Does paraphrasing remove AI watermarks?

Yes. A statistical watermark lives in the model's word choices, so a rewrite that replaces the words removes it. The providers say so themselves. Anthropic: light editing probably will not remove the watermark completely; a complete rewrite where every word is replaced will. OpenAI: replacing 10 percent of words with synonyms reduced detection on 400-token passages from about 92 to 66 percent, and replacing 25 percent reduced it to 17 percent. The research literature has reported the same since 2023. What a paraphrase does not remove is everything else: document history, drafts, a provider's record of its outputs, and the fingerprint that rewriting tools leave behind, which detectors now train on.

The mechanism in one paragraph

A watermark detector counts how many of the model's word choices lean toward a keyed pattern. Each replaced word removes one count. A few replacements leave the count high enough to detect. Many replacements push it toward what unmarked text would show. There is no threshold at which the mark "breaks"; it fades. That is why the providers describe robustness to light editing and not to paraphrasing, and why every published number is a curve against the fraction of text changed and the length of the passage.

What the providers measured

OpenAI's October 2026 announcement is the most detailed public data. On 400-token English responses at a 1 percent false positive target, detection was about 92 percent with no edits, about 66 percent after a tenth of the words were swapped for synonyms, and about 17 percent after a quarter. Synonym swapping is a weak attack; a fluent paraphrase changes far more than a quarter of the words. Google describes SynthID-Text as robust to light modification and does not claim robustness to paraphrase. Anthropic's statement is the plainest of the three and is quoted above.

What the research found

Kirchenbauer and colleagues, in their 2023 reliability paper, attacked their own watermark with machine paraphrasing, human rewriting and mixing marked text into unmarked documents. The mark degraded under every attack but often remained detectable in long passages, because an attacker must change a large share of tokens to flatten a statistical pattern. Sadasivan and colleagues, the same year, showed that recursive paraphrasing, rewriting the rewrite, defeated both watermarks and classifiers, and argued that as model text approaches human text any detector must trade misses against false alarms. Krishna and colleagues built DIPPER, an 11-billion-parameter paraphraser, confirmed that it broke the detectors of the day, and proposed the defence that still matters most: retrieval. If a provider keeps a record of what its models produced, a rewritten passage can be matched by meaning, which paraphrase preserves. The RAID benchmark now scores detectors against paraphrasing and ten other attacks on a public leaderboard, which is the fairest place to see current numbers.

What a rewrite does not remove

Three things survive a paraphrase, and they are what decisions actually turn on. First, process evidence: the version history of a document, the drafts, the notes, the typing replay that tools such as GPTZero and Grammarly record. A rewritten text with no history is its own kind of signal. Second, the rewriter's fingerprint: paraphrasing models have styles of their own, and detectors have trained on them since early 2025. Turnitin's bypasser detection, launched August 27, 2025, flags rewritten machine text and counts it as AI-generated. Pangram reports detecting most high-quality humanized text. A rewrite that passed in 2024 can score as AI in 2026. Third, provider records: the retrieval defence works on meaning, and meaning is the one thing a paraphrase is designed to keep.

Why this matters for policy

Because removal is easy, the law has moved toward making marks a provider duty rather than a user prohibition, and toward making platforms preserve provenance rather than making individuals keep it. The EU Code of Practice asks signatories to keep marks as non-removable as they can. California's AI Transparency Act bars large online platforms from knowingly stripping provenance data from January 1, 2027. Neither makes paraphrasing by a person an offence. The policy section has the texts.

Questions people ask

Does a light edit remove an AI watermark?

Usually not. Anthropic says light editing probably leaves the mark; OpenAI found that changing 10 percent of words cut detection from about 92 to 66 percent on 400-token passages.

Does translation remove a watermark?

Translation replaces every word, so the mark does not survive. OpenAI lists translation among the reasons a mark may be missed.

Does paraphrasing remove evidence that a text was AI-generated?

It removes the watermark and lowers classifier scores, but it does not change document history, drafts, typing replay or a provider's record of outputs, and detectors now train on paraphrased output.