How Should We Think About OpenAI’s AI Text Watermarking?

On October 5, 2026, OpenAI published an announcement [1] and technical report [2] for textGrain, its text watermarking scheme. The technology embeds an invisible statistical signal in text generated by certain models, providing evidence that may later help identify AI’s involvement.

How does this “watermark” get into text, and what might follow from it? What does detecting an AI watermark in a piece of writing actually mean?

I. What is a watermark in text?

1. How textGrain works

Text isn’t an image. It has no pixels. Where could a watermark hide?

At each step, the model chooses among possible words or word fragments, called tokens. Based on the preceding text, it assigns probabilities to these candidates, then samples from that distribution to decide what to write next.

textGrain intervenes at this point. Using a secret key and nearby preceding text, it generates rules that group the candidates and adjust the probability of choosing each group. Within the chosen group, it selects a token according to the original relative probabilities. The selected tokens thus develop a statistical relationship with the rules generated from the key. The watermark lies in these choices.

The more those choices are governed by watermarking rules, however, the less randomness remains in the model’s original sampling process. textGrain therefore sets an “entropy loss budget”: entropy measures randomness during generation, and a proportion of the original entropy becomes the budget for how much randomness watermarking may consume. The algorithm must leave a detectable signal while preserving room for different ways of expressing something.

To detect the watermark, the detector takes the text and reconstructs the rules using the same key and nearby preceding text at each position. It scores the relationship between the selected tokens and those rules, then aggregates the scores to determine whether the passage exhibits the watermark’s statistical signature [2].

Text length and contextual constraints also affect detection. In tests reported by OpenAI, at a target false positive rate of 1%, content such as psychology text has a detection rate of roughly 80% at around 200 tokens, rising to about 95% at 400 tokens. Tokens are not equivalent to a count of Chinese characters. Detection rates are lower for more constrained content such as mathematics, where probability distributions tend to be more concentrated [1].

Editing can weaken an existing signal. In one experiment in the official report, replacing 10% of the words in a 400-token English passage with synonyms reduced the detection rate from approximately 92% to 66%. Replacing 25% brought it down to 17% [1].

Under the announced arrangements, API users of certain models can enable watermarking themselves; it is off by default. In the European Union, eligible ChatGPT and Codex outputs will gradually receive watermarks over the following weeks. The accompanying detection tools are initially available to approved researchers and professional organizations [1].

2. A 1% false positive rate does not mean a positive result is 99% certain

The key is to ask what the denominator is.

Consider a hypothetical example:

• Of 10,000 tested texts, 100 contain a watermark and the other 9,900 do not.
• At a 95% detection rate, about 95 of the 100 watermarked texts will be detected.
• At a 1% false positive rate, about 99 of the 9,900 unwatermarked texts will be incorrectly flagged.
• A total of 95 + 99 = 194 texts will test positive. Of those, the proportion that actually contain a watermark is approximately 95 ÷ (95 + 99) ≈ 49%.

The false positive rate answers this question: among texts without a watermark, how many are misidentified? When we receive a test result, we are asking a different question: among the flagged texts, how many actually contain one? If unwatermarked texts vastly outnumber watermarked texts, even a 1% error rate can produce more false positives than true detections. In this example, the 99 false positives even outnumber the 95 correct detections.

So however low the false positive rate is, the actual proportion of watermarked texts in the tested material still matters when judging how much confidence to place in a positive result.

3. Watermark detection versus an “AI percentage”

textGrain looks for a signal deliberately left during generation. Common “AI percentage” detectors instead judge how much a piece of text resembles AI writing based on linguistic features. These are different methods. Failure to detect a watermark does not prove that a human wrote the text independently.

The strength of a watermark cannot be directly converted into how much of a text AI wrote. But this technology makes one question more concrete: when an article is flagged as involving AI, how should we interpret that result?

---

II. Two hypothetical writing scenarios

Writing often involves personal requirements and multiple revisions. How might this mechanism behave in that kind of collaboration? Two hypothetical scenarios can help us understand it.

1. Gradually adding personal requirements

Suppose we ask AI to write a passage, then gradually add our own requirements: “Make the tone more restrained,” “Use this term here,” “Don’t phrase it that way.” As the text moves closer to what we want, what happens to the watermark?

These requirements change the probabilities of the model’s next choices. What matters is how much room for choice remains. “Make the tone more restrained” can be expressed in many ways, so the model can still choose among different words and sentences, leaving room for the watermarking mechanism to operate. The detail of a prompt and the amount of choice left to the model are two different things.

