How AI Text Watermarks Actually Work (KGW, SynthID, and the Limits)

AI text watermarks work by injecting a keyed statistical bias into the token-sampling step of a large language model. A pseudorandom function, seeded with a secret key and recent context, either partitions candidate tokens or assigns them scores. Sampling then nudges toward preferred tokens, creating an invisible pattern that accumulates across the generated passage. A detector holding the matching key runs a statistical hypothesis test to measure whether the pattern is present. A positive result is probabilistic evidence that the passage may have been processed by a specific watermarking system. It is not proof of authorship, a universal AI verdict, or a guarantee that every word came from the model. Text watermarks are distinct from hidden Unicode characters, C2PA file-level provenance metadata, and post-hoc AI detectors that classify style without any embedded signal.

What is an AI text watermark?

An AI text watermark is a statistical provenance signal embedded during text generation. It influences which tokens (words or word fragments from the model's vocabulary) are selected at each step, creating a pattern invisible to readers but measurable by a detector that holds the correct secret key.

Think of a radio station embedding an inaudible identification tone in its broadcast. Listeners hear normal audio, but a tuned receiver can verify the source. A watermarked passage reads the same way: natural to a person, yet carrying a statistical fingerprint a keyed detector can test.

A text watermark is not:

• Hidden Unicode or zero-width characters inserted into the text.
• A visible "generated by AI" label.
• C2PA signed metadata attached to an image, video, or PDF file.
• A post-hoc stylistic classifier that guesses whether text "looks AI-written."

Why this matters now: the EU AI Act's Article 50 places transparency obligations on AI providers, Anthropic has described text-marking plans for Claude, and Google DeepMind has deployed SynthID-Text in production. Anthropic's Help Center distinguishes its embedded text watermarks from C2PA provenance metadata for supported files.

How does an LLM generate text, and where does the watermark fit?

Tokens, logits, and probabilities

A large language model generates text one token at a time. At each step, the model outputs a vector of raw scores (logits) over its entire vocabulary, often tens of thousands of entries. A softmax function converts these logits into a probability distribution: each token receives a probability reflecting how likely the model considers it as the next word or word-piece.

Sampling: temperature, top-k, top-p

Before the model selects the next token, parameters like temperature, top-k, and top-p shape the distribution. Temperature controls randomness (lower values make output more deterministic). Top-k limits candidates to the k most probable tokens. Top-p (nucleus sampling) keeps the smallest set of tokens whose cumulative probability exceeds a threshold p. These parameters determine how many plausible candidates are in play at each step.

Where the watermark layer sits

The watermark operates between the probability computation and the final token selection. It acts as an external logits processor or sampling wrapper: it does not retrain the model or change its weights. At each generation step, the watermarking layer takes the secret key plus recent context (preceding tokens), modifies the sampling decision, and passes the result forward. This process repeats for every generated token, accumulating a statistical trace across the entire output.

How does the KGW green-list watermark work?

The KGW scheme, introduced by Kirchenbauer et al. (arXiv:2301.10226), is the foundational text watermarking method that most later work builds on or responds to.

Partitioning the vocabulary with a keyed hash

At each generation step, KGW takes the preceding token (or a short window of preceding tokens) and a secret key, feeds them into a cryptographic hash or pseudorandom function, and uses the output to split the vocabulary into two disjoint sets: a green list and a red list. The green list contains a fraction γ (gamma) of the vocabulary; the red list contains the rest. Because the partition depends on the preceding context and the key, it changes at every position.

Biasing green tokens (soft watermarking)

In the soft variant, a constant δ (delta) is added to the logits of every green-list token before sampling. Red tokens are not banned; they just become less probable. In the hard variant, red tokens are excluded entirely, but this can visibly degrade quality when the most natural next token happens to be red. Soft watermarking is the more common approach because it balances detectability with output quality.

Why the result still reads like normal text

Among plausible next tokens, the logit nudge often swaps one synonym-level choice for another ("big" instead of "large," for instance). A reader cannot tell which synonym was preferred by the watermark. A stronger δ increases detectability but can reduce naturalness. At low-entropy positions, where only one plausible continuation exists (a proper noun, a number, a fixed phrase), the watermark has little room to operate: the model was already going to pick that token regardless.

