Can generative watermarking move from impossibility to auditable compliance?

Article 50(2) asks for qualified, not absolute, marking

Article 50(2) of the EU AI Act requires providers of systems generating synthetic audio, image, video, or text to make outputs machine-readably marked and detectable as artificially generated or manipulated. The paper stresses that this is not an absolute command: the provision qualifies effectiveness, interoperability, robustness, and reliability by technical feasibility, implementation cost, content-specific limits, and the state of the art.

That qualification is what makes an auditable design possible. Because the obligation is contextual, a technical certificate can delimit the content types, lengths, languages, transformations, and operating points it covers, instead of claiming universal detection. The paper also separates three instruments with different legal effects: the binding Article 50(2) standard, the voluntary Code of Practice that reached final form on 10 June 2026, and the Commission's Article 50 Guidelines adopted on 20 July 2026. Adherence to the Code is not conclusive evidence of compliance and does not create the presumption of conformity that harmonized standards carry under Article 40.

The Code adds concrete commitments for signatories, including reliability testing across content length and use contexts, robustness testing against lexical substitution, character insertion or deletion, paraphrasing, and translation cycles, interoperable detector access required by 2 February 2027, and downloadable digitally signed detection results. For free-form text, the Code requires an imperceptible watermark on texts longer than 200 tokens while acknowledging that reliability at such lengths may be lower than for very long texts.

Strong watermarking fails under adaptive removal

The paper does not dispute the impossibility results it builds on. Under broad, oracle-aided threat models, no efficient adversary can be prevented from removing a nontrivial mark while preserving output quality. Separately, for human-text distribution and machine-text distribution, the AUROC of any detector is bounded by one half plus the total variation distance minus half its square, so the bound approaches a purely random valuation as the two distributions converge.

These are different boundaries and the paper keeps them apart. The impossibility result concerns an active adversary with quality and perturbation oracles; the total-variation bound concerns statistical separability even without an adversary. Neither says a deployed watermark is useless. They say a nontrivial, quality-preserving, universally removal-resistant guarantee cannot be assumed.

The paper also flags a measurement trap. A single AUROC averages across thresholds, obscuring a text's length and domain, and says little about a document that has moved outside the evaluation distribution. Confidence intervals for an average benchmark metric do not become coverage guarantees for a later individual item.

A description-length profile replaces an unidentified entropy constant

The first technical contribution is a description-length robustness profile. A context-seeded watermark derives a pseudorandom seed from a secret key and a window of preceding tokens, and the detector aggregates bounded contributions into a score. The paper defines watermark evidence bits as a minimum-description-length device, so the profile states how much source-specific evidence survives a named transformation rather than asserting robustness in general.

A finite-sample bound shows that detectable bias decays and that the required sample size grows with the inverse square of the decay rate. The construction replaces an unidentified Shannon-entropy constant with collision entropy, and it keeps token edit distance and semantic loss on separate axes. The paper's stated purpose for this layer is falsifiability: a robustness claim becomes a measurable surface over named ordinary and adversarial transformations, not a blanket property.

Conformal sets separate false attribution from false exclusion

The second contribution is a two-sided conformal procedure. Label-conditional conformal prediction sets use separate false-attribution and false-exclusion levels and return one of three states: "watermark supported," "not supported," or "inconclusive." Coverage is obtained as a finite-sample result and is class-conditional under exchangeability.

The design choice matters because the two errors are not the same mistake. False attribution of the target watermark and false exclusion of genuinely marked text get separately chosen tolerances, and ambiguous or anomalous cases are routed to the inconclusive state instead of being forced into a binary verdict. The paper is explicit that this layer assigns no posterior probability to an individual text and does not allocate a legal burden of proof, which is supplied by applicable substantive and procedural law and applied by the competent decision-maker. A detector report must never present the raw score, the conformal p-value, or a classifier confidence as "the probability that AI wrote this."

The surviving-token rule overstates tolerable editing about twofold

The paper reports a small reproducible simulation of a tournament watermark. The supplementary code has three files: one implements the keyed pseudorandom function, the next-token model, tournament generation, the substitution channel, the detector, the conformal p-values, the decision rule, and the diagnostic; one runs the experiments and writes figures plus a machine-readable results file; one asserts the properties the propositions assume. The master seed is 20260902 and the seed-window length is 4. Planning levels are 0.01 and 0.05; operating levels are 0.01 for false attribution and 0.10 for false exclusion. Stratum A uses K in {2,4,8,16} with q* uniform on (.55,.97); stratum B uses K in {2,4,8} with q* uniform on (.80,.99).

