A Claim That Outruns Its Evidence
OpenAI’s textGrain watermark, released in October and built to satisfy Europe’s transparency rules, arrives with an unusually candid set of caveats attached. [1] The company states plainly that a watermark can indicate that an OpenAI system generated or processed part of a passage, but not how much human editing went into it. It establishes no ownership and no responsibility. It associates no user with the text. It does not verify accuracy. And the absence of a mark indicates nothing at all about human authorship. Four negatives and one partial positive — that is the entire evidentiary yield of a technology now being folded into European law. The gain is real but narrow: a statistical signal that says “some of this passed through our model,” and nothing more.
The Mechanism Behind the Mark
To understand what the watermark can and cannot deliver, start with how the model produces words. An AI model calculates probabilities for different possible next tokens — the next word or word fragment — based on the text already written, then selects one and repeats until the response is complete. After the prompt “today the weather is…,” as Xiang Li, co-author of the textGrain technical report and a postdoctoral researcher at the University of Pennsylvania, illustrates, the model might weigh “warm” or “cool” as candidates.
TextGrain intervenes at exactly that fork. A secret key generates pseudorandom values — numbers produced by a mathematical process — that influence which token the model suggests. The result is a statistical pattern embedded in the wording itself, invisible to a reader, which a detector holding the same key can search for. No hidden characters, no extra spaces, no odd punctuation. Copying a response into another document therefore does not automatically strip the mark, because the wording carries it.
Entropy as a Budget
What separates textGrain from earlier attempts is that it treats unpredictability as a resource to be spent. Developers specify how much entropy — how much variation in word choice — they are willing to allow, and the system adjusts to that target. Li’s framing is deliberately economic: entropy functions as a kind of money, and the approach lets developers determine precisely how much of it to consume. The practical benefit is control. A developer can dial the signal up for detectability or down for naturalness, and the system respects the setting rather than guessing.
That control matters because the alternative is brute force. A watermark that distorts output to be detectable defeats the purpose of a language model; one that leaves output untouched cannot be found. Budgeting entropy is the compromise, and it is the genuine engineering advance here — a way to make the mark survive the reader’s eye while remaining legible to a detector.
What the Tests Actually Showed
The measured results, run on psychology questions drawn from the ELI5 database, which gathers questions and answers from the /r/explainlikeimfive subreddit, tell a story of length dependence. [1]. At a 1 % false-positive rate — the detector is designed to wrongly flag about one in 100 unwatermarked passages — the system caught roughly 80 % of 200-token passages, about 150 words. Stretch the passage to 400 tokens, roughly 300 words, and detection climbed to about 95 %.
The pattern is not a bug to be patched but a property of the method. Li calls it a basic limitation of text watermarking technologies, one that would be complicated to solve. Short passages may simply not contain enough watermark evidence for reliable detection, even with additional computation, while longer passages generally provide more. The signal accumulates; it does not appear.
Editing as an Off-Switch
If length is the first constraint, revision is the second, and it bites harder. In an evaluation of 400-token passages, replacing just 10 % of words with synonyms reduced detection from 92 % to 66 %. [1]. Replace up to 25 % and the rate collapsed to 17 %. The reason is structural: because the watermark depends on preceding tokens, changing one word can disrupt the signal at several positions downstream. A single substitution does not remove one unit of evidence; it scrambles a stretch of the chain.
This is where the practical gain narrows sharply. The watermark is designed for text that leaves the model and travels unchanged. The moment a human edits, paraphrases, or translates, the statistical trail degrades — and translation and substantial paraphrasing interfere with detection as well. Highly constrained material such as mathematics produces lower rates, and code is similarly constrained because the model has fewer acceptable wording choices to spend entropy on. In effect, the mark works best precisely where human intervention is least.
The Gap Between Signal and Meaning
Both directions of inference fail, for different reasons. The detector measures a pattern, not a process. It cannot distinguish a paragraph Claude wrote outright from one Claude helped edit, and it cannot see the human who rewrote a watermarked draft into something the detector no longer recognizes.
OpenAI acknowledges the boundary directly, stating that “text watermarking and detection remain early technologies with significant limitations” and noting that views about their benefits and responsible uses are still developing. [1] The company says it will continue improving detection, studying how watermarks withstand editing and translation, and exploring ways to distinguish AI assistance from AI authorship more meaningfully. [1]. That last phrase reads as an admission: assistance and authorship are not yet separable, and the watermark does not pretend otherwise.
What the Law Asks For
The transparency obligations in Article 50 of the EU AI Act took effect on 2 August. Providers of systems generating synthetic audio, images, video, or text must mark outputs in a machine-readable format so they can be detected as artificially generated or manipulated. Technical solutions must be effective, interoperable, robust and reliable as far as this is technically feasible.
