Watermarking: The Detection That Would Work, and Why You Do Not Have It

There is a method for catching AI-written text that is not a guess. It does not squint at your prose and estimate a probability; it reads a signal the model deliberately left behind, and it reports a false-positive rate you can calculate rather than hope for. OpenAI built one that its own engineers rated 99.9% effective. Google runs one live inside Gemini today. And you — the teacher grading a stack of essays, the editor vetting a freelancer, the reviewer screening a manuscript — will almost certainly never get to use it. The reason is a single structural fact that governs this entire field: watermarking works only if you controlled the model at the moment the text was written, and the person who most wants to detect AI is exactly the person who did not. That gap is why your professor cannot reliably catch AI, and why a market now worth over half a billion dollars sells you a coin flip instead.

What a watermark actually is

Start with the distinction the research literature draws before anything else. In a 2025 review that maps the whole field, Lingyun Xiang and colleagues split every detection method into two paradigms: “passive detection, which relies solely on analyzing the generated text, and active detection, which requires embedding auxiliary signals into the generation process” (Xiang et al., 2025, p. 6). Passive detection is a coroner examining a body. Active detection is the mint pressing a security thread into a banknote before it circulates. Every consumer tool you have ever touched — GPTZero, Turnitin’s indicator, ZeroGPT — is passive. Watermarking is the active kind, and it is a different species of thing.

The mechanism is elegant. A language model writes by sampling each next word from a probability distribution over its vocabulary. A watermark quietly rigs that sampling. Xiang’s team describes generation-time watermarking as modifying “the token-sampling distribution (e.g., logit biasing, vocabulary partition, entropy-gated selection) so that generated text carries statistically testable traces” (Xiang et al., 2025, p. 7). The classic scheme secretly divides the vocabulary into a “green list” and a “red list” using a hidden key, then nudges the model toward green words. To any reader the output looks completely normal. But anyone holding the key can count the green words — far more than chance means the text is watermarked — and because it is a statistical test, the odds of a false accusation are a number, not a vibe. This is what the passive tools can never offer: a receipt instead of an inference.

Why it works, and the guess doesn’t

The gap in reliability between the two paradigms is not subtle. When OpenAI’s internal watermarking system was rated 99.9% effective at flagging ChatGPT output once enough text was generated, that figure describes a method reading its own signal (Montti, 2024). Now put it beside the passive tools that institutions actually deploy. The most thorough independent evaluation, run by Debora Weber-Wulff and a large European team across twelve tools, concluded flatly that the available detectors “are neither accurate nor reliable and have a main bias towards classifying the output as human-written rather than detecting AI-generated text” (Weber-Wulff et al., 2023, p. 1). Their headline number: human-written text is identified “quite accurately (accuracy above 80%),” but the tools’ ability to catch AI hovers “only around 50% or slightly above” (Weber-Wulff et al., 2023, p. 8). The advertised job — catch the machine — is the one they do worst, at roughly a coin flip. That is the difference active detection erases. One method is near-certain; the other is barely better than guessing.

And watermarking scales without wrecking the writing. Google’s SynthID-Text is a production version of exactly the scheme Xiang describes, deployed live inside Gemini and open-sourced in late 2024. Across nearly 20 million Gemini responses, watermarked and unwatermarked outputs showed no significant difference in whether users rated them thumbs-up or thumbs-down — the mark is invisible to readers and does not degrade quality (Google DeepMind, 2024). So the strong method is real, shipped, and free to implement. Which raises the obvious question: why has no one ever handed you a watermark reading?

The catch: you have to own the mint

Because active detection carries a requirement passive detection does not. Xiang’s team states it precisely: watermarking and its cousins “require access to or control over the generation system, making them more suitable for platform-level deployment or proprietary model settings” (Xiang et al., 2025, p. 17). You cannot watermark a model you do not run. The green list has to be applied while the text is being written, by whoever controls the sampling. Verification then needs the key held by that same party. Provenance lives with the mint, not with whoever later receives the banknote.

Line that up against how AI detection is actually demanded. The person who wants it is the grader, the editor, the peer reviewer — someone holding a finished document from an unknown source, with no access to the model that produced it and no idea which of a dozen models it even was. This is the same asymmetry we trace in how AI detectors actually work: the strong tool needs cooperation from the AI, and the moment you need detection, that cooperation is gone. A student writes in whatever chatbot they like, on their own account, and pastes the result into a document. There is no thread in that paper for the professor to hold up to the light, because the professor was never at the mint. Watermarking cannot help them — not because the technology is weak, but because they occupy the one position it was never designed to serve. Every argument about whether AI detectors can be trusted in a classroom runs aground here.

Even where the mint exists, it barely runs

Suppose the model owner does watermark. Two things still break the promise.

First, adoption is almost nonexistent, and where it could matter most it was deliberately switched off. OpenAI had that 99.9%-effective watermark ready for roughly a year and chose not to ship it. The reasons are the whole story: a company survey found nearly 30% of users said they would use ChatGPT less if their output were watermarked, and OpenAI worried the mark would disproportionately stigmatize non-native English speakers using the tool as a legitimate aid (Montti, 2024). A watermark only catches text from the model that carries it, so SynthID flags Gemini output and nothing else. The market leader watermarks nothing. The result is that even a perfect reader is useless on text from an unmarked model — which is most text.

