An AI watermark is a hidden signal placed in AI-generated content so software can later recognize where it came from. For images, that idea is familiar. For text, it sounds impossible. There are no pixels to hide anything in, just words.
It turns out you can watermark text by nudging which words a model picks. Researchers have shown it works, and at least one large lab has tested it at scale. The method also has clear limits, and those limits matter if you're a teacher, editor or student trying to understand what a "watermark check" can tell you.
This guide explains how text and image watermarks work in plain English, where they break down, how they differ from AI detectors, and what EU rules now say about marking AI content.
What is an AI watermark?
An AI watermark is a signal embedded in AI-generated text, images, audio or video that marks it as machine-made. Unlike a visible logo, it's usually invisible to people and readable only by software that knows what to look for. For text, the signal sits in subtle word choices. For images, it can sit in the pixels or in signed metadata attached to the file. A watermark only exists if the AI provider adds it at the time of generation.
How do AI text watermarks work?
Most text watermarks work by biasing the model's word choices in a pattern only the detector knows. Each choice looks normal on its own. Across a few hundred words, the pattern becomes statistically obvious.
The green list and red list idea
The best-known method comes from John Kirchenbauer and colleagues, first posted in January 2023 and presented at ICML 2023. Here's how it works, step by step.
Before the model writes each word, the system takes the previous word and runs it through a hash function. That gives a number, which seeds a random generator.
The generator splits the model's whole vocabulary into two groups. One is the "green list." The rest is the "red list."
The model gets a small nudge toward green words. In the "soft" version, it adds a bonus to green words' scores but can still pick a red word when that's clearly the better choice.
Later, a detector with the same hash method re-creates the green list for each position and counts how many words landed in it.
Human writing hits green words about as often as chance predicts. Watermarked text hits far more. The detector turns that gap into a z-score, and the paper uses a threshold of 4, which corresponds to roughly a 3 in 100,000 chance of a false alarm by luck.
Here's a toy example. Say the previous word is "the" and the secret split puts "river," "garden" and "station" on the green list, but "park" and "city" on the red list. A watermarked model writing "We met at the..." leans toward "garden." One word proves nothing. Two hundred words that keep landing on green lists do.
The soft approach matters for quality. When only one word makes sense, as in "The capital of France is...", the model can ignore the nudge. The paper notes this "low entropy" text is the hard case. If there's only one sensible answer, people and models write the same thing, and no watermark can tell them apart.
Tournament sampling in SynthID-Text
In October 2024, a team led by Sumanth Dathathri at Google DeepMind published "Scalable watermarking for identifying large language model outputs" in Nature. It describes SynthID-Text, which uses a different trick called tournament sampling.
Instead of one nudge, the model proposes several candidate words. Each candidate gets random scores from secret watermarking functions. The candidates face off in pairs, round by round, like a knockout bracket, and the winner becomes the next word. Words that tend to win these secret tournaments leave a pattern a detector can score.
The team tested it in a live experiment on nearly 20 million chatbot responses. Users rated responses with thumbs up or thumbs down. The difference in ratings between watermarked and unwatermarked responses was tiny and not statistically significant. That's a large real-world test, and it suggests text watermarking needn't hurt quality.
How do image watermarks and C2PA content credentials work?
Images use two separate approaches. Invisible watermarks hide a signal in the pixels. Provenance standards attach a signed record of where the file came from and how it was edited.
The main provenance standard is C2PA, from the Coalition for Content Provenance and Authenticity. It's an open technical standard, and its records are called Content Credentials. C2PA describes them as working like a nutrition label for digital content.
Here's the basic idea. A C2PA manifest is a set of statements, called assertions, about a file. They can say which tool created it, what edits were made, and whether AI was involved. Those statements are hashed and digitally signed, then bound to the file. If someone changes the image or the record, the signature no longer matches.
There's an important limit. Metadata can be stripped, for example when an image is screenshotted or re-saved by some apps. C2PA handles this with "soft bindings," which use invisible watermarks or fingerprint lookups to find the original record online. The C2PA explainer also says plainly that provenance information alone can't tell you whether content is true, accurate or factual. It tells you where a file came from. It doesn't tell you whether to believe it.
Approach | What it marks | How it's checked | Main weakness |
|---|---|---|---|
Text watermark | Word choices | Count words that fit a secret pattern | Paraphrasing, translation, short texts |
Invisible image watermark | Pixels | Software reads the hidden signal | Heavy edits or crops can damage it |
C2PA content credentials | Signed record attached to the file | Verify the signature and read the history | Metadata stripped by screenshots or re-saves |
Statistical AI detection | Nothing added | Estimate from patterns in the content | Estimates only, weaker on some kinds of text |
Can AI text watermarks be removed?
Yes, often. Text watermarks get weaker when the wording changes, and several kinds of change are common in everyday use. That's why a missing watermark tells you very little.
Paraphrasing. The Nature paper on SynthID-Text says directly that generative watermarks are weakened by edits, including paraphrasing by another model. Kirchenbauer's group studied this in a follow-up paper at ICLR 2024. They found watermarks often survive, because paraphrases keep fragments of the original. But after strong human paraphrasing, they needed around 800 tokens of text to detect the watermark at a strict false alarm rate.
Translation. A 2024 ACL paper by He and colleagues tested what happens when watermarked text is translated into another language. Their translation-based attack pushed detection performance down to random-guessing levels.
Short texts. The detector needs enough words to see the pattern. A two-sentence answer simply doesn't contain much evidence.
Low-variety text. Code, lists and factual answers leave the model fewer choices, so there's less room to hide a signal.
