Tech Brief: AI Text Watermarking -- KGW Mechanics, Attack Surface, and the 6-Month Outlook

Claude’s watermark probably does not work how you think. This brief explains how Anthropic, Google, and OpenAI build text watermarking and whether it can be defeated. The source is Alex Cui, CTO of GPTZero, in an X explainer (2026-08-11). The mechanics match the published KGW paper; the outlook section is Cui’s judgment, not a verified result.

The KGW method: generation

Almost all watermarking that is fast and cheap enough for a frontier lab uses the same formula, following Kirchenbauer, Geiping, Wen et al. 2023 (the KGW method). It embeds a statistical signal during generation:

1. Suppose the model has generated n tokens so far. Take those n tokens plus a secret key and hash them.
2. Use the hash to randomly reweight the probabilities for the n+1 token, then sample from the new distribution. The simple case: split 50% of English words into a green set and a red set based on the hash, and boost the probability of words in the green set.

The watermark is a bias, not a tag. The model does not print anything visible. It just makes green words slightly more likely at each step.

The KGW method: detection

Detection reverses the process without needing the model:

1. For each token, determine whether it was in the green set or the red set.
2. Recreate the hash from the secret key plus the text preceding the token, then recreate the green and red sets.
3. Check every token in the text. If the text draws from the green set more than 50% of the time, beyond what chance allows, claim the watermark.

The statistical test is the whole trick. A random human text hits green about half the time. A watermarked text hits green noticeably more often. The z-score of that excess is the detector’s evidence.

The three questions everyone asks

1. Does paraphrasing break the hash? Mostly yes. A deterministic hash over the preceding tokens breaks the moment a word changes. The fix is to derive the hash from a statistical model instead of a deterministic function (SIR, Adaptive Watermark). Because the whole watermark is probabilistic, a fuzzy hash still works.

2. Does the watermark make text worse? Yes, in principle. In practice it is usually imperceptible – Google’s human-feedback study across 20,000 texts found users did not notice. There are exponentially many ways to write the same paragraph, so the bias rarely lands on the one word the writer needed. DiPmark goes further and avoids shifting the distribution on average. Watermarks still fail on short text and on highly predictable text like “2+2=4”, where there is no choice to bias.

3. Can the green and red sets be reverse-engineered? Not easily. Reconstructing the exact sets takes an exponentially large number of samples from the watermarker. The real risk is Watermark Stealing: if the detector is open, attackers use it as an oracle to learn which words are green.

What a frontier lab still has to solve

• Streaming. Labs stream text token-by-token to users. Many watermark methods plan sentences or paragraphs at a time, or rewrite text after generation, to survive paraphrasing (SemStamp, PostMark). A streaming lab cannot afford that yet.
• Key leakage. If the secret key leaks, the watermark is busted. Mitigation is key rotation: keep several keys in circulation so one leak does not destroy everything.
• Code. Some text cannot be arbitrarily changed without breaking it. Code watermarks must target parts that tolerate synonyms – variable naming, comments (SWEET, EWD, Invisible Entropy).
• User education. Detectors have false positives and false negatives, and someone has to explain that to users. GPTZero considers this a large part of its work.

The 6-month outlook (Cui’s judgment)

1. If Anthropic releases the detector publicly, it defeats its own watermark. Attackers find reliable removal strategies by testing against the real detector. AI detectors like GPTZero have an advantage here: they can train against those adversaries once they appear.
2. If the detector stays private to government partners, as Google has done, it is safer – but not safe. Zhang et al. 2024 (Watermarks in the Sand, arXiv 2311.04378, ICLR 2024) shows trained approaches that break watermarks zero-shot, with no data, by simply trying to write like a human. The generic attack works without knowing the key or even the scheme. Making a detector public also makes it battle-tested and stronger long-term, which is Cui’s direct experience.
3. Watermarks do not survive intense paraphrasing (combining word-choice and syntax attacks), nor human text substitution (rewriting AI text by plagiarizing human authors). Cui reports that free paraphrasers quickly bypassed Google DeepMind’s SynthID in his testing. Independent tools confirm the pattern: reverse-SynthID-text and Rephrasy both strip SynthID watermarks.
4. Frontier labs are likely okay with this. They expect most users not to attack the watermark, and they plus European regulators likely stop caring past a certain point. Good enough is the bar.
5. Users of frontier LLMs will probably not care. They do not realize watermarks are there. The EU will force everyone to conform. And the effort reads more like regulatory hoop-jumping than an earnest attempt to expose LLM use.

Cui’s closing point: the first concern should not be watermarking, it should be AI detectors. Someone posting “it’s not X, it’s Y” is not where the watermark makes a difference.

Reference

1. Alex Cui (CTO, GPTZero), X explainer, 2026-08-11 – https://x.com/alexcdot/status/2087078010524406137
2. Kirchenbauer, Geiping, Wen, et al., “A Watermark for Large Language Models”, 2023 – https://arxiv.org/abs/2301.10226 (KGW green/red-list method)
3. Zhang et al., “Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models”, arXiv 2311.04378, ICLR 2024 – https://arxiv.org/abs/2311.04378 (zero-shot generic watermark attack)
4. Google DeepMind, SynthID text watermark (Nature 2024) – detection and removal tools verified: aloshdenny/reverse-SynthID-text, rephrasy.ai/synthid-ai-detector
5. ACM Computing Surveys, “A Survey of Text Watermarking in the Era of Large Language Models” – https://dl.acm.org/doi/10.1145/3691626
6. NEO, watermark-forge reference implementation of the KGW scheme – https://heyneo.com/blog/watermark-forge