The qualifier carries the weight. The EU’s Code of Practice, a voluntary route for providers to demonstrate compliance, does not require watermarks on outputs shorter than 200 tokens — roughly 150 English words — and EU guidance excludes code snippets and short responses from text-watermarking expectations. So the law’s own instruments already carve out the zone where textGrain performs worst. Whether that carve-out reflects technical realism or simply lowers the bar is the open question.
A Verdict Without Benchmarks
Thomas Souverain, a postdoctoral fellow on AI ethics at the Institute of Advanced Education in Paris, judges the early methodology behind textGrain to be reliable and potentially better than its competitors at identifying AI-generated text. He also notes the legislation is open to interpretation. OpenAI says textGrain matched or outperformed Google’s SynthID Text in its own tests, but those results have not been independently verified. [1] Souverain’s caution is procedural rather than technical: “We only have a technical study… there hasn’t been a peer-reviewed academic article, and we don’t [yet] have access to a precise protocol [for textGrain].” Until independent researchers can test the system, and while the AI Act’s criteria lack measurable thresholds, no one can say whether textGrain meets the legal standard. If it is eventually found not to, Souverain points to a fine of up to 7 percent of OpenAI’s annual income. The law specifies robustness as a goal but supplies no number that robustness must reach.
The Testers Who Just Arrived
OpenAI has opened access to its detector to a limited group of researchers, including John Thickstun, an assistant professor of computer science at Cornell University, and researchers at the Kempelen Institute of Intelligent Technologies in Bratislava. Thickstun and Dominik Macko, a senior researcher at KInIT, had only just gained access and had not yet begun evaluating the system. Macko’s team plans to test textGrain’s robustness across different subject areas, languages, and text lengths — precisely the dimensions where the published results are thinnest.
Souverain wants more than a vetted circle. He calls on OpenAI to make textGrain open-source so researchers outside the team can identify faults, paraphrases and translation weaknesses by trying to break it. He grants the corporate logic of keeping a flaw quiet until it is found, but argues for a more open phase, pointing to SynthID, where the methods are accessible. The tension is familiar: a transparency tool whose own workings are only partly transparent.
The Counter-Move Arrives Immediately
Any expectation that a watermark would settle the question of AI authorship ran into resistance within days of Anthropic’s rollout. Anthropic began marking Claude’s output worldwide from 2 August, embedding a statistical pattern in the model’s word choices that travels with copied-and-pasted text. [2]. Developers responded by building removers. One open-source project, Watermarks Remover, released by Paris-based entrepreneur Guillaume Meyer, strips hidden characters and metadata and then rewrites the text, disrupting the word-choice pattern while keeping the meaning. The first version took about five hours to build and has drawn more than 14,000 GitHub stars.
Meyer’s objection is aimed at the technique, not at attribution: “I am all for content attribution. I am against the watermarking technique, and that’s a very significant distinction.” His complaint is that the method treats authorship as binary, marking text whether Claude wrote it outright or only helped edit it. “I think it’s the wrong answer to a real problem.” Sabrina Ramonov, an AI educator, put the user-side case bluntly: “AI watermarks punish normal users, not bad actors.” She built a free browser-based remover for Claude and ChatGPT marks. Ansh Aneja, a Tokyo-based developer, released a local open-source version called MarkScrub after an earlier tool reportedly went from zero to 8,500 users in a day, a figure Business Insider could not verify. US Google Trends interest in “AI watermark remover” rose 60 percent week on week.
Compliance, Not Surveillance
Anthropic’s defense is that the mark says nothing about ownership or authorship and does not change a user’s rights under its terms. The watermark carries no identifying information and cannot be traced to a specific person, organisation or chat. The company frames the feature as compliance with the EU AI Act, whose transparency code it signed alongside roughly 190 other signatories in July. [2]. Because it cannot yet limit the mark to the EU, it is rolling the feature out globally and extending it to older models.
The mechanics are modest by design. The mark rides on low-stakes word choices: when several words would work equally well, the model leans toward one of them. That is the same principle textGrain formalizes as entropy budgeting, applied at smaller scale. Neither company claims the mark identifies a person; both claim it identifies a process. The gap between those two claims is where the entire debate lives.
The Gain, Measured Honestly
Set aside the legal wrangling and something concrete remains. TextGrain gives developers a calibrated dial between detectability and naturalness, and it delivers detection rates near 95 % on long, unedited passages at a 1 % false-positive rate. For a platform that wants to tell its users, machine-readably, that a block of text came through its model, that is a working instrument. It is not a lie detector, not an authorship registry, and not a substitute for editorial judgment.
OpenAI’s phased approach — opt-in for API customers, a gradual EU rollout across ChatGPT and Codex, detector access restricted to approved researchers — reflects both the legal requirement and the technology’s boundaries. [1]. The company’s own summary is the fairest verdict available: a watermark can show that a system touched a passage. It cannot show what a person did next. That distinction, small as it sounds, is the whole distance between a transparency measure and a truth claim — and the watermark, for now, stands firmly on the near side of it.