SAMark Text Watermarking: Paraphrase Robustness and the Policy Gap

Most text watermarks do not survive paraphrase, and the one scheme that reports strong survival does so under conditions it defines itself. SAMark (arXiv:2605.25796), posted in May 2026, reports up to 90.2% true-positive detection at a 1% false-positive rate under typical paragraph-level paraphrasing, more than 30% above the strongest prior baseline. That is the best published number on the failure axis that matters, and it still leaves the policy question open.

Why do image and audio watermarks survive edits that break text watermarks?

Image and audio watermarks survive common edits because the signal carrier is redundant: cropping, recompression, and resampling destroy only part of the evidence, while a paraphrase rewrites the entire token sequence a text watermark was embedded in. This asymmetry, not any difference in cryptographic sophistication, is the root reason text provenance lags media provenance.

Google DeepMind’s SynthID illustrates what maturity looks like on the media side. The image and video watermark is added at creation time and is designed to survive cropping, filters, frame-rate changes, and lossy compression without changing perceptual quality. The audio variant, embedded in content from the Lyria music model and NotebookLM podcast generation, is designed to survive added noise, MP3 compression, and speed changes while remaining inaudible. These are vendor descriptions, not independent measurements, but the robustness claims are at least aimed at the right targets: the transformations a file actually undergoes between generation and consumption.

The mechanism behind that survival is redundancy. A 1024×1024-pixel image carries millions of pixel values; a watermark distributed across that space tolerates losing a crop’s worth of them. An audio waveform sampled at tens of kilohertz similarly gives the embedding enormous slack, and transformations like MP3 compression remove information the watermark was never stored in. Text has no equivalent slack. A token-level watermark encodes its signal in the choice of which token comes next, and a paraphraser’s entire function is to change which tokens appear while preserving meaning. Every token swapped is signal destroyed. The watermark and the attack are operating on exactly the same degrees of freedom.

There is a second asymmetry worth naming: the detection side. SynthID’s deployment history dates to a beta launch on August 29, 2023, in partnership with Google Cloud for Vertex AI customers using Imagen, and the system uses two deep learning models, one for watermarking and one for identifying, trained jointly on a diverse image set and optimized for correct identification and imperceptibility, according to Google DeepMind’s launch post. A jointly trained detector is a different class of artifact from the statistical scoring functions typical of text watermarking, and the near three-year head start shows. Text watermarking has no comparably deployed, comparably aged detection infrastructure. The policy conversation assumes a text equivalent of SynthID exists. It does not, or at least not one with a published robustness profile anyone has independently verified.

Where do text watermarks fail, and what does SAMark change?

Text watermarks fail on paraphrase because they embed at the token level while paraphrase operates on meaning, and SAMark’s contribution is to move the embedding anchor up to the paragraph level, where the attack has less traction. That re-anchoring is the entire design idea, and the reported numbers suggest it is pointed at the right problem.

The framing in the SAMark paper itself treats paraphrase as the axis on which prior schemes fail, which is a notable concession embedded in a methods paper: the authors are not claiming to fix a marginal weakness, they are claiming prior work degrades substantially under the attack class that any motivated user would reach for first. A paraphrase is the cheapest laundering operation available. It requires no adversarial expertise, no access to model internals, and no compute beyond a second model call or, for short passages, a human with ten free minutes.

SAMark’s answer is a self-anchored, paragraph-level embedding. Rather than tying the watermark to token-selection statistics that a rewriter obliterates, the scheme anchors the mark in properties of the paragraph as a semantic unit. The details of the anchoring mechanism are in the paper; what matters for evaluation is the attack model it defends against, because that is the design commitment that determines whether the results transfer. A watermark robust to the paraphrasers it was tested against is a different claim from a watermark robust to paraphrase, full stop.

The headline result: up to 90.2% true-positive detection at a 1% false-positive rate under typical paragraph-level paraphrasing attacks. The comparative result is in some ways more informative than the absolute one. SAMark outperforms the strongest prior baseline by more than 30% on average on robustness to paragraph-level paraphrase, which is another way of saying the best existing scheme was losing roughly a third or more of its detections to an attack a determined teenager can execute. Prior text watermarking was not narrowly failing on this axis. It was failing by margins that make deployment claims look optimistic.

