AI Text Watermarking: How Detection Actually Works
Two tools can read the same paragraph and return opposite answers. One says 98% AI. The other says human. Neither is broken. They are measuring different things, and only one of them is measuring anything real.
"AI detection" covers two techniques with almost nothing in common. One guesses from style. The other checks for a mark the model deliberately left while generating. This guide covers how each works, what a result actually proves, and how to inspect text yourself.
The two things called AI detection
Style classifiers: GPTZero, Turnitin's AI indicator, Copyleaks, and nearly every free web tool. They read text they know nothing about and estimate how likely a language model produced it, purely from properties of the writing. No cooperation from the generator is needed, and none is available.
Watermark detectors: run by the company whose model produced the text, using a key only that company holds. The model was steered during generation to leave a statistical pattern, and the detector measures that specific pattern.
The distinction is the whole subject: a style classifier is guessing, a watermark detector is checking. A classifier will happily flag text no model has ever touched. A watermark detector can say nothing at all about text from a model that does not watermark, which is still most text in the world.
How a text watermark works
Nothing is inserted. No hidden characters, no invisible Unicode, no metadata attached to the string. The text you read is the entire text that exists.
At each step a language model produces a probability for every token that could come next, then samples one. A watermark changes the sampling, not the vocabulary:
- A keyed pseudorandom function scores the candidate tokens, seeded by the tokens just before them.
- Sampling is biased towards tokens the key happens to favour, but only among tokens the model already rated plausible.
- Across hundreds of tokens, favoured tokens turn up more often than chance allows.
The detector recomputes the same key-derived scores over the finished text and asks whether that fraction is higher than an unwatermarked writer would produce. The output is a score against a threshold, not a yes or no.
Two properties follow directly from the mechanism:
- The key is required. Without it the pattern is statistically invisible. To anyone who does not hold it, watermarked text is indistinguishable from ordinary text.
- Length is required. One sentence carries too few tokens for the count to separate from chance. Detectors set a floor; BlinkWrite's is 200 tokens, roughly 150 words of English.
Because the bias only chooses between tokens the model already ranked highly, the text means what it would have meant anyway. That is the design target: a mark that costs nothing in quality and survives being read, copied, and pasted.
Why editing weakens it, and by how much
The signal is spread thinly over the whole passage rather than stored in one place, so every edit takes a little off the score.
- Fixing typos, changing punctuation, deleting a sentence: the score drops slightly. It normally survives.
- Rewriting half the sentences in your own words: the score drops sharply, often past the threshold.
- Paraphrasing the whole thing, or translating it and back: the mark is gone. Every token was chosen again by a different process.
Which is why the most common claim about these tools is the wrong way round. A negative result does not establish human authorship. It is equally consistent with a model that does not watermark, a watermarked draft that was edited, a translation, or a paraphrasing tool. Only a positive result carries information, and only about the model that left the mark.
Hidden characters are not watermarks
Zero-width characters get called watermarking constantly. They are not. They are invisible characters, and the confusion is worth clearing up because this is the one thing you can check for yourself in ten seconds.
Copy the text, then list every non-ASCII character in it:
pbpaste | python3 -c "import sys; t = sys.stdin.read(); print(sorted({hex(ord(c)) for c in t if ord(c) > 127}))"
The ones worth knowing: 0x200b zero-width space, 0x200c and 0x200d the zero-width joiners, 0x2060 word joiner, 0xfeff byte-order mark, 0xa0 non-breaking space. If a run of those appears in ordinary prose, something put them there.
To strip them and keep everything else:
pbpaste | python3 -c "import sys; bad = {0x200b, 0x200c, 0x200d, 0x200e, 0x200f, 0x2060, 0xfeff}; sys.stdout.write(''.join(c for c in sys.stdin.read() if ord(c) not in bad))" | pbcopy
What you will usually find instead is ordinary typography: 0x2014 em dash, 0x2019 curly apostrophe, 0x201c and 0x201d curly quotes. Those are not marks of anything. Word, Pages, and every phone keyboard produce them.
Because invisible characters are this easy to see and remove, nobody treats them as a durable mark. A tool advertising a hidden-character watermark is offering something that does not survive a copy into a plain text field.
Why style classifiers flag innocent writers
Classifiers mostly measure two things: perplexity, meaning how predictable each word is given the words before it, and burstiness, meaning how much sentence length and complexity vary across a passage. Model output tends to be low-perplexity and evenly paced.
So does a great deal of human writing:
- Writing by someone working in a second language, who reaches for the common word and keeps sentences short and regular.
