The Invisible Watermark Is Here. It Tells You Less Than You Think.

On October 5, OpenAI published a short page with a title more candid than most product announcements: "Our approach to EU text provenance rules." Its subheading read "Promoting transparency within the limits of today's technology." The context is a genuinely large change: the EU AI Act now requires generative AI providers to make machine-generated text identifiable, and OpenAI is responding by adding an invisible watermark to eligible ChatGPT and Codex output in Europe over the coming weeks. The part worth lingering on is the second half of that subheading — the limits. Because the most honest paragraph OpenAI wrote is the one listing everything a watermark cannot tell you.

What the mark actually is

A visible "AI" stamp would be cut off in a paste, so OpenAI's method, called textGrain, works differently. It is a statistical watermark: as the model generates each word it slightly favours the choices a secret key singles out, adding hundreds of tiny nudges across a passage. Nothing visible is added, the text reads normally, and the signal travels with the text when it is copied and pasted. A detector holding the same key can count how often the favoured choices appear and, over a long enough passage, judge whether the text came from the model. OpenAI says textGrain matched or exceeded the other approaches it tested, including SynthID for text, and that it saw no meaningful change in model performance with it switched on.

Where it comes apart

The limits are structural — a consequence of the mechanism, not a bug that can be patched out. Because the mark lives in word choices, it gets stronger the more words the model can choose between. Long essays give signal. Code does not: at each point there are few correct tokens, so there is little room to steer. Short answers, maths and translated text are likewise weak. And because the mark is a pattern in probabilities, a human editor can erase it without leaving any visible trace on the page. OpenAI's own numbers: replace 10% of the words in a 400-token passage with synonyms and detection drops from about 92% to 66%; replace a quarter and it falls to 17%.

These limitations contribute to our decision to provide initial detector access only to approved researchers and expert organizations, who can help us evaluate reliability and responsible uses.

— OpenAI

The fine print is the discovery

The most telling part of OpenAI's page is the list of things a watermark does not do. The operative line reads: "A watermark does not measure human contribution. It can indicate that an OpenAI system generated or processed part of a passage, but not how much human judgment, editing, or creativity went into it." The rest follows the same logic: it does not establish ownership or responsibility, does not identify the user, and does not verify accuracy. Then comes the disclaimer most people will misread — the absence of a detected watermark does not prove human authorship, because the text may be too short, too edited or translated, or may simply have come from another company's model.

That last point should slow everyone down. Europe asked for a signal that says "this is AI-generated." What OpenAI has delivered is a narrower, more honest one: "an OpenAI system generated or processed part of a passage." Between those two statements sits almost everything people actually want to know — who wrote it, whether it is true, who is answerable for it. A watermark answers none of it, because those questions are not statistical; they are social.

Beyond the vendor's own caveats

The research community pushes on the same point from another direction. In a paper written just after the EU enforcement date, three researchers at Case Western Reserve University argue that the real governance failure is not watermarking but the fact that neither the public's objections nor the vendors' assurances can be independently checked. Their abstract states it plainly: "We argue that neither the objections nor the assurances can currently be verified and that this unverifiability, rather than watermarking itself, is the substantive governance failure."

The same paper situates the launch in an industry already moving. Google has shipped SynthID-Text in Gemini since 2024. In August, Anthropic disclosed that every Claude model released after the enforcement date embeds a watermark, enabled by default with no opt-out. The public reaction was immediate and, by the paper's account, contradictory: users complained the watermark degraded code, feared it silently encoded identifying information, and in the same breath called it both easily removed and impossible to escape. A GitHub tool that claimed to strip the mark collected more than ten thousand stars within a week, with no published evidence that it worked. TechCrunch notes that The Wall Street Journal reported in 2024 that OpenAI had built a watermark earlier but held off partly over fears that users would flee to rivals that did not watermark.

Better than nothing, and not enough

The honest counter-argument is that a watermark is better than nothing, and that is true with an important colon after it. A detectable signal set into the words themselves, strong enough to survive copying, is a real gain over the empty void of a year ago. It is one layer in a stack OpenAI insists is layered — Content Credentials and C2PA metadata on images, SynthID watermarks in images and audio, public verification tools for those media. When a signal survives even metadata stripping, that is progress.

But the risk is the shortcut the mind takes. A mark that says "an OpenAI system processed this" will be read as "this is untrustworthy," and the absence of a mark will be read as "this is human," and both readings are wrong more often than Europe has admitted. Provenance is not proof; it is a breadcrumb about the making of a thing, not a verdict on whether to believe it.

So the launch lands with an uncomfortable geometry. Europe asked for confidence, and OpenAI shipped accuracy about what a mark cannot do. That candour is admirable and rare. But it is also the tell: we now regulate the production of a signal whose honest meaning is far narrower than the trust we want it to carry. The invisible watermark is here. It will mark more text than we expect, undo itself with a thesaurus, and leave us sitting with a sentence we have been avoiding — that knowing a machine touched a passage never told us whether to believe it. That decision is still ours.

We use AI tools in our research and drafting on this site. Every judgement and every recommendation is a person's.