AI Text Watermarking: How It Works, How It's Detected, and How It Can Be Circumvented

Introduction: Why AI Watermarking Is Suddenly in the Spotlight

Earlier this month, Anthropic announced it would be embedding invisible text watermarks in Claude's outputs — a move that quickly sparked widespread discussion across the industry. Meanwhile, the European Commission revealed that several companies, including Black Forest Labs and OpenAI, have similarly committed to marking AI-generated content with identifiable signals.

As regulatory pressure mounts and demands for technical transparency grow, AI text watermarking is rapidly evolving from an academic curiosity into a practical challenge the entire industry must confront. Two core questions are worth exploring in depth: How do AI text watermarks actually work? And can they be circumvented or erased?

How AI Text Watermarking Works

What Is a Text Watermark?

Unlike image watermarking, text watermarking can't simply embed invisible information at the pixel level. Text is a discrete sequence of symbols — any modification risks altering its meaning. AI text watermarks therefore rely on a more sophisticated approach: embedding statistical signals by subtly adjusting the probability distribution over vocabulary choices during text generation.

In simple terms, when a language model generates each word, it samples from a candidate vocabulary according to learned probabilities. A watermarking algorithm divides this vocabulary into a "green list" and a "red list," then slightly biases the sampling probabilities so the model is more likely to choose words from the green list.

How the Invisible Statistical Signal Works

This bias is nearly imperceptible to human readers — the text still reads naturally and fluently. But from a statistical perspective, watermarked text will contain green-list words at a significantly higher frequency than random chance would predict. A detector holding the secret key used during generation (which determines the green/red list partitioning) can then apply a statistical test to determine whether a given piece of text was produced by a specific model.

The elegance of this mechanism lies in several properties:

• No need to store the original text: Detection relies entirely on statistical features, not database comparison
• Lower sensitivity on short texts: The longer the text, the more reliable the statistical signal
• Adjustable strength: A stronger bias makes the watermark easier to detect, but may affect text quality

The most representative implementation of this approach is the "KGW watermarking" scheme proposed in 2023 by researchers at the University of Maryland (Kirchenbauer et al.). The core idea: before generating each word, the algorithm uses the preceding word (or a longer context window) as a seed, applying a pseudorandom function to dynamically generate a new green/red list partition for that position — meaning the green list is not fixed but shifts with context. This makes it impossible for an attacker to reverse-engineer the rules simply by observing which words appear frequently. During detection, the party holding the key recomputes the green list at each position and tallies the proportion of words in the full text that fall into their respective green lists; if this proportion significantly exceeds the random baseline (typically quantified via a z-test), the watermark's presence can be confirmed with high confidence. This design locks the secret entirely in the key rather than embedding it in the model's weights, which in theory allows the watermark to be toggled on or off without modifying the model itself.

Can AI Watermarks Be Circumvented or Erased?

Common Watermark Evasion Techniques

Since watermarks depend on the statistical distribution of word choices, any operation that disrupts this distribution can theoretically weaken or eliminate the watermark. Here are the most widely discussed evasion methods:

1. AI paraphrasing: Running the text through another language model for rewriting introduces a new vocabulary distribution, scrambling the original watermark signal. This is currently one of the most effective evasion methods.
2. Synonym substitution: Manually or semi-automatically replacing key words — especially high-frequency green-list terms — can reduce detection confidence.
3. Text blending: Interleaving AI-generated content with human-written content dilutes the overall statistical strength of the watermark.
4. Round-trip translation: Translating text into another language and back again significantly alters the vocabulary distribution.

The Ongoing Arms Race Between Evasion and Robustness

However, evasion is not without cost. Deep paraphrasing requires additional compute and time, and may introduce semantic drift or quality degradation. At the same time, watermarking researchers are continuously improving algorithmic robustness — for example, designing schemes more resistant to localized edits, so that only extensive, comprehensive rewriting can fully eliminate the signal.

This is ultimately an ongoing arms race: stronger watermarks raise the cost of evasion, while more sophisticated evasion methods drive the next generation of watermarking algorithms. There will be no "once and for all" solution in the near term.

Academic research has decomposed watermark reliability into two mutually constraining dimensions: imperceptibility and robustness. The former requires that the watermark not visibly degrade text quality; the latter requires that the watermark remain detectable even after attacks like paraphrasing or truncation. These two properties are inherently in tension — the stronger the watermark signal (i.e., the more strongly green words are favored), the higher the robustness, but the more constrained vocabulary choices become, and the more likely fluency and diversity will suffer. A third dimension also exists: false positive rate — the probability of incorrectly flagging human-written text as watermarked. In high-stakes contexts like academic integrity verification or legal forensics, controlling the false positive rate is critical; an overly aggressive detection threshold could lead to unjust accusations against innocent authors. How to strike the right engineering balance among all three dimensions remains one of the central open problems in watermarking research.

An Unexpected Use Case: Measuring the Degree of Human-AI Collaboration

Beyond attribution and content moderation, AI text watermarks may also help us answer a long-standing question: "How much of this content was actually created by a human?"

From Binary Judgments to Degree Measurement

Traditional AI detection tends toward a binary verdict: is this text AI-generated or not? But real-world content creation increasingly takes a hybrid form — humans drafting, AI polishing, or AI generating and humans editing.

The statistical properties of watermarks happen to offer a way to measure the "human-AI ratio":

• Purely AI-generated text will have a strong, intact watermark signal
• Text that has been heavily edited by humans will have a diluted watermark signal
• By measuring the degree of signal attenuation, it is theoretically possible to estimate the depth of human involvement

This kind of graduated assessment is more reflective of real-world creative workflows than a simple authenticity judgment, and may prove uniquely valuable in contexts like academic integrity, content copyright, and journalistic fact-checking.

It's worth noting that this "ratio estimation" approach remains in the theoretical exploration stage, and practical application faces several challenges. First, human editing behavior is highly uneven — heavily revising a few key arguments has a very different impact on watermark signal than uniformly tweaking phrasing throughout the text, so raw signal strength cannot accurately reconstruct the editing volume. Second, different human authors naturally overlap to varying degrees with watermark-favored vocabulary, making it difficult to establish a unified baseline. That said, this approach has already shown practical potential for automated content moderation (such as batch detection of AI content farms on social platforms), and some researchers are exploring composite scoring models that combine multiple statistical features to improve estimation accuracy.

Conclusion: Balancing Transparency and Creative Freedom

The rise of AI text watermarking reflects the industry's urgent need for content traceability. From Anthropic to OpenAI, leading companies — driven by regulators such as the EU — are gradually incorporating watermarking into standard practice.

But technology alone cannot solve every problem. The reality that watermarks can be circumvented reminds us that no single mechanism is sufficient to address the full complexity of AI content governance. The real solution may lie in multilayered coordination among watermarking technology, detection tools, legal frameworks, and platform accountability.

For content creators and everyday users alike, understanding how AI watermarks work not only helps protect one's own interests — it also enables more informed judgment in this era of transformation around the question of "authenticity."