AI Watermarks Fall Short as Courtroom Evidence Under Forensic Scrutiny
A new study from researchers Saifur Rahman Tamim and Amir Labib Khan delivers a damning verdict on AI watermarking as courtroom evidence. The paper evaluates three major LLM watermarking methods — KGW, Unigram, and SynthID-Text — against the Daubert admissibility criteria used by U.S. courts and the NIST digital forensic process. The motivation stems from a growing gap between policy and reality: governments like the EU and California mandate watermarking for AI-generated content, yet no one rigorously tests whether these watermarks hold up as reliable legal evidence.
The results paint a bleak picture. When subjected to simple meaning-preserving paraphrasing — a legally realistic attack that cannot easily be dismissed as tampering — every single KGW and Unigram watermarked text loses its marker entirely. SynthID performs only marginally better at a 98.3% removal rate. Even before any attack, the systems suffer staggering false-negative rates of 70 to 83%, meaning they routinely fail to detect AI content at all. SynthID also exhibits paradoxical behavior, flagging over 5% of human-written text as AI-generated and leaving 80% of its own pristine output stuck in an uncertainty zone.
The researchers introduce a Forensic Readiness Score framework with 12 criteria and a 60-point scoring system to assess reliability. Despite this structured approach, none of the three watermarking methods satisfy more than two of five Daubert factors required for legal admissibility. The authors concede that their scoring system itself struggles to capture the sheer forensic uselessness of the current technology. As lawmakers continue drafting regulations around watermark mandates, this research serves as a critical wake-up call that the underlying technology is nowhere near ready for the evidentiary bar courts demand.