AI Watermark Explained: How Detection Works and Fails

An AI watermark can fail even when the original text was watermarked correctly. In one independent evaluation, the KGW method detected only 9 of 30 pristine texts, producing a 70% false-negative rate with a Wilson 95% confidence interval of 52.1% to 83.3% (arXiv evaluation). That's not a solved detection system. It's a probabilistic signal that works under specific conditions, then weakens when those conditions change.

Table of Contents

• What an AI Watermark Actually Is
  • Watermarking versus provenance
• The Two Main Watermarking Families
• How Detectors Try to Read the Signal
  • The scoring pipeline
• Why Detection Breaks Down in Practice
• Rewriting and Cleaning as Countermeasures
  • Why the attack is structurally effective
• Policy Gaps and the Open-Model Problem
  • The coverage problem
• Practical Guidance for Writers and Compliance Teams
  • What a watermark can support
  • What should disqualify it as sole evidence
• A Clear-Eyed Takeaway on AI Watermarks

What an AI Watermark Actually Is

An AI watermark usually isn't a visible stamp, a signature, or a label attached to a document. In statistical text watermarking, the model changes how it samples words. At each step, it gives a subtle preference to some possible tokens, creating a pattern that a detector with the right key can test later.

A useful analogy is a loaded die. The die still produces ordinary-looking rolls, but its internal odds lean slightly toward selected outcomes. A watermark detector doesn't look for a sticker on the page. It checks whether the sequence of word choices contains an unusual statistical bias.

That distinction matters because the signal lives inside the wording. Change enough words, and you change the evidence the detector is measuring. Copying the text usually preserves the pattern. Paraphrasing, translation, synonym replacement, or substantial editing can disturb it.

Watermarking versus provenance

Provenance systems take a different route. A standard such as C2PA can attach signed information around an image or other file, recording where it came from and how it was handled. That wrapper can help with accountability, but it can also disappear when someone strips metadata, screenshots the image, or converts the file.

Statistical text watermarks don't depend on a visible wrapper. They're embedded in token selection, which makes them harder for casual users to notice but also makes them vulnerable to changes in the text itself. The technical guide to how AI text watermarks work describes this distinction in practical terms.

Core idea: A watermark can indicate that a particular generator probably influenced text. It doesn't automatically prove who wrote it, how much AI contributed, or that the current version is unchanged.

Every reliability claim follows from that hidden, probabilistic design. If the text is long enough, unmodified, and produced by a system whose detector you can access, the signal may be useful. Remove those conditions, and confidence can drop quickly.

The Two Main Watermarking Families

Think of watermarking as choosing between two ways to mark a message. One method changes the choices made while producing the message. The other embeds information in the file or media representation.

Statistical token-choice systems belong to the first family. Methods such as KGW, approaches associated with Scott Aaronson and related research, and SynthID-Text bias token selection during generation. The detector later checks whether the text contains an unusually high share of tokens favored by the watermarking scheme.

Embedding and provenance systems belong to the second family. SynthID for images and audio embeds a signal in the media itself, while Adobe's C2PA Content Credentials use signed provenance information associated with the asset. These methods don't depend on a detector understanding the model's vocabulary choices.

Property	Statistical Token-Choice, such as KGW and SynthID-Text	Embedding / Provenance, such as SynthID image and C2PA
Where the signal lives	In token choices during generation	In pixels, audio data, or attached provenance records
What detection needs	The relevant key, scoring method, and enough text	The embedded signal or signed credential
Main strength	Can survive ordinary copying and pasting	Can record source and handling information
Main weakness	Rewriting can weaken or erase the signal	Re-encoding, screenshots, or metadata stripping can remove it
Cross-system detection	Usually limited to the producing system	Depends on compatible standards and preserved credentials

Token-choice watermarking is tightly coupled to the generator. A detector built for one provider generally can't read another provider's watermark. Embedding methods are more independent of model internals, but their external wrapper or media signal can be removed during ordinary file handling.

For a focused explanation of one vendor-specific approach, Claude text watermarking explained offers useful background. The important caution is that a watermark from one developer isn't a universal language shared by every detector. The same limitation applies when comparing visible Unicode artifacts with statistical marks, as explained in this guide to hidden Unicode versus statistical watermarks.

No production text system currently ships an embedding-style watermark in the same straightforward sense as a pixel or audio watermark. Text systems generally work by influencing word selection, then using statistical scoring to look for the resulting pattern.

