Watermarking in AI Text: How It Works and Its Limitations
The rapid spread of large language models has led to a growing need for methods to identify synthetic content. Whether it concerns academic integrity, preventing large-scale influence campaigns, or upholding journalistic standards: the question of who or what wrote a text is more relevant than ever. One of the most discussed technical solutions for this is embedding a so-called watermark in generated text. Unlike traditional methods for verifying authenticity, a text watermark operates at the level of probability calculation and mathematical patterns.
This article analyzes the underlying technology of watermarking in generated text. We look at the difference with visual media, the mathematical workings of token-level influence, and the inherent trade-off between text quality and detectability. We also cover the ways bad actors can circumvent these systems and why organizations are wise to base their policies on processes rather than solely on technical detection tools.
What Is a Synthetic Text Watermark?
A watermark in AI-generated text is not physically visible. It is not a hidden character sequence, not a specific set of invisible Unicode characters, and not an encoded space. This kind of superficial modification can, after all, be removed instantly by simply copying the text as plain text or clearing the formatting. Instead, a modern text watermark is a subtle, statistical deviation in the selection of words generated by the model.
When a language model produces text, it does so step by step. The model predicts the next token each time based on the history already generated. For each next token, the model calculates a probability distribution over its entire vocabulary. A watermark intervenes directly in this selection process by systematically making certain tokens a fraction more popular than they would be based on pure context alone. This adjustment is imperceptible to a human reader, but leaves a clear, recognizable pattern for a statistical detector.
The Difference with Image and Video
To understand why text watermarks are so complex, a comparison with other media forms is illuminating. Images, audio, and video contain an enormous amount of redundant information (redundancy). An image consists of millions of pixels, and a video of dozens of frames per second. Within that vast data structure, subtle changes can be made in the frequency domain or in the least significant bits of pixels without a human observer noticing. This aligns with standards such as C2PA, which focus on cryptographic provenance metadata in media files.
Unlike combating deepfakes and disinformation in visual media, text has almost none of this redundancy. Text is discrete in nature: a word either is or isn't there. Any change of a letter or a word directly affects the meaning, grammar, and readability of the sentence. Where one can adjust a few pixels in an image without changing the composition, one cannot arbitrarily replace words in a sentence without damaging its structure. This makes embedding a robust watermark in text a much greater challenge.
| Property | Watermarking for Image/Video | Watermarking for Text |
|---|---|---|
| Data redundancy | Very high (millions of pixels/samples) | Very low (discrete words and tokens) |
| Modification level | Pixel values, frequency domain | Sampling distribution of tokens (logits) |
| Visibility | Invisible to the human eye | Unnoticed in natural language flow |
| Vulnerability to editing | Robust against compression and scaling | Highly vulnerable to paraphrasing and editing |
How Token-Level Watermarking Works Technically
The most common method for text watermarking is based on the concept of a 'green' and a 'red' list of tokens. This principle operates during the sampling phase of the language model. The algorithm uses a cryptographic hash function and a pseudorandom number generator (PRNG) to split the model's vocabulary at each step.
The Step-by-Step Split
While generating a token $T_n$, the watermarking algorithm looks at the immediately preceding token $T_{n-1}$ (or a sequence of preceding tokens). The unique value of this preceding token is used as input for the hash function. This hash then serves as the 'seed' for the pseudorandom generator. Based on this seed, the model's entire vocabulary is split into two groups:
- The green list: Tokens that are favored during generation.
- The red list: Tokens that are discouraged or excluded.
The size of the green list is usually fixed at a certain percentage of the total vocabulary, for example half. Because the split depends on the preceding token at each step, the composition of the green and red lists constantly changes in a seemingly random way. This prevents a human reader or a simple algorithm without the correct key from detecting a pattern.
Adding Bias
Before the model actually selects a token from the probability distribution (the so-called logits), the watermarking system applies a correction factor. A constant value $\delta$ (delta) is added to all tokens on the green list. This shifts the probability distribution: the probability that the model chooses a token from the green list increases, while the probability of a token from the red list decreases.
