Watermarking an image or a video is easy to picture: a few pixels can be altered, or metadata can be tucked inside the file. Plain text is a harder case. When you copy a passage and paste it somewhere else, only the words appear to travel with it. So where could a hidden mark live that a human cannot read but a specific system can recognize?
The answer is not inside the characters. It is in the choice of words.
Writing as a series of small choices
Modern language models do not produce each next word as a single fixed answer. At every position they weigh several candidate words, each with a different probability. At a given point, “important,” “significant,” “substantial” and “notable” might all be grammatically correct, but the model assigns each a different likelihood.
That small freedom is what makes text watermarking possible. Over a long article, a model faces hundreds of positions where more than one word would preserve the meaning and quality of the sentence. The basic idea of watermarking is to influence those choices very slightly, so slightly that a reader notices nothing unusual, while a statistical pattern builds up across the whole text.
Think of the model as rolling weighted dice for each word. If the dice are tilted by a tiny amount according to a secret rule, one or two words prove nothing, but after hundreds or thousands of words a pattern can begin to show.
How a secret key shapes the pattern
In the best-known research approach, described by Kirchenbauer and colleagues at the University of Maryland in 2023, a secret key is used to split the candidate words temporarily into groups, often described as “green” and “red” lists. The colors do not exist in the text. They are a mathematical classification that can be reconstructed only by a system holding the same key.
The model is then given a slight statistical preference for words in the green group. Red words can still be chosen; the model is not forced. Only the probabilities shift, by enough that in a long passage green selections occur somewhat more often than chance would predict. The reader perceives nothing. The meaning is unchanged, the language sounds natural and no visible symbol is added. The mark is a statistical pattern spread across hundreds of word decisions.
Whether a word counts as green or red is not a fixed property. In several schemes the assignment depends on the preceding few words combined with the key, so the same word can be green in one context and red in another. That is why it is not easy to tell, by inspection alone, which words carry the watermark.
Google’s SynthID Text builds on the same underlying concept, though its mechanism is more sophisticated than the simple green and red illustration. According to Google, SynthID inserts a statistical signal into the model’s token generation process that a dedicated detector can later look for. Google DeepMind published the method in Nature in 2024 and released an open-source implementation.
Detection
The interesting part comes at detection time. An organization holding the relevant key or detection mechanism can run the text back through the same mathematical process and check whether certain kinds of choices occurred far more often than random probability would suggest.
If no watermark is present, the results should sit close to a random distribution. If the same statistical bias persists across hundreds or thousands of tokens, the detector accumulates stronger evidence that the text passed through a watermarking process. That is also why these systems tend to work better on long documents than on short sentences: a few words carry very little statistical evidence, while hundreds of choices in a long text can form a clear pattern.
Copying and pasting does not necessarily destroy the mark, because the watermark is not held in a hidden character or in file metadata. If the original wording survives, the statistical choices survive with it.
Where editing changes things
Editing is where the picture gets more complicated. If someone only corrects spelling, changes punctuation or swaps a few words, most of the original wording remains and the signal can survive to a degree. The more extensive the rewriting, the weaker the original statistical structure becomes. If an entire passage is recomposed in new words and sentences while keeping the meaning, detection becomes much harder for this family of methods, because the original token choices that carried the signal are largely gone.
Research experiments point the same way. Light editing or paraphrasing does not always erase a watermark immediately; if enough of the original structure remains, the detector can still find statistical evidence. After a thorough recomposition, the signal can weaken significantly.
Not all text watermarks are alike. Some techniques derive the signal from previous tokens, some modify the probability process in different ways, and some research approaches try to build more robust watermarks at the level of meaning. Results from one experimental method cannot be assumed to apply to every company’s production system.
Watermark detectors versus AI detectors
A further distinction matters. Generic AI detectors examine style, predictability and linguistic patterns to estimate whether a text was probably machine-written. Such systems can be wrong and have flagged human writing as AI-generated. A cryptographic or statistical watermark, by contrast, is a signal deliberately inserted, and real watermark detection usually requires the provider’s own detection system, algorithm or secret information. A general-purpose website cannot credibly claim, from the text alone, to have found Google’s or any other provider’s secret watermark.
Finding a watermark also does not always mean the whole text was written by AI from start to finish. If a human draft was translated, rewritten, proofread or heavily processed by an AI system, the output may carry a watermark signal depending on the implementation. In some cases the more accurate label is “AI-processed” rather than “AI-generated.” Equally, the absence of a watermark does not prove a human wrote the text: short passages, unsupported models, different generation methods, substantial editing or complete rewriting can all affect detection.
In the AI era, the technology points to a notable shift. Identifying AI-written text in the future may depend less on whether it “sounds like AI” and more on statistical fingerprints inside the language, invisible to people but recognizable to a system holding the right mathematical key. The AI does not need to write a hidden character into its text. It only needs to tilt, very slightly, its selection among the correct words available at hundreds of positions. One choice proves nothing; thousands of small choices together form a statistical signature that travels quietly through the entire text. The mark is not in the words, but in how the words were chosen.
