Why Paraphrasing Fails to Remove LLM Watermarks

Paraphrasing does not remove an LLM watermark because the watermark was never written at the sentence level in the first place. The signal lives in token-choice statistics, and because the watermark is written at that layer rather than at the sentence level, the statistical fingerprint produced there survives whatever new words a rewriting strategy puts on top of it unless that strategy addresses the token-choice layer directly.

KGW: a token-level, not sentence-level, watermark signal

The KGW scheme, the most studied watermarking method in current use, works by splitting a model's entire vocabulary into two groups before a single word gets generated: a green list and a red list. At each step of producing text, the model applies a small positive bias toward tokens on the green list, nudging the sampling process to favor them over red-list alternatives. Nothing about this biases what the sentence says. It biases which words, among many that could say roughly the same thing, get chosen to say it.

Detection works as a hypothesis test applied to statistical patterns, not a content judgment. A detector counts the proportion of green tokens across a passage and converts that count into a z-score, and a z-score above 4 corresponds to a p-value below 3 × 10⁻⁵, a threshold described in an ICLR 2025 paper on watermark detection as giving a provably low false-positive rate. That low false-positive rate means the test measures a genuine statistical departure from what unwatermarked text would produce.

Each token's green-list assignment is generated by hashing the token or tokens that came before it. The watermark is context-chained: every choice made earlier in a passage shapes the constraints on every choice made later. A single sentence, read in isolation, carries no visible trace of any of this. The bias is far too small to notice in any one word. It only becomes detectable once hundreds of token choices are aggregated and measured together. Intervening at the level of a sentence, a paragraph, or a stylistic rewrite misses where the signal actually resides. The watermark was built to survive exactly that kind of edit.

Sentence-level paraphrasing degrades but does not erase the green-token bias

Paraphrasing a watermarked passage swaps some green tokens for red ones. Any rewrite that changes wording will, by definition, replace some of the model's original token choices with different ones, and some of those replacements will land on red-list tokens that lower the aggregate green-token count. Some" red-token substitutions are not enough to defeat detection. Across a passage of meaningful length, enough of the original green-token bias typically survives the rewrite that the aggregate z-score stays above the detection threshold.

The clearest demonstration of this ceiling comes from DIPPER, a large paraphrasing model trained specifically for the task of rewording AI-generated text. A NeurIPS 2023 paper on paraphrasing attacks found that DIPPER does something more decisive than merely dent the signal: it successfully evades watermark detectors, effectively eliminating the watermark signal when applied to text generated by three separate large language models. DIPPER represents about as capable a general-purpose paraphrase tool as exists for this purpose, and its results mark the boundary of what sentence-level rewriting, done well, can accomplish against a watermark detector.

KGW's context-chaining property complicates any paraphrase attempt further. When a rewrite changes an early token in a sequence, it scrambles the hash inputs that determine green-list assignments for every token that follows it. That sounds, at first, like it should help an evasion attempt: if the green-list assignments downstream get scrambled, shouldn't the green-token count come out close to random? In practice the scrambling is not uniform enough to flatten the overrepresentation of green tokens across a full passage. Pockets of the original bias persist unpredictably, and the aggregate statistic that the detector relies on remains distinguishable from what unwatermarked writing would produce.

This is not a skill problem. A more careful human editor, or a more sophisticated paraphrase model than DIPPER, does not close the gap, because the gap sits in the probability distribution from which tokens were drawn across the entire passage, an aggregate property that no amount of sentence-by-sentence polish directly targets. Paraphrasing is a tool built to change what text says and how it reads. The watermark lives in a layer that paraphrasing, by its nature, is not built to reach.

Suppressing a Watermark Signal: Targeted Token-Level Attacks

Watermark signals can be suppressed, and the methods that actually do it confirm, rather than contradict, where the problem lives. The attacks that work operate on token-selection probabilities directly, not on sentence meaning, and that single design difference separates them entirely from paraphrasing.

BIRA, the Bias-Inversion Rewriting Attack presented at ICML 2026, illustrates the mechanism precisely. BIRA applies a negative logit bias to a proxy suppression set of tokens identified through token surprisal, deliberately pushing generation away from exactly the tokens a watermark would have favored. The paper shows mathematically that reducing the average conditional probability of sampling a green token by a small margin, denoted δ, causes a watermark detector's success rate to decay exponentially. Applied across seven separate watermarking schemes, including KGW, BIRA achieves evasion rates above 99 percent.

A separate line of work, the Self-Information Rewrite Attacks paper from 2025, reaches a comparably complete result by a different route. Rather than rewriting text broadly and hoping enough green tokens get displaced, the method converts the attack into targeted deletion of precisely the tokens carrying the watermark signal, identified through their self-information content. Tested against KGW, Unigram, and several other schemes, it achieves near-complete attack success.

Both results require identifying which specific tokens carry the watermark signal and acting on those tokens in particular, which in turn requires either access to the watermarking scheme's internal parameters or a sophisticated proxy model capable of approximating them. Neither resource sits in the hands of a content team running an editorial rewrite pass. Describing ordinary paraphrasing as an "evasion strategy" conflates two operations that share no real mechanism: one is a surface-level rewording exercise, and the other is a targeted mathematical intervention against a statistical bias. The fact that the only attacks with proven, near-total success rates operate at the token level, and require this degree of technical access to do so, is itself the strongest evidence that the signal was never sitting at the sentence level to begin with.