Open models. Anyone can download an open model and run it without a watermark. The SynthID-Text authors note that enforcing watermarking on models deployed in a decentralized way is difficult.
What's the difference between watermark detection and AI detection?
Watermark detection looks for a signal the AI provider deliberately added. Statistical AI detection, which is what most AI detectors do, estimates whether text reads like AI based on patterns in the writing itself.
That difference shapes what each one can say. A watermark check can give strong evidence, but only for text from a model that used that watermark, and only if you have the right detector. It can't say anything about text from other models. A statistical detector works on text from any source, but its output is an estimate. Our guide to how AI detectors work explains the patterns they measure, and our post on whether AI detectors can be wrong covers their weak spots.
In practice, the two tools complement each other. Watermarks help when a provider has added them and the text hasn't changed much. Statistical detection fills the gap for everything else. Neither should be the sole basis for accusing someone.
What does the EU AI Act say about watermarking AI content?
The EU AI Act requires providers of generative AI systems to mark their output so it can be detected as AI-made. These transparency rules, in Article 50, apply from 2 August 2026.
Article 50(2) says providers of AI systems that generate synthetic audio, image, video or text must make sure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Article 50(4) adds labeling duties for people who deploy AI. Deepfakes must be disclosed, and so must AI-generated text published to inform the public on matters of public interest, unless a human has reviewed it and taken editorial responsibility.
Two updates since then matter:
A grace period. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. According to a White & Case summary, systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking requirement.
A code of practice. On 10 June 2026, the European Commission published a voluntary Code of Practice on marking and labeling AI-generated content. Jones Day's summary says signatories use at least two layers of marking, such as metadata plus watermarks, because no single technique fully meets the requirement.
That multi-layer approach is a quiet admission of everything above. Each method breaks in some situations, so providers stack them.
What should teachers and editors take from all this?
Treat watermarks as one useful signal that's missing far more often than it's present. A positive watermark result can be strong evidence. A negative result proves almost nothing.
Here's a practical way to use what you now know:
If a tool reports a watermark, note which model it covers and how long the text was.
If no watermark is found, don't read that as proof of human writing. The text may come from another model or may have been edited.
For images, check for content credentials with a C2PA verification tool, and remember that missing credentials are common.
For student or contributor work, rely most on process evidence such as drafts, version history and a conversation.
It's also a great topic for an AI literacy lesson. Students who understand watermarks understand why "Was this made by AI?" rarely has a one-click answer.
If you want a second view on a piece of text right now, you can paste it into our free AI detector. It estimates how much the writing reads like AI and highlights the sentences that read most like AI, and you can read how it works first. Before you rely on any watermark claim, ask which models it covers and how much text it needs.
Frequently asked questions
Can AI-generated text be watermarked?
Yes. Researchers have shown that a language model can be nudged toward a secret pattern of word choices that software can later detect. A 2024 Nature paper reported testing one such method on nearly 20 million live chatbot responses with no significant change in user ratings. The watermark only exists if the model's provider adds it when the text is generated.
Can you see an AI watermark in text?
No. A text watermark lives in which words were chosen, and each choice looks natural. You can't spot it by reading. Only a detector that knows the secret method can count the pattern and calculate how unlikely it would be by chance. That's also why you can't confirm a watermark yourself without access to the right detection tool.
Does paraphrasing remove an AI watermark?
It weakens it, sometimes a lot. Research presented at ICLR 2024 found watermarks often survive paraphrasing because fragments of the original remain, but strong human rewrites meant detection needed around 800 tokens of text. Translation is harder on watermarks still. A 2024 ACL study found a translation-based attack cut detection to chance level.
What is C2PA?
C2PA, the Coalition for Content Provenance and Authenticity, is an open technical standard for recording where digital content came from and how it was edited. Its records, called Content Credentials, are digitally signed and attached to files like images and video. They show origin and history, but C2PA itself notes that provenance can't tell you whether content is true.
Is a watermark better than an AI detector?
They do different jobs. A watermark gives strong evidence when it's present, but only for content from models that add one, and it can be weakened by edits. AI detectors estimate from writing patterns and work on text from any source, but their scores are estimates. Using both, alongside human judgment, gives a fuller picture than either alone.
When do EU AI watermarking rules apply?
Article 50 of the EU AI Act, which requires machine-readable marking of AI-generated content, applies from 2 August 2026. The Digital Omnibus on AI gave systems already on the market before that date until 2 December 2026 to comply. A voluntary Code of Practice published in June 2026 explains how providers can meet the rule.
Sources
A Watermark for Large Language Models, Kirchenbauer et al., ICML 2023, first posted 24 January 2023
On the Reliability of Watermarks for Large Language Models, Kirchenbauer et al., ICLR 2024, first posted 7 June 2023
Scalable watermarking for identifying large language model outputs, Dathathri et al., Nature, 23 October 2024
Can Watermarks Survive Translation? On the Cross-lingual Consistency of Text Watermark for Large Language Models, He et al., ACL 2024, February 2024
C2PA: Coalition for Content Provenance and Authenticity, C2PA, accessed October 2026
C2PA Specifications 2.2 Explainer, C2PA, accessed October 2026
Article 50: Transparency obligations for providers and deployers of certain AI systems, EU Artificial Intelligence Act, accessed October 2026
EU AI Omnibus enters into force, amending the AI Act, White & Case, 4 August 2026
Commission publishes Code of Practice on marking and labelling AI-generated content, European Commission, 10 June 2026
European Commission Publishes Final Code of Practice on AI Labelling and Transparency, Jones Day, June 2026
Comments