How-ToGuide
AI Text Watermarking Explained: What It Can and Cannot Prove
A watermark in AI-generated text is not a hidden word or an invisible character. It is a faint statistical pattern in which words were chosen, planted while the text is being generated and measurable later by anyone who holds the key. The idea is clever and the research is solid, but a watermark answers a narrower question than most people expect.
On this page
How a statistical watermark works
The best-known design comes from a 2023 paper by John Kirchenbauer and colleagues at the University of Maryland, published on arXiv. A language model writes one token at a time, where a token is a word or part of a word. Before each token is chosen, the scheme uses the previous token and a secret key to split the vocabulary at random into a green list and a red list. It then gives green tokens a small boost, so the model picks them a little more often than it otherwise would. A reader sees normal text. A checker who knows the key can recompute the lists and count the green tokens. Ordinary human writing lands on green about as often as chance predicts; watermarked text lands there noticeably more often.
The paper frames detection as a statistical test that gives a p-value, the probability of seeing that many green tokens by chance. That is its strength: the result comes with an interpretable error rate, and the authors report that the pattern can be detected from a relatively short span of tokens with little effect on text quality.
What a watermark test can and cannot prove
| Question | Can a watermark test answer it? | Why |
|---|---|---|
| Did this text come from a specific watermarked model? | Often, given enough text and the key | The green-token count is far above chance |
| Was this text written by a human? | No | A negative result only means no watermark from that key was found |
| Did any AI tool help write this? | No | Models without a watermark leave no such pattern |
| Is a short passage watermarked? | Weakly | Too few tokens for a confident test |
| Was the text heavily rewritten after generation? | Not directly | Editing lowers the count and the confidence |
| Did the writer break a rule? | No | That depends on the policy and on what was allowed |
Why editing weakens the signal
The watermark lives in the specific tokens that were chosen. Every time a person swaps a word, reorders a sentence or rewrites a paragraph, some green tokens are replaced by tokens that are green only by chance, and the count drifts back toward normal. A follow-up study by the same Maryland group, presented at a major machine learning conference in 2024, tested watermarked text after rewriting by people and by other models, and after mixing it into longer human writing. It found that these changes dilute the watermark but that it often remains detectable when there is enough text; after strong human paraphrasing, detection needed around 800 tokens on average at a very low false positive rate. Work by other University of Maryland researchers on whether AI text can be reliably detected at all argued that rewriting puts real limits on every detection method. The honest summary is that editing weakens a watermark gradually and that a longer text keeps more of it.
Where deployment stands
For most text in circulation today, there is no watermark that a member of the public can check. The Kirchenbauer scheme was published with open code, but a watermark only exists if the company running the model switches it on, and only the key holder can test for it reliably. In 2024 Google DeepMind researchers published a text watermarking scheme in Nature; the paper notes that watermarking had not been adopted in production systems because of strict quality and efficiency demands, and reports a live experiment on nearly 20 million responses from the company's chatbot that found no loss of quality. NIST's 2024 report on reducing risks from synthetic content reviews watermarking alongside provenance records and detection as complementary tools, none sufficient alone. Images are further ahead: many cameras and editors can attach signed provenance data, explained in the guide to signed Content Credentials for images.
Check a claim about watermarks
Ask whose watermark
A claim that text is watermarked should name the model or company and the key. Without the key there is no reliable test.
Ask how much text was tested
Short passages give weak results. Ask for the length and the reported false positive rate.
Separate watermarks from detectors
Many tools that talk about AI signals are score-based detectors, not watermark checks; how score-based AI detectors differ from watermark checks covers the difference.
Look at the writing record
For your own work, version history and notes remain the clearest evidence; the guide to show how you wrote a piece explains how to present them.
To see how watermarks fit alongside similarity reports, read plagiarism checkers compared with AI detectors. If you are cautious about sending drafts to online tools at all, see which AI tools send your text off the laptop, or start from the how-to hub.
Common questions
Is there an invisible watermark in all AI text?
No. Most text in circulation carries no watermark a public tool can check. A watermark exists only if the model's operator turned one on.
Can a watermark prove a human wrote something?
No. Finding no watermark only means no watermark from that key was found. The text could still come from a different model.
Does a watermark change how the text reads?
It is designed not to. The published research reports little or no measurable loss in quality.
Are text watermarks the same as metadata?
No. Metadata sits alongside a file and is easily removed. A text watermark is spread through the word choices themselves.
Sources
- arXiv: A Watermark for Large Language Models (Kirchenbauer et al., 2023): green-list token scheme and p-value detection.
- arXiv: On the Reliability of Watermarks for Large Language Models: paraphrasing dilutes but rarely erases a watermark in long text.
- Nature: Scalable watermarking for identifying large language model outputs: production-scale test and earlier lack of adoption.
- NIST: Reducing Risks Posed by Synthetic Content: watermarking reviewed alongside provenance and detection.