AI Watermarks
---
Research checked: 20 September 2026.
An AI watermark is a deliberately embedded signal that helps a detector recognize content produced by a participating system. It is different from a detector that guesses whether arbitrary text sounds machine-written. Watermarking changes generation or the generated artifact so that a later check can look for a particular pattern. Its usefulness depends on that pattern remaining detectable under the conditions in which the content is shared.
Source: Figure 1 from Kirchenbauer et al., “A Watermark for Large Language Models” (2023).
For text, one influential approach subtly biases token selection toward a context-dependent preferred subset. A detector then asks whether the observed preference is stronger than chance would predict. The result is statistical evidence accumulated over a sequence, rather than a visible label attached to a particular word. This creates tradeoffs among signal strength, generation quality, and the amount of text needed for detection. Kirchenbauer et al., A Watermark for Large Language Models.
SynthID-Text explores a scalable sampling-based approach designed to preserve output quality while enabling watermark detection. Its published evaluation includes a large deployment experiment. That is evidence for the evaluated method and conditions; it does not mean that every AI-generated passage carries a detectable watermark. The generator must participate, and the relevant detector must be available. Dathathri et al., Scalable Watermarking for Identifying Large Language Model Outputs.
Editing complicates detection. A short quotation may contain too little evidence. Substantial rewriting or translation can weaken the signal. Google's implementation guidance explicitly discusses reduced detector confidence under these transformations and supports uncertain outcomes alongside positive and negative classifications. A negative result therefore cannot establish human authorship. Google, SynthID: Tools for Watermarking and Detecting LLM-Generated Text.
Provenance metadata takes another approach. C2PA Content Credentials use signed assertions associated with media to communicate provenance information. This is conceptually different from embedding a statistical signal in pixels or token choices. Cryptographic validation can help establish integrity and the relationship to a signer, but it does not make every claim about an asset true. Provenance and watermarking can complement each other while answering different questions. C2PA Technical Specification, version 2.2.
An illustrative deployment shows why context matters. Suppose a platform wants to label images created by its own generator. It can control the embedding step and test common transformations such as resizing and recompression. A school trying to classify arbitrary essays faces a much harder problem: unknown generators, mixed human and machine writing, and unknown editing histories. The same confidence threshold would not automatically be appropriate for both uses.
I would evaluate a watermark using declared false-positive rates, minimum content lengths, realistic edits, and mixed-origin examples. Reports should say which generator and watermark family the detector can recognize. A positive result is evidence about a signal under a specified test; it does not identify who operated the model, establish intent, or prove that the content is accurate. Watermarks can make provenance more observable when their claims stay within those boundaries.