AI Text Watermarking and Content Provenance

Branding something with no physical form

The word watermark comes from paper. Hold a banknote to the light and a face appears, pressed into the fibres; the mark is part of the physical object and you cannot copy the note without copying the mark. That is the mental picture most people carry into any conversation about watermarking, and it is the wrong one for plain text. Digital text has no fibres and no substrate. A paragraph is just a sequence of characters, and any character you could hide inside it, an invisible space, a swapped quotation mark, a zero-width joiner, can be stripped out by pasting the text into a plain editor. If a watermark were a hidden character, defeating it would take three seconds.

So the providers did something less obvious. Rather than adding a mark on top of the words, they changed how the words themselves are chosen, so that the mark is carried by the visible text and cannot be removed without rewriting it. Understanding that idea is the whole of this section, and it matters at a university because the same mechanism is now being read, by staff and by software, as if it answered a question it cannot answer: did a person write this.

Two different mechanisms: files and text

It helps to separate two things that are often confused, because they work in completely different ways.

For files such as images, providers attach signed provenance metadata following an open standard called C2PA, the Coalition for Content Provenance and Authenticity. Think of it as a cryptographically signed shipping manifest that rides alongside the file: it records what made the file, with which tool, and whether it has been altered since. Because the standard is open, anyone can build a reader that checks the manifest and verifies the origin. The strength of C2PA is that it is verifiable and interoperable; the weakness is that it is a wrapper around the content, not the content itself, so it survives only while nothing disturbs the wrapper.

That wrapper is easy to lose, and usually not on purpose. Take a screenshot of a provenance-stamped image and the screenshot is a brand-new file created by the operating system, with no manifest attached. Upload the original to almost any social platform and its compression pipeline strips the metadata to save space. C2PA is designed for cooperative systems that agree to preserve and read the manifest; it was never built to withstand someone who wants the mark gone, and most ordinary sharing removes it without anyone intending to.

Text watermarking is the second mechanism, and it is the one causing the argument, because it does not rely on a wrapper at all.

What a text watermark actually is

The common assumption on developer forums is that AI text watermarking is a bag of formatting tricks: hidden Unicode, zero-width spaces, curly quotes standing in for straight ones. It is a reasonable guess, and it is wrong, for the reason given above: anything sitting on top of the text washes out the moment the text is retyped or pasted as plain characters.

The text watermark is not a layer on top of the words. The mark is the words. When a provider says the mark is woven into the text, it means the mark consists of the actual visible word choices the model made while writing. It survives being copied into a plain-text editor because what you are copying is the pattern of word choices itself. You cannot remove it without genuinely rewriting the sentences, which is a very different level of effort from running a find-and-replace.

Green lists, red lists and the z-score

To see how word choices can carry a hidden pattern without turning the writing into nonsense, you have to look at how a language model produces text. It does not plan a paragraph; it predicts one token, usually a word or word fragment, at a time, choosing from a ranked list of likely next tokens. The published research describes the underlying method even though providers keep their own keys secret; the clearest account is the scheme by Kirchenbauer and colleagues, presented at ICML in 2023, and the same idea sits behind Google's SynthID for text.

Freeze the moment before the model writes its next word. Suppose the text so far is "the night sky was incredibly". The model has computed probabilities for thousands of possible next words: perhaps dark, clear, beautiful, vast, each a perfectly acceptable continuation. Without a watermark, it samples from that ranked list and continues. With a watermark, a step is inserted first: a pseudo-random generator, seeded by a secret key and by the preceding words, splits the entire vocabulary into a green list and a red list for this one position. The algorithm then nudges the model toward a green-list word. If the model's favourite, dark, is on the red list, it is quietly passed over in favour of the best available green word, say beautiful. A reader sees nothing unusual; the sentence still reads well.

The signal only appears over distance. Across hundreds of words, watermarked text lands on green-list words far more often than chance would produce, because a thumb was on the scale at every step. A detector holding the same secret key can replay the split at each position, count how often the text used a green word, and compare that to the roughly half-and-half a person writing freely would produce. That comparison is expressed as a z-score, a measure of how many standard deviations the green-word count sits above what chance predicts. A z-score near zero looks human; a high z-score says the text follows the provider's pattern. The demonstration below lets you watch the count and the z-score move as a sentence is built, with the watermark on and off.

