Editing 10% of Words Cuts Detection of OpenAI's Watermark from 92% to 66%

A watermark for text sounds like a convenient solution: the model invisibly tags its response, and a dedicated detector later determines where it came from. In practice, it all comes down to a familiar product problem: users are not obliged to publish a response unchanged. They shorten it, rearrange phrases, translate it, or ask another model to rewrite it. After that kind of processing, the hidden signal quickly weakens.

OpenAI has introduced textGrain, a method designed in part to meet the requirements of Article 50 of the European AI Act. In the company's tests, it found the mark in about 95% of texts 400 tokens long, but only in 80% of texts 200 tokens long. Editing is even more telling: replacing 10% of words with synonyms cut detection in 400-token fragments from 92% to 66%, and replacing 25% of words cut it to 17%.

How text gets an invisible mark

At each step, a language model chooses the next word, or part of a word, from several probable options. Say that after the phrase "the weather today is..." it could continue with "warm" or "cool." A watermark uses a secret key to slightly influence that choice. To the reader the response looks normal, but a statistical pattern known to the detector appears in the sequence of words.

The distinctive feature of textGrain is entropy control, that is, management of the reserve of permissible variability. The developer sets how much freedom can be spent on embedding the signal, and the system tries to balance how visible the mark is to the detector against how natural the response sounds. This is not a stamp or an entry in every sentence: confidence emerges only after enough statistical evidence has accumulated.

Hence the problem with short messages. In a response of a couple of sentences, there may simply not be enough data. With the stated false positive rate of 1%, the detector will wrongly flag about one in a hundred texts without a watermark. A positive result, meanwhile, does not show how much was written by a human, and a negative one does not prove human authorship.

Why ordinary edits break the check

The signal depends not only on an individual word but also on the sequence that precedes it. If an editor replaces one word, several of the following segments of the statistical pattern may change at once. That is why even light stylistic editing, with no deliberate attempt to fool the system, noticeably worsens detection.

Imagine a service that generates a 150-word product description. A manager changes the headline, trims repetitions, and replaces a dozen phrasings. The text is still mostly produced by the model, but the detector may already return a negative result. The opposite error is painful too: when checking thousands of student papers or applications, a 1% false positive rate turns into dozens of unfounded suspicions.

There is no independent evaluation of textGrain yet. OpenAI has given access to a limited group of researchers, who still have to test different languages, topics, and lengths. The company's claim that it is comparable or superior to Google SynthID Text has likewise not yet been confirmed by external testing.

What developers and products should do

European rules require machine-readable marking of synthetic content that must be effective, interoperable, robust, and reliable as far as is technically feasible. But there are no measurable thresholds for these characteristics yet. The voluntary code of practice, meanwhile, does not require watermarks for texts shorter than 200 tokens.

The practical takeaway is simple: a detector's output must not become the sole basis for blocking, accusing, or sanctioning anyone. In a generative product, it is better to combine several layers of provenance: a watermark, signed metadata, a model identifier, a generation log, and explicit labeling in the interface. Disputed cases need manual review and a right of appeal.

Developers should separately test real user scenarios: shortening, translation, style correction, word replacement, and regeneration. A metric on untouched lab text says little about how the feature performs after publication. textGrain looks like a useful additional signal, but not a universal lie detector, and the product should be designed with exactly that limitation in mind.