AI Watermark Detection Explained: Why It Barely Works for Text (Yet)

Quick answer

Watermarking is real and scaling fast, but it is almost entirely limited to images, video, and audio. Text remains the exception to widespread watermarking. Google's SynthID offers an open-source text watermarking technique. That technique, however, ships only inside Google's own Gemini text output. Independent research released in 2025 discovered that SynthID loses its signal after any basic paraphrasing. OpenAI's major provenance announcement in May 2026, which appeared alongside Google at I/O, addressed images generated through ChatGPT, Codex, and the API. The announcement made no mention of watermarking for ChatGPT's written text. At present, watermarking is not the tool used to determine whether a piece of writing is AI-generated. The method still relies on statistical detection, perplexity scoring, burstiness, and model-specific patterns.

What actually got announced in May 2026

On May 19, 2026 OpenAI released a post titled "Advancing content provenance for a safer, more transparent AI ecosystem." The announcement also noted that the firm had joined the steering committee of the Coalition for Content Provenance and Authenticity, known as C2PA. In the same release OpenAI pledged to embed Google DeepMind's SynthID watermark into images produced by ChatGPT, Codex and the OpenAI API. The SynthID watermark will sit on top of the C2PA metadata that OpenAI already appends to its outputs. A preview of a public tool was included, allowing users to upload an image and see both SynthID and C2PA signals in a single check.

The same day, at Google I/O 2026, Google announced it was bringing C2PA verification and SynthID detection natively into Search and Chrome, on top of the Gemini app support that already existed. Google also said Pixel 8, 9, and 10 phones would start embedding C2PA credentials into video captures, not just photos, and that Instagram would begin auto-labeling Content Credentials through a partnership with Meta. Google's own numbers: SynthID has watermarked more than 100 billion images, videos, and audio files since it launched in 2023.

All of the stated data points involve images, video, or audio. The post deliberately avoids using "text" when naming the marked materials. The announcement therefore shows a genuine expansion of provenance systems. Readers will find it is not a text-detection innovation, despite the initial framing.

Text watermarking does exist. It's narrower than people assume

A 2024 Nature article describes Google DeepMind's text implementation of SynthID. By adjusting the language model's probability scores for its next word, the method embeds a detectable statistical signature. This signature can be measured by a detector without access to the original model. Google has made the approach available through Hugging Face Transformers, allowing developers to integrate it into their own generation workflows.

Open-sourced SynthID Text can be taken up by any developer looking to tag generated prose. Yet the May 2026 statements make clear that the leading labs, OpenAI, Anthropic and Meta, have not adopted the system for their models. At present the sole location where text is watermarked with SynthID is within Google's Gemini platform, both in the mobile app and the browser version. If you test a paragraph from ChatGPT, Claude or Grok with a watermark scanner you will find nothing, because those engines do not use any watermark.

Google's own documentation for developers building on SynthID Text is upfront about the ceiling here. It calls out two limitations directly: watermark application is less effective on factual responses, because there's less room to nudge word choice without changing accuracy, and detector confidence "can be greatly reduced when an AI-generated text is thoroughly rewritten, or translated to another language."

Independent researchers already broke it

That second limitation isn't theoretical. A paper accepted at TrustCom 2025, "Robustness Assessment and Enhancement of Text Watermarking for Google's SynthID," ran SynthID-Text through a battery of what the authors call "meaning-preserving attacks": paraphrasing, copy-paste edits, and back-translation. Their conclusion, in the paper's own words: SynthID-Text "is vulnerable to meaning-preserving attacks, such as paraphrasing, copy-paste modifications, and back-translation, which can significantly degrade watermark detectability." The researchers found the watermark held up reasonably well against simple word swaps, but paraphrasing that combined high lexical diversity with reordered sentence structure caused a sharp drop in detection reliability. Their proposed fix, a hybrid method called SynGuard that layers semantic-level watermarking on top of SynthID's lexical approach, recovered an average 11.1% F1-score improvement over plain SynthID-Text in their tests, which is itself a signal of how much ground there was to make up.

This isn't a new problem for text watermarking generally. Back in 2022, before ChatGPT had even had its first birthday, OpenAI was already exploring a cryptographic watermarking scheme for its own text output, built by guest researcher Scott Aaronson. It never shipped as a product feature. MIT's Srini Devadas told TechCrunch at the time that getting around it would likely be "fairly easy... by rewording, using synonyms, etc." Three years and one industry-wide watermarking push later, that specific criticism still describes the current state of the art for text.

Why this doesn't change how text detection works

Current checking methods remain unchanged after the May 2026 announcements. A watermark can exist only if the model places it in the text. To detect it you must have the matching detector. Most AI-generated documents lack a watermark since the models themselves do not add one.

That's the reason statistical detection hasn't gone away and isn't about to. Tools that look at perplexity, burstiness, and model-specific patterns don't need the generating model's cooperation. They work by analyzing the statistical fingerprint the text leaves behind: how predictable the word choices are, how much sentence-to-sentence rhythm varies, whether the vocabulary matches patterns common across many large language models. It's an imperfect method, genuinely capable of being wrong in both directions, but it's the method that actually applies to text written by any model, watermarked or not.

Image and video provenance is heading somewhere genuinely useful. A photo with an intact SynthID watermark or C2PA manifest gives real, checkable information. Text is a different problem, and as of mid-2026 it's still mostly unsolved by the watermarking approach that's scaling fast everywhere else.

FAQ

Does ChatGPT text have a watermark?

SynthID, adopted by OpenAI in May 2026, covers images produced through ChatGPT, the API, and Codex. Text watermarking was not mentioned in the announcement. At present no public verification tool exists for detecting a watermark in ChatGPT-written text. As a result, such text remains unwatermarked.

Which AI tool actually watermarks text right now?

Google's Gemini app and web experience are the main live example. Gemini uses SynthID Text to embed a statistical signature in its generated text, and Google's own Gemini app can check content for that specific watermark. The method is open-sourced, so other companies could adopt it for their own models, but as of this writing none of the other major labs have.

Can a text watermark be removed or evaded?

Independent research says yes, at least for SynthID-Text as currently deployed. The TrustCom 2025 robustness study found that paraphrasing, especially when it changes both word choice and sentence structure, and back-translation, both significantly reduced watermark detectability. That echoes a long-standing criticism of text watermarking that goes back to OpenAI's own unreleased 2022 prototype.

If watermarking doesn't work well for text, how does AI text detection work instead?

The leading technique avoids any watermark. It looks directly at the text's own statistical signatures. It measures how predictable each word is, a metric known as perplexity. It also tracks irregularities in sentence pacing, often called burstiness. In addition, it maps vocabulary trends that typify particular model families. Most AI-text detectors, ours included, rely on this method. Because it analyses the content itself, it can spot AI-generated passages from any model, watermarked or not.

Should I trust a "watermark detected" result over a statistical AI detection score?

Treat both as signals, not verdicts, for the reasons above: watermark detection can be evaded by paraphrasing, and statistical detection carries its own [false-positive rate]. Neither method alone should be the sole basis for a high-stakes decision.

If you want to see what statistical detection actually catches in a piece of writing right now, run it through our free demo. You'll get a sentence-level breakdown instead of a single yes-or-no watermark check that, for text, mostly isn't available anyway.