Does watermarking solve AI-text detection? Where the research stands

What this review covers

Watermarking is the one branch of AI-text detection where the detector does not have to guess. Instead of training a classifier to spot statistical fingerprints after the fact, the model provider embeds a signal at generation time — biasing the model's word choices in a way that is invisible to a reader but detectable by anyone who holds the key.

This review reads five primary documents closely:

1. The paper that defined the modern approach — Kirchenbauer et al.'s green-token scheme (ICML 2023).
2. The first production deployment at scale — Google DeepMind's SynthID-Text, published in Nature in October 2024 and shipped inside Gemini.
3. Google's own public statement of SynthID's limits.
4. OpenAI's explanation of why it built a text watermark and chose not to release it.
5. The theory paper arguing that strong watermarking — a watermark that survives a determined attacker — is impossible under plausible assumptions (Zhang et al., ICML 2024).

Every quotation below is verbatim from the linked source, checked on the date in the sources list. Where a claim could not be verified against the primary document, it does not appear.

The short version: watermarking works remarkably well against honest users and casual edits, has been deployed at consumer scale, and is still removable by paraphrase, translation, or trivial transformations — by the providers' own admission and by mathematical argument.

Kirchenbauer et al. (2023): the green-token scheme

The paper that most of the field builds on is "A Watermark for Large Language Models" by Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein (University of Maryland), presented at ICML 2023.

The core mechanism, in the authors' words:

"The watermark works by selecting a randomized set of 'green' tokens before a word is generated, and then softly promoting use of green tokens during sampling."

In other words: at each step of generation, a pseudorandom function (seeded by the preceding text) splits the vocabulary into a "green" set and its complement. The model is nudged — not forced — to prefer green tokens. A human reading the output sees nothing unusual. A verifier who knows the seeding scheme counts how many of the document's tokens landed in their green sets. In unwatermarked human text, roughly the expected fraction will be green by chance. In watermarked text, far more will be — and the excess is measurable.

Three properties the authors claim, each verbatim:

• The signal is "invisible to humans but algorithmically detectable from a short span of tokens."
• Detection does not require access to the model: the watermark can be "detected using an efficient open-source algorithm without access to the language model API or parameters."
• Detection is a "statistical test" with "interpretable p-values" — the verifier does not output a vibe, it outputs the probability that an unwatermarked text would show this much green by chance.

The authors also report "negligible impact on text quality" for their soft promotion scheme at reasonable strength settings.

Two things are worth stressing about what this design is:

It is a provider-side commitment, not a reader-side guess. Every detector reviewed in our detector-accuracy review works after the fact, with no cooperation from the text's producer. A watermark is the opposite: the producer plants evidence on purpose. That is why its statistical guarantees are so much cleaner — the p-value is real math, not a classifier's calibrated confidence.

It only covers models that choose to watermark. The scheme says nothing about text from a model whose operator did not embed the signal, an open-weights model run locally with the watermark stripped from the sampling code, or a model released before watermarking existed. Absence of a watermark is not evidence of human authorship — a point every document in this review agrees on.

SynthID-Text (Nature, 2024): the first deployment at scale

For a year and a half, generation-time watermarking was an academic proposal. In October 2024 it became a production system. Dathathri et al.'s "Scalable watermarking for identifying large language model outputs" appeared in Nature (vol. 634, pp. 818–823, 23 October 2024) and described SynthID-Text, Google DeepMind's scheme.

The paper's framing of what it achieved:

SynthID-Text "preserves text quality and enables high detection accuracy, with minimal latency overhead."

Mechanically, SynthID-Text replaces Kirchenbauer's single green/red split with "a tournament-like process": candidate tokens are compared against each other through multiple rounds of pseudorandom scoring functions, and the winner is emitted. The effect is the same in kind — the sampled text carries a statistical signature a keyed verifier can test for — but the tournament structure lets Google tune the quality/detectability trade-off more finely.

Three facts from the paper matter for anyone assessing whether watermarking is "real" yet:

1. It shipped. The paper states the system was "productionized in the user-facing Gemini and Gemini Advanced chatbots." This is not a lab demo; the paper describes a large live-traffic experiment using real Gemini user feedback to confirm that watermarked responses were not rated worse than unwatermarked ones.