Consider poetry. If we want AI to give us a poem about homesickness, we could make either of two requests.

One is: “Write me a poem about missing home,” with no further restrictions. It could write about the moon or familiar streets; it could use five or seven characters per line. There are still many choices about what to write and how, leaving room to embed a signal through token selection.

The other is: “Recite Li Bai’s Quiet Night Thought.” Here, the requested output is the familiar poem:

床前明月光，疑是地上霜。

举头望明月，低头思故乡。

Considering only these 20 Chinese characters, if exact reproduction is required, there is only one possible choice at each step. The model cannot substitute another expression. In this scenario with a completely fixed output, the choice space is zero, and so is its entropy. No new watermark signal can be embedded through token selection.

Both outputs come from AI, yet original composition and recitation leave very different amounts of room for watermarking. What matters is how much freedom of choice remains during generation.

2. Multiple rounds of rewriting and editing

Now imagine another scenario. AI writes a short article of three paragraphs. You dislike the second, ask it to rewrite only that paragraph, and insert the new version while leaving the first and third unchanged. Can the assembled article still contain a detectable watermark?

According to the detection method in OpenAI’s technical report [2], the detector calculates a local score for each token using that token and a short window of preceding text, then aggregates the scores. With the same key and configuration, the same token and local preceding text receive the same local score. The detector does not need to know which generation round produced the passage.

Start with the first paragraph. Neither its text nor its preceding context has changed, so the original local scores can remain. Rewriting the second paragraph does not erase the first paragraph’s watermark.

Next, consider the new second paragraph. If a model with watermarking enabled still writes it, and generation leaves some room for choice, it has a chance to carry a new watermark signal. Rewriting does more than remove old text: it also generates new text.

The third paragraph is slightly different. Although its opening text remains unchanged, the preceding second paragraph has changed, so some scores may be affected. Further along, once the detector’s context window lies entirely within the unchanged third paragraph, the original local scores can return.

The final article may therefore contain both preserved old signals and newly generated ones. If those signals are strong enough to meet the detection threshold, an article can still test positive after multiple rounds of revision.

---

III. What does detecting an AI watermark mean?

We can ask a further question: even if we know for certain that AI generated an entire passage, what does that tell us about its correctness and value?

I think creative work should be evaluated by whether its content is correct and valuable. Whether AI contributed to it, or even generated all of it, does not directly answer either question.

When we collaborate with AI, if the result is factually accurate, clearly expressed, and reflects judgments we endorse, there is no need to revise it again merely to reduce a detection score.

Quotations must be faithful to their sources, and technical terms must be used correctly. A fact can be phrased in different ways, but replacing an accurate word with an awkward synonym to evade detection does not make an article better.

Delete empty language, correct mistakes, and rewrite what remains unclear: these changes have concrete reasons. “AI was detected” should not automatically become another editing task.

This reminds me of plagiarism checks. Imagine replacing “similarity score” with “AI percentage.” What scenes might follow?

When the similarity score (AI percentage) is high:

Supervisor: Why is the similarity score (AI percentage) in your paper so high?

Me: How high?

Supervisor: 87%.

Me: Huh? Is there a requirement for that?

Supervisor: The university requires it to stay below 20%.

Me: What do I do, then?

Supervisor: Reduce the similarity (AI percentage), of course.

When the similarity score (AI percentage) is low:

Supervisor: Why is the similarity score (AI percentage) in your paper so low?

Me: Isn’t low good?

Supervisor: It’s only 2%.

Me: That means I wrote it all myself.

Supervisor: That’s the problem.

Supervisor: How can you write a paper without citing other people’s research (using AI)?

Me: …

I don’t know whether this technology will be used like plagiarism detection, turning a score into an assessment standard that restricts creation and AI use. But I think that if it does, it will be a short-lived, distorted, and rather comic way of using it.

As AI becomes part of everyday research and creation, continuing to use “avoid leaving traces of AI” as a criterion for evaluating work will increasingly conflict with normal working practices. That is why I think such restrictions will be difficult to sustain.

---

Sources

[1] OpenAI: Text provenance and watermarking announcement, October 5, 2026.

[2] OpenAI: textGrain: Entropy-Calibrated Watermarking for Language Model Text, technical report.

AI contribution

The author proposed the topic, the two scenarios, and the supervisor–student dialogues; decided the structure and central position; and reviewed and adjusted the technical explanations and Chinese wording through successive rounds. AI helped check sources, organize the outline, draft and revise the text, and design and generate the illustrations. AI translated the Chinese article into English for the blog, with the author responsible for publication decisions.