Text watermarking has been a research idea for years, and on October 5, 2026, OpenAI said it is turning it into a product feature, at least inside the European Union. The company announced that invisible watermarks will be added to eligible ChatGPT and Codex text output for EU users over the coming weeks, with opt-in watermarking available to API customers worldwide starting that day.
The announcement came with an unusual amount of numbers: detection rates at two passage lengths, what happens when words are swapped for synonyms, and a table comparing benchmark scores with and without the watermark. This article reads those figures closely, explains what a statistical watermark is, and spells out the base-rate problem that the detection rates do not solve on their own.
What OpenAI announced
In its post, OpenAI says the EU AI Act requires generative AI providers to make generated text identifiable in a machine-readable way, and that it is responding with a phased, regional rollout. It does not cite an article number in the post, and the details of the legal obligation are not examined here.
Four things happen. API customers can opt in to watermarking for select models, and it stays off by default. Approved researchers and expert organizations can apply for access to a detector. Over the following weeks, ChatGPT and Codex output in the EU gets the watermark on all plans, and cloud partners are to be enabled to offer it for OpenAI model outputs. OpenAI also says it is not making watermarking a global default at launch, calls the technology early with significant limitations, and plans to release it as open source at some point, with no date given.
How a statistical text watermark works
A language model picks each next token by sampling from a probability distribution. A statistical watermark nudges that sampling so the output carries a pattern a detector can test for, without changing the text in any way a reader would notice. OpenAI’s description is brief: textGrain adds an invisible statistical signal to the model’s word choices, and the detector looks for that signal in a passage. The fuller mechanism is in a technical report that I could not review for this article, so what follows is general background, not a description of textGrain.
In the best-known public schemes from the research literature, a secret key and the preceding few tokens are hashed to split the vocabulary into a favored set and an ordinary set, and the sampler is biased slightly toward the favored set. A detector with the key counts how many tokens fall in the favored set and asks whether that count is too high to be chance. Longer passages give more tokens to count, so the evidence accumulates. That single fact explains most of the numbers in the next section.
It also explains why the watermark is not a label stuck on the text. Nothing is appended and no hidden characters are inserted. The signal is a bias in the word choices themselves, which is why it survives copying and pasting but not a thorough rewrite.
Working through the detection figures
OpenAI reports detection rates at a fixed false positive rate of 1 percent, meaning the detector is tuned so that about 1 in 100 unwatermarked passages gets flagged by mistake. On psychology passages, it detects about 80 percent of watermarked text at 200 tokens and about 95 percent at 400 tokens. Doubling the length takes the miss rate from about 20 percent to about 5 percent, a fourfold drop. That is the accumulation effect at work. On mathematics text the rates are described only as substantially lower, with no figure given. That fits the mechanism: when the correct next token is nearly forced, as in an equation, the sampler has little freedom to carry a signal.
Now the edits. For 400-token passages, detection is about 92 percent with no editing, about 66 percent when 10 percent of words are replaced with synonyms, and about 17 percent when 25 percent are replaced. Note that the unedited figure here is 92 percent, a little below the 95 percent quoted for psychology passages; the post does not explain the difference, so the two figures may come from different test sets.
Read the drop in terms of survivors. Replacing 10 percent of words costs roughly a quarter of the detections (from 92 to 66). Replacing 25 percent costs more than four-fifths (92 to 17). The relationship is steep because a change to one word also changes the context hash for the following tokens in schemes of the kind described above, so a replacement can spoil more than one token’s worth of evidence. Whether textGrain behaves this way is not stated in the post.
The base-rate problem
A 1 percent false positive rate sounds small. Whether it is small depends on how much of what you test is actually watermarked. The following is illustrative arithmetic using OpenAI’s 92 percent no-edit detection rate and 1 percent false positive rate; the prevalence values are assumptions, not data from the post.
Suppose 10 percent of the documents a school or publisher checks are watermarked ChatGPT text. Out of 1,000 documents, 100 are watermarked and 92 of those are caught; of the 900 others, 9 are flagged wrongly. A flag is correct 92 times out of 101, about 91 percent. Now suppose only 1 percent are watermarked. Of 1,000 documents, 10 are watermarked and about 9.2 are caught, while about 9.9 of the 990 others are flagged wrongly. A flag is now correct only about 48 percent of the time.
Same detector, same error rates, very different meaning for a flag. This is the reason OpenAI says false positives and false negatives are both possible and that the detector is not public at launch. It is also the reason a missing watermark is not proof of human authorship, and a detected one is not proof that a particular person cheated.
