AI Watermarks: Text Signals, Files and Detection

An AI watermark is a signal deliberately added during generation. In text, it can be a statistical pattern in word choices; in files, watermarking and signed provenance work differently. None of these is the same as a generic AI detector score or an accidental zero-width character.

Table of Contents

• What an AI Watermark Actually Is
  • Watermarking versus provenance
• The Two Main Watermarking Families
• How Detectors Try to Read the Signal
  • The scoring pipeline
• Why Detection Breaks Down in Practice
• Rewriting and Cleaning as Countermeasures
  • Why the attack is structurally effective
• Policy Gaps and the Open-Model Problem
  • The coverage problem
• Practical Guidance for Writers and Compliance Teams
  • What a watermark can support
  • What should disqualify it as sole evidence
• A Clear-Eyed Takeaway on AI Watermarks

What an AI Watermark Actually Is

An AI watermark usually isn't a visible stamp, a signature, or a label attached to a document. In statistical text watermarking, the model changes how it samples words. At each step, it gives a subtle preference to some possible tokens, creating a pattern that a detector with the right key can test later.

A useful analogy is a loaded die. The die still produces ordinary-looking rolls, but its internal odds lean slightly toward selected outcomes. A watermark detector doesn't look for a sticker on the page. It checks whether the sequence of word choices contains an unusual statistical bias.

That distinction matters because the signal lives inside the wording. Change enough words, and you change the evidence the detector is measuring. Copying the text usually preserves the pattern. Paraphrasing, translation, synonym replacement, or substantial editing can disturb it.

Watermarking versus provenance

Provenance systems take a different route. A standard such as C2PA can attach signed information to an image or other file, recording where it came from and how it was handled. That record can help with accountability, but it can also disappear when someone strips metadata, screenshots the image, or converts the file.

Statistical text watermarks don't depend on an attached record. They're embedded in token selection, which makes them harder for casual users to notice but also makes them vulnerable to changes in the text itself. The technical guide to how AI text watermarks work describes this distinction in practical terms.

Core idea: A watermark can indicate that a particular generator probably influenced text. It doesn't automatically prove who wrote it, how much AI contributed, or that the current version is unchanged.

Every reliability claim follows from that hidden, probabilistic design. If the text is long enough, unmodified, and produced by a system whose detector you can access, the signal may be useful. Remove those conditions, and confidence can drop quickly.

The Two Main Watermarking Families

Watermarking methods fall into two broad families. One changes the choices made while producing the content. The other embeds information in the file or media representation, or attaches signed records to it.

Statistical token-choice systems belong to the first family. Methods such as KGW, approaches associated with Scott Aaronson and related research, and SynthID-Text bias token selection during generation. The detector later checks whether the text contains an unusually high share of tokens favored by the watermarking scheme. Google applies SynthID Text to Gemini output, Anthropic has documented a SynthID-style word-choice watermark for Claude, and OpenAI has announced textGrain for eligible ChatGPT and Codex text in the EU, with an opt-in for API customers. None of these relies on hidden code points.

Embedding and provenance systems belong to the second family. SynthID for images and audio embeds a signal in the media itself, while C2PA Content Credentials use signed provenance information associated with the asset. These methods don't depend on a detector understanding the model's vocabulary choices.

Property	Statistical Token-Choice, such as KGW and SynthID-Text	Embedding / Provenance, such as SynthID image and C2PA
Where the signal lives	In token choices during generation	In pixels, audio data, or attached provenance records
What detection needs	The relevant key, scoring method, and enough text	The embedded signal or signed credential
Main strength	Can survive ordinary copying and pasting	Can record source and handling information
Main weakness	Rewriting can weaken or erase the signal	Re-encoding, screenshots, or metadata stripping can remove or weaken it
Cross-system detection	Usually limited to the producing system	Depends on compatible standards and preserved credentials

Token-choice watermarking is tightly coupled to the generator. A detector built for one provider generally can't read another provider's watermark. Embedding methods are more independent of model internals, but an attached record or media signal can be lost during ordinary file handling.

For background on one vendor's approach, this third-party explainer on Claude text watermarking is a starting point. A watermark from one developer isn't a universal language shared by every detector. It is also unrelated to invisible Unicode characters picked up while copying, as explained in this guide to hidden Unicode versus statistical watermarks.

Plain text has no pixels or file container to carry an embedded signal, so text watermarking works by influencing word selection and then using statistical scoring to look for the resulting pattern.

