An interactive explainer
Invisible Ink
AI companies have started watermarking the text their models generate, and they do it without adding a single character. The mark lives somewhere stranger: in the randomness itself. This page shows the mechanism, then what a match actually proves.
The whole trick, end to end animated · loops
write→publish→detect
consistent with key K ✓
The model writes by drawing keyed "random" choices. The finished text ships looking like anyone's prose. Then the detector, holding the key, re-reads it: each shaded token is one choice that agrees with the key (darker teal = stronger agreement), and the z-score climbs until the verdict is beyond doubt. Scores are simulated to show the idea.
01 · Where the signal lives
Language generation is a long series of coin flips
A language model writes one token at a time. At each step it produces a probability distribution over what could come next, and a sampler draws from it using a random number. That draw is the hiding place. A distribution doesn't care where its randomness comes from: replace the random number generator with a pseudorandom function of a secret key and the preceding few words, and every individual choice is still exactly as likely as before. No reader can tell. Someone holding the key, though, can recompute what the "random" numbers were supposed to be at every position and check whether the text agrees.
The sampling lab simulated
"The weather today was cold and ___"
Both samplers draw from the same distribution. Run it a few hundred times and the two histograms converge to the same shape: the difference is invisible in the outputs, and exists only in which draws were made, which the key can replay. Note that "sugary" (struck out) never wins on either side. The watermark only ever chooses among words the model already considered likely.
02 · The mechanism
The keyed lottery
The cleanest scheme is Scott Aaronson's "Gumbel trick" (2022), the ancestor of the SynthID-style approach now shipping in production models. At each position, every candidate token i gets a pseudorandom ticket rᵢ ∈ [0,1], derived from the secret key and the preceding tokens. The sampler picks the token with the largest rᵢ1/pᵢ. A lovely bit of probability theory guarantees this selects each token with exactly its model probability, so the output distribution is provably unchanged. Yet the chosen token's ticket tends to be suspiciously high, and that is what the detector measures.
The machine, running animated · loops
The generator, one position at a time. The key and the last few words go into the pseudorandom function, which hands each candidate a ticket rᵢ. Scores rᵢ^(1/pᵢ) pick the winner, the word joins the sentence, and the context window slides forward. Watch for the forced position: when one candidate has almost all the probability, the tickets don't matter and no signal is left there.
One position of the lottery simulated
The highlighted row wins. Click through positions: the winner varies (sometimes the favorite, sometimes an underdog) at exactly the model's own rates. Across many positions, though, the winners' tickets average high. Without the key you cannot recompute the tickets, so you cannot see the pattern.
03 · Detection
Detection is a hypothesis test, not a decode
The detector recomputes every ticket and asks one question: are the chosen tokens' tickets higher than chance? Each token contributes a whisper of evidence, and the whispers add. A tweet-length fragment stays ambiguous; three paragraphs become overwhelming. That is why watermark checks report a probability rather than a verdict, and why they weaken whenever there are fewer tokens to read.
The detector at work animated · loops
tokens: 0
z = 0.0
consistent with key ✓
The detector reads token by token, recomputing each ticket with the key. Tokens that agree light up; the z-meter climbs past the threshold mark once enough of them accumulate. Notice how far into the text that happens: the verdict needs dozens of tokens, never a handful.
Evidence accumulates with length simulated
watermarked text
human-written text
Detection score (a z-statistic) against text length, recomputed with the key. The human text wanders around zero forever; the watermarked text crosses any confidence threshold you set, given enough tokens. Below ~50 tokens the two are barely distinguishable, which is the honest reason short texts can't be attributed.
04 · Tampering
Not a checksum, not a QR code
A checksum shatters if one bit changes. A QR code survives damage perfectly up to a hard error-correction limit, then dies completely. The watermark is a third thing: a statistical stain spread evenly across every choice-point. Edit 20% of the words and roughly 80% of the evidence survives. Paraphrase everything and it's gone, along with, arguably, the claim that the text is still "AI-generated." There is no cliff, only an ever-widening maybe.