Detecting the watermark with a z-test

The detector does not need the LLM itself. It needs only the secret key and the same hash function. Given a passage, the detector:

1. Re-tokenizes the text.
2. Reconstructs the green/red partition at each token position using the key and preceding context.
3. Counts the total green tokens g out of T scored positions.
4. Computes the z-statistic:

z = (g − γT) / √(Tγ(1 − γ))

A high z-score means the passage contains far more green tokens than chance would produce under the null hypothesis (ordinary, unwatermarked text). The PMLR proceedings version of the paper illustrates a threshold of about z > 4, which corresponds to a p-value around 3 × 10⁻⁵. In the authors' OPT-1.3B/C4 experiment, roughly 98.4% of generated samples were detected at that threshold.

No model access required

Because the detector reconstructs green/red lists from the key alone, it never queries the LLM's weights or API. This is a key practical advantage: detection can happen offline, on any text, by anyone who holds the key.

What is Gumbel-style distortion-free watermarking?

Gumbel-style watermarking takes a different approach: it aims to preserve the model's original output distribution while still embedding a detectable signal.

At each step, keyed pseudorandom scores (derived from the secret key and recent context) are assigned to each candidate token. The next token is selected using a rule, such as the Gumbel-max trick or exponential-min sampling, that jointly considers the model's probability and the keyed pseudorandom score.

In the idealized distortion-free setting, the marginal distribution of each individual token stays unchanged: over many samples, the token frequencies match what the model would have produced without watermarking. The watermark exists only in the joint correlation between the key and the selected tokens across many positions. Detection works by aggregating the keyed scores of the tokens that were selected; a consistently high aggregate indicates the watermark's presence.

An important caveat: at temperature 0 or greedy generation, the model is deterministic. It always picks the single highest-probability token. No sampling entropy is available to encode a preference, and the watermark signal can collapse. Different implementations may handle this edge case differently.

The formal analysis of distortion-free watermarking and its entropy requirements appears in Christ, Gunn, and Zamir (arXiv:2306.09194) and is further analyzed in A Statistical Framework of Watermarks for Large Language Models (arXiv:2404.01245).

How does SynthID-Text work?

SynthID-Text, developed by Google DeepMind and described in Dathathri et al., Nature 2024, is the most prominent production-deployed text watermarking scheme. It runs as a logits processor, not a model retraining step.

Scoring candidates with keyed g-functions

SynthID-Text's secret configuration includes private keys and an n-gram context length (the Google AI for Developers documentation lists 5 as a good default for ngram_len). Pseudorandom g-functions score candidate tokens based on recent context and the key, producing a watermark preference score for each candidate.

Tournament sampling

Several candidates are drawn from the model's distribution. In the paper's example, m = 3 yields 2³ = 8 candidates. These candidates compete in pairwise rounds: at each layer, the candidate with the higher g-function score advances. The tournament winner becomes the next token, carrying a statistical preference toward higher watermark scores.

The system supports both distortionary and non-distortionary configurations, letting operators balance detectability against output-distribution fidelity.

Detection: weighted-mean or Bayesian scoring

The detector reconstructs the g-function scores for each token position in a passage, aggregates them, and returns one of three states: watermarked, not watermarked, or uncertain. Detection does not require running the underlying LLM.

Quality at scale

The Nature paper reports a live experiment with nearly 20 million Gemini responses. In the non-distortionary configuration, the authors found no measurable quality degradation across benchmarks and human evaluations. That is the paper's reported result for its tested configuration, not a universal guarantee for every watermark setting.

KGW vs. Gumbel vs. SynthID: a side-by-side comparison

How all three differ from post-hoc detectors: Post-hoc AI detectors (GPTZero, ZeroGPT, Originality.ai, etc.) analyze already-written text using learned or statistical features like perplexity and burstiness. They have no embedded signal to look for. They rely on pattern recognition rather than a keyed provenance signal and face different false-positive and generalization challenges.

What survives copying, editing, and translation?

Watermark robustness depends on how much of the original token sequence survives a transformation. The findings below come from specific experiments, not universal guarantees.