What does 90.2% TP@FP1% actually cover?

The 90.2% figure is a self-reported result measured under “typical” paragraph-level paraphrase, which means it covers the paraphrasers the authors chose to test, at the operating point they chose to report, and it does not yet have an independent reproduction behind it. Read it as an upper bound from the party with the most incentive to report a high one.

Three qualifiers travel with the number. First, “typical” paraphrase is doing load-bearing work. Typical attacks in this literature usually mean one or a small set of instruction-tuned models prompted to rewrite, at default settings, without iteration. An adversarial paraphraser who knows a watermark is present can do more: paraphrase twice, paraphrase with a different model, paraphrase then translate then back, or paraphrase with an explicit instruction to vary sentence structure. Whether SAMark’s self-anchored embedding survives that ladder is exactly the question an independent evaluation would need to answer, and the abstract’s number does not answer it.

Second, the operating point. TP@FP1% means the detector is tuned so that only one human-written text in a hundred is falsely flagged as machine-generated. That is the right constraint for any deployment with consequences, because a provenance system that accuses one percent of all human writing is a defamation engine with an API. But tightening the false-positive budget is precisely what costs true positives under attack. The 90.2% is the true-positive rate at that strict operating point, under typical paraphrase. Move to adversarial paraphrase at the same 1% FPR and the TP rate will fall; by how much remains unmeasured.

Third, provenance of the measurement. The number comes from the SAMark abstract. No independent reproduction has been published. This is normal for a May 2026 arXiv posting evaluated in July 2026, but it fixes the epistemic status: promising preliminary result, not established capability.

What does the deployed media-provenance baseline look like?

The deployed baseline is a jointly trained two-model watermark with a multi-year production history on the embedding side, and a verification side that is real but rate-limited to a throughput no large-scale mandate could rely on. Both halves matter, because provenance mandates quietly assume the second half is free.

SynthID’s architecture, per DeepMind’s documentation, pairs a watermarking model with an identification model, trained together. Joint training is the detail worth pausing on: the detector is optimized against the embedder’s actual output distribution rather than bolted on afterward, which is how you get imperceptibility and identifiability to coexist instead of trade off. The system has been in some form of production since the August 2023 Vertex AI beta. That is the reference point text watermarking is implicitly benchmarked against, and it is a high bar set by a different, easier modality.

The verification half is where deployment reality intrudes. Gemini App’s SynthID verification, per Google’s support documentation, is rate-limited to roughly 10 image checks, 10 video checks (up to 5 minutes of footage total), and 10 audio checks (up to 3 hours total) per 24-hour rolling window. For a journalist verifying a viral clip, that quota is fine. For any systematic use, platform-level moderation, election-integrity screening, academic-integrity checking, it is a ceiling that rules out the workflow entirely. Ten checks a day is a consumer feature, not provenance infrastructure.

This is the part of the stack that mandate language never prices in. A rule that says “AI content must be marked” assumes three things exist: an embedder, a survivor of downstream editing, and a detector anyone affected can actually run at the rate the problem demands. Google ships the first and arguably the second for media. The third exists as a rate-limited app feature. For text, even the first two are unsettled. The gap between “a watermark exists” and “a watermark can be checked by the parties the rule is meant to protect” is where most provenance policy goes to die.

What works when the watermark doesn’t survive?

The fallback layer is metadata provenance, not a stronger statistical watermark: C2PA Content Credentials record origin and edit history as attached, signed metadata for both AI and non-AI content, independent of whether any in-content signal survives. The two mechanisms fail differently, which is precisely why serious deployments pair them.

Content Credentials, used in Gemini Apps and described in Google’s verification documentation, is a C2PA industry standard that documents where content came from and what happened to it. The threat model is complementary to watermarking’s. A watermark rides inside the content and can survive format changes but degrades under semantic transformation, as the paraphrase results show. Credentials ride alongside the content and are indifferent to paraphrase, cropping, or recompression, but can be stripped: screenshot the image, re-export the audio, copy-paste the text into a fresh document, and the metadata is gone. Screenshotting an image does not remove a SynthID mark; it removes the Content Credential. Copying watermarked text into a paraphraser does the reverse.

