Wired reported that developers had found ways around invisible watermarks in AI-generated text. That outcome is not surprising once you understand what a text watermark actually is, and the mechanism is worth knowing whether you are trying to detect AI writing or relying on someone else’s detector.
There is nothing hidden in the text
The first assumption is usually that a watermark is a hidden character, a zero-width space or an unusual bit of punctuation. Those exist, and they are trivially removed by copying into a plain text editor.
Statistical watermarking is different and considerably cleverer. It changes nothing you can see, because the signal is in which words were chosen.
How it works
A language model generates text one token at a time. At each step it has a probability distribution over possible next tokens, and usually several are acceptable: large, big, substantial might all fit.
A watermarking scheme uses the preceding tokens to seed a pseudorandom function that splits the vocabulary into a green list and a red list. The model is then nudged towards green-list tokens whenever the choice is genuinely open.
Any single word choice tells you nothing. Across a few hundred words, though, the proportion of green-list tokens drifts measurably above chance. A detector holding the same secret key recomputes the lists and counts. Human writing lands near 50 percent; watermarked output lands well above it.
The result is a statistical claim with a confidence level, not a yes or no. That distinction matters enormously and is almost always lost by the time a detector reports a verdict.
Why it is fragile
The signal lives in word choice, so anything that changes word choice dilutes it.
- Paraphrasing substitutes synonyms, which is precisely the thing the watermark encodes.
- Translating out and back rewrites nearly every token.
- Heavy editing by a human dilutes it in proportion to how much was changed.
- Short text never accumulates enough signal. Below a few hundred words the statistics are too weak to distinguish from chance.
- Mixing sources buries a watermarked passage inside unwatermarked writing.
There is also a fundamental tension the research community acknowledges openly. A strong watermark constrains word choice enough to degrade writing quality; a watermark weak enough to preserve quality is easier to wash out. There is no setting that is both robust and invisible in effect.
Detection without a watermark is much worse
Most tools marketed as AI detectors have no key and no watermark. They guess from surface statistics such as how predictable the text is.
These are unreliable in a specific and damaging direction. They disproportionately flag writing by non-native English speakers, whose vocabulary tends to be more conventional, and clear technical prose, which is deliberately predictable. Several universities have stepped back from them after false accusations.
If you are on the receiving end of such an accusation, the important point is that these tools produce probabilities, not evidence, and a probability is not a finding of misconduct.
What this means practically
If you are trying to verify authorship, treat any detector output as one weak signal among several. Version history, drafts and the ability to discuss the work are far stronger evidence than a percentage.
If you publish, understand that watermarks are a provenance signal for the well-behaved, not a control on the determined. They help label content honestly; they do not stop anyone who wants to strip them.
If you are setting policy, the more durable approach is cryptographic provenance attached to files at creation, which several industry standards now cover, rather than trying to recover a signal from text after the fact.
Watermarking is genuinely useful and genuinely limited, and most of the public argument about it confuses the two.
Join the discussion