The Invisible Watermark: A Pilot Study on the Verifiability Gap in AI Text Watermarking

Article 50 of the EU AI Act requires generative AI providers to mark synthetic content in a detectable format. This obligation is carried out through a mechanism invisible to end users. The resulting gap leaves accountability around disinformation, copyright infringement, and public trust largely unaddressed. This paper reports a pilot study that probes this transparency–verifiability gap through a comparative document analysis of five major providers (Anthropic, OpenAI, Google, Meta, xAI) combined with a small-scale empirical robustness pilot of the open-source SynthID-Text method on GPT-2. The document analysis shows that regulatory disclosure does not equate to an independently verifiable detection mechanism for third parties. In this pilot experiment, watermarked texts scored significantly higher than unwatermarked texts (t(38) = 15.94, p < 0.001, Cohen’s d = 5.04, ROC-AUC = 1.000; Youden’s J-optimal threshold = 0.533, yielding 100% sensitivity and 100% specificity on this intact (uncorrupted) sample; the design was adequately powered (80%) only for effects of d ≥ 0.91 or larger, A calibration/test-separated validation on independent held-out data (n = 320) confirmed this discrimination within the pilot setup (TPR at FPR ≤ 1% = 98.75%), without implying generalization beyond it. This signal, measured with an untrained detector, degraded substantially under a deliberately engineered high-severity stress test (50% word-level corruption), a decline confirmed by Holm-corrected pairwise comparisons across nine of the ten corruption-level pairs (F(4, 56) = 98.39, p < 0.001, generalized η2 = 0.744, r = −0.824). These are preliminary, pilot-scale findings; they indicate that Article 50 guidance should require standardized error-rate reporting and independently auditable detection access, not disclosure alone. They offer an exploratory contribution to the AI ethics literature on transparency and accountability. Given the small open-source backbones (GPT-2, with a replication on Pythia-410M), the primarily untrained detector (a small-scale trained Bayesian detector did not outperform it on intact text), the single watermarking scheme, and the largely synthetic corruption type (only one model-based paraphrase condition was tested), these results remain preliminary, pilot-scale evidence whose generalization to commercial systems, large-scale trained detectors, other watermarking families, and a broader range of realistic paraphrase and translation attacks requires future research.