Copy-paste and light edits

Copying and pasting preserves the token sequence exactly, so the watermark signal generally survives intact. Kirchenbauer et al. (arXiv:2306.04634) reported that in a copy-paste experiment, a 600-token human passage containing 150 watermarked tokens achieved AUC above 0.95 under the tested conditions. Light edits (fixing typos, swapping a few words) remove a small fraction of the signal but typically leave enough tokens for detection.

Paraphrasing

Heavier rewriting changes more tokens and weakens the statistical trace. The same Kirchenbauer et al. reliability paper found that ROC-AUC stayed above 0.85 with 200 tokens and above 0.90 with 600 tokens after GPT-3.5/paraphrase-model rewrites. After strong human paraphrasing, detection was possible after roughly 800 tokens on average at a 10⁻⁵ false-positive rate. Separately, Krishna et al. (NeurIPS 2023) showed that DIPPER, an 11-billion-parameter paraphrase model, reduced detection performance for several schemes in tested settings.

Translation

Token-level signals do not automatically survive re-tokenization in another language. He et al. (ACL 2024) reported that their cross-lingual watermark-removal attack reduced AUC from 0.95 to 0.67, approaching random-guessing performance. Translation restructures the token sequence, making it one of the most challenging transformations for current watermarking methods.

All figures above are results of specific experiments under stated conditions, not universal performance claims.

Why do short and low-entropy passages cause problems?

Statistical evidence accumulates token by token. A 50-token passage provides far fewer observations than a 500-token one, yielding wider confidence intervals and weaker detection power.

The problem deepens with low-entropy output. When the model is near-certain about the next token (code completions, proper nouns, fixed formulas, verbatim quotations, factual continuations), only one plausible candidate exists. The watermark cannot nudge a choice that is already determined. Formally, Christ, Gunn, and Zamir (arXiv:2306.09194) show that quality-preserving detection requires enough empirical entropy in the generated output. Below a threshold, a watermark either degrades quality (by forcing an unlikely token) or becomes undetectable (by having no freedom to express a preference).

A concrete example: "What is 2 + 2?" has one correct continuation. A 500-word open-ended essay on the same topic, by contrast, offers hundreds of positions where plausible synonyms exist and the watermark can operate.

Google's own SynthID documentation notes that watermarking is less effective for factual responses with limited freedom in token selection. Avoid trusting universal token-count claims; detection thresholds depend on the model, watermark configuration, text type, and acceptable false-positive rate.

What are the security and theoretical limits?

Strong watermarking is theoretically impossible

Zhang et al., Watermarks in the Sand (ICML 2024) proved that under their stated assumptions, any watermark can be removed by an attacker with access to a quality oracle (a way to judge whether text is still good) and a perturbation oracle (a way to generate plausible rewrites), with only minor quality loss. They showed the generic attack against three existing LLM watermark schemes. This does not mean every practical workflow can easily remove a watermark, but it sets a theoretical ceiling on robustness guarantees.

Watermark stealing for under $50

Jovanović, Staab, and Vechev (arXiv:2402.19361) showed that API queries costing under $50 could roughly reverse-engineer prominent distribution-modifying watermark schemes. They reported average spoofing (adding a false signal) and scrubbing (removing an existing signal) success of over 80% in their tested settings. The security implication: a secret-key watermark whose behavior leaks through API outputs can be partially reconstructed by a resourceful attacker.

Radioactivity after fine-tuning

Sander et al. showed that watermarked text used as fine-tuning data can leave a detectable residual signal, termed "radioactivity," in a downstream model. In their open-model experiments, radioactivity was detected at p < 10⁻⁵ with as little as 5% watermarked training data. This detects model contamination, not the content of a single output passage.

Keyed ecosystems fragment interoperability

Each provider uses its own key and configuration. No universal key registry, cross-provider detection standard, or shared detector exists. A detector for one provider's watermark cannot read another's mark. This fragmentation limits watermarking as a general-purpose provenance layer and means that "is this text AI-generated?" remains a harder question than "was this text processed by a specific system?"

How are text watermarks different from AI text detectors?

A watermark is embedded during generation by a cooperating provider. It produces a keyed statistical signal that a matching detector can test. A post-hoc detector analyzes already-written text using learned or statistical features (perplexity, burstiness, stylistic patterns) with no embedded signal to look for. The two solve different problems.