- Technical documentation, standards text, legal boilerplate, and anything written to a house template.
- Text that has been through a grammar checker, which removes exactly the irregularities a classifier reads as human.
- Short text of any kind, where there is not enough signal to measure.
This is measured, not anecdotal. A 2023 Stanford study ran seven detectors over TOEFL essays written by non-native English speakers: they were flagged as AI-generated more than half the time on average, and every detector agreed on nearly one in five. The same tools classified essays by US eighth-graders as human almost perfectly. OpenAI withdrew its own AI Text Classifier in 2023, citing low accuracy.
The practical consequence: a percentage from a style classifier is not evidence of anything on its own, and it is least reliable for exactly the writers most likely to be harmed by it.
If you are accused of using AI
The accusation usually arrives as a number with no context. Ask for the context.
- Which tool, which version, and what score? A vendor's own documentation is where the limits are stated.
- What false-positive rate does the vendor publish, and on what corpus? If the answer is "we don't publish one", the number means very little.
- Was the passage long enough? Most tools are unreliable under a few hundred words, and most say so.
- Was it a draft or a final edit? Grammar checkers and heavy editing both move the score towards "AI".
The strongest evidence on your side is process, not a counter-test: document version history, editor revision timestamps, commit history, notes, earlier drafts. That record is hard to fake and easy to show. A second classifier disagreeing with the first proves only that classifiers disagree.
What the law now asks of generators
Article 50 of the EU AI Act has applied since 2 August 2026. Providers of systems that generate synthetic content must mark the output in a machine-readable way, and the marking must be effective, interoperable, robust, and reliable as far as technically feasible. Deployers carry separate disclosure duties for some uses.
"Machine-readable" is why watermarking is the approach being built rather than a label in the interface. A label in the interface survives nothing, because the text leaves the tool and the label stays behind. A mark carried in the token stream travels with the text.
There is a carve-out worth knowing: the marking obligation is narrowed where a system performs an assistive function for standard editing, or does not substantially alter the input. A spelling correction to a sentence you wrote is not the same act as a generated reply, and the regulation reflects that.
BlinkWrite's watermark and its signed report
BlinkWrite marks every generation, and the specifics are public rather than a claim you have to take on trust.
The watermark is blinkwrite-synthid-text-v4, applied by BlinkWrite's self-hosted inference engine. It is applied at the engine level, so no request can disable it, not by a parameter and not by a prompt.
You can check any text at the BlinkWrite watermark detector. It needs at least 200 tokens and returns an inconclusive result for text that is shorter or highly repetitive. Text submitted to the detector is not stored or logged, and the public page posts it straight to the rate-limited endpoint.
Each detection returns a signed JSON report containing a SHA-256 hash of the submitted text rather than the text itself, the time, the detector and watermark versions, the model identifier, the score, the threshold, the result, and the identifier of the signing key. The report is signed with an Ed25519 key as a compact JWS, so a third party can verify it without asking BlinkWrite anything. The current and retired public keys are published at the detector key endpoint, which means a report signed last year still verifies after a key rotation.
What a positive result establishes: the text carries BlinkWrite's watermark. It does not identify a person, an account, or a request, because the mark carries no identity by design. AI transparency documents the report fields and the limits in full.
If what you actually want is for your writing not to read as machine-written, that is a style problem rather than a detection one. See why your writing sounds like AI.
Common questions
Can AI detectors be trusted?
Watermark detectors run by the generating company are reliable within their stated limits: enough text, and no paraphrasing since generation. Style classifiers applied to arbitrary text are not reliable enough to act on alone, and they misfire most on second-language writers and on formulaic technical prose.
Does paraphrasing remove a watermark?
Usually, yes. The mechanism is public and there is no point pretending otherwise: a paraphraser re-picks every token, so the statistical pattern does not survive. What also does not survive is the specificity of the original, which is generally the part worth keeping.
Do em dashes mean AI wrote it?
Not as evidence, but they have become the tell most readers act on, and that is what matters in practice. Heavy em dash use now draws the accusation whoever wrote the text, so the safe habit is to reach for a comma, a colon, or a full stop instead.
Can I watermark my own writing to prove I wrote it?
Not with this technique, which works at generation time inside the model's sampler. For proving authorship, version history with timestamps is both stronger and easier to produce.
Does a watermark let the company see what I wrote?
No. The mark is a statistical property of the token choices. Detecting it requires the key and the text in front of you; it reveals nothing about who produced the text or when, and it carries no stored copy of anything.