- Prevalence 10 percent: about 91 percent of flags are correct.
- Prevalence 1 percent: about 48 percent of flags are correct.
- Assumptions: 92 percent detection, 1 percent false positive rate.
Does the watermark hurt output quality?
A watermark that makes answers worse would be a hard sell. OpenAI compared a model it calls Astra, at its maximum setting, with and without the watermark across eight benchmarks and reports no meaningful performance differences. The Artificial Analysis Intelligence Index went from 49.57 to 49.76. GPQA Diamond went from 94.44 to 93.94, a loss of half a point. DeepSWE v1.1 went from 72.80 percent to 71.68 percent, about 1.1 points lower. Terminal-Bench 4.0 went from 53.90 to 56.06 percent, and Terminal-Bench Science 0.1 from 56.90 to 60.00 percent, both higher with the watermark.
Scores moving in both directions is what noise looks like. The post does not give run-to-run variation, so a 2-point gain on a coding benchmark and a 1-point loss on another cannot be told apart from chance using the published numbers alone. The fair reading is that no large degradation shows up. It would be a mistake to read the gains as a benefit of watermarking. These are OpenAI’s own measurements of its own model.
What the watermark does not say
OpenAI lists the limits clearly. A watermark shows only that an OpenAI system generated or processed part of a passage. It does not measure how much a person contributed, establish ownership or responsibility, identify the user, or confirm that the content is accurate. The detector reports whether an OpenAI watermark is present and, per the post, does not reveal prompts, conversations or accounts.
Short, heavily edited, or translated text may carry too little signal. Translation in particular is something OpenAI says it is still studying. Text from other vendors, from before the rollout, or from models without watermarking will not carry the mark at all. In practice, that means a negative result is mostly uninformative, which is a harder limitation for classrooms and newsrooms than the false positives.
Text versus images and audio
The post is careful to separate text from other media. For images, OpenAI cites Content Credentials, which follow the C2PA standard, plus invisible SynthID watermarks. For audio, it cites invisible SynthID watermarks. A public verification page and a Content Provenance API exist for images and audio. For text, the post describes only the statistical watermark, with no metadata layer.
The reason is structural. Metadata can be stripped by anyone who copies the text into a new document, and plain text has nowhere to carry it. A signal in the word choices is the only option that travels with the text, at the price of the fragility described above.
Why the rollout is split by region
Turning the feature on only for EU consumers while leaving it opt-in for API customers gives OpenAI a controlled environment to learn how the detector behaves on real traffic. The post says as much: the EU rollout gives it room to learn from real-world use. It also means that, for now, most ChatGPT text produced outside the EU will carry no watermark, so detectors will see a mixed population, which pushes the base rate in the earlier section toward the unhappy end.
There is a competitive angle too. The post says textGrain matched or exceeded other approaches OpenAI tested, including SynthID for text, while cautioning that strong performance under ideal conditions does not guarantee reliable detection in everyday use. That comparison is OpenAI’s own and has not been replicated by outside researchers, which is part of why the researcher detector access program matters.
Frequently asked questions
What is text watermarking in AI?
It is a method of biasing a language model’s word choices so the output carries a statistical pattern that a detector with the right key can test for. The text reads normally; the pattern is only visible to the detector.
Will all ChatGPT text be watermarked?
No. According to OpenAI, watermarking is being added to eligible ChatGPT and Codex output in the EU over the coming weeks, is opt-in in the API, and is not a global default at launch.
Can I use it to prove someone used ChatGPT?
Not reliably. OpenAI says detection can produce false positives and false negatives, the detector is not public, and a missing or present watermark does not establish who wrote what.
Does editing the text remove the watermark?
Substantially, yes. In OpenAI’s test on 400-token passages, detection fell from about 92 percent to about 66 percent with 10 percent of words replaced by synonyms, and to about 17 percent with 25 percent replaced.
A watermark is a statistical test, and statistical tests answer narrow questions. This one asks whether a passage was likely produced by a particular OpenAI system with the mark enabled. It cannot tell you about authorship, honesty or effort, and OpenAI says so in plain terms. The numbers in the announcement are encouraging for long, unedited text and discouraging for anything short, translated or paraphrased, which describes a lot of real-world text. The measure to watch is not the headline detection rate but the first independent evaluations by the researchers who get detector access: how the false positive rate holds up on text that nobody tuned the detector for.
Sources
