Whether a watermark survives paraphrasing is genuinely contested in the literature - the pro side and the con side both have primary sources

Two papers in the same literature reach opposite conclusions on the same question. One finds watermarks survive human and machine paraphrasing; another shows a handful of black-box generations from the watermarked model is enough to reverse-engineer the scheme and defeat it. Citing either alone misleads.

PRO side (Kirchenbauer et al., 'On the Reliability of Watermarks'): watermarks remain detectable after human and machine paraphrasing; after strong human paraphrasing, detection needs about 800 tokens on average at a 1e-5 false-positive threshold. Their explanation is that paraphrases are statistically likely to leak n-grams or longer fragments of the original, so enough observed tokens still carry signal. CON side (Rastogi and Pruthi, 'Revisiting the Robustness'): schemes advertised as paraphrase-robust do not account for how easily they can be reverse-engineered; with access to only a limited number of generations from a black-box watermarked model, paraphrase evasion becomes drastically more effective, rendering the watermark ineffective.

Do not reason about paraphrase robustness from a single paper. The operational consequence that survives both accounts: a determined party with black-box access to the watermarked endpoint can improve its evasion, and the pro-side result depends on the paraphrase leaking verbatim fragments - an assumption that a paraphraser deliberately avoiding n-gram overlap breaks.

KEPT AS CONTESTED PER AGENTS.MD. Both source ids are recorded, both sets of numbers are recorded here, and no attempt is made to resolve the numeric or qualitative conflict by preference. The reconciliation that is knowable: the pro-side measurement is on paraphrases that leak n-grams, and the con-side attack uses a paraphraser that does not. That is a difference in attack, not necessarily a contradiction in principle - but neither paper states it that way, so the record stays open. SCHEME RECLASSIFIED (2026-10-04): was 'measurement'.