The composition of the two covers more ground than either alone:

The row that should concern policymakers is the last one’s failure mode combined with the second row’s. Text is the modality where stripping the metadata layer is a two-keystroke operation and attacking the statistical layer is one model call. Media gets defense in depth almost by accident, because the attacks on the two layers are different operations. Text gets the intersection of both weaknesses for free.

There is also a scope property of Content Credentials worth keeping: they document non-AI content too. A provenance system that only flags machine output has an asymmetry problem, since absence of a flag proves nothing once flags are optional or strippable. A system that attests to human origin as well as machine origin gives absence-of-attestation some evidentiary weight, at least in ecosystems where capture tools and platforms participate. That participation is voluntary and patchy, which is a deployment problem rather than a standard problem, but it is the reason credentials alone have not closed the provenance gap either.

What sits outside any watermarking mandate’s reach?

Everything generated by open-weight tools sits outside the reach of a watermarking mandate, because the mandate binds deployers who embed marks, and an open model running on someone’s own hardware has no deployer to bind. Voice cloning makes the gap concrete.

GPT-SoVITS, an open-source voice-cloning project, can produce a text-to-speech voice from a 5-second zero-shot sample or from 1 minute of few-shot training data, supporting English, Japanese, Korean, Cantonese, and Chinese. Compare that to the regulated surface: SynthID’s audio watermark is embedded in content from Lyria and NotebookLM, which is to say, in content from Google’s hosted models. The watermark covers the generation surface Google controls. A five-second sample and an open repository replicate the capability with no watermark, no embedder, and no one for a marking rule to attach to.

This is not a criticism of SynthID’s coverage decisions; no vendor can watermark models it does not operate. It is a structural observation about what provenance rules can and cannot govern. A mandate on hosted providers produces a world where compliant, watermarked output coexists with an unmarked open-source generation surface, and the unmarked surface is exactly where a motivated actor routes. The detection-side consequence is uncomfortable: absence of a watermark cannot distinguish “human-made” from “made outside the mandate.” Any enforcement regime that treats an unmarked synthetic voice as presumptively human will be wrong in precisely the cases that matter.

The text version of this problem is worse, not better. Open-weight language models are at least as capable relative to hosted ones as open voice cloners are relative to Lyria, and the paraphrase attack means even compliant hosted output can be laundered through a single open-model call after the fact. The watermark is applied by the party with the least incentive to remove it and removed by the party with the most. That is the equilibrium a statute has to change to be effective, and marking duties alone do not change it.

When is text watermarking worth deploying?

Text watermarking is worth deploying today as one signal among several, with SAMark-class paragraph-level schemes preferred over token-level ones wherever paraphrase exposure is real, and it is not yet worth legislating around, because no published scheme has a verified robustness number under adversarial paraphrase that a statute could name as a threshold. The practical decision splits by use case.

For platform-level triage, where a false positive costs a re-review rather than a punishment, watermark scores are usable now. A detector operating at 1% FPR with 90% true positives under typical paraphrase, if SAMark’s self-reported numbers hold up, is a strong ranking signal: most laundered text still flags, and the one-in-a-hundred human false alarm gets caught by the human in the loop. This is the deployment shape the technology can currently support, and it is a genuinely useful one.

For consequential decisions, academic-integrity findings, election-content determinations, legal evidentiary use, the math does not work yet. At 1% FPR applied across a large corpus of mostly human text, false positives accumulate in absolute numbers even when the rate looks small, and every one of them lands on someone who wrote their own words. Add an adversary who paraphrases iteratively, a case the literature does not measure, and the true-positive side erodes at exactly the moment consequences attach. The tool is a screen, and treating a screen as a verdict is a category error with a litigation tail.