If the model is very certain about a specific word that is grammatically necessary (for example the article 'het' in a specific context), that word will often still be chosen, even if it is on the red list, because the original probability was extremely high. But in cases where there are multiple synonyms or sentence construction options with similar probabilities, the added $\delta$ ensures that the model systematically chooses an option from the green list.
The Detection Process: Statistical Testing
Detecting a watermark does not require access to the original language model, but does require the hash function used and the specific parameters with which the green and red lists were generated. The detector analyzes the suspect text and performs the same steps as the model did during generation.
For each consecutive pair of tokens in the text under examination, the detector calculates, based on the first token, which words were on the green list for the second token. The detector then counts how many tokens in the entire text actually came from the corresponding green lists. This count is compared to the theoretical expectation.
The statistical null hypothesis: A human author writes without knowledge of the green list. The probability that a token chosen by a human falls on the green list is, purely by chance, roughly equal to the size of that green list (for example 50%). However, if a text contains a significantly higher proportion of green tokens, the null hypothesis can be rejected.
The detector calculates a z-score to determine how likely it is that the distribution in the text is due to chance. When this z-score exceeds a certain threshold, the statistical certainty that the text was generated by the specific language model is nearly conclusive. This makes the detection process highly reliable in theory, provided the text is long enough and has not been substantially altered.
The Trilemma of Text Watermarking
Implementing a watermark forces developers to make strategic trade-offs. There is a trilemma between three conflicting properties:
- Detectability: How short the text can be while still demonstrating the watermark with high certainty.
- Text quality: The degree to which the text remains natural, grammatically correct, and coherent in content.
- Robustness: The degree to which the watermark withstands manual editing, paraphrasing, or translation.
If one chooses a very high value for $\delta$, the watermark becomes extremely easy to detect, even in very short texts. The price paid for this, however, is a reduction in text quality. The model is, after all, forced to choose words that are green but statistically less fitting in context. This can lead to increased perplexity, manifesting as unnatural language use, repetitive sentence structures, or subtle semantic errors. This is particularly problematic for tasks requiring high precision, where methods such as measuring hallucinations demonstrate that any disturbance of the natural output can degrade the reliability of the answers.
Attacks and Vulnerabilities
Although the mathematical foundation of watermarks is solid, there are in practice various ways in which these systems can be circumvented or rendered useless. This makes blindly relying on the presence of a watermark risky.
Paraphrasing and Textual Editing
The most obvious attack on a text watermark is paraphrasing the generated text. Because the watermark depends on the exact sequence of tokens (the preceding token determines the green list for the next one, after all), any change in the text disrupts the hash chain. If a user introduces synonyms, reorders sentences, or simply makes an adjustment every few words, the detector loses the thread. The statistical significance of the green tokens then quickly drops below the detection threshold.
Translation as a Bypass Route
Another effective method is translating the text. By translating an AI-generated Dutch text into German and then back into Dutch, the original watermark disappears completely. The sentence structure is rebuilt during this process by a different model (or the same model without an active watermark key), causing the specific token sequences that formed the watermark to be lost.
Mixing Sources and Manual Noise
Combining human text with AI-generated fragments likewise weakens detectability. If a document consists half of authentic human input and half of watermarked AI text, the statistical deviation flattens out. The detector then needs a much longer text to be able to establish, with sufficient mathematical certainty, that synthetic influences are present.
The Challenge of Open-Weight Models
A fundamental problem for the broad enforcement of watermarks is the existence of open-weight models. A developer can choose to implement watermarking infrastructure in a closed API service. However, users who run a model locally whose weights are publicly accessible can easily disable or bypass the code that adjusts the sampling distribution. As long as powerful models remain available without built-in watermark restrictions, the effectiveness of this technology remains limited to the platforms of specific commercial providers.
