How does AI text watermarking work?
Text has no pixels to hide a signal in, so AI text watermarking hides it in word choice: a secret key quietly favors some words over others, and a detector later measures the lean.
At every step where a language model picks its next token, a secret key pseudo-randomly splits the vocabulary into a favored green list and the rest (sometimes called the red list). The model is then nudged to prefer green-list words whenever a natural choice exists. No single sentence gives anything away — plenty of ordinary sentences happen to use green words. But across a few hundred words, genuinely watermarked text leans toward the green list far more than chance would explain, and a detector holding the same key can measure that lean.
See the lean a detector measures
The passage below was written with a toy watermark: at each step, a made-up key marked some word choices "green". Read it first — nothing looks unusual. Then reveal the green list.
The morning market opens early, and the first customers arrive before the stalls are even ready. Vendors stack crates of fresh produce, call out prices, and trade jokes with regulars they have known for years. By noon the square is full, and by evening only empty crates and swept cobblestones remain.
0 of 0 words sit on the green list — about 0%. If word choice were unbiased, you'd expect roughly half. That surplus, sustained over hundreds of words, is the watermark.
An illustration with a toy key — real systems split the vocabulary per-context with a secret key, so the green list changes at every step and can't be learned from examples.
Detection: counting the lean
A detector re-derives the green list for each position using the same secret key, counts how many of the text's tokens landed on it, and computes how unlikely that count would be for unwatermarked writing. The output is a confidence score, not a verdict: long, lightly-edited passages give strong signals; short or heavily edited ones don't. This is the approach behind the "green list" scheme introduced by Kirchenbauer et al. in 2023 and behind Google DeepMind's SynthID-Text, which is deployed on Gemini responses.
What weakens the watermark
Every edit that replaces a token replaces a data point. Substantial paraphrasing, translation to another language and back, or asking a different model to rewrite the passage all erode the lean until the detector loses confidence. So does brevity — a tweet-length text simply doesn't contain enough choices to measure. This is the tension every text watermark has to manage: strong enough bias to survive editing, weak enough to leave quality untouched.
There is also a structural limit: detection needs the provider's secret key. Google can check for Google's watermark, but no third-party tool can, and text from a provider that doesn't watermark at all — which today includes ChatGPT — carries no signal to find.
Why providers bother
Provenance and regulation. The EU AI Act requires generative AI output to be marked as artificially generated in a machine-readable way, and watermarking is one of the accepted techniques. Platforms also want a scalable way to label synthetic text for moderation and research — even an imperfect statistical mark beats none.
Should a tool exist that removes marks like this?
Cast your vote — we're measuring demandFrequently asked questions
Does ChatGPT watermark its text?
As of publication, OpenAI has described a text-watermarking method internally but has not deployed it in ChatGPT, citing concerns such as easy circumvention by paraphrasing and unfair effects on non-native English writers. Google has deployed SynthID-Text on Gemini output.
Can a reader see an AI text watermark?
No. Every individual sentence reads naturally, because the watermark only nudges the model between words that already fit. The signal exists only statistically, across a few hundred words.
Does paraphrasing remove a text watermark?
Substantial paraphrasing weakens it badly — every reworded token is a fresh draw the watermark never biased. Light editing usually leaves enough marked tokens; a full rewrite in your own words largely erases the signal.
Can AI text watermark detection prove a student cheated?
No — it's probabilistic. The detector reports how unlikely the observed lean would be by chance. Short passages, heavy edits, or translation cut confidence sharply, and checking requires the provider's secret key.
Is AI text watermarking required by law?
Regulation is moving that way: the EU AI Act requires machine-readable marking of AI-generated output. Watermarking is one accepted technique, though no specific method is mandated.