The simulation confirms both claims and shows that the surviving-token rule overstates the tolerable edit rate roughly twofold, with the overstatement growing with the seed's window length. The paper's own framing is that ordinary editing erases evidence faster than a surviving-token count suggests.

Two further findings carry into practice. A calibration cell that omits the edit band does not degrade gracefully on edited text: it reports "not supported" for nearly every genuinely marked document. And assuming a 200-token threshold, editing already leaves most genuinely marked documents inconclusive. The paper draws the distinction directly: the point at which the Code requires signatories to apply watermarking should be separated from the point at which the resulting evidence becomes informative enough for a categorical attribution. A duty to mark is not a warranty of detectability.

Certificate, signed report, and recalibration make claims checkable

The framework maps its quantities onto three governance objects: a premarket certificate, a signed detector report, and a postmarket recalibration protocol. The machine-readable report should contain at least a cryptographic hash of the exact input bytes and the normalization or tokenization procedure; provider, generator or sampler, watermark, detector, and calibration-set identifiers; timestamp, key epoch tested, declared cell, input length, and in-scope status; the raw detector score, both p-values, both error levels, the relevant sample counts, and the decision statistic; the three-state natural-language conclusion; active drift or integrity warnings with a link to the applicable certificate version; and the detector service's digital signature and verification information.

The paper also translates Article 50(2)'s four attributes into evidence a provider can produce, and states what each does not establish. Effectiveness is evidenced by coverage of in-scope outputs, the detectable-length distribution, and true-positive and abstention rates at declared error levels, but not by universal marking of exempt, truncated, unsupported, or externally generated content. Reliability is evidenced by label-conditional error control in declared cells, subgroup results, and signed reproducible reports, but not by pointwise certainty for a disputed document or validity after unmeasured shift. Robustness is evidenced by description-length and performance surfaces across named transformations, but not by resistance to every adaptive, quality-preserving removal strategy. Interoperability is evidenced by versioned detector discovery, authenticated access, common schemas, signatures, and retirement notices, but not by semantic equivalence among different providers' scores or keys.

A positive result identifies a configuration, not an author

The paper defines its hypothesis narrowly. The target is whether the input contains the target provider's active watermark under a declared configuration; the complement includes human text, output from other models, provider output generated without the target mark, and text from which the mark has been removed. Neither hypothesis is equivalent to "AI authored" versus "human authored," because mixed authorship, retrieval, quotations, provider-side exemptions, and post-generation edits all break that equivalence.

The outcome the framework delivers is text carrying the watermark of a specified provider, model or sampler version, detector version, and key epoch. A negative result does not establish human authorship, and a positive result does not establish who submitted, edited, or endorsed the text. The paper notes that generic AI detectors have shown severe error disparities for nonnative English writing; a provider-specific watermark detector avoids some feature-based biases, but length, language, and topic can still shift its score distribution.

The paper also records an incentives caveat: lower reliability may justify more restrictive detector access, while improvements in detector performance may reduce a provider's regulatory discretion. The issue is partly endogenous, since the technical limitation that triggers the restriction is itself influenced by the provider's choices about developing, validating, and deploying the detector.

The demonstration is synthetic and the framework is analytic

The paper states that it develops an analytic and governance framework and reports no new empirical dataset, human-participant experiment, or proprietary system evaluation. All data underlying the demonstration are synthetic and are regenerated deterministically by the accompanying code from the recorded seed. The code depends only on numpy, scipy, and matplotlib, and reproduces every figure and number in the demonstration in a few minutes on a single core.

That boundary matters for how far the numbers travel. The twofold overstatement of tolerable editing, the failure of a calibration cell that omits the edit band, and the inconclusive results near the 200-token threshold are simulation findings under the stated seeds, strata, and operating levels, not measurements of a deployed production watermark. The paper's own position is that the architecture does not defeat the impossibility theorem and assigns no posterior probability to an individual text; its value is that it makes claims falsifiable, so regulators can read "robust and reliable as far as technically feasible" as evidence comparable across providers and over time, and providers can disclose failure regions without treating every limitation as noncompliance.

Sources used in this answer