Watermarking AI content

A university receives a 700-word essay that is polished, oddly generic, and impossible to attribute.

A newsroom gets a video of a politician saying something inflammatory.

A search engine is about to add billions of machine-written pages to the next model’s training set.

In each case, “did a machine make this?” is useful information. It is not always easy information.

The obvious approach is to inspect the finished content. Look for telltale phrases. Ask an AI detector. Compare the writing with known samples.

These methods are fragile because they inspect effects after the fact. By then, the evidence may already have been changed by:

• an editor
• a translator
• a screenshot
• a second model

Watermarking changes the problem. A generator deliberately embeds a hidden, statistically detectable signal while creating the content. A detector later looks for that signal.

That signal can help with:

• misinformation
• academic and journalistic integrity
• platform moderation
• filtering synthetic material before it contaminates a future pretraining set

It is not a magical “AI or human” stamp. That distinction is the whole subject.

What a watermark actually claims

A watermark can support a claim about generation, not necessarily authorship.

If text contains a valid watermark, the safest conclusion is:

This text contains a signal consistent with this watermark scheme and key.

Under a validated threat model, that raises the probability that it passed through a compatible watermarking process, but it does not identify the generator or rule out deliberate forgery.

It does not tell you:

• who operated the generator
• whether a human edited the text
• whether its facts are true

A person could ask a model to write it and publish the result.

If no watermark is found, the safe conclusion is only:

This detector did not find its signal.

The text may be:

• human-written
• produced by an unwatermarked model
• changed by paraphrasing, translation, shortening, or a screenshot

Absence is not proof of human authorship.

Three related tools answer different questions:

• An embedded watermark hides a signal inside the content. It may survive compression or a mild crop, but a determined attacker may remove it.
• Provenance records signed information about how content was created and edited. It can be strongly verifiable, but the record may disappear after a screenshot or re-encoding.
• A post-hoc AI detector infers a possible cause from content without generator cooperation. It can cover old or uncooperative content, but its clues are imperfect.

A serious system may use all three. None is a courtroom verdict by itself.

Statistical text watermarking: bias the choices, not the spelling

Text has no pixels in which to hide a faint pattern. A watermark therefore changes the model’s choices as it generates tokens.

A token is a piece of text from the model’s vocabulary. It can be:

• a whole word
• part of a word
• punctuation
• a leading space

Before sampling the next token, the model produces a logit, an unnormalised score. Higher logits generally become higher probabilities.

The canonical green-list method:

1. Use the previous token, context, and a secret key to seed a pseudorandom vocabulary split.
2. Put roughly half the candidate tokens into a green list and the rest into a red list.
3. Add a bias, called the watermark strength, to green-token logits.
4. Sample from the adjusted distribution and repeat at the next position.

The key keeps the split unpredictable. The watermark remains readable because the model often has several plausible continuations. A small nudge toward one choice can preserve meaning while accumulating a detectable surplus across many positions.

For token i at position t:

adjusted_logit(i, t) = original_logit(i, t) + delta

when i is green at that position; otherwise its logit is unchanged. The exact algorithm may use more context, but the causal idea is the same.

The watermark is not a fixed set of “green words.” A token’s status depends on:

• its position
• its context
• the tokenizer
• the key

“The” may be green in one position and red in the next.

A detector for this scheme needs:

• the matching tokenizer
• the algorithm
• the key
• the token sequence

It reconstructs each eligible green list and counts how often the actual token was green.

Tokenisation is therefore critical. If generation and detection split the text differently, they check different positions.

The signal can be weakened or destroyed by:

• rewriting
• normalisation
• translation
• OCR
• another tokenizer

The arithmetic: green surplus becomes a z-score

Suppose half the eligible tokens are green. Let n be the eligible-token count, g the observed green count, and p = 0.5 the chance baseline. Under the unwatermarked hypothesis:

z = (g - n * p) / sqrt(n * p * (1 - p))

For 200 tokens, chance predicts 100 green tokens and the standard deviation is about 7.07.

• 102 green tokens are only 2 above expectation: z ≈ 0.3, ordinary sampling noise.
• 168 green tokens are 68 above expectation: z ≈ 9.6, extraordinarily unlikely by chance under the ideal assumptions of independent choices and a correct null model.

A threshold such as 4 is a policy choice, calibrated with validation data. It balances false positives against false negatives.

A z-score is not the probability that “AI wrote this”; it is evidence against one statistical null hypothesis.

Misleading results can come from:

• a wrong key
• a wrong tokenizer
• a wrong population model

The knobs that decide whether it works

Watermark strength is a quality–detectability trade-off. A larger logit boost makes the surplus easier to detect but can cause:

• unnatural synonyms
• repetition
• lost distinctions

The effect depends on entropy, or how many plausible choices the model has. A small bias can steer a creative sentence with many reasonable continuations. It may not change a factual sentence where one token dominates.

Sampling settings also matter:

• temperature
• top-k
• top-p

If green tokens are filtered out before sampling, their boost cannot help. Greedy decoding leaves less room for the watermark.