How Detectors Try to Read the Signal

The KGW scheme is a useful worked example because it makes the pipeline concrete. The detector needs information that ordinary readers don't have, including the seeding rule and the secret key.

At each position, the system uses the preceding context and its secret rule to divide candidate tokens into two groups, commonly described as a green list and a red list. The generator slightly favors green-list candidates. The detector repeats the grouping process and counts how many tokens in the observed text belong to the favored group.

The scoring pipeline

1. Recover the context. The detector tokenizes the text and examines the preceding tokens at each position.
2. Recreate the partition. Using the secret key and seed logic, it rebuilds the relevant green and red lists.
3. Count favored tokens. It measures how often the text selected green-list tokens.
4. Compare with a baseline. A statistical test asks whether the count is unusually high for text without that watermark.
5. Apply a threshold. The detector returns a score, p-value, or classification based on a chosen cutoff.

A detector can return false positives and false negatives. A result depends on the model, passage, threshold and evaluation dataset, so keep source evidence and revision history alongside any score.

The threshold also changes the trade-off. A strict cutoff may reduce false accusations but miss more watermarked text. A looser cutoff may catch more candidate outputs while also flagging more unwatermarked writing.

A detector's headline accuracy is inseparable from its calibration data, model family, language, text length, and threshold.

Proprietary systems use variations on this logic, often with private keys and undisclosed calibration methods. That makes cross-vendor comparisons difficult. One detector's confidence score isn't automatically comparable with another's.

Why Detection Breaks Down in Practice

Watermark detection often looks strongest when the detector tests the same model, the same generation settings, and untouched outputs. Independent evaluations can paint a harsher picture. A 2026 preprint that tested open-source implementations of three schemes found that KGW detected only 9 of 30 pristine texts, so 21 were missed (arXiv study).

That result doesn't mean every KGW deployment will fail in the same way, and the SynthID-Text figures below come from the open-source MarkLLM implementation, not Google's production system. It does show why a detector score can't be treated as a universal forensic conclusion. Performance depends on implementation details, model behavior, text length, language, and the conditions under which the text was produced.

Measure (one 2026 preprint, open-source implementations)	KGW token watermark	SynthID-Text (MarkLLM implementation)
Missed on pristine watermarked texts	70% (21 of 30)	80% (24 of 30 fell in the uncertainty band)
Removal after paraphrasing	100% of detected watermarks reported removed	98.3% (58 of 59 detected texts)
False positives on paraphrased human text	Not reported in the cited result	5.4% (10 of 184)

Source for all table figures: arXiv 2607.16010. These are not measurements of Simple Unmark or of any provider's production detector.

Other studies reach different numbers. A 2025 robustness assessment of SynthID-Text found that detection held up considerably better under its paraphrasing settings, while still weakening under other attacks such as back-translation, and proposed a hybrid scheme to improve robustness. Compare each study's dataset, model, passage length and detector threshold before applying its findings to another workflow.

Shorter text gives the detector fewer token choices to measure. Mixed human and AI writing dilutes the signal. A translation or heavy edit changes the token sequence even when the meaning stays intact. Systems can also behave differently across languages, genres, and levels of formality.

The practical conclusion is simple: a watermark is a statistical bias, not a signature. A clean result doesn't prove human authorship, and a positive result doesn't prove that the named model wrote every sentence.

Rewriting and Cleaning as Countermeasures

A watermark survives copying because copying preserves the words. Rewriting acts on the signal at its source by changing those words. A competent paraphrase, synonym substitution, or round-trip translation can keep the meaning while reshuffling the token distribution the detector expects.

A practical cleaning workflow has two separate jobs:

• Text rewriting: Change enough wording to weaken the token-choice bias while preserving facts, names, numbers, tone, and intent.
• Unicode cleanup: Remove zero-width characters, stray direction controls and unusual spacing that can hide inside copied text, after checking whether the context needs them. Joiners and direction marks have legitimate uses in some scripts and emoji.

These are different problems. Statistical watermarking lives in word choice. Hidden Unicode artifacts live in the character layer. A regex or normalization pass can address the second problem, but it won't remove a token-choice watermark.

Why the attack is structurally effective

The detector doesn't know that a human editor intended to attack the watermark. It sees a changed sequence and recalculates the score. Once enough high-impact token choices have changed, the original statistical pattern may fall below the detector's threshold.

