What Is an AI Text Watermark? (And What It Isn't)

If you've heard that AI-generated text can be "watermarked," you might picture something like a photo watermark: a visible mark, or maybe a hidden string of characters buried in the file. Delete the mark, delete the watermark. Simple.

That's not how text watermarks work at all — and understanding the difference explains almost everything else about detecting, removing, and arguing about them.

A watermark is a statistical habit, not an object

When a large language model writes a sentence, it doesn't pick words deterministically. At every step it computes a probability distribution over its entire vocabulary and samples from it. "The cat sat on the…" might give "mat" 40%, "floor" 25%, "sofa" 10%, and a long tail of everything else.

Watermarking schemes — the best known academic design comes from researchers at the University of Maryland, and Google has published a production variant for its Gemini models — exploit that sampling step. Before each token is chosen, a secret key pseudorandomly splits the vocabulary into a "green list" and a "red list," and the model is nudged to prefer green-list words. The nudge is small enough that the text still reads naturally, but across hundreds of words a detectable bias accumulates: watermarked text contains statistically more green-list words than a human writer would produce by chance.

Two properties follow directly from that design:

• There is nothing to delete. No invisible characters, no metadata field, no hidden Unicode. The watermark is the word choices, distributed across the whole text.
• Detection requires the secret key. Without the key, you can't know which words were "green" at each position, so you can't score the text. Only the provider who watermarked the output can verify it.

What it isn't

A few common confusions are worth clearing up.

It isn't metadata. Files can carry provenance metadata — the C2PA standard does this for images and documents — but that's a tag attached to a file, not a property of the words. Metadata survives copy-paste poorly and can be stripped by re-saving; statistical watermarks survive copy-paste and are unaffected by re-saving, but degrade when the text is edited. They're complementary, not interchangeable.

It isn't a stylistic fingerprint. Stylometry tries to identify an author from writing habits. Watermarking is the opposite: an artificial habit injected on purpose, keyed to a secret, designed to be machine-checkable rather than human-readable.

It isn't universal. Watermarking only exists if the provider turned it on, for that model, for that output. Plenty of AI text carries no watermark at all, and open-weight models running on your own hardware have no provider holding a key.

Why it matters

Regulators have noticed that AI content is hard to distinguish from human writing, and they're starting to mandate marking. The EU AI Act, for example, requires providers to make AI-generated content machine-readable — watermarking is one of the main technical options for complying. So expect more AI text to carry statistical watermarks over the next few years, not fewer.

For writers, the practical questions are: can it be detected, and can it be removed?

Detection is probabilistic. The detector computes a score and compares it against a threshold; longer texts give more reliable scores, and short texts — under roughly 300 words — are unreliable in both directions. A short human paragraph can look "AI-ish," and a short watermarked paragraph can sail under the threshold.

Removal is equally probabilistic, and this is the part most people get wrong. Because the watermark lives in word choices, the only way to degrade it is to change the words — enough of them, at every linguistic level. Swapping a few synonyms barely moves the score. Genuinely rewriting the text — different vocabulary, restructured sentences, reordered ideas — changes so many token choices that the original statistical pattern degrades below what a detector can use.

That's exactly what our text rewriting tool does: multiple rewriting passes targeting vocabulary, sentence structure, and flow, followed by a meaning check so the content survives the transformation. It reports how much of the text changed, as a percentage of tokens. What it — or any tool — honestly cannot do is verify that a watermark is gone, because verification needs the provider's secret key. Anyone claiming certainty on that point is claiming something the math doesn't support.

Why you can't check it yourself

A natural follow-up: if the watermark is "just statistics," can't you compute the score yourself? No — because the green list at every position depends on the secret key. Two people looking at the same paragraph see the same words, but only the keyholder knows which of those words counted as "green" when they were written. Everyone else is guessing. This is why watermark verification is a provider-side capability, and why independent claims about a specific text being "provably watermarked" or "provably clean" should be treated with skepticism unless the provider published the check.

The honest summary

An AI text watermark is a statistical bias in word choice, locked to a secret key, invisible to readers, and fragile under rewriting. You can't see it, you can't strip it like metadata, and you can't confirm its absence without the key. What you can do is transform the text enough that the original pattern no longer meaningfully exists — and measure how much you changed.