Understanding AI Text Watermarks

I have been trying to understand AI-generated text watermarking: what it is, how it works, why companies are using it, and why people say it can be bypassed.

These notes are based mainly on a short PDF summary I gathered from an Alberta Tech video about Google SynthID, Claude-style watermarking, pseudo-random token selection, and the practical limits of detection.

What is an AI text watermark?

When I first heard the phrase “AI watermark,” I imagined something visible, like a footer that says:

Generated by AI

But text watermarking, at least in the systems described here, is not like that.

The watermark is invisible to the reader. It is not a hidden character or a visible label. Instead, it is a statistical pattern placed into the generated text while the model is choosing its next tokens.

So the text still looks normal, but the model provider may later be able to test whether the text carries a detectable statistical signature.

Why watermark AI-generated text?

The main motivation seems to be provenance: being able to identify whether a piece of text was likely generated by a specific AI system.

From the notes, some reasons include:

• Regulatory compliance, especially with rules like the European Union AI Act.
• Content provenance, where platforms, publishers, schools, or organizations want to know whether text came from a machine-generated draft.
• Attribution, especially when people are trying to separate human writing from AI-assisted writing.
• Invisible labeling, where the user experience is not interrupted by obvious badges or footers.

This part makes sense to me in theory. If synthetic content is becoming common, then some kind of provenance system seems useful.

But the hard part is that writing is messy. People edit. People paraphrase. People use AI as a drafting tool, not always as a final-output machine. That makes the watermarking question more complicated.

How the watermark works, as I understand it

The basic idea is that modern language models generate text one token at a time. At each step, the model predicts many possible next tokens and assigns probabilities to them.

A normal generation process might choose from likely tokens using methods like top-k or top-p sampling.

A watermarking system adds another layer on top of this. According to the notes, systems like SynthID use controlled pseudo-randomness. Candidate tokens are evaluated through something like a tournament process using secret-key-derived values.

My simplified understanding is:

1. The model predicts possible next tokens.
2. The watermarking system uses a secret key to assign pseudo-random values to token choices.
3. The generator slightly favors token choices that help create a detectable statistical pattern.
4. The final text still looks natural.
5. Over a long enough passage, the provider can test whether the statistical pattern is present.

The important part is that this does not mean every token is obviously suspicious. The watermark is only meaningful over a larger sample of text.

Why it can preserve text quality

One interesting claim in the material is that watermarking can preserve output quality because it works within the normal probability range of the model.

In other words, the system is not forcing bizarre word choices just to encode a signal. It is choosing among plausible next tokens.

That is why the watermark can be invisible to readers. If done carefully, the text should still read like normal AI-generated text.

The notes also mention that Google studied this across many Gemini interactions and found no discernible quality drop. I am not evaluating that claim myself here, but it is one of the stated arguments in favor of this approach.

The benefits I noted

Here are the strongest arguments for text watermarking from my notes:

• It is invisible. Readers do not see ugly labels or inserted markers.
• It can preserve quality. The model still chooses likely tokens.
• It may help with regulation. AI labs can show that they have some way to identify synthetic content.
• It can support provenance. In longer passages, it may help determine whether text came from a particular model.
• It can survive small edits. A typo or a few word changes may not be enough to remove the statistical signal.

This is the part where watermarking sounds elegant: subtle, mathematical, and mostly invisible.

The limitations that stood out to me

The limitations are where the topic gets more interesting.

Short text is hard to detect

Watermarking needs enough text for the statistics to become meaningful. A single sentence or very short paragraph may not provide enough signal.

The notes suggest that detection becomes more practical over longer passages, such as multiple paragraphs.

This makes intuitive sense. If the watermark is statistical, then it needs a sample size.

Code is a weak case

Code seems especially difficult to watermark.

In code, many tokens are highly constrained. If the model is writing a function, a bracket, comma, indentation pattern, or keyword may be almost forced by syntax.

When there is very little freedom in token choice, there is less room to embed a watermark. The notes describe this as a low-entropy situation, where the token choice is so obvious that watermarking has little influence.

So watermarking may work better for prose than for deterministic or structured outputs like:

• code
• JSON
• tables
• strict templates
• highly constrained formats

Detection is centralized

Another issue is that the model provider usually holds the secret key.

That means reliable detection may depend on the company that created the watermark. This creates a trust and governance question:

• Who gets access to the detector?
• Can users challenge a result?
• What happens if a false accusation is made?
• Does the provider become the authority over authorship?

This part feels important because watermarking is not only a technical system. It also becomes an institutional power system.

Authorship can get blurry

I also worry about ordinary mixed-use cases.

For example:

• Someone asks AI to draft an email, then rewrites it heavily.
• A student uses AI to brainstorm, but writes the final version themselves.
• A developer uses AI for documentation and edits the result.
• A writer uses AI to outline, then rewrites from scratch.

At what point is the final text “AI-generated”? At what point is it human-authored? A watermark can help identify origin, but it does not automatically answer the authorship question.

Can watermarks be removed?

The material discusses several ways that watermark signals can be weakened or removed. I am treating these more as limitations of the technology than as recommendations.

Because the watermark depends on a particular token sequence and statistical pattern, anything that substantially changes the token sequence can damage the signal.

The broad categories mentioned are:

• Paraphrasing, where the sentence structure and word choices are rewritten.
• Translation and back-translation, where text is translated into another language and then back again.
• Heavy human editing, where paragraphs are reordered, sentences are merged or split, and vocabulary changes.
• Highly constrained prompting, where the model has too little freedom to choose alternate tokens.
• Using local or open-weight models, where the generation pipeline may not include the same corporate watermarking system.

The big lesson for me is that text watermarking is not the same as a permanent cryptographic signature. It is more like a statistical trace. Statistical traces can be useful, but they can also become weaker when the text is transformed.

A simple comparison

Here is the way I am currently organizing the idea in my head:

My current takeaway

AI text watermarking seems clever, but not magical.

It is useful because it can add an invisible statistical signature without obviously damaging the generated text. That could help with provenance, regulation, and platform-level transparency.

But it also has real limits:

• It needs enough text.
• It struggles with low-entropy output like code.
• It depends on secret keys and centralized verification.
• It can be weakened by substantial rewriting.
• It does not solve the deeper social question of authorship.

So my current view is that watermarking may be one useful tool, but it should not be treated as a complete solution for detecting AI writing. It gives a probabilistic signal, not a full explanation of how a piece of text was created.

And for something as sensitive as authorship, trust, or academic integrity, that distinction matters.

References

• AI_Text_Watermarking_Pros_Cons_Removal.pdf
• Alberta Tech video: Google has secretly been watermarking your text for years