What is AI text watermarking?

How language models hide a statistical signal in the text they generate, why it survives some edits but not others, and how it differs from metadata-based provenance.

By didaiwritethis.ai

The idea in one paragraph

A text watermark is a statistical pattern that a language model weaves into its output while generating it. Nothing is appended to the text and nothing is hidden in the file — the watermark lives in which words were chosen. Read normally, the text looks unremarkable. Run through a detector holding the right key, it registers a pattern that random human writing would essentially never produce.

How the signal gets in

Language models generate one token at a time, and at each step there are many acceptable next tokens. "The meeting was productive" could continue with "and", "but", "though", "." — the model holds a probability distribution over all of them. That freedom of choice is the space a watermark hides in.

The best-known scheme, from Kirchenbauer and colleagues in 2023, works roughly like this:

1. Before choosing each token, a pseudorandom function seeded by a secret key (and by the preceding tokens) splits the vocabulary into a "green" list and a "red" list.
2. The model nudges its probabilities to slightly favour green-list tokens — enough to bias the outcome, not enough to force an odd word.
3. Repeat across hundreds of tokens and the finished text contains far more green-list words than chance would predict.

Detection reverses it. Holding the same key, a detector recomputes which tokens were green at each position, counts the hits, and asks a statistical question: how likely is this many green tokens if nobody was steering? For text of any length the answer becomes vanishingly small, which is what makes a positive result meaningful.

Google DeepMind's SynthID-Text, described in a 2024 Nature paper, takes a related approach using tournament sampling, and has been deployed on production Gemini traffic — evidence that watermarking can run at scale without visibly degrading output.

The central tension

Every watermarking scheme trades off three things that cannot all be maximised at once:

• Detectability — how short a passage can be while still carrying a readable signal.
• Quality — how much the bias distorts the model's natural output.
• Robustness — how much editing the signal survives.

Push detectability up and you either bias token choice harder, which costs quality, or you need longer text. This is why watermark detection is unreliable on short passages: a tweet simply does not contain enough token choices to carry a statistically distinguishable pattern. Most schemes need a few hundred words before they say anything confident.

What breaks a watermark

• Paraphrasing. Rewriting substantially replaces the token sequence, and the signal degrades with it. Running text through another model to reword it is an effective attack.
• Heavy editing. Light copy-editing usually leaves enough intact. Rewriting most sentences usually does not.
• Translation. Passing text through another language generally destroys the pattern.
• Mixing. A few watermarked paragraphs inside a longer human document may not register above the noise.
• Short length. Not an attack, just a limit — there is not enough signal in a sentence.

What a watermark is not

It is worth separating watermarking from two things it gets confused with.

It is not metadata. Provenance standards such as C2PA attach signed information about how a file was made. That is useful and complementary, but metadata is stripped the moment someone copies text out of a document. A statistical watermark travels with the words themselves, through copy and paste.

It is not a general AI detector. This is the distinction people most often collapse, and it matters. A watermark detector answers "does this text carry this specific model's signal?" It cannot answer "was this written by any AI?" Text from a model that does not watermark is invisible to it — not suspicious, simply invisible.

Reading a result honestly

The asymmetry between the two outcomes is the single most important thing to understand:

• Watermark found — strong evidence. The pattern is hard to produce by accident.
• No watermark found — weak evidence of almost nothing. It is consistent with human authorship, but equally consistent with a non-watermarking model, a watermarking model with the feature disabled, paraphrased output, or text too short to measure.

Treating a negative as proof of human authorship is the most common way to misuse one of these tools. See also whether conventional AI detectors work, which covers the style-based alternative and why its failure modes are worse.