Anyone can verify the cryptographic signature using standard public keys. Verification does not rely on guessing statistical probabilities or tuning threshold curves. Either the document matches the signed hash, or it does not.

Third, people retain local custody. Origin proofs are generated right at the edge of the user's personal hardware. Proving where a document originated never requires uploading sensitive medical notes or personal correspondence to a centralized platform.

Proof of origin must never come at the expense of truth. By moving authentication out of the words and into the envelope, we keep digital tools honest, verifiable, and safe for everyone.

In the Shared Horizon action library, public teams and developers can explore practical steps for privacy-preserving watermark auditing, and track how open content credentials establish origin across community software.

Related essays: Paying for words instead of the repair · When the middleman pads the meter · Postmarks for the real world · Who is really there?. Further reading: Why an AI agent will not audit itself · When an agent forgets who said what.

Footnotes

1. For statutory transparency obligations and watermarking proposals, see the European Union Artificial Intelligence Act, Article 50 (Transparency obligations for providers and deployers of certain AI systems), EUR-Lex 2024/1689.
2. John Kirchenbauer et al., "A Watermark for Large Language Models," Proceedings of the 40th International Conference on Machine Learning (ICML 2023), arXiv:2301.10226. See also TextSeal2 on copula mixing (Oct 2026), arXiv:2610.40613.
3. Jun Yao, Chao Wang, Yupeng Qiu et al., "ProxyEraseAgent: Blind Watermark Removal in the Wild," arXiv:2610.11290 (Oct 2026).
4. Tobias Braun, Jonas Henry Grebe, Emil Sivic et al., "The Poisoned Conversation: Privacy-Leaking Watermarks in Unified Multimodal Models," arXiv:2610.05453 (Oct 2026).
5. Coalition for Content Provenance and Authenticity (C2PA), "Content Credentials Specification 2.1," C2PA Technical Specification (2024-2026).