See the mark form

Step through the same sentence twice. With the watermark switched off, the model takes its top-ranked word at each step, and the green words fall where they may, so the z-score drifts around zero. Switch the watermark on and the model is pushed onto the green list at each step; the green count climbs and the z-score rises, all while the sentence still reads normally.

Where the mark is strong, and where it thins to nothing

Whether the watermark holds depends on how much freedom the model had while writing, a quantity information theory calls entropy: the number of reasonable choices available at each step. Where entropy is high the mark is robust; where it is low the mark weakens or fails, and this is a property of the mechanism rather than a trick anyone has to perform.

Ordinary prose is high-entropy. Ask for a blog post or a client email and there are many acceptable ways to phrase each sentence, so the model can nearly always find a green-list word that still reads well and the mark embeds cleanly. Source code is the opposite. Its syntax is rigid; a given line often has only one or two correct continuations, and if the correct token lands on the red list the model must either break from the green list or accept a worse token, which in code can mean an odd variable name, a clumsier structure, or an outright error. Research on watermarking low-entropy text documents this trade-off directly: pushing the mark into constrained output degrades the output or the mark, and often both.

Code rarely keeps the mark for a second reason. The moment it is pasted into a development environment, an auto-formatter such as Prettier or Black rewrites the spacing and standardises the layout. That reformatting scrambles the exact token sequence the mark depends on, and the green-to-red pattern is lost as a side effect, with no intent to evade. More deliberate removal is also documented: peer-reviewed work by Sadasivan and colleagues (2023) shows that paraphrasing tools can rewrite text enough to defeat watermarks and statistical detectors, which is why "humaniser" services that launder AI text past detectors are sold openly. The honest summary is that the mark is real and hard to remove by accident in ordinary prose, and at the same time genuinely fragile in low-entropy text and against a determined rewrite.

SynthID and signed provenance in practice

Google's SynthID is the most developed public example of the approach, covering both text, using the green-list style of token sampling, and images and other media, using an imperceptible pattern embedded across the file and described in a 2024 paper in Nature. Google states that its media watermark is designed to survive common edits such as cropping, compression and colour changes. That robustness figure is the provider's own claim about its own tool, and is worth treating as such: a vendor statement, not independent confirmation, and separate from the fragility of the C2PA metadata wrapper discussed above, which is a different layer.

Watermarking is only one of the ways software tries to identify AI text. A separate approach, stylistic detection, ignores any hidden mark and instead looks for the statistical fingerprints of machine writing, and it is the subject of the companion section on how detection technology works. The two are easy to confuse but are not the same thing: a watermark is a signal a provider deliberately put there and can verify with a key; a stylistic detector is a trained guess about text it was never given a key for.

The regulatory driver: the EU AI Act

None of this was a spontaneous choice by the providers. The trigger was the European Union's AI Act, and specifically Article 50, which sets transparency obligations for AI-generated content, backed by a voluntary code of practice that major model providers signed. As the relevant obligations took effect in 2026, providers implemented marking on new models to stay compliant and keep access to the European market. The Act is, in spirit, a successor to the GDPR, the European data-protection law that reshaped privacy practice well beyond Europe.

The striking part is that the mark was not confined to Europe. A provider could in principle run one pipeline that marks text for European users and another that does not for everyone else, but maintaining two separate paths roughly doubles the engineering burden and complicates every enterprise deployment that crosses borders. It is cheaper and simpler to build one pipeline and apply the mark everywhere. The practical result is the same dynamic the GDPR produced: a European rule became a worldwide default, not because other countries adopted it, but because global providers found it easier to meet the strictest requirement everywhere. For a university in the Northern Territory, that means text from a compliant model arrives marked regardless of where the student or the staff member sits.

A smoke alarm, not a meter

Here is where the mechanism collides with how the mark is being used. A watermark detector reports whether the provider's pattern is present. It does not, and cannot, report how much of the document the model wrote, because the mark is added during output and carries no record of the input. The provider's own guidance on these tools makes the same point: a detected mark shows the text was processed by the model, not that the model authored it.