The tamper race animated · loops
0% altered
QR code
readoutreads perfectly ✓
Watermarked text
detection confidence100%
The same damage hits both sides at the same rate. Error correction hides every wound until it can't hide any more, then the QR dies all at once. The watermark never lies about its health: each rewritten token takes its whisper of evidence with it, and the confidence drains in plain view.
Degradation under tampering illustrative shapes, not measurements
QR code (error-corrected)
statistical watermark
A QR code at its highest error-correction level reads perfectly until ~30% damage, then fails absolutely. A watermark's detection confidence decays smoothly as words are rewritten, and long verbatim passages inside an edited document still light up on their own.
05 · Entropy
Where the ink can't stick
The watermark needs genuine choices: positions where several words are about equally good. Prose is full of them. Arithmetic, facts, and code are not. After "2 + 2 =" there is one right answer, and nudging it would be vandalism, so the watermark simply isn't applied there. The practical consequence is that code, factual lists, and lightly edited human text carry weak or no watermark, no matter how good the scheme is.
Choice-points in prose vs. code
Prose
The afternoon light was thin and the park nearly empty; a solitary runner traced the gravel path beneath the bare planes.
8 of 24 tokens are real choices
Code
function add(a, b) {
// sum the pair
return a + b;
}
5 of 19 tokens are real choices, mostly names & comments
Highlighted tokens are positions where an equally-good alternative existed. In code, the only slack is in identifiers and comments; the executable structure is forced, so it carries almost no signal.
06 · Limits
What a match actually proves
- A match is one-way evidence. A hit means "consistent with this provider's key." A miss proves nothing: not human authorship, not another model, not even that this model wasn't involved before an edit.
- There is no payload. Current production schemes carry no serial number, user ID, or timestamp; the only recoverable "message" is a single bit. Multi-bit schemes exist in the literature (see the reading list).
- Whoever can detect can forge. With today's symmetric keys, the detector holds the same secret the generator used, which is one reason detection is offered as a guarded API rather than a public key. Public-key watermarking is an open research front.
- A determined adversary wins. Impossibility results show a good paraphraser can strip any watermark while preserving meaning. The scheme raises the cost of laundering text; it cannot make laundering impossible.
- Regulation is the driver. The EU AI Act's transparency rules, via the Code of Practice signed in July 2026, require providers to mark AI-generated content. That is why the major labs are shipping this now, worldwide.
07 · The research
Four years, from blog post to Nature
-
2022
Aaronson's Gumbel watermark
Scott Aaronson, at OpenAI, proposes watermarking via keyed sampling, the distortion-free idea every later scheme builds on. Described in talks; never formally published.
-
2023
The field forms, and the attacks arrive
Kirchenbauer et al. publish the first major scheme, green/red token lists (arXiv:2301.10226). Christ, Gunn & Zamir prove watermarks can be made cryptographically undetectable (arXiv:2306.09194). Kuditipudi et al. formalize distortion-free, edit-robust schemes (arXiv:2307.15593). Meanwhile Sadasivan et al. ask whether detection can ever be reliable (arXiv:2303.11156) and DIPPER breaks detectors by paraphrasing (arXiv:2303.13408).
-
2024
SynthID-Text goes to production, then to Nature
DeepMind's tournament-sampling watermark is tested on ~20M live Gemini interactions with no measurable quality loss (Nature, s41586-024-08025-4). The survey era begins: a field-wide SoK (arXiv:2411.18479), WaterPark stress-testing 10+ schemes (arXiv:2411.13425), and paraphrase robustness revisited (arXiv:2411.05277).
-
2025
Hardening, and the regulators look in
SynthID's robustness is independently probed and enhanced (arXiv:2508.20228). PMark moves the watermark to the semantic level to survive paraphrasing (arXiv:2509.21057). "Watermarking LLMs in Europe" asks whether any of this satisfies the AI Act (arXiv:2511.03641).
-
2026
Payloads, public keys, deployment
MirrorMark embeds multi-bit payloads distortion-free (arXiv:2601.22246). SynthID-Text gets independent theoretical analysis (arXiv:2603.03410). DHMark splits detection from forgery with public-key methods (arXiv:2608.03093). And under the EU Code of Practice, the major providers begin watermarking in production.