Researchers put AI watermarks to the test—and broke every single one

Tech giants spent the summer promising that invisible watermarks would save us from deepfakes. Academic researchers just broke every single one of them.

Soheil Feizi, a computer science professor at the University of Maryland, released a new preprint paper this week detailing his team's findings. His conclusion is brutal: they don't have any reliable AI watermarking right now because his team managed to break every method they tested.

Washing out the mark and framing humans

Feizi looked at how bad actors can evade watermarks by "washing" them out. But the vulnerability cuts both ways.

Attackers can easily strip watermarks from AI-generated pictures to pass them off as real. Even worse, they can lift those same watermarks and embed them into authentic human-made photos, triggering false positives and framing authentic media as AI.

This isn't an isolated red flag. Researchers from UC Santa Barbara and Carnegie Mellon previously found that all invisible watermarks are vulnerable. Feizi's team went a step further, proving that even high-perturbation, visible watermarks can be manipulated.

A broken defense before election season

Misinformation concerns are surging ahead of the 2024 U.S. presidential election, where altered clips are already popping up on platforms like Truth Social.

Tech heavyweights including OpenAI, Alphabet, Meta, and Amazon pledged this summer to develop watermarking tools. Google DeepMind rolled out a beta version of its SynthID watermarking tech in late August, though DeepMind cautiously noted at the time that the tool was not foolproof.

Detection startups are rolling their eyes. Ben Colman, CEO of Reality Defender, noted that watermarking fails in real-world environments because it is easily faked, removed, or ignored. Bars Juhasz, cofounder of evasion platform Undetectable, openly stated that an entire commercial ecosystem already exists to strip these watermarks in seconds.

Still, researchers like UC Berkeley's Hany Farid and Maryland's Tom Goldstein argue that watermarking should not be thrown out entirely. To them, robust watermarks remain a form of harm reduction that stops low-effort fakes, even if sophisticated attackers can bypass them.

Why it matters

We think tech giants leaning on watermarks as a primary safety shield looks increasingly like security theater. Pledging watermarking standards was a politically convenient way to appease regulators this summer, but deploying a defense that breaks under basic adversarial pressure creates a dangerous false sense of security.

For everyday internet users and platforms, relying on invisible tags right now is a trap. If bad actors can easily spoof watermarks onto real photos, automated detection tools risk censoring authentic evidence while letting laundered deepfakes slip through unnoticed.

Watermarks may still have a minor role as a speed bump against low-effort bots. But we believe the industry must stop treating pixel-level watermarking as a silver bullet and start treating content provenance as a layered defense problem.