Summary
Two authors writing in Nature argue that AI-text watermarks should face independent public scrutiny, citing attacks that reportedly spoofed or removed earlier watermarks.
A 27 October correspondence in Nature argues that AI-text watermarking efforts should invite independent public scrutiny. Authors Weibin Hu and Xueru Zhang describe watermarks as potential transparency signals, while cautioning that they should not be treated as definitive evidence of misconduct.
The authors point to tests of earlier watermarking approaches in which attackers inferred patterns through model queries and then spoofed or removed the watermarks. They report that these attacks cost less than US$50 and succeeded roughly 80% of the time. The figures concern the earlier efforts cited in the correspondence.
A watermark is a signal, not a verdict
In broad terms, a text watermark is a pattern embedded during generation that a detector can look for later. It may help identify text associated with an AI system, but the presence or absence of a detectable pattern is not, by itself, a complete account of how a text was produced or whether its use broke a rule.
Hu and Zhang’s argument is that scrutiny by researchers outside the organisations developing watermarking systems can help reveal how well those signals withstand attempts to manipulate them. That distinction matters when watermark detections are used in decisions about authorship or misconduct: a signal’s reliability and limits need to be understood before it is treated as evidence.
The correspondence gives no experimental detail behind the cited attack figures, so they should not be generalized to every watermarking system. Its central point is narrower: watermarking can support transparency, but its security and evidentiary role warrant public examination.