How Detectors Try to Read the Signal

The KGW scheme is a useful worked example because it makes the pipeline concrete. The detector needs information that ordinary readers don't have, including the server-side random seed logic and secret key.

At each position, the system uses the preceding context and its secret rule to divide candidate tokens into two groups, commonly described as a green list and a red list. The generator slightly favors green-list candidates. The detector repeats the grouping process and counts how many tokens in the observed text belong to the favored group.

The scoring pipeline

1. Recover the context. The detector tokenizes the text and examines the preceding tokens at each position.
2. Recreate the partition. Using the secret key and seed logic, it rebuilds the relevant green and red lists.
3. Count favored tokens. It measures how often the text selected green-list tokens.
4. Compare with a baseline. A statistical test asks whether the count is unusually high for text without that watermark.
5. Apply a threshold. The detector returns a score, p-value, or classification based on a chosen cutoff.

A z-score measures how far an observation sits from an expected baseline. A p-value describes how compatible the observation is with that baseline under the test's assumptions. Neither is a percentage saying “this text is 93% AI.” A binary verdict is a policy choice applied to a statistical result, not a direct reading of authorship.

The threshold also changes the trade-off. A strict cutoff may reduce false accusations but miss more watermarked text. A looser cutoff may catch more candidate outputs while also flagging more unwatermarked writing.

A detector's headline accuracy is inseparable from its calibration data, model family, language, text length, and threshold.

Proprietary systems use variations on this logic, often with private keys and undisclosed calibration methods. That makes cross-vendor comparisons difficult. One detector's confidence score isn't automatically comparable with another's.

Why Detection Breaks Down in Practice

Watermark detection often looks strongest when the detector tests the same model, the same generation settings, and untouched outputs. Independent evaluations create a harsher picture. The KGW method detected only 9 of 30 pristine texts, which means 21 of those 30 texts were missed in that evaluation (arXiv study).

That result doesn't mean every KGW deployment will fail in the same way. It does show why a detector score can't be treated as a universal forensic conclusion. The method's performance depends on implementation details, model behavior, text length, language, and the conditions under which the text was produced.

Attack	KGW token watermark	SynthID-text, Google DeepMind
False negatives on pristine texts	70% in one independent evaluation (arXiv)	Not established by that evaluation
Removal after paraphrasing	100% of initially detected watermarks removed in one study (arXiv)	98.3% removal after paraphrase in the same study (arXiv)
False positives on paraphrased human text	Not reported in the cited result	5.4% in the study (arXiv)
Uncertainty on pristine watermarked outputs	Not reported in the cited result	80% in the study (arXiv)

The paraphrase result is particularly important. In that evaluation, every initially detected KGW and Unigram watermark was removed after paraphrasing, while SynthID remained detectable only 1.7% of the time, equivalent to 98.3% removal (arXiv study).

Shorter text gives the detector fewer token choices to measure. Mixed human and AI writing dilutes the signal. A translation or heavy edit changes the token sequence even when the meaning stays intact. Systems can also behave differently across languages, genres, and levels of formality.

The practical conclusion is uncomfortable but simple: a watermark is a statistical bias, not a signature. A clean result doesn't prove human authorship, and a positive result doesn't prove that the named model wrote every sentence.

Rewriting and Cleaning as Countermeasures

A watermark survives copying because copying preserves the words. Rewriting attacks the signal at its source by changing those words. A competent paraphrase, synonym substitution, or round-trip translation can keep the meaning while reshuffling the token distribution the detector expects.

A practical cleaning workflow has two separate jobs:

• Text rewriting: Replace enough wording at relevant positions to reduce the green-list bias while preserving facts, names, numbers, tone, and intent.
• Unicode cleanup: Remove zero-width characters, direction controls, homoglyphs, and unusual spacing that can hide inside copied text.

These are different problems. Statistical watermarking lives in word choice. Hidden Unicode artifacts live in the character layer. A regex or normalization pass can address the second problem, but it won't reliably remove a token-choice watermark.

Why the attack is structurally effective

The detector doesn't know that a human editor intended to attack the watermark. It sees a changed sequence and recalculates the score. Once enough high-impact token choices have changed, the original statistical pattern may fall below the detector's threshold.

The Simple Unmark AI watermark remover illustrates this two-part workflow by cleaning hidden characters and rewriting phrasing to reduce statistical watermark patterns. That's an example of the mechanism, not a guarantee that every detector will return a particular result.

Meaning can remain stable while the statistical evidence changes completely.

