Does watermarking AI-generated text actually work?

How it works

A text watermark nudges the model's word choices in a pattern that is invisible to readers but statistically detectable by someone who knows the key. The influential early design is Kirchenbauer and colleagues' "A Watermark for Large Language Models", presented at ICML 2023, which splits the vocabulary into "green" and "red" lists at each step and slightly favours green words. A detector counts green words and runs a statistical test.

Google DeepMind described a production system in Dathathri and colleagues' "Scalable watermarking for identifying large language model outputs", published in Nature in October 2024. It changes only the sampling step, does not need the original model to detect the watermark, and the authors report it preserved text quality in a large live test. The paper also states the key limitation plainly: watermarks can be circumvented by editing or paraphrasing.

Three ways to tell where text came from

Approach	Who controls it	Can give positive proof?	Weak point
Style-based detector	Anyone, after the fact	No, only a probability (see accuracy thread)	False positives, bias, easy to evade by editing
Text watermark	The model provider, at generation time	Yes, when the key holder checks	Only covers watermarked models; paraphrasing erodes it
Signed provenance (C2PA-style)	The producer or tool, at creation time	Yes, for the file's history (see C2PA thread)	Optional; stripped by screenshots and re-encoding

What that means in practice

• Coverage is the real constraint. A watermark only exists if the provider chose to add it. Text from open models, or from providers that do not watermark, carries nothing to detect.
• Detection needs the key. Generally only the provider, or partners it shares detection with, can check for its watermark.
• Editing erodes it. Short passages and heavily rewritten text may not carry enough signal for a confident result. The thread on humanizers and paraphrasers covers what the research says about deliberate rewriting.