What Is an AI Text Watermark?

7 min read

An AI text watermark is not a hidden character, a zero-width space, or a tag in the metadata. It is something considerably harder to spot and harder to remove: a deliberate, measurable bias in which words the model chose.

That distinction matters, because most advice about "removing AI watermarks" is written as if there were an invisible marker to strip out. There usually isn't. Understanding what is actually there changes what you can sensibly do about it.

Start with how a model picks a word

A language model does not decide on a sentence and then write it. At every position it produces a probability distribution over its whole vocabulary — tens of thousands of candidate tokens, each with a score — and samples one. Then it does it again, conditioned on everything written so far.

That sampling step is the opening. If you can influence which token gets picked, without picking noticeably worse tokens, you can encode a signal into the text itself. The reader sees ordinary prose. The distribution tells a different story.

The green list

The best-documented approach comes from a 2023 paper by Kirchenbauer and colleagues, and it is elegant enough to describe in a paragraph.

Before choosing each token, take the previous token and feed it through a hash function seeded with a secret key. Use the result to split the entire vocabulary pseudo-randomly into two halves: a green list and a red list. Then add a small bonus to every green token's score before sampling.

The model is now gently biased toward green tokens — but "green" is redefined at every single position, because it depends on the token before it. There is no fixed vocabulary of suspicious words. The same word is green in one sentence and red in the next.

What the detector measures

Someone holding the same key can replay the whole calculation. They walk the text token by token, recompute which list each token belonged to, and count the greens.

In unwatermarked text, roughly half the tokens land in the green list — that is what "split the vocabulary in half" means. In watermarked text, the fraction is higher. The question is whether it is enough higher to rule out coincidence, and that is a standard statistics problem:

z = (green_count − γT) / √(T · γ · (1 − γ))

where T is the number of tokens and γ is the green-list fraction, usually 0.5. A z of 4 or more is overwhelming evidence — the probability of that many greens arising by chance is vanishingly small.

The consequence worth internalising: detection gets stronger with length. The denominator grows with the square root of the token count, so a long document accumulates certainty that a single sentence never can. Two hundred words is a comfortable signal. Fifteen words is noise.

Why you cannot see it

The bias per token is small by design. Push it too hard and the text degrades — the model starts preferring a slightly odd synonym over the natural word, and quality drops in ways readers notice. Watermarking schemes are tuned to sit below that threshold.

So no individual word choice is evidence of anything. "Significant" instead of "important" proves nothing. The signal only exists in aggregate, across hundreds of choices. This is why you cannot inspect a document and find the watermark, and why no amount of careful reading will reveal it.

What breaks it

Because the green list at each position depends on the preceding token, editing has a disproportionate effect. Change one word and you do not just reclassify that word — you re-roll the list for the word that follows it. Two tokens are affected by one substitution.

This is also why the published research is candid that these schemes weaken under paraphrasing, translation, and heavy editing. It is a known property, not a discovered flaw. A watermark survives copy-paste; it does not reliably survive rewriting.

The practical question then becomes which words to change, since changing all of them destroys your writing. That is a targeting problem, and it is the subject of how detectors actually work.

Watermarking is not AI detection

These two get conflated constantly, and they are fundamentally different.

  • Watermark detection tests for a specific signal that a specific generator deliberately inserted, using a key. When it fires, it is close to proof. When it does not fire, it tells you almost nothing — the text may be from a model that does not watermark.
  • AI-writing classifiers — the tools that guess whether text "feels" machine-written — look at surface statistics like sentence-length uniformity and vocabulary diversity. They require no key, work on any text, and are much less reliable, with a well-documented tendency to misclassify non-native English writing.

A document can fail a classifier while carrying no watermark at all, and carry a watermark while sailing past a classifier. They are answering different questions.

Who actually does this

Fewer providers than you would guess. Google DeepMind's SynthID-Text is deployed in Gemini and is the only production text watermark at scale; OpenAI built a prototype and never shipped it; Anthropic has not deployed one in Claude. We go through the current state provider by provider in AI watermarking by model.

The honest limitation of any tool, including ours

A detector needs the generator's key. Without it, you can reproduce the mathematics but not the specific partition that a given vendor used — so what you get is a statistical estimate of watermark pressure, not a verdict.

Our own tool says so on its face, and reports a score near 50% for ordinary text, because 50% is what "the green-list test cannot distinguish this from chance" honestly looks like. Any free tool claiming to definitively detect a specific vendor's watermark without that vendor's key is overstating what is possible.

Sources

Keep reading