Post-Hoc Classifiers versus Active Watermarks
It is important to distinguish between active watermarking systems and passive, after-the-fact detectors (post-hoc classifiers). Where a watermark actively weaves patterns into the text during creation, a post-hoc classifier tries afterward to guess whether a text was written by a machine based on statistical features such as 'perplexity' (how predictable the text is) and 'burstiness' (the variation in sentence length and structure).
Post-hoc classifiers are generally a much weaker instrument. They are prone to false positives: texts written by humans but mistakenly flagged as AI. This particularly affects writers who use a highly structured, simple style, such as non-native speakers or professionals drafting formal, legal documents. Because the patterns they use are close to the average predictability of a language model, passive detectors often flag them incorrectly. Watermarks do not have this problem in theory, because the probability of a false-positive detection can be mathematically bounded by setting the z-score threshold extremely strict.
Provenance Metadata and Content Credentials
Besides the mathematical influence on text patterns, provenance metadata is being explored as an additional route. This uses cryptographic signatures stored in the file header (metadata) at the moment a document is exported. This system is comparable to digital certificates.
Although this is a reliable method for demonstrating the chain of ownership and editing, it does not solve the challenges of plain text. As soon as a user copies the text via the clipboard (Ctrl+C and Ctrl+V) and pastes it into a new editor, all metadata is lost. Provenance metadata therefore only works in closed ecosystems or with specific file formats (such as signed PDFs), but is unsuitable for the billions of informal text exchanges that take place daily.
Societal and Practical Implications in the Netherlands
The discussion about recognizing synthetic text touches on various domains of Dutch society. The applicability of detection technology differs greatly by sector.
Education and Academic Assessment
In education, the fear of fraud with AI-generated essays is significant. Many educational institutions have experimented with passive detection tools, but run into the unreliability and legal risks of false accusations. The absence of a universal watermarking standard means schools cannot simply accuse students based on a statistical score. Moreover, the ease with which students can paraphrase a text means active watermarks offer little protection in this context.
Journalism and Media Integrity
Within journalism, the emphasis is on transparency and verifying sources. Although editorial teams can benefit from systems that help check submitted pieces, manual checking and fact-checking AI answers remain the most important line of defense. A technical watermark can be supportive, but should never replace the journalistic duty of hearing both sides and source verification.
Job Application Procedures and Evidentiary Value
Companies that receive large volumes of job application letters sometimes look for ways to assess the authenticity of these letters. Here too, a candidate who has a letter generated and then lightly edits it quickly renders the watermark unrecognizable. In legal contexts and evidentiary proceedings, the evidentiary value of a detected watermark is likewise limited: it can serve as supporting statistical evidence, but is rarely conclusive because the input history and possible edits to the text are difficult to reconstruct after the fact.
At the European level, legislation such as the EU AI Act sets rules for the transparency of AI systems. Providers of models that generate synthetic content are required to label their outputs in a machine-readable manner. This is driving further development and standardization of watermarking techniques, although technical enforceability remains a complex issue.
Policy Considerations for Organizations
Given the technical limitations and the vulnerability of watermarks to active circumvention, organizations do well not to hang their policy on the hope of a perfect detection tool. A strategic approach instead focuses on process design and responsible integration.
Organizations can, for example, make clear agreements about logging AI usage. By requiring employees or external partners to declare which tools they used during the writing process, the focus shifts from after-the-fact control to upfront transparency. Here, internal filtering systems and moderation and safety models can be deployed to guarantee that the generated content meets the organization's qualitative and ethical standards.
Furthermore, it makes sense to emphasize the quality and factual accuracy of the final output, regardless of its origin. If a text is factually correct, contains no plagiarism, and correctly informs the reader, the exact method of creation is of secondary importance in many business contexts. Building a culture centered on critical thinking and manual editing proves in practice to be far more robust than chasing a watermark detector that can be fooled by a simple paraphrasing action.
