Multilingual AI watermarking fails in translation
A sentence generated by an AI in English carries a hidden signature. Translate that same sentence into Swahili, and the signature is gone. The system still reports it as watermarked, with full confidence. That contradiction — a detector that answers confidently and wrongly — is the subject of a paper that quietly dismantles one of the more comforting stories about AI deception.
The Promise and the Crack
Watermarking is the technical answer to a deception problem. If AI-generated text can be invisibly tagged, then platforms, publishers, and readers can tell machine output from human output. The method works by nudging word choices during generation — small statistical biases that a detector can later recover. Multilingual watermarking extends this promise across languages, so that a model writing in Finnish or Bengali is as traceable as one writing in English.
The paper, submitted to arXiv in October 2025, tests that promise directly. Its finding is blunt: existing multilingual watermarking methods are not multilingual. They are English methods wearing a cosmopolitan label. Evaluated only on high-resource languages, they collapse under translation attacks in medium- and low-resource ones. The label promises universality; the behavior delivers it only in English.
Why the Signal Dies
The failure has a mechanical cause, and it is worth understanding because it explains why the problem is not a matter of tuning. Watermarking depends on the model’s tokenizer — the vocabulary it uses to break text into pieces. In English, that vocabulary is dense with full-word tokens. A watermark can hide in the choice between “happy” and “glad,” two complete units the detector knows how to look for.
In languages the tokenizer was never built to serve, full-word tokens are scarce. Words get chopped into fragments, and the statistical signal fragments with them. The paper calls this semantic clustering, and it is where the deception lives: the watermark is not weakened, it is dissolved. The detector, meanwhile, keeps operating as though nothing changed. It returns a verdict. The verdict is wrong.
The Fix That Admits the Problem
The authors propose STEAM, a detection method that accepts the failure rather than papering over it. Instead of trusting the watermarked text as it stands, STEAM translates the suspect passage back and forth across candidate languages, searching for the version that best restores the hidden signal. It uses Bayesian optimization to search among 126 languages, hunting for the back-translation that recovers the watermark’s strength.
The approach is deliberately agnostic. It works with any watermarking method, across different tokenizers, without modifying the original text, and it extends to new languages without retraining. The reported gains are an average of +0.23 AUC and +37 percentage points in TPR@1%. Those numbers matter less than what they represent: a scalable path toward watermarking that treats language diversity as a design constraint rather than an afterthought.
What the Gap Costs
Here is the ethical dimension that no amount of engineering resolves. A watermarking system that works in English and fails silently in Tigrinya does not merely underperform. It creates a two-tier reality. Speakers of well-resourced languages get verifiable provenance. Speakers of the rest get the appearance of it — a detector that says “watermarked” or “not watermarked” with the same confidence in both cases, and no way for the user to know which answer to trust.
The harm compounds because the failure is invisible from the outside. A journalist in Nairobi checking a suspicious message gets a result. Nothing in the interface warns that the underlying method was validated on English, French, and German. The system’s confidence is uniform across languages; its competence is not. That is the precise shape of AI deception — not a lie told, but a gap between claim and capability that the claimant never surfaces.
The Institutional Silence
What the paper exposes is not a bug awaiting a patch. It is an evaluation culture that treats high-resource languages as the default and everything else as an edge case. Benchmarks are built where the data is; the data is where the funding is; the funding follows the markets. The result is a class of tools that pass their tests and fail their users, and a research literature that reports success because it never looked where success was unlikely.
STEAM is a genuine contribution, and its authors are candid about the limits of what came before. But the deeper correction is institutional. Until multilingual claims are tested in the languages that make them hard, watermarking will keep offering a guarantee it cannot keep — and the people most likely to rely on that guarantee will be the ones least served by it.
Sources
1. arXiv 2510.18019 - Is Multilingual LLM Watermarking Truly Multilingual?