Watermarks in AI text

A detector reads finished text. From how it reads, it guesses whether a model wrote it, and the paraphrasing study below tested several of these detectors by name. Nothing was put in the text on purpose.

A watermark goes in on purpose, while the model writes. It’s a pattern in which words were picked, keyed to a secret, that a checker can count later. The first well-known scheme is from Kirchenbauer and colleagues. Scott Aaronson described a keyed version from his time at OpenAI.

Provenance metadata is a third thing: a signed label attached to the file, not hidden in the words. Its standard is C2PA.

A detector guesses. A watermark counts. A label vouches, until someone strips it.

Before each word, the scheme hashes the previous word and seeds a random split of the whole vocabulary with the result. A fraction γ of the words is green, the rest red. Then every green word’s score gets a small bonus δ before the model picks.

Where many words would do, the bonus tips the choice green, and where one word is nearly certain, it barely moves it. That’s the whole reason watermarks need choice. The figure below lets you see it.

To check, the detector redoes the hashes and counts the green words, then asks how surprising that count is for a writer who didn’t know the lists. That’s a z-score, z = (green − γT) / √(Tγ(1−γ)) for T words. At z above 4, unwatermarked text sets off a false alarm about 3 in 100,000 times.

In the paper’s own example, 9 green words were expected and 28 showed up. It says watermarked text can be found from “as few as 25 tokens”, with no access to the model, only the hash rule or the key. At z = 4 it reports about 98% of 200-token outputs caught. That’s its measurement on one small model (OPT-1.3B), not a general rate.

Since the score doesn’t depend on δ, δ can change with the kind of text. The checker stays the same.

If the model was nearly forced to write it, the text carries almost no signal. The paper uses the quick brown fox and a C for-loop: people and models finish both the same way, and forcing a change hurts quality. The failures it shows are mostly low-entropy, often memorised text.

Code is the hard case. Change one token and a program can break, but a mark that’s too weak goes unseen. One fix, called SWEET, applies the rule only where a token has enough entropy, when writing and again when checking.

Nobody can mark a list with one right answer. Aaronson’s example is the first 200 primes. OpenAI says the same about the first 1,000 primes for its own classifier.

Google says its method is less effective on factual responses. It also says larger models and RLHF can lower entropy.

Repetition can fool the counter too: a phrase repeated in human text can inflate the green count. So the checker skips repeated word groups.

Short text is its own problem. The EU’s voluntary Code of Practice, published in 2026, treats text under 200 tokens as too short to watermark reliably. It expects that to improve.

The green list is a bias. It really does change the model’s odds, and a second family of schemes doesn’t touch them at all. Aaronson’s rule gives each candidate word a keyed number r between 0 and 1 and picks the word with the largest r raised to the power 1/p, p being the model’s own probability for that word.

If you can’t see the key, each word still comes up exactly as often as p says, and he says “you can actually get watermarking with zero degradation of the model output quality”. To check, add up log(1/(1−r)) over the text. On watermarked text, it runs high.

Kuditipudi and colleagues swap the hash for a long key sequence and keep the same rule. Detection aligns the text to the key, and that survives edits. They report detection from 35 tokens with 40 to 50% of tokens corrupted, on OPT-1.3B and LLaMA-7B. On an instruction-tuned model they report only about a quarter of answers detectable, because of lower entropy.

Christ, Gunn and Zamir turn it into a cryptographic statement. Without the key, no efficient test can tell watermarked output from the original, even with many queries, and text written without the key is almost never flagged. The result assumes one-way functions exist. It needs enough empirical entropy in the stretch checked.

The catch is plain. Hash the recent words and the same context gives the same choice: ask twice, get the same answer. Google says its version accepts some reduction in the variety of responses for the same reason. And distortion-free is about the odds, not robustness: paraphrase and translation still hurt.

Google’s scheme, SynthID-Text, runs a tournament. It draws 2 to the power m candidate words from the model, pairs them off and keeps whichever scores higher under a keyed 0-or-1 function, then repeats with the next function until one word is left. The seed is a hash of the last four tokens plus the key. To check, it averages those scores over the text.

