Watermarking

In plain English

Instead of inspecting finished text and estimating whether a machine wrote it, the generator marks its own output on the way out.

It is a fundamentally different approach from every other term in this glossary: those measure what text looks like, and this one records what actually happened.

A worked example

An illustration of how a statistical watermark biases word choice. The mechanism is real; the specific words are chosen to show the shape of it, not taken from any system's output.

  context: "The results of the experiment were ..."

  model's plausible next words, split by a secret key:
    green list   surprising  encouraging  inconclusive
    red list     clear       positive     significant

  unwatermarked  picks freely           → ~50% green over a long text
  watermarked    nudged toward green    → ~90% green over a long text

  detector holding the key counts green words and sees the skew.

No individual word is evidence of anything. "Inconclusive" is an ordinary word and a human might well choose it.

The signal only exists in aggregate. Over a few hundred words, a distribution that should sit near half lands near nine-tenths, and that skew is what a detector holding the key measures.

Which also explains the failure mode: shorten the text or rewrite enough of it and the distribution reverts toward chance, taking the evidence with it.

Why it matters for AI detection

It is the only detection approach that could in principle be reliable, because it does not infer authorship from style — and style-based inference is the source of every false-positive problem on this site.

It is also the approach with the weakest coverage, and the reason is structural rather than technical. A watermark only exists if the model's operator chose to add one, so it can say "this came from a participating model" and can never say "a human wrote this". Open-weight models that anyone can run locally will not carry one.

So the realistic reading is that watermarking may eventually give strong positive evidence for some text, while telling you nothing at all about the rest. It does not become a general test for human authorship, and a document with no watermark has established nothing.

Commonly confused with

Perplexity

Perplexity infers from style after the fact and works on any text. A watermark is planted at generation time and works only on text from a model that planted one.

Metadata provenance

Provenance schemes attach signed information alongside a file. A watermark lives inside the words themselves, so it survives copy-paste where metadata does not.

Read next

• How AI detectors work
• Token
• False positive
• Large language model
• Can a watermark prove it?