AI watermarking doesn't visibly alter text. Instead, it uses a secret key to slightly boost the probability of certain words appearing in a sequence. This creates a statistically significant pattern that can only be detected by a tool with access to the original model and the secret key.

While making detection tools public seems beneficial, it introduces a significant risk. Adversaries can repeatedly query the detector with different inputs to learn its patterns and eventually reverse-engineer the secret key. This would allow them to either remove watermarks or fool that specific detector.

To validate their watermarking method, researchers didn't just rely on simulations. They physically created watermarked protein binders in a lab. Lab tests showed that watermarked proteins had nearly identical "hit rates" and binding capabilities as non-watermarked versions, proving the method's real-world effectiveness.

DeepMind’s SynthID Bio embeds watermarks in protein sequences by substituting certain amino acids with functionally similar ones (e.g., leucine for isoleucine). This is analogous to choosing a synonym in text. The change is imperceptible to the protein's function but detectable as a watermarked pattern.

Despite being a key compliance tool for the EU AI Act, current text watermarking technology is fragile. The statistical fingerprints embedded in AI-generated text can be removed with little effort by running the content through readily available paraphrasing tools, undermining the robustness requirements of the law.

Watermarking isn't a one-size-fits-all solution. High-dimensional data like images (millions of pixels) offers ample space to hide an imperceptible signal. In contrast, low-dimensional data like text requires a completely different method based on biasing word choice to avoid altering its meaning.

Unlike encryption which can be broken, VEIL's "informationally compressive anonymization" (ICA) permanently destroys sensitive information while preserving its predictive value. This approach reduces data size and is inherently quantum-resilient because the original information no longer exists to be stolen or decrypted by future computers.

Initiatives like Google's Synth ID aim to standardize detection of AI-generated content. However, these systems are vulnerable. Simple user actions like screenshotting can strip metadata, and blending AI-generated assets with real footage can easily confuse detection algorithms, limiting their effectiveness.

AI labs face a trade-off with watermark detection tools. Making them widely available promotes public transparency, but it also allows bad actors to use the detector's feedback to reverse-engineer and train other AI models to become more effective at removing the watermarks, undermining the system's long-term security.