Consider a student who writes an original ten-page essay entirely themselves, then pastes it into the tool at the end and asks only for the commas to be fixed and the spelling checked. The tool reads the human text and returns it corrected, and while producing that output it runs the sampling algorithm and weaves in the mark. The essay is now watermarked, and a detector will say so, even though every idea and almost every word is the student's own. The mark cannot tell "write me an essay" apart from "fix the typos in my essay", because both produce marked output.

That is why a watermark, like the stylistic detectors beside it, is a smoke alarm rather than a meter. When it sounds, something is worth a look; it does not tell you whether the cause is a house fire or burnt toast, and it produces a weak positive signal and essentially no reliable negative one. What an integrity process can actually do with a signal like this, once base rates and fair procedure are taken into account, is worked through in Detection as Evidence, Not Verdict, and the arithmetic of false positives across a whole cohort is set out with a calculator in How Detection Technology Works.

What none of this proves

Watermarking is a real engineering achievement and a reasonable response to a genuine transparency problem: at scale, it helps identify which content came from which system. The mistake is to carry that population-level usefulness down to the individual case. A mark establishes that text touched a particular model. It does not establish authorship, it does not measure the human contribution, and its absence proves nothing either, because the mark can be diluted by a low-entropy task, lost to a reformat, or rewritten away.

The practical posture that follows is the same one this workshop returns to throughout. Treat any watermark or detector result as one signal among several, never as a verdict; ask what the signal can actually support before acting on it; and keep the burden of an allegation where fair process puts it, on evidence a student can see and answer, not on a number that no one, including the person reading it, can independently check.

Explore

The interactive walkthrough deck below covers the same ground as a presenter-led session, with a step-through word generator, the SynthID image example, and the EU AI Act timeline. It suits a one-hour taster or self-paced study.

Its final module is a watermark playground. A small stand-in model writes a passage with the mark off, hard or soft, and a detector built on the Kirchenbauer z-score counts the green-list words and reports whether the mark is there. The human-written history of CDU from Wikipedia is pre-loaded as the control text; paste in anything of your own and the detector scores it without needing the model. Two settings worth showing a room: change one letter of the detector key and the mark vanishes, and switch from the creative passage to the factual one to see how little room names and dates leave for a mark.

Sources

Claims on this page draw on the peer-reviewed and primary record; provider material is used only for what providers say about their own tools, and is labelled as such wherever it appears. Verification of the underlying claim set was completed on 17 August 2026 for the companion deck.

• Article 50, Regulation (EU) 2024/1689 (EU AI Act), full text via the AI Act Explorer, artificialintelligenceact.eu, accessed 17 August 2026. Transparency obligations for AI-generated content.
• European Commission Digital Strategy, "Transparency obligations under Article 50 AI Act" and the Code of Practice on Transparency of AI-generated Content, accessed 14 August 2026.
• Kirchenbauer, Geiping, Wen, Katz, Miers and Goldstein, A Watermark for Large Language Models, ICML 2023, arXiv, 24 January 2023. The green-list / red-list mechanism and the z-score.
• Dathathri, See, Ghaisas and colleagues, Scalable watermarking for identifying large language model outputs, Nature 634, 23 October 2024. SynthID for text.
• SynthID, Google DeepMind, deepmind.google, accessed 17 August 2026. Coverage across text, image, audio and video; edit-robustness description is Google's own claim about its own tool.
• Sadasivan, Kumar, Balasubramanian, Wang and Feizi, Can AI-Generated Text be Reliably Detected?, arXiv 2303.11156, first posted March 2023. Paraphrase attacks against watermarks and detectors.
• Research on watermarking low-entropy generation (for example arXiv 2405.14604), on the quality-versus-robustness trade-off in constrained text such as code, accessed 14 August 2026.
• Coalition for Content Provenance and Authenticity (C2PA), c2pa.org, accessed 17 August 2026. The signed-provenance standard and its scope as a metadata wrapper.
• Provider guidance on marking AI-generated content, stating that a detected mark shows text was processed by the model rather than authored by it, accessed 14 August 2026.