OpenAI has begun adding an invisible watermark to text generated by ChatGPT and Codex in the European Union to comply with the transparency requirements of the AI Act. The most notable detail in the announcement on October 5 is not the mechanism itself, but rather the figures self-reported by the company highlighting the mechanism’s own limitations.
Why text watermarking is harder than image and audio
For images and audio, OpenAI has released public verification tools and embedded invisible SynthID watermarks into several formats. For text, the problem is more difficult because sentences can be edited, translated, or almost entirely rewritten while preserving their original meaning.
OpenAI’s solution is called textGrain. Rather than inserting a specific symbol, the model subtly biases word selection to create a statistical pattern undetectable to human readers but recognizable to a detector. Because the watermark resides within the words themselves, it persists through copying and pasting. The company noted that the method’s secret lies in a key used to order next-token predictions to complete sentences.
OpenAI claims that textGrain matches or outperforms methods it tested, including Google’s SynthID for text. At the same time, the company was candid about something few industry peers admit: strong performance under ideal conditions does not guarantee reliable detection in practical use.
Text watermarking is not truly effective
The data table in the announcement clearly outlines the limits of current technology. At a 1% false positive rate, the detector identifies the watermark in approximately 80% of 200-token passages, compared to roughly 95% of 400-token passages for psychology content. For mathematics content, where word choice is less flexible, the rate is significantly lower.
Effectiveness is also sensitive to editing. On a 400-token passage, replacing 10% of words with synonyms drops the detection rate from about 92% to 66%. Replacing 25% of words causes that figure to plunge to 17%.
This is why the company is not immediately releasing the detection tool to the public. Initial access is restricted to vetted researchers and specialized organizations on a case-by-case basis to evaluate reliability before any broader rollout. For images and audio, verification tools remain publicly accessible as before.
On the deployment side, API developers worldwide can proactively enable watermarking for certain models starting October 5, though it is disabled by default. For ChatGPT and Codex users, the feature will roll out gradually over the coming weeks exclusively in the EU, applying across all tiers. OpenAI emphasized that it is not making watermarking a global default at launch in order to allow time to learn from real-world feedback.
What a watermark can and cannot reveal
Most noteworthy in the announcement is a dedicated section clarifying the scope of what detection results actually mean:
- First, a watermark only confirms that a portion of text was generated or processed by an OpenAI system; it in no way reflects the degree of human contribution, creativity, or editorial effort. The marker also does not determine copyright, ownership, or the legality of using the text, nor is it linked to any specific account, prompt, or conversation.
- In addition, the absence of a watermark does not mean the text was written by a human. The passage may be too short, heavily edited, or generated by another model. OpenAI also indicated plans to open-source the method in the future.
In terms of context, Anthropic implemented text watermarking globally for Claude two months earlier, drawing pushback from some users who argued that they drive the content while Claude serves merely as a tool. Even so, Anthropic, Google, Meta, Microsoft, and OpenAI have all pledged compliance with the European Union’s code of practice for AI-generated content.
The core question remains unanswered: can a solution that easily breaks down after changing just 25% of words adequately shape user behavior, or does it merely serve as a legal shield for platforms while reader trust remains unearned?