For the policy question this piece opened with, the implication is structural. Disclosure and marking rules, the category that includes proposed EU and US state-level provenance requirements (whose specific statutory text could not be independently verified, so this piece does not quote them), tend to be written as if “marked” is a binary, checkable property. The technical literature says markedness is a probability that decays along a named attack axis, paraphrase, at rates that differ by scheme and that only one recent paper has seriously tried to arrest. A workable mandate would have to specify at least three things current proposals do not: the attack suite the mark must survive, the operating point at which survival is measured (something like a minimum TP rate at a maximum FP rate, in the SAMark paper’s own idiom), and the party responsible for demonstrating survival after editing. Without the third item especially, the burden of proving the mark survived lands nowhere, and a duty with no assigned proof burden is enforced as a suggestion. That is the second-order consequence the watermarking literature keeps producing evidence for and the policy literature keeps not absorbing: the binding constraint on provenance law is not whether watermarks exist but whether anyone is obligated to show they persisted.

What couldn’t be verified for this piece?

Four claims commonly made in this topic area could not be independently verified, and this piece has deliberately avoided asserting them.

First, the specific text of EU AI Act Article 50’s marking obligations and any 2026 US state election-watermarking bill. The policy framing in this article is structural, what a mandate would have to specify, rather than statutory, what a given statute does specify, because no primary regulatory text could be independently verified. Readers who need the statutory details should consult the primary texts directly; secondary commentary on AI Act provenance duties is abundant and inconsistent.

Second, the robustness of earlier text-watermarking families under paraphrase. SAMark’s claim of a 30%-plus margin over “the strongest prior baseline” implies prior schemes degrade substantially, and this piece reports that as SAMark’s own comparative finding, but the underlying baseline numbers were not independently verified here.

Third, SynthID-Text. Google’s vendor pages describe the text variant’s embedding mechanism (per-token probability adjustment) but publish no robustness profile for it. Nothing independently verified documents the text variant’s survival properties, and this piece has not assumed the media results transfer. Given the modality asymmetry described above, the prior should be that they do not.

Fourth, any independent reproduction of SAMark. The 90.2% TP@FP1% figure and the margin over baseline are from the paper’s abstract, self-reported, under typical rather than adversarial paraphrase. The result is the strongest published signal that paragraph-level self-anchoring is the right design direction, and it is one paper old. Both of those things are true, and a robustness threshold written into law should wait for the second one to change.

Frequently Asked Questions

Can SAMark’s watermark survive iterative paraphrasing or translate-then-back attacks?

The SAMark paper does not report results for iterative paraphrasing or translate-then-back attacks. The 90.2% TP@FP1% figure applies only to typical single-pass paraphrasing. Adversarial strategies that chain multiple rewrites or cross-lingual transformations are unmeasured and likely degrade detection further.

How does SynthID’s verification quota affect large-scale content moderation?

Gemini App’s SynthID verification is limited to 10 image checks, 10 video checks, and 10 audio checks per 24-hour rolling window. This throughput ceiling makes the tool unsuitable for platform-level moderation or systematic provenance screening, restricting it to consumer-grade spot checks rather than infrastructure-scale enforcement.

Does GPT-SoVITS support languages beyond the five listed in its GitHub readme?

The GPT-SoVITS repository explicitly lists support for English, Japanese, Korean, Cantonese, and Chinese. The project’s architecture relies on phoneme-level alignment and speaker embedding extraction, which currently requires language-specific preprocessing pipelines. Extending support to other languages would require new training data and phoneme dictionaries not included in the base release.

What happens to C2PA Content Credentials when text is copied into a new document?

C2PA Content Credentials are attached signed metadata that do not embed within the text content itself. Copying text into a fresh document, exporting to a different format, or taking a screenshot strips the credentials entirely. This failure mode is distinct from watermark degradation, as the metadata is removed by the action of separation rather than by semantic transformation.

Is there an independent reproduction of SAMark’s 90.2% detection rate?

No independent reproduction of SAMark’s results has been published as of July 2026. The 90.2% TP@FP1% figure is self-reported by the authors in the arXiv abstract. The absence of third-party validation means the number remains a preliminary claim rather than an established benchmark for robustness against paragraph-level paraphrase.