Google says that with two competitors per match, the odds for a single word are unchanged. Add more competitors and the mark gets stronger, but it does distort them.

Google also ran a live test on nearly 20 million Gemini responses, some watermarked and some not. The thumbs-up and thumbs-down rates differed by 0.01% and 0.02%, and Google calls both differences not statistically significant. It measured quality. It didn’t measure whether the mark survives a rewrite.

Google said in its Nature paper of October 2024 that it was watermarking responses in Gemini and Gemini Advanced. Google’s SynthID page, which I read on 2026-11-03, says text from the Gemini app and web experience is watermarked. Those are Google’s statements. I haven’t checked them independently.

Google’s page for the SynthID Detector portal lists images, video and audio files. I found no claim there that the portal reads writing.

Google said in October 2024 that it was releasing the method to developers through Hugging Face. Each key setup needs its own trained detector. And Google says the configuration has to stay private, or the mark can be copied.

Google lists its own limits. The provider has to cooperate, and open models are hard to enforce. The method is weaker on factual prompts and after thorough rewriting or translation, and it’s open to stealing, spoofing and scrubbing. Google writes that watermarks “do not offer a complete solution to artificial-intelligence text detection”.

OpenAI’s position is different. In an update of August 2024 OpenAI said it had built a text watermarking method and was still considering it, that the mark held up against local tampering such as paraphrasing but was easy to get round with translation, rewording by another model, or inserting a special character between every word and deleting it, and that the method could stigmatise AI as a writing tool for non-native English speakers. That’s all I know of its position, as of that post. I say nothing about what it does now.

Researchers ran watermarked text through DIPPER, an 11-billion-parameter paraphraser. At a 1% false-positive rate, detection fell from 100% to 57.2%, and watermarking was still the most resilient detector they tested. The paraphraser has to be a different model, or the paraphrase comes out watermarked too.

Another group kept paraphrasing. One pass took detection from 99.8% to 80.7% with DIPPER, or to 54.6% with a smaller chat model, and five passes took it below 20%. With query access to the detector, it fell to 4%.

Translation does more damage. A round trip through Russian beat every scheme the authors tried but one. They note they didn’t check that the meaning survived.

Google says translation weakens its mark. OpenAI says so too, and describes one more trick: insert a special character between every word, then delete it. The first paper had the same idea, an emoji after every word, and called it the strongest attack it knew of.

Normalising the text first takes care of look-alike letters and zero-width characters. Pasting watermarked passages into human writing is harder to catch than paraphrasing.

Length fights back. The first paper’s group ran a second study: paraphrased text that looked clean at 200 to 300 tokens showed the mark again by 600 tokens. Graduate students asked to remove it were caught after 800 tokens on average. The authors write that “even human writers cannot reliably remove watermarks if being measured at 1000 words”.

One limit can’t be fixed with length. Christ and colleagues prove that “no undetectable watermarking scheme can be completely unremovable”. Their attack is expensive, and it assumes the user can specify a response prefix.

The less obvious risk runs the other way: human text made to look watermarked. Watch enough output and you can estimate the green lists. Researchers learned them for 181 common words from one million queries. A person then wrote text the checker flagged, and the detection score (AUROC) fell from 99.8% to 1.3%.

Watermark stealing does this automatically. In that paper’s tests, forging and removal both succeeded over 80% of the time on average, for a modest one-time cost in queries. And forged text incriminates whoever owns the watermarked model.

The first paper had already warned that with a one-token hash the lists could be learned with conceivable effort. The stealing paper suggests that schemes which leave the odds unchanged may resist stealing better. That’s a suggestion, not a finding.

OpenAI says its own classifier labelled 26% of AI-written text as likely AI-written and wrongly labelled 9% of human text as AI on its test set, and that it was very unreliable under 1,000 characters and unreliable on code. It withdrew the tool on 20 July 2023. Its note says it was “no longer available due to its low rate of accuracy”.

A preprint tested seven detectors on 91 essays by non-native English writers, and they flagged more than half as AI-written: an average false-positive rate of 61%. On US 8th-grade essays, they were near perfect.