2. The latency cost is tiny. In the reported configuration, generation went from 15.527 ms per token to 15.615 ms per token — an overhead of roughly half a percent. There is also a "distortionary" variant with stronger detection "at the cost of some quality loss"; the non-distortionary variant is the one described as deployed.

3. The authors state the limits themselves. The paper says the watermark is "weakened by edits to the text, such as through LLM paraphrasing," and — in a sentence worth quoting whenever a vendor claims otherwise —

"No text detection method is foolproof."

The paper names the open attack surface directly: "stealing, spoofing and scrubbing attacks", described as "an area of ongoing research." (Spoofing — forging a watermark onto text the model never produced — is the inverse problem, and arguably the scarier one for anyone accused on the basis of a watermark hit.) The authors also note that getting open-source models to watermark is "difficult" — once the weights and sampling code are public, nothing stops a user from sampling without the tournament.

What Google says about SynthID's limits

DeepMind's own blog post announcing the deployment is unusually candid, and because it is the vendor speaking about its own product, the caveats carry weight. The post confirms the deployment — "watermarking AI-generated text in the Gemini app and web experience" — and describes the mechanism as "modulating the likelihood of tokens being generated." It also announced plans at the time of publication: Google was "planning to open-source SynthID for text watermarking."

Then the limits, verbatim:

SynthID's "confidence scores can be greatly reduced when an AI-generated text is thoroughly rewritten or translated to another language."

and:

SynthID is "less effective on responses to factual prompts."

The second caveat is subtle and important. A watermark lives in the model's freedom to choose among tokens. Ask "What is the capital of France?" and there is essentially one right answer — there is no slack in which to hide a signal. The more constrained the correct output, the weaker the watermark. Short answers, lists of facts, code with one idiomatic form: all are hard cases by design of the problem, not by any flaw in SynthID.

The first caveat — rewriting and translation defeat it — matches exactly what the paraphrase-attack literature found for post-hoc detectors. Our paraphrase-attacks review covers Krishna et al.'s DIPPER experiments, where paraphrasing dropped a watermark detector's accuracy from 100% to 4.6% at a 1% false-positive rate. The watermark is a property of the specific token sequence the model emitted; a paraphrase replaces that sequence.

OpenAI: built it, measured it, did not ship it

OpenAI's page "Understanding the source of what we see and hear online" contains the company's public accounting of its own text-watermarking work. It is the most instructive document in this review, because it describes a watermark that worked — and then lists the reasons it was not released.

On effectiveness, OpenAI says its method has been:

"highly accurate and even effective against localized tampering, such as paraphrasing"

— note that this is a stronger robustness claim than Google makes, covering at least some paraphrase. But the same sentence continues:

"[it is] less robust against globalized tampering; like using translation systems, rewording with another generative model, or asking the model to insert a special character in between every word and then deleting that character - making it trivial to circumvention by bad actors."

Read that last attack again: ask the model to put a marker character between every word, then delete the markers. The watermark lives in token choices; mangling and un-mangling the tokenization destroys it. The circumvention requires no skill, no second model, and no cost.

OpenAI then gives two non-technical reasons for not deploying — both directly relevant to education:

Watermarking "could stigmatize use of AI as a useful writing tool for non-native English speakers."

"applying it to large volumes of text would lead to a large number of total false positives."

The first concern mirrors the bias findings in the detector-accuracy literature (see our review of non-native-speaker bias). The second is the base-rate arithmetic that haunts every detection method: even a tiny per-document false-positive rate, multiplied across millions of documents checked, produces a large absolute number of innocent people flagged. OpenAI is saying its watermark detector — with real statistical guarantees — still fails this test at scale.

Zhang et al. (ICML 2024): the impossibility result

The theory paper in this set is "Watermarks in the Sand" by Zhang, Edelman, Francati, Venturi, Ateniese, and Barak (Harvard/George Mason), published at ICML 2024. Its claim is the strongest in the literature:

Under their assumptions, "strong watermarking is impossible to achieve."

The argument's structure matters more than its formalism. Define a strong watermark as one that survives any attacker who wants to keep the text's quality and meaning. Assume the attacker has two capabilities:

1. A quality oracle — some way to check that a candidate rewrite is still good (for instance, another language model that can judge text quality).
2. A perturbation oracle — some way to make small meaning-preserving edits (for instance, another language model that can rephrase a sentence).

