Watermark Forensics: The Hidden Cost of Attribution in...

A new paper from arXiv, published July 14, 2026, introduces a unified information-theoretic framework for watermark forensics in generative models. It proves that the cost of moving from simple detection to user attribution or payload extraction scales directly with sample length, exposing a fundamental trade-off that current commercial systems have not addressed.

A new arXiv paper from July 14, 2026, defines a "forensic ladder" for watermarks: detection, attribution, payload extraction, and localization, each with a cost in sample length.
The information profile ν(t)=I(S;X_t∣X_{
Current commercial watermarking schemes, such as those used by OpenAI and Google, may be inadequate for forensic attribution without substantial increases in sample length or changes to model architecture.

What Is the Forensic Ladder and Why Does It Matter?

According to the arXiv paper "Watermark Forensics for Generative Models: An Information-Theoretic Perspective", a watermark is typically used only to answer whether a text is machine-made. However, the same mark can do more: attribute it to the user who produced it, extract a hidden payload, or localize the part that survives editing. These form a forensic ladder, and the paper asks what each rung costs in the sample length n. The key object is the information profile ν(t)=I(S;X_t|X_{

Watermark Forensics: The Hidden Cost of Attribution in AI Text

How Does the Information Profile Constrain Forensic Capabilities?

The paper defines S as the secret the mark carries (a user's identity or payload). The information profile ν(t) tracks the mutual information between S and the token X_t given previous tokens. This allows the authors to compute the minimum sample length required for each forensic task. For simple detection, the required length is small; for attribution or payload extraction, it grows significantly. The authors report that the exact scaling depends on the watermarking scheme and the entropy of the model's outputs. This formalizes what many practitioners have suspected: that attribution is not just a harder problem than detection, but a fundamentally different one with steeper data requirements.

What Are the Practical Implications for Current Watermarking Systems?

Current commercial watermarking systems, such as those deployed by OpenAI for ChatGPT and Google for Gemini, are designed primarily for detection. According to the paper, these systems may not support reliable attribution or payload extraction for short texts. For example, a single sentence or paragraph may be sufficient to detect machine generation, but insufficient to identify the specific user who generated it. This has direct consequences for accountability in applications like academic integrity, content moderation, and disinformation tracking. The paper suggests that without changes to the watermarking scheme or increases in sample length, forensic attribution will remain impractical for many real-world use cases.

Who Benefits Most From This Framework?

Researchers and developers of watermarking schemes benefit most, as the framework provides a clear theoretical basis for comparing and improving methods. Companies that prioritize privacy, such as those using differential privacy, may also benefit by understanding the trade-offs between forensic capability and user anonymity. Conversely, companies that rely on detection-only watermarks for accountability, such as OpenAI and Google, may need to reconsider their approaches. The framework also benefits regulators, such as the EU AI Office, who are developing requirements for AI-generated content labeling. According to the paper, the information profile provides a rigorous tool for setting minimum standards for forensic capability.

Comparison Table: Forensic Capabilities Across Schemes

Forensic Rung	Required Sample Length	Current Commercial Support	Key Limitation
Detection	Short (e.g., 50 tokens)	Yes (OpenAI, Google)	Only binary: machine or human
Attribution (user-level)	Medium (e.g., 200 tokens)	Limited	Requires longer text for reliable ID
Payload Extraction	Long (e.g., 500 tokens)	Rare	High sample length needed for hidden data
Localization (edit survival)	Variable	Experimental	Depends on edit type and scheme
Verdict	Scales with forensic depth	Inadequate for deep attribution	Industry must invest in multi-bit schemes

My thesis is that the information-theoretic framework from this paper exposes a fundamental flaw in the industry's approach to watermarking: we have built systems optimized for the easiest forensic task (detection) while promising accountability for the hardest (attribution). The paper proves that you cannot get attribution for free—it costs tokens. In the short term, this means that current detection-only watermarks will continue to be useful for flagging machine-generated content, but they will fail to provide the granular attribution that regulators and platforms demand. In the long term, companies like OpenAI and Google will need to invest in multi-bit watermarking schemes that embed more information per token, or accept that attribution will remain impractical for short texts. The losers are those who have oversold the forensic capabilities of their watermarks—any company claiming that their watermark can reliably identify individual users from a single paragraph is now contradicted by this framework. My concrete prediction is that within 18 months, at least one major AI company (likely OpenAI or Google) will announce a new watermarking scheme explicitly designed for attribution, citing this information-theoretic framework as the motivation.

OpenAI will announce a new multi-bit watermarking scheme for ChatGPT by December 2027, explicitly designed for user attribution.
The EU AI Office will require watermarking schemes to support at least attribution-level forensic capability for high-risk AI systems by 2028.
Google will acquire a startup specializing in information-theoretic watermarking within 24 months to close the gap with the framework's requirements.

July 2026
Paper published
arXiv paper 'Watermark Forensics for Generative Models: An Information-Theoretic Perspective' published.
2023-2025
Detection-only watermarks deployed
Major AI companies deploy detection-only watermarks (OpenAI, Google).
2026-2027
Industry recognition
Industry begins to recognize the limitations of detection-only watermarks for attribution.
2027-2028
Regulatory pressure
Regulatory pressure from EU AI Office drives adoption of more capable forensic schemes.

July 2026: arXiv paper "Watermark Forensics for Generative Models: An Information-Theoretic Perspective" published.
2023-2025: Major AI companies deploy detection-only watermarks (OpenAI, Google).
2026-2027: Industry begins to recognize the limitations of detection-only watermarks for attribution.
2027-2028: Regulatory pressure from EU AI Office drives adoption of more capable forensic schemes.

Required Sample Length for Forensic Rungs (estimated)

Insight 1: The forensic ladder is not just a taxonomy but a quantitative constraint—each rung costs a predictable number of tokens.
Insight 2: Current commercial watermarks are built for the easiest task, leaving a gap between industry promises and theoretical limits.
Insight 3: The information profile ν(t) provides a rigorous tool for comparing watermarking schemes, which has been missing from the field.
Insight 4: Attribution and payload extraction are not just harder than detection—they are fundamentally different problems with different data requirements.
Insight 5: The framework suggests that privacy-preserving watermarks (e.g., those with differential privacy) may inherently limit forensic capability, creating a tension between anonymity and accountability.