Watermarking AI-Written Text Turns Out to Be a Much Harder Problem Than Watermarking AI Images

Provenance marking for AI-generated images and video has matured into genuinely deployed infrastructure, embedding signed metadata or subtle pixel-level patterns that survive common edits and can be checked later to confirm an image's AI origin. Text presents a fundamentally harder version of the same problem, because unlike an image's pixel grid, text has almost no redundant capacity to hide a signal in without risking a change to what the sentence actually says. The leading technical approach for text watermarking works statistically rather than by embedding hidden data directly: at each point where a generation model chooses its next word, the watermarking scheme subtly biases that choice toward a pseudorandomly selected subset of otherwise equally plausible words, in a pattern invisible to a human reader but detectable by a statistical test run over enough text, comparing observed word choices against the expected unwatermarked distribution. The watermark isn't hidden in the text the way a barcode is hidden in a margin; it's encoded in the specific, otherwise-arbitrary word choices the model made along the way. That statistical approach has a structural weakness that image watermarking doesn't share to the same degree: it only survives if enough of the original wording survives. A short passage doesn't contain enough word choices for the statistical test to reach confidence, heavy paraphrasing or translation into another language destroys the specific word-choice pattern the watermark depended on, and even moderate human editing can degrade the signal below a reliably detectable threshold. An adversary motivated to strip the watermark can often do so simply by asking a second AI system to paraphrase the first one's output, a defeat that requires no technical sophistication at all. The practical consequence is that text watermarking has settled into a narrower, more honest role than the "detect any AI-written text" framing it's sometimes given: useful as one signal among several for distinguishing largely unedited AI output, genuinely helpful in contexts like academic integrity checks where the text in question is likely to be close to its original generated form, and much less reliable as a general-purpose detector for text that has been through any deliberate effort to evade it. Several AI developers now describe watermarking as a complement to disclosure policy and platform-level labeling requirements rather than a standalone solution, which is a more modest claim than the technology carried in its earliest coverage.