Generation and detection must agree on:

• the context seed
• green fraction (gamma)
• bias (delta)
• ignored tokens
• minimum length
• key
• tokenizer
• algorithm version

A production detector is a measurement system

Evaluate on:

• ordinary human writing
• watermarked output
• transformed output

Include:

• code
• lists
• quotations
• mathematics
• multiple languages
• short messages
• heavily edited text

Calibrate across the actual length range: a 30-token reply has much more variance than a 2,000-token report.

Keep keys secret and versioned. A leaked key lets attackers study or deliberately maximise the detector’s preferred choices.

Use more than two outcomes:

• No usable signal: too short or otherwise unsuitable.
• Signal detected: the test passed the service threshold.
• Signal not detected: the test did not pass.
• Conflict: provenance and embedded evidence disagree.

This keeps a statistical measurement from quietly becoming an accusation.

Embedded watermarks, classifiers, and C2PA

Image and audio watermarks alter continuous representations such as:

• pixels
• latent features
• frequency components

They seek a hidden pattern that is recoverable after ordinary transformations. SynthID is an example of watermarking across generated media. Its applications include:

• image
• audio
• video
• text

Stable Signature embeds a signal into an image-generation decoder.

These signals may survive:

• compression
• resizing
• a modest crop

They may be weakened by:

• repainting
• heavy noise
• repeated transformations
• screenshots
• aggressive audio compression
• mixing
• time shifting

C2PA, the Coalition for Content Provenance and Authenticity’s open standard, takes a different route. A file can carry a signed manifest containing assertions about its origin and edits.

Verification checks whether the manifest changed after signing and whether the signing identity is trusted.

C2PA proves that a particular issuer signed a particular provenance claim. It does not prove the claim is honest or that a depicted event is real.

A platform can also strip the manifest; a screenshot usually contains the visible image, not its original credentials.

Practical question	Best first tool	Why
Was this file produced through a participating, documented pipeline?	C2PA credentials	Signed provenance authenticates a participating signer’s recorded assertion, not necessarily the actual creator or the truth of that assertion.
Did the content pass through a known generator after metadata was stripped?	Embedded watermark	The signal lives in the content, not just beside it
Was this made by an unknown or uncooperative system?	Post-hoc classifier or forensic review	It needs no generator cooperation, but its evidence is weaker and domain-dependent
Is the decision high stakes?	Combine signals and human review	Different failure modes make agreement more informative

C2PA offers stronger positive provenance when it survives. Embedded watermarks add evidence after metadata disappears. Classifiers cover content with neither, but are generally triage rather than proof.

Failure modes you will see first

No signal on an obviously generated essay. Check length, tokenizer, key, algorithm version, paraphrasing, and whether greedy decoding or a constrained path bypassed the sampler. Do not simply lower the threshold; return an inconclusive result when evidence is weak.

A human technical document is flagged. Code, quotations, legal boilerplate, and formula-heavy writing have restricted choices that can create an accidental green surplus. Measure false positives by domain and avoid punitive decisions from one score.

The model sounds stiff. Excessive bias, especially in low-entropy factual text, causes repeated wording or unnatural synonyms. Lower the strength, measure quality and detectability together, and decide whether every output needs a watermark.

Provenance disappears or systems disagree. C2PA credentials can be removed by:

• screenshots
• metadata-stripping uploads
• export paths

Editing can damage an embedded signal.

To respond:

• preserve original assets
• inspect transformation history
• keep policy separate from measurement

In one breath

• Watermarking embeds a generation signal; it does not identify a person or prove truth.
• Green-list text watermarking uses a keyed, position-specific vocabulary split and a small logit boost.
• Detection compares the green count with chance: with 200 tokens and a 50% baseline, 102 gives z = 0.3, while 168 gives z = 9.6.
• Strength, sampling, tokenisation, length, and editing determine usefulness.
• Embedded watermarks, C2PA provenance, and post-hoc classifiers are complementary evidence, not interchangeable proof.

Quick check

Quick check

0/3

Q1Why does a green-list watermark usually preserve readable text?

It adds invisible Unicode characters after generationIt slightly favours green tokens among several plausible choices, so the text statistics change without forcing a visible marker into every sentenceIt encrypts the text and hides the encryption key in punctuationIt replaces every red-list word with a synonym

Check answer

Q2A 200-token passage has 168 green tokens under a detector whose chance baseline is 50 percent. What does its z-score of 9.6 mean?

There is a 96 percent probability that a particular person wrote itThe passage is definitely AI-generated and cannot have been editedThe green count is extremely unusual under the detector's unwatermarked statistical assumption, so the watermark signal is strongThe model used exactly 9.6 watermark keys

Check answer

Q3A 40-token passage has 29 green tokens, the baseline is 50 percent, and your policy requires a z-score above 4. What should the system do?

Flag it as conclusive: 29 is much more than 20Calculate z as about 2.8 and return weak or insufficient evidence rather than a conclusive verdictAssume it is human because 29 is below 40Ignore the baseline and report 72.5 percent as the z-score

Check answer

Next

Watermarking can help keep synthetic material out of the next pretraining set, while red-teaming tests how easily signals can be removed or forged. At runtime, pair provenance and watermark evidence with content guardrails, because knowing where text came from does not tell you whether it is safe to use.