AI watermarking is one of the most discussed - and most misunderstood - approaches to content provenance. The basic idea is appealing: if AI models could invisibly sign their own outputs, detecting AI-generated content would become a matter of checking for that signature rather than trying to infer the content's origin from its style. In practice, it is more complicated.
How Statistical Watermarking Works
The most widely studied approach, developed by researchers at the University of Maryland and later implemented in various forms by major labs, works by biasing the model's token selection during generation. At each step, the model divides the vocabulary into a "green" list and a "red" list using a pseudorandom function seeded by the preceding tokens. The model then slightly favors green-list tokens in its sampling distribution. The resulting text looks completely natural to a human reader, but a detector with knowledge of the watermarking key can verify the statistical overrepresentation of green-list tokens across the document.
This approach is elegant because it does not require any post-processing - the watermark is baked into the generation process itself - and it is statistically robust, detectable even in relatively short passages.
The Robustness Problem
Watermarks can be attacked. Simple paraphrasing - substituting synonyms, rearranging sentences, or passing the text through a second model - can disrupt the token-level statistical pattern sufficiently to evade detection. More sophisticated attacks, including those using translation as an intermediary step, can nearly eliminate detectable watermark signal while preserving the semantic content of the original.
There is also the ecosystem fragmentation problem. Watermarking only helps if every major model that generates content implements a compatible watermarking scheme and those schemes are detectable by a common verification infrastructure. Currently, watermarking implementations are proprietary, inconsistently deployed, and not universally verifiable.
What Watermarking Cannot Do
Watermarking identifies content generated by a specific model - it does not prove that content was not generated by AI. The absence of a detectable watermark is not evidence of human authorship: the model may not use watermarking, the watermark may have been removed, or the text may come from an open-source model with no watermarking capability. This asymmetry is a fundamental limitation.
Where Watermarking Fits in the Stack
Watermarking is most useful as one layer in a multi-signal detection system. When a watermark is present and verifiable, it provides high-confidence evidence of AI generation. When absent, the system falls back to stylometric and behavioral analysis. Verification platforms may combine watermark signals with other indicators when available, but the core detection logic should not depend on watermark presence - which is how accuracy is maintained across unwatermarked models and paraphrased content.