If a student submits an AI-written essay, can a teacher prove it? If a propaganda network floods social media with AI-generated articles, can platforms detect and label them? If a company’s earnings report was drafted by AI, do investors have a right to know? These questions have moved from academic discussion to urgent practical concern, and the technology for answering them — AI text watermarking and detection — is in an arms race with the technology for evading it.
How AI text watermarking works
Text watermarking embeds a statistical signal into AI-generated text that’s imperceptible to human readers but detectable by algorithms. The leading approach, developed at the University of Maryland and refined across several research labs, works by subtly biasing the model’s token selection during generation.
In normal operation, an LLM selects the next token from a probability distribution. A watermarked model uses a pseudorandom function — seeded by the preceding tokens — to divide the vocabulary into a “green list” and a “red list” for each generation step. The model is slightly biased to prefer green-list tokens. The result: watermarked text contains a statistically detectable surplus of green-list tokens compared to human-written text, even though individual word choices appear natural.
The watermark is robust to common modifications — paraphrasing, translation, minor editing — because the green-list bias persists through these transformations. It’s also invisible to human readers because green-list tokens aren’t noticeably different from red-list tokens; the bias is statistical, not semantic.
Who is deploying watermarking
OpenAI has deployed watermarking in ChatGPT’s API output since late 2025, with detection available through a dedicated endpoint. The company reports a detection accuracy of 99.9% for unmodified watermarked text, dropping to roughly 85% after moderate paraphrasing. ChatGPT’s consumer interface doesn’t currently apply watermarking, though OpenAI has indicated this may change.
Google DeepMind’s SynthID for text, released in mid-2025, takes a different approach: rather than biasing token selection, it modifies the probability distribution itself. The resulting watermark is more robust to paraphrasing but computationally more expensive to embed. SynthID is deployed across Google’s AI products and available as an API for third-party use.
The Coalition for Content Provenance and Authenticity (C2PA) — the same consortium behind Adobe’s Content Authenticity Initiative — has expanded its provenance standard to include AI text metadata. The standard defines how AI systems should declare their involvement in content creation, enabling downstream tools and platforms to surface this information to users.
The evasion arms race
The sobering reality is that all current text watermarking can be defeated with sufficient effort. Paraphrasing through another AI model strips most watermark signals. Translating to another language and back removes them almost entirely. Manual editing at scale is impractical, but running AI-generated text through a “de-watermarking” model — trained specifically to neutralize the statistical signatures — is entirely feasible.
This creates an asymmetric dynamic: watermarking makes casual, low-effort AI text generation detectable, which covers the majority of real-world misuse cases (student cheating, spam, low-quality content farms). But sophisticated adversaries — state-sponsored disinformation operations, determined plagiarists — can defeat watermarking with moderate effort.
The AI detection paradox also persists: as AI-generated text becomes more human-like, the features that distinguish it from human writing become subtler and harder to detect. A detector that’s sensitive enough to catch sophisticated AI text will inevitably produce false positives — flagging human writing as AI-generated. These false positives carry serious consequences when they affect students accused of cheating or writers whose work is mislabeled.
Policy and norms
Given the technical limitations, the most important developments in AI text detection may be institutional rather than technological. Universities are rewriting academic integrity policies to focus on process rather than product — requiring students to document their writing process, demonstrate understanding of their own work, and disclose AI assistance rather than relying on detection tools to catch violations.
Platforms are adopting labeling requirements rather than detection-based enforcement. YouTube requires creators to disclose when content contains AI-generated elements. Several states have passed laws requiring political campaigns to label AI-generated advertising. These approaches acknowledge the limitations of detection while establishing norms of transparency.
The bottom line
Perfect AI text detection is probably impossible — a consequence of the fundamental similarity between high-quality AI writing and human writing. But perfect detection isn’t necessary for meaningful progress. A layered approach combining watermarking for casual detection, provenance standards for transparency, and institutional policies for accountability can address the majority of AI text misuse cases. The goal isn’t to make AI text impossible to hide — it’s to make dishonesty about AI use reliably detectable and socially costly.