OpenAI's invisible watermark is a compliance tool, not a lie detector

On October 5, OpenAI announced textGrain, an invisible statistical watermark for AI-generated text. The company said it will start adding the mark to eligible ChatGPT and Codex text output in the European Union over the coming weeks, across all plans, automatically. Developers using the API anywhere in the world can turn it on for select models starting now. It ships off by default, and OpenAI said it will not become a global default at launch. Every claim in the previous paragraph is the company's own account of its own product, reported by TechCrunch from OpenAI's blog post. Treat it as a vendor claim, which is how this article treats it.

The mechanism is worth understanding because it determines what the mark can prove. textGrain does not stamp hidden characters or metadata onto text. When the model has several next words that would fit a sentence about equally well, a secret key tips the choice toward one of them. One nudge means nothing. Hundreds of nudges across a passage form a statistical pattern that a detector holding the key can test for. Because the signal lives in the words themselves, it survives copy and paste. OpenAI developed the method with researchers from the University of Pennsylvania and Yale and published a technical report alongside the announcement. The company says it plans to release the technology as open source.

Now the limits, which OpenAI published itself, and which deserve credit. In the company's own evaluation of 400-token passages, replacing 10 percent of the words with synonyms dropped detection from about 92 percent to 66 percent. Replacing 25 percent dropped it to 17 percent. Short passages, math answers, and translated text are harder to detect. A technical roundup of the announcement reports detection around 80 percent on 200-token passages and 95 percent on 400-token passages at a 1 percent false-positive rate, with math substantially worse. These are OpenAI's numbers, not independent measurements. The honest reading is that textGrain is a compliance signal for long, lightly edited text, and little more.

That is why the detector is the real story. OpenAI is not giving the detection tool to the public. Access is limited to approved researchers and expert organizations who apply for it. The company's stated reason is reliability: the tool produces false positives and false negatives, and a public detector would be wielded as an accusation machine. OpenAI is explicit about the asymmetry: a watermark can indicate that an OpenAI system generated or processed part of a passage, but a missing watermark proves nothing. The text could be too short, too heavily edited, or from another company's model. If you are building any workflow that treats "no watermark found" as evidence of human authorship, stop. The vendor is telling you the tool cannot do that.

The driver is regulation, not conscience. The EU AI Act's transparency rules took effect on August 2 and require AI companies to mark AI-generated content so other systems can identify it. OpenAI drew the line exactly at the border of the jurisdiction that can penalize it: mandatory in the EU, opt-in everywhere else, off by default. The Wall Street Journal reported in 2024 that OpenAI had built a text watermark before and shelved it, partly over fears users would switch to rivals that did not watermark. The technology did not change its mind. A law with a deadline did. Anthropic shipped its own text watermark for Claude two months ago and applied it worldwide; OpenAI chose the narrower path.

Three practical takeaways for operators.

First, if you publish AI-generated text in the EU, assume it will carry the mark soon and plan your disclosure posture accordingly. Deployers have their own duty under Article 50 for text published to inform the public on matters of public interest, with an exemption for content under human review or editorial control.

Second, the API opt-in is worth enabling if you operate in a context where provenance matters: education, publishing, regulated communications. It costs nothing and gives downstream detectors something to find. But do not confuse enabling it with solving provenance. A detector only sees the marks of the provider that made them, checked by tooling that holds the key. Nobody's detector reads anyone else's mark.

Third, keep the honest sentence in your own documentation. OpenAI said the watermark does not identify the user and that it saw no meaningful change in model performance with the mark switched on. Both are vendor claims, but the second is at least falsifiable, and the first is the privacy property that makes the whole scheme acceptable. A watermark that identified users would be a surveillance feature. This one, as described, is not.

The broader pattern is the one to watch. OpenAI's shelved Astra model showed the lab will publish its own failures when the tests force it (see our analysis of the Astra pull). Governments, meanwhile, are writing the rules the labs then comply with: New York City's proposed agent bill package is the domestic version of the same dynamic (see our analysis). textGrain shows the same instinct applied to capabilities: ship the mark, publish the limits, restrict the detector. Skepticism still applies to the numbers, which are the vendor's own. But a vendor that tells you exactly where its provenance tool stops working is giving you more than most compliance theater does. Use the mark for what it is. Do not ask it to be a lie detector.