Second, the mark washes out. Xiang concedes that watermarking “degrades under heavy paraphrasing or lossy transformations” (Xiang et al., 2025, p. 7), and Aounon Kumar’s team measured the damage exactly. Running watermarked output through an ordinary paraphraser dropped detection accuracy from 97% to 80% with a light pass, to 64% and then 57% with heavier ones — while the text’s perplexity barely moved and its quality held (Kumar et al., 2024, p. 6). The green-token share fell from about 58% to 44%, and the signal drowned. Worse, Kumar proved this is a mathematical ceiling, not an engineering gap: as models get better at imitating humans, “the performance of even the best possible detector decreases” while its false-positive rate climbs (Kumar et al., 2024, p. 11). And the failure runs both ways — by feeding paraphrased human essays into a retrieval-based detector’s database, the researchers made it falsely classify all 100 human passages as AI-generated (Kumar et al., 2024, p. 19). So the honest cheater strips the mark in five minutes, while the mark that survives mostly catches the honest user who never tampered with anything.

Into that gap, the market sells guessing

Here is the commercial consequence. The reliable method is locked to model owners who mostly won’t turn it on, leaving a desperate, paying audience — schools, publishers, employers — with a problem no watermark can solve for them. Something rushes to fill that vacuum, and it is the weak method wearing the strong method’s clothes.

The numbers are not small. The AI-detector market was valued at roughly $581 million in 2025 and is projected near $750 million in 2026 (Grand View Research, 2026). Turnitin, embedded in some sixteen thousand institutions, booked $203 million in revenue in 2024; GPTZero hit $24 million in annual recurring revenue in 2025, up 253% year over year, with around thirty million users (Sacra, 2025). Every dollar of that is spent on passive guessing — because passive is the only kind you can sell to a customer who does not own the model. The tool’s one virtue is precisely its fatal flaw: it needs no control of the AI, which is exactly why it cannot reliably detect the AI.

And it does real harm in the place watermarking was supposed to protect. Passive detectors misfire hardest on the writers least able to fight back — the mechanism behind why detectors flag non-native English writers as machines is the same statistical calm a second language produces. Then the false verdict lands with the weight of a fact. A 2026 study on automation bias opens with the whole problem in one line: “A single percentage in an artificial intelligence detection report can change how a teacher reads a student paper” (Du et al., 2026, p. 2). Its experiments found that a high detection score paired with red visual risk cues pushed teachers toward guilty judgments against their own reading of the work, prompting the authors to warn against treating these reports as decisive evidence (Du et al., 2026, p. 14). This is the ground truth behind why detector scores are not proof: a probability, dressed as a verdict, sold because the actual verdict is locked in a vault you cannot open.

There is a bitter irony that the field saw coming. Patit Santra and Debasis Majhi noted in 2023 that the expensive similarity tools — Turnitin, iThenticate, Ouriginal — “failed repeatedly to detect scholarly text produced by ChatGPT,” while a freely available AI detector caught the same text (Santra & Majhi, 2023, p. 178). The paid infrastructure built to police writing was blind to the new machine, so a market for guessing grew on top of it — expensive tools that don’t work, propping up cheaper tools that also don’t.

Regulation is trying to force the mint open

The one force that could change the equation is law, and it has started to move. The EU AI Act’s Article 50 transparency rules took effect on 2 August 2026, requiring providers to apply a machine-readable mark to AI-generated content and make it detectable, with a grace period to 2 December 2026 for systems already on the market and fines reaching €15 million or 3% of global turnover for non-compliance (EU Artificial Intelligence Act, 2026). This is regulation reaching for provenance at the mint — obliging the model owners who alone can watermark to actually do it.

But notice what it can and cannot fix. Even the drafters concede that no single marking technology yet meets all four of the Act’s own demands — effectiveness, interoperability, robustness, and reliability — because paraphrase and translation still strip the mark, exactly as Kumar measured. And the obligation binds providers, not graders. It may eventually mean Gemini and GPT text carries a detectable trace; it does nothing for the teacher facing an essay from a model that isn’t covered, or one run through a rewriter, or a homegrown open-weights model with the watermarking simply switched off. The law can order the mint to press the thread. It cannot put the key in your hand.

What to actually take from this

The detection that would work exists, it is provably good, and it is not for you. Watermarking is a receipt readable only by the party that issued it, present only when that party chose to issue it, and erasable by anyone willing to paraphrase. The moment you are in a position to need detection — holding finished text from a source you don’t control — you are outside the only condition under which the reliable method functions. That is not a temporary state of the technology; it is the shape of the technology.

So when a vendor sells you “AI detection,” understand what you are being sold. Not the 99.9% receipt locked inside Gemini and shelved inside OpenAI, but its passive impostor: a guess that runs near 50%, collapses under a five-minute rewrite, and lands its mistakes on the innocent. The strong method is defined by needing the model; the thing you can actually buy is defined by not needing it. Those are the same sentence read twice, and it is the whole reason the market sells guessing. Treat any detector score the way you would treat an accusation with no evidence attached — because, structurally, that is exactly what it is.