Hardening watermarking designs against paraphrase attacks

Watermark design has not stood still in the face of paraphrase attacks, and the direction of that work makes sentence-level evasion harder with each iteration. Researchers building newer schemes have focused specifically on distributing the watermark signal more redundantly across a passage so that no single rewrite, however well targeted, can remove enough of it.

The SEEK scheme illustrates this strategy directly. SEEK introduces what its authors call equivalent texture keys: multiple tokens within a given watermark window that can each independently support detection, rather than relying on any single token to carry the signal for that stretch of text. If a paraphrase replaces one of those tokens, the redundant carriers around it still support detection, so an attacker has to overcome every equivalent carrier within a window simultaneously rather than defeating the watermark one substitution at a time. That redundancy is a direct engineering response to the exact failure mode paraphrasing exploits: the chance that any given green token gets displaced during a rewrite.

The broader pattern is an arms race tilting in favor of detection. Watermark researchers are building schemes explicitly hardened against the kind of rewriting operations a content team is most likely to actually perform. Newer detectors are catching more than sentence-level paraphrasing can defeat, and that gap is widening. None of this means watermarks are unbeatable; the token-level attacks discussed above prove otherwise. It means the specific strategy of rewording a passage by hand, or running it through a general paraphrase tool, is aimed at a target that is actively moving away from it.

The double-sided fragility of watermarks: a compliance trap, not a safe exit

Paraphrasing AI-generated content carries a cost that has nothing to do with whether it successfully fools a detector. Rewriting a passage to strip a watermark can simultaneously destroy provenance information that a content team is legally obligated to preserve, while still failing to bring the aggregate z-score back under the detection threshold. Both failures can happen in the same document at the same time.

The regulatory stakes are concrete. The EU AI Act's Article 50, enforceable from August 2, 2026, requires providers of generative AI systems to mark their outputs in a machine-readable format, and separately requires deployers to make human-readable disclosures for certain categories of AI-generated content. That provision establishes provenance infrastructure that organizations will be expected to maintain as a matter of law, not as an optional transparency gesture. A paraphrase pass run for the purpose of evading a watermark detector does not distinguish between the statistical signal it is trying to erase and the disclosure infrastructure the law requires it to keep. It can damage both at once, since both live in overlapping parts of the text's generation history.

A content team that paraphrases AI-generated text specifically to avoid detection may still fail the detection test, because the aggregate green-token bias survives sentence-level rewriting as shown above, and may also fail the separate compliance obligation to maintain disclosure signals, because the paraphrase pass stripped the very provenance markers that obligation depends on. That combination, detection intact and disclosure gone, is the worst outcome available under current regulation, and it follows directly from treating an architectural problem as though an editorial fix could resolve it. Solving it requires an intervention at the level where the signal and the provenance both actually originate, which is the level of how the text gets generated in the first place, not the level of how it gets reworded afterward.

Dispersing authorship across models as the structurally sound alternative to paraphrasing

Every section up to this point establishes the same underlying fact from a different angle: the watermark signal is a property of a single model's token-selection distribution, and no amount of sentence-level rewriting changes that distribution enough to matter. The logical remedy follows directly from the diagnosis. If the problem is that one model's green-list bias dominates the output, the fix is to make sure no single model's green list ever dominates it.

Authorship dispersed across multiple models accomplishes this by construction. When token choices across a passage are drawn from different models, each operating under its own green-list assignment seeded independently by its own provider, no single z-score test applied against one watermarking scheme can find the concentrated overrepresentation it needs to flag. The statistical signature that a detector relies on assumes a consistent bias running through an entire passage; dispersing authorship breaks that consistency at its source rather than attempting to paper over it after the fact.

The parallel to BIRA's own result is instructive on this point. BIRA achieves evasion rates above 99 percent against seven watermarking schemes precisely because it reduces the conditional probability of selecting a green token at the token level, the exact layer where the bias lives. Multi-model authorship reaches a comparable outcome by architecture rather than by attack: it lowers the concentration of any one green-list signature across a passage without requiring knowledge of any model's secret green list or access to its internal parameters, resources that, as established earlier, are not realistically available to a content team.

This remedy does not require dismantling a working content process. Teams that already run clear briefs, approved outlines, and reliable drafting workflows do not need to discard any of that structure; the fix operates downstream, at the model-selection and token-blending layer, leaving the editorial workflow that produces the content untouched. What changes is not how an organization plans or edits its content. What changes is which models, and how many of them, contribute the actual token-level choices that make up the final text.

Any claim about resolving this problem, whether made about paraphrasing, a token-level attack, or a multi-model approach, should be measured against one standard: a z-score benchmark run against a real KGW detector. A subjective readability judgment proves nothing about whether a green-token bias survives in the aggregate statistics. A claimed "humanization" score proves nothing either. The z-score test is what the entire detection apparatus is built around, and it is the only standard that tells you, with the same rigor the watermark itself uses, whether the structural signal problem has actually been solved.