Paraphrasing took DetectGPT from 70.3% to 4.6% at a 1% false-positive rate.

A theoretical result says that as model text gets closer to human text, even the best possible detector approaches a coin flip. The same paper has a caveat, though. For a watermarked model, it says, the bound can be near one. Krishna and colleagues dispute how far that result reaches, because retrieval doesn’t depend on how human the text reads.

The alternative is retrieval. The provider keeps every output and searches it, and in one study that found 80% to 97% of paraphrases at a 1% false-positive rate over 15 million generations. Aaronson names the cost to privacy.

OpenAI says a low false-positive rate, applied to huge volumes, still adds up to many false positives. Figure 4 does that arithmetic for a watermark, where the rate is a formula. A detector without one has no such formula. OpenAI’s reported 9% is an empirical rate on one test set.

Article 50(2) of the EU AI Act covers providers of systems that generate text, and leaves out assistive editing functions. As far as is technically feasible, outputs must be “marked in a machine-readable format and detectable as artificially generated or manipulated”. Recital 133 lists possible techniques: watermarks, metadata, cryptographic provenance, logging and fingerprints, or a combination.

The Act applies from 2 August 2026. For systems already on the market before then, the Commission’s FAQ (last updated 24 July 2026) says the marking obligation applies “only as from 2 December 2026”.

The Code of Practice is voluntary, and its final text came out in 2026. It says text can’t carry metadata, so one layer of marking is enough, but text over 200 tokens must still be watermarked “even though it may have lower reliability”. Detector access for free-form text may be limited to verified experts such as regulators, fact-checkers and researchers. Logging or fingerprinting alone isn’t enough.

The US voluntary commitments of July 2023 are another matter. Their watermark promise covers audio or visual content. Text isn’t in it. The White House fact sheet words it more loosely, as content, so I go by the commitments document.

C2PA is a signed record attached to content, saying who made it and what was done to it. Since version 2.3, from December 2025, it can ride inside plain text as invisible Unicode characters. Copy part of the text, though, and it breaks. Metadata can be stripped, so C2PA pairs it with watermarks or fingerprints, and the explainer says “provenance information alone cannot tell you whether the digital content is true”.

In OpenAI’s August 2024 note, the trade-off goes like this. Signed metadata has no false positives. It just isn’t a mark in the words.

A label is easy to check, and as easy to remove. A watermark is hard to remove, and only ever probable.

Watermarking only finds text from providers that chose to watermark, with keys the checker can use. Google says open models are hard to enforce. And the checker has to trust the provider to have applied it.

Most numbers here come from small or older models. The first paper used OPT-1.3B, the attack papers GPT2-XL and OPT-13B. Only Google reports a production test, and it measured quality, not robustness.

The robustness studies disagree because they measure different things: Kirchenbauer’s group says length rescues the mark, and Sadasivan’s says recursive paraphrasing beats it at about 300 tokens. Both can be true. Figure 2 shows the length axis and doesn’t pick a winner.

The cleanest claims are cryptographic and conditional: one-way functions, enough empirical entropy, contiguous text.

Google’s deployment claims and OpenAI’s description of a method it was still considering come from the companies themselves. I haven’t seen anyone else verify either. I didn’t read Google’s supplementary robustness results, so I use none of them.

The Commission’s FAQ and the Code of Practice date from 2026, and they may change. For the Act, I cite the 2024 regulation as published.

Everything in the figures is invented, every word, sentence and number, and each caption says so. The toy models don’t reproduce any paper’s results. Reported numbers appear only in the cited paragraphs.

My viewWatermarking is the only method here where I know the false-alarm rate before I run it. When a wrong answer means accusing a person, that’s worth a lot.

My viewIt isn’t a lie detector for text. If nobody worked hard to wash it out, it’s a receipt that one provider’s model wrote this stretch.

My viewI wouldn’t let a detector without a watermark decide anything about a person. Even the company that built one retired it.

My viewA signed label and a watermark answer different questions, so I’d want both. And I’d still read the words. A receipt, not a polygraph.