Given both, the attacker can random-walk through the space of quality-preserving variants of the watermarked text. The watermark was a property of one particular token sequence; the walk leaves the meaning intact while scrambling the sequence. Under these assumptions, no watermarking scheme — present or future — can survive.

The assumptions are not exotic. Any capable open LLM can serve as both oracles today. And the paper is not only theory: the authors empirically removed three published watermarks — Kirchenbauer et al.'s scheme among them — "with only minor quality degradation."

The practical reading: watermarking's robustness ceiling is set by the cost of running a second model over the text, and that cost is already near zero.

The five documents, side by side

Document	Venue, year	What it establishes	Stated limits
Kirchenbauer et al.	ICML 2023	Green-token watermark; detectable from short spans; open-source statistical test with p-values; negligible quality impact	Only covers cooperating models; later shown removable by paraphrase (Krishna et al.) and oracle attacks (Zhang et al.)
Dathathri et al. (SynthID-Text)	Nature, Oct 2024	First production deployment (Gemini); ~0.5% latency overhead; quality preserved per live user feedback	"Weakened by edits… such as through LLM paraphrasing"; "No text detection method is foolproof"; stealing/spoofing/scrubbing open
DeepMind blog	2024	Confirms Gemini deployment; open-sourcing planned	Confidence "greatly reduced" by thorough rewriting or translation; "less effective on responses to factual prompts"
OpenAI watermark page	—	A working watermark robust to localized paraphrase	"Trivial to circumvention"; non-native-speaker stigma; false positives at scale — not released
Zhang et al.	ICML 2024	Strong watermarking impossible under quality-oracle + perturbation-oracle assumptions; three schemes removed empirically	Result conditional on its assumptions — but the assumed capabilities already exist

What the literature does and does not establish

Established:

• Generation-time watermarking works as designed against unmodified output: detectable from short spans, verifiable with interpretable p-values, with negligible quality and latency cost (Kirchenbauer et al.; Dathathri et al.).
• It has been deployed at consumer scale. SynthID-Text ran inside Gemini with live user-feedback evaluation (Dathathri et al., Nature).
• Every provider that built one states, in its own documentation, that the watermark is removable: by LLM paraphrasing (Google), by thorough rewriting or translation (Google), by "globalized tampering" up to and including a character-insertion trick that is "trivial to circumvention" (OpenAI).
• There is a formal argument, with empirical demonstrations against three published schemes, that no watermark can survive an attacker equipped with a quality oracle and a perturbation oracle (Zhang et al.).
• Watermarking only ever covers cooperating models. Open-weights models can sample without the watermark, and text generated before deployment carries no signal.

Not established:

• That a watermark's absence says anything at all about a text. A document with no watermark could be human-written, written by a non-watermarking model, written by a watermarking model and then paraphrased, or generated locally from open weights. The literature supports none of these being distinguishable from the others by watermark testing.
• That watermark presence is immune to forgery. The Nature paper lists spoofing as an open attack class — so a positive hit is strong evidence, not proof, until spoofing is resolved.
• That any deployed watermark survives a motivated adversary. No study in this set demonstrates robustness against an attacker willing to spend one extra model pass.
• Detection rates for watermarked text "in the wild" across the full range of prompt types — the vendors themselves flag factual and short responses as weak cases, and no independent field study of deployed SynthID detection accuracy existed in the documents reviewed here.

Why this matters for provenance

Watermarking is the best-engineered answer to the question "did a cooperating model generate this exact text?" — and the documents above show it answering that question well. But an integrity case asks a different question: who did the work? On that question, watermarking is structurally silent in both directions. No watermark ≠ human. Watermark removed ≠ detectable. And the one student most likely to be harmed — per OpenAI's own stated concern — is the non-native speaker whose legitimate AI-assisted drafting gets stigmatized.

The alternative is evidence that attaches to the writing process rather than the output tokens: a record of how a document came to exist, created as it was written, that the writer can present when asked. That is what writing provenance is, and what a sealed writing record shows. A paraphrase attack can scrub a watermark; it cannot retroactively manufacture three hours of drafting history.

Related reading: paraphrase attacks on AI detectors · how accurate are AI text detectors? · how AI detectors work — and why they break