This is why watermarking is most useful against passive copying, not determined editing. A person who only pastes an output preserves more of the signal. A person who revises, translates, or regenerates the passage changes the evidence the detector relies on.

Policy Gaps and the Open-Model Problem

Regulation is moving toward machine-readable marking, but a mandate doesn't create a reliable technical signal by itself. Under the EU AI Act, Article 50 requirements for machine-readable marking began applying on 2 August 2026, a major policy milestone for AI watermarking (timeline and policy context).

That deadline creates pressure for providers to ship marking systems. It doesn't solve the harder questions: whether the mark survives rewriting, whether independent detectors can verify it, whether languages receive comparable treatment, and what happens when a model doesn't participate.

The coverage problem

Closed providers can insert marks because they control the generation pipeline. Open-weight models can run outside that pipeline, so they may produce text without any provider-side watermark at all. A detector can't recover a signal that was never inserted.

The ecosystem therefore splits into two broad categories:

• Participating closed systems: They may provide a detectable mark, but the mark depends on the provider's detector, key, and implementation.
• Open or unmarked systems: They can produce text without a watermark, leaving detectors with no embedded provenance signal to inspect.

Broader policy research found that only 38% of AI image generators implemented adequate watermarking, while only 18% used deep-fake labeling practices (arXiv policy analysis). Those figures show partial real-world coverage, even as formal requirements become stricter.

For compliance teams, this makes data provenance more important than a single detector result. A practical overview of trustworthy data origins for compliance helps frame the broader requirement: organizations need records about source, handling, and review, not just a probabilistic label attached to final text.

Practical Guidance for Writers and Compliance Teams

Treat an AI watermark as one input in a review process, not a verdict. It can support a provenance claim when the producing platform, detector, and document history are all known. It can't reliably establish authorship after substantial editing or across unrelated systems.

What a watermark can support

• Closed-platform provenance: If Gemini produced the text and the relevant platform can verify its own output, the mark may support a limited claim about platform involvement.
• Internal audit trails: A known model version, saved prompt, timestamp, and preserved original output give a stronger record than a detector score alone.
• Corroboration: Combine detection with disclosure statements, revision history, writing-style baselines, and human review.

What should disqualify it as sole evidence

• Paraphrased or translated writing: The statistical pattern may have been weakened or removed.
• Mixed human and AI drafts: A clean section doesn't establish that the entire document was human-written.
• Open-model output: No provider watermark may have been inserted.
• High-stakes decisions: Don't use a detector score alone for employment, grading, disciplinary action, or legal liability.

Use a written decision rule. For example, refuse to treat a result as decisive when detector confidence is below 0.7, when the text has passed through paraphrasing, or when an authorship claim lacks a signed provenance record. That 0.7 cutoff is a governance choice, not a universal scientific standard.

A layered workflow is slower than pressing a detection button, but it matches the evidence. Preserve originals, record the producing system when known, ask for disclosure, compare drafts, and send disputed cases to a human reviewer.

A Clear-Eyed Takeaway on AI Watermarks

AI watermarks are useful infrastructure in cooperative settings. They're not lie detectors.

Statistical methods such as KGW depend on token choices that remain sufficiently faithful to the original output. Independent testing has shown how quickly that assumption can fail. Embedding systems can preserve a signal more independently of model vocabulary, but they still depend on the producing platform, compatible verification, and an intact media or provenance record.

The most defensible claim is narrow: a valid watermark may show that a participating system probably influenced an unmodified piece of content. It doesn't prove that the system wrote the entire passage, that a person didn't edit it, or that an unmarked passage came from a human.

Keep three mental models:

1. Detectability depends on length and token fidelity. A longer, untouched output gives a statistical detector more evidence. Rewriting removes evidence.
2. Provenance beats detection for accountability. Prompts, model records, signed credentials, revision history, and disclosure provide context that a score can't.
3. Policy will shape standards. The EU AI Act's Article 50 milestone on 2 August 2026 pushes providers toward machine-readable marking, but adoption and enforcement remain broader than any single algorithm (policy timeline).

Watermarks can help identify cooperating systems under controlled conditions. They can't close the open-model gap, survive every rewrite, or establish authorship by themselves.

---

Simple Unmark cleans hidden Unicode artifacts and rewrites text to reduce statistical watermark patterns while preserving meaning, facts, numbers, proper nouns, tone, and intent. If you need to inspect or clean AI-assisted text, visit Simple Unmark and run a passage through its paste, clean, and copy workflow.