Who Gets Flagged? The Pluralistic Evaluation Gap in AI Content Watermarking

1. Problem Statement

The paper addresses a critical, overlooked vulnerability in the deployment of AI content watermarking: systematic bias based on content properties.

• Context: Watermarking is becoming the default infrastructure for AI content authentication, mandated by major governance frameworks (EU AI Act, US Executive Order 14110, China's labeling measures).
• The Core Issue: Watermark signal strength, detectability, and robustness are not uniform; they depend heavily on the statistical properties of the content itself (e.g., token entropy in text, frequency distributions in images/audio).
• The Gap: These properties vary systematically across languages, cultural visual traditions, and demographic groups. However, current evaluation benchmarks assume a "monocultural" uniformity. Consequently, watermarking systems may produce biased authentication, disproportionately flagging content from non-native speakers, non-Western cultures, or specific demographic groups as AI-generated (false positives) or failing to detect AI content in other groups (false negatives).
• The Paradox: While generative AI models are subject to rigorous bias auditing, the verification layer (watermarking) is held to a lower standard, despite being the gatekeeper for content provenance.

2. Methodology

The authors employ a multi-faceted approach combining literature review, technical analysis of embedding mechanisms, and benchmark auditing:

• Mechanism Analysis: The paper deconstructs how watermarking works across three modalities (Text, Image, Audio) to identify where content dependence creates bias:
  • Text: Analyzes how token sampling and entropy affect signal embedding.
  • Image: Examines frequency-domain encoding and its reliance on perceptual quality metrics.
  • Audio: Investigates frequency-domain embedding relative to acoustic properties (pitch, prosody).
• Benchmark Audit: The authors reviewed major existing watermarking benchmarks (e.g., MarkMyWords, WaterBench, WAVES, AudioMarkBench) to assess their evaluation dimensions. They specifically looked for:
  • Cross-lingual/cross-cultural testing.
  • Demographic disaggregation of results.
  • Discussion of bias.
• Evidence Synthesis: They synthesized existing empirical studies (e.g., Xie et al., He et al.) that demonstrate disparate impacts, contrasting them with the lack of such reporting in standard benchmarks.

3. Key Contributions

The paper makes three primary contributions to the field of AI safety and governance:

1. Identification of the "Pluralistic Evaluation Gap": The authors document that, with one exception, no major watermarking benchmark currently reports performance across languages, cultural content types, or demographic groups.
2. Technical Pathways to Bias: They provide a technical explanation of how bias arises in each modality:
   • Text: Non-native English speakers generate text with different token distributions and higher entropy, leading to stronger watermark signals and higher false positive rates. Tokenizers trained on English fragment non-Latin scripts, altering detection statistics.
   • Images: Perceptual quality metrics are biased toward Western (ImageNet-style) distributions. Non-Western visual traditions (calligraphy, textiles) and non-Western platform compression pipelines (e.g., WeChat) are untested, risking invisible failures.
   • Audio: Tonal languages (e.g., Mandarin, Yoruba) have different spectral profiles than English. Frequency-domain watermarks may interact unpredictably with these profiles, yet benchmarks rarely test beyond English.
3. Proposal of a Pluralistic Evaluation Framework: The authors propose three concrete dimensions that must be mandatory for any watermark benchmark:
   • Cross-lingual Detection Parity: Testing across diverse scripts and languages, not just English.
   • Culturally Diverse Content Coverage: Including non-Western visual traditions and non-studio audio environments.
   • Demographic Disaggregation: Reporting False Positive Rates (FPR) and False Negative Rates (FNR) stratified by population groups (e.g., native vs. non-native speakers, sex, age).

4. Results and Findings

• Benchmark Audit Results: Table 1 in the paper reveals that out of the major benchmarks reviewed, only one (AudioMarkBench) includes multilingual testing and demographic stratification. All others (MarkMyWords, WaterBench, WAVES, etc.) fail to report on these dimensions.
• Empirical Evidence of Bias:
  • Text: Studies show non-native English speakers have significantly higher false positive rates because AI systems modify their text more extensively, creating stronger watermark signals. Translation of watermarked text can reduce detection to chance levels.
  • Images: While no direct study exists yet, the authors argue that bias is structurally inevitable because the training data (ImageNet) and evaluation metrics are Western-centric.
  • Audio: AudioMarkBench found that female speech had higher false positive rates for forgery than male speech under certain perturbations. Tonal languages showed anomalous false negative rates.
• Policy Asymmetry: The authors found a stark regulatory asymmetry: The EU AI Act requires bias audits for generative models but explicitly exempts watermarking systems from equivalent scrutiny, creating a scenario where a "fair" model could be paired with a "biased" verifier.

5. Significance and Implications

• Governance and Fairness: The paper argues that watermarking cannot be considered "neutral infrastructure." If the verification layer is biased, it undermines the entire goal of AI content provenance, potentially leading to the censorship or mislabeling of content from marginalized groups.
• Regulatory Reform: The authors call for extending existing audit requirements to watermarking. They propose that regulators (EU, US, China) should mandate:
  • Inclusion of watermark detection parity in conformity assessments.
  • Disaggregated reporting of FPR/FNR by language and demographic.
  • Robustness testing against global compression codecs and pipelines, not just Western defaults.
• Shift in Research Priority: The paper emphasizes that the technical capability to test for these disparities exists (as proven by AudioMarkBench). The barrier is not resource or capability, but priority. The field must shift from optimizing solely for robustness and quality to optimizing for pluralistic fairness.

Conclusion: The paper concludes that evaluation must precede deployment. To ensure equitable AI governance, the verification layer must be held to the same bias-auditing standards as the generative models it is designed to govern.