The bias risk of post-hoc detectors is well-documented. Liang et al. (arXiv:2304.02819) evaluated seven GPT detectors on 91 TOEFL essays by non-native English speakers. The average false-positive rate was 61.22%. Of those essays, 19.78% were unanimously classified as AI-authored by all seven detectors, and 97.80% were flagged by at least one. These figures measure post-hoc detectors, not KGW or SynthID false positives.

A watermark is not "a more accurate AI detector." It trades a different set of properties: keyed provenance rather than stylistic classification, provider-specific scope rather than general coverage, and a different set of failure modes tied to entropy, key secrecy, and text transformation rather than linguistic bias.

What can (and cannot) an AI text watermark prove?

A detected AI text watermark can indicate: probabilistic evidence that text was generated or processed by a specific watermarking system holding a particular key.

A detected AI text watermark cannot prove:

• That the model "authored" every word in the passage.
• That no human edited, rearranged, or supplemented the text.
• That unmarked text is human-written or was not generated by a different AI system.
• That every AI provider's output will be detected.

Anthropic's own Help Center uses careful language: a detected mark indicates content "may have been processed by Claude". "AI-generated," "AI-assisted," and "processed by a model" are not interchangeable terms.

A text watermark is best understood as a probabilistic provenance signal tied to a particular watermarking configuration. It is not a universal AI detector, a guarantee of authorship, or proof that no human was involved.

FAQ

Do AI text watermarks add hidden characters to the output? No. Modern generative watermarks (KGW, Gumbel, SynthID) work by nudging token-sampling probabilities during generation. The resulting text contains ordinary characters; no invisible Unicode or whitespace is inserted.

Does every AI provider use the same watermark? No. Each provider that implements watermarking uses its own secret key and configuration. No shared standard or cross-provider detector exists. A detector for one provider's scheme cannot read another's mark.

Are AI text watermarks the same as C2PA metadata? They are different mechanisms. C2PA is cryptographically signed provenance metadata attached to a file (images, video, audio, PDFs). Text watermarks are statistical patterns embedded in the token sequence itself. Anthropic's Help Center describes both but distinguishes them.

Can a watermark be forged to make human text look AI-generated? Watermark-spoofing research (Jovanović et al., 2024) showed that an attacker who reverse-engineers approximate watermark behavior from API queries can attempt to add a spurious signal. This is a known security limitation.

Does detecting a watermark mean the AI wrote the entire passage? No. A positive detection is statistical evidence that portions of the text may have been processed by a watermarking system. It does not establish that every word came from the model or that no human editing occurred.

Sources

Academic papers:

• Kirchenbauer et al., A Watermark for Large Language Models: https://arxiv.org/abs/2301.10226
• Kirchenbauer et al., On the Reliability of Watermarks for Large Language Models: https://arxiv.org/abs/2306.04634
• Kirchenbauer et al. (PMLR proceedings): https://proceedings.mlr.press/v202/kirchenbauer23a.html
• Dathathri et al., Scalable watermarking for identifying large language model outputs, Nature 2024: https://www.nature.com/articles/s41586-024-08025-4
• Christ, Gunn, Zamir, Undetectable Watermarks for Language Models: https://arxiv.org/abs/2306.09194
• Zhang et al., Watermarks in the Sand (ICML 2024): https://proceedings.mlr.press/v235/zhang24o.html
• Jovanović, Staab, Vechev, Watermark Stealing in Large Language Models: https://arxiv.org/abs/2402.19361
• Sander et al., Watermarking Makes Language Models Radioactive: https://openreview.net/forum?id=qGiZQb1Khm
• Liang et al., GPT detectors are biased against non-native English writers: https://arxiv.org/abs/2304.02819
• He et al., Can Watermarks Survive Translation? (ACL 2024): https://aclanthology.org/2024.acl-long.226/
• Krishna et al., Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense (NeurIPS 2023): https://proceedings.neurips.cc/paper_files/paper/2023/file/575c450013d0e99e4b0ecf82bd1afaa4-Paper-Conference.pdf
• A Statistical Framework of Watermarks for Large Language Models: https://arxiv.org/html/2404.01245

Official documentation:

• Anthropic Help Center: How Claude marks AI-generated content: https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content
• Google AI for Developers: SynthID Text: https://ai.google.dev/responsible/docs/safeguards/synthid