The Simple Unmark AI watermark remover, our product, follows this two-part workflow: it cleans hidden characters and rewrites phrasing with the aim of weakening statistical watermark patterns. We don't have access to providers' watermark detectors, so we can't measure how much signal remains after a clean, and it can't guarantee any detector result.

Meaning can remain stable while the statistical evidence changes substantially.

This is why watermarking is most useful against passive copying, not determined editing. A person who only pastes an output preserves more of the signal. A person who revises, translates, or regenerates the passage changes the evidence the detector relies on.

Policy Gaps and the Open-Model Problem

Regulation is moving toward machine-readable marking, but a mandate doesn't create a reliable technical signal by itself. The European Commission's Article 50 FAQ states that the transparency rules apply from 2 August 2026. For systems placed on the market before that date, the specific Article 50(2) marking and detection obligation has a transition until 2 December 2026. This is a scope-dependent obligation, not a rule that every existing AI output must already be marked. The watermarking overview provides broader background.

That milestone creates pressure for providers to ship marking systems. It doesn't solve the harder questions: whether the mark survives rewriting, whether independent detectors can verify it, whether languages receive comparable treatment, and what happens when a model doesn't participate.

The coverage problem

Closed providers can insert marks because they control the generation pipeline. Open-weight models can run outside that pipeline, so they may produce text without any provider-side watermark at all. A detector can't recover a signal that was never inserted.

The ecosystem therefore splits into two broad categories:

• Participating closed systems: They may provide a detectable mark, but the mark depends on the provider's detector, key, and implementation.
• Open or unmarked systems: They can produce text without a watermark, leaving detectors with no embedded provenance signal to inspect.

The same 2026 preprint discusses the EU AI Act and California's SB 942, arguing that both assume watermark evidence is reliable enough for legal use without validating it against forensic standards.

For compliance teams, this makes data provenance more important than a single detector result. A practical overview of trustworthy data origins for compliance helps frame the broader requirement: organizations need records about source, handling, and review, not just a probabilistic label attached to final text.

Practical Guidance for Writers and Compliance Teams

Treat an AI watermark as one input in a review process, not a verdict. It can support a provenance claim when the producing platform, detector, and document history are all known. It can't reliably establish authorship after substantial editing or across unrelated systems.

What a watermark can support

• Closed-platform provenance: If Gemini produced the text and Google's detector can check it, a watermarked result may support a limited claim about platform involvement. Detector access is restricted for most providers, so this usually isn't something an individual reviewer can run.
• Internal audit trails: A known model version, saved prompt, timestamp, and preserved original output give a stronger record than a detector score alone.
• Corroboration: Combine detection with disclosure statements, revision history, writing-style baselines, and human review.

What should disqualify it as sole evidence

• Paraphrased or translated writing: The statistical pattern may have been weakened or removed.
• Mixed human and AI drafts: A clean section doesn't establish that the entire document was human-written.
• Open-model output: No provider watermark may have been inserted.
• High-stakes decisions: Don't use a detector score alone for employment, grading, disciplinary action, or legal liability.

Use a written decision rule. For example, refuse to treat a result as decisive when detector confidence is below 0.7, when the text has passed through paraphrasing, or when an authorship claim lacks a signed provenance record. That 0.7 cutoff is a governance choice, not a universal scientific standard.

A layered workflow is slower than pressing a detection button, but it matches the evidence. Preserve originals, record the producing system when known, ask for disclosure, compare drafts, and send disputed cases to a human reviewer.

A Clear-Eyed Takeaway on AI Watermarks

AI watermarks are useful infrastructure in cooperative settings. They're not lie detectors.

Statistical methods such as KGW and SynthID-Text depend on token choices that remain sufficiently faithful to the original output, and independent testing has shown how quickly that assumption can fail. Embedding systems can preserve a signal more independently of model vocabulary, but they still depend on the producing platform, compatible verification, and an intact media or provenance record.

The most defensible claim is narrow: a valid watermark may show that a participating system probably influenced an unmodified piece of content. It doesn't prove that the system wrote the entire passage, that a person didn't edit it, or that an unmarked passage came from a human.

Keep three points in mind:

1. Detectability depends on length and token fidelity. A longer, untouched output gives a statistical detector more evidence. Rewriting removes evidence.
2. Provenance beats detection for accountability. Prompts, model records, signed credentials, revision history, and disclosure provide context that a score can't.
3. Policy will shape standards. The EU AI Act's marking requirement, applying from August 2026, pushes providers toward machine-readable marking, but adoption and enforcement involve more than any single algorithm (policy timeline).