AI
Cross-lingual Summarization Breaks AI Text Watermarks More Effectively Than Paraphrasing
Researchers show that translating text to another language, then summarizing and translating back destroys watermark detection while preserving meaning—revealing a major gap in current AI-text provenance schemes.
Watermarks embedded in AI-generated text are meant to persist as a low-cost way to prove origin. Yet new research demonstrates a practical vulnerability: combining translation, summarization, and back-translation systematically strips these signals while keeping the text readable.
The Vulnerability#
The attack, called cross-lingual summarization (CLSA), works by routing text through multiple languages as a kind of semantic filter. By translating to a pivot language—such as Chinese—summarizing the result, and optionally translating back, the method compresses content in a way that destroys the statistical biases on which token-level watermarks rely. Unlike simpler paraphrasing attacks, which remain detectable or degrade text quality, this approach maintains semantic fidelity while breaking watermark detection.
Experimental Evidence#
Testing across four watermarking schemes (KGW, SIR, XSIR, and Unigram) and five languages (Amharic, Chinese, Hindi, Spanish, and Swahili), the researchers found that CLSA outperformed conventional paraphrasing attacks. For the XSIR scheme—which was explicitly designed to resist cross-lingual tampering—the watermark detection accuracy (AUROC) dropped from 0.827 under paraphrasing to 0.53 near random chance when CLSA was applied, all while preserving task usefulness on 300 held-out samples per language.
Implications for AI Provenance#
The findings highlight a critical blind spot in current watermarking approaches. Distributional methods that rely on subtle shifts in token likelihood alone cannot withstand attacks that force semantic compression across language boundaries. The researchers argue that robust provenance solutions must move beyond statistical watermarking and adopt stronger mechanisms—such as cryptographic approaches or model attestation—to remain viable for regulatory or authenticity purposes.
This work underscores why AI watermarking, despite its appeal as a lightweight tool, may not be sufficient for high-stakes provenance claims without additional safeguards.
