Notes from Việt Nam on law, technology, languages, history, culture and travel.

Two Years After Shelving It, OpenAI Ships a Text Watermark: How textGrain Works and Where It Breaks

On Monday, 5 October 2026, OpenAI said it will start adding an invisible watermark to text written by ChatGPT and Codex for users in the European Union. The rollout will happen “over the coming weeks” and covers all plans, but only in the EU. On the API, customers anywhere in the world can switch the same watermark on for selected models from the day of the announcement. It is off by default. OpenAI also opened applications for access to its detector, which for now is limited to approved researchers and expert organisations.

The scheme is called textGrain. Alongside the blog post, OpenAI published a short technical report, textGrain: Entropy-Calibrated Watermarking for Language Model Text, by authors from OpenAI, the University of Pennsylvania and Yale. That makes this one of the few production watermarking systems with a public description of its maths. The report is the most useful part of the announcement.

Why now: Article 50 and Anthropic’s head start

The trigger is regulation. The EU AI Act’s transparency obligations (Article 50) took effect on 2 August 2026. They require providers of generative AI to mark synthetic content in a machine-readable, detectable way. A Code of Practice on AI-generated content transparency gives providers voluntary guidance on how to do that.

Anthropic moved first. On 11 August it said Claude models released after 2 August would embed an invisible watermark in their text, globally and on by default. The reaction was hostile. TechCrunch reported paying users cancelling their subscriptions because work they had drafted with Claude could still be flagged after editing, and John Gruber wrote a long, widely shared post attacking the idea.

OpenAI’s choices look like a response to that episode. The watermark is mandatory only where the law requires it, opt-in everywhere else, and the detector is not publicly available.

There is history here too. In August 2024 the Wall Street Journal reported that OpenAI had a working text watermark that was about 99.9% effective and had kept it on the shelf for about a year. One reason was an internal survey in which close to 30% of ChatGPT users said they would use the product less if it were watermarked and rivals’ output was not. Two years later, regulation has settled that debate, at least inside the EU.

What is actually new: watermarking as optimal transport

Text watermarks have one basic idea in common. At each step the model has a probability distribution over the next token. A secret key, combined with the preceding few tokens, generates pseudorandom values that nudge which token gets picked. Someone who holds the key can later recompute those values and check whether the observed tokens line up with them more often than chance allows. Earlier designs include Kirchenbauer et al.’s “green list” (2023), Scott Aaronson’s Gumbel-max scheme for OpenAI, and Google DeepMind’s SynthID-Text, which was published in Nature in 2024. textGrain builds on these and changes three things.

1. Treat it as an optimal transport (OT) problem. At each step textGrain uses the key and the context window to split the vocabulary into a few blocks and sums the probabilities within each block. It then couples these block probabilities to m equally likely “columns”. The cost table comes from keyed Gumbel random variables, and the coupling is solved with Sinkhorn iterations under a KL-divergence penalty. The key then selects one column, which gives a block, and a token is sampled inside that block using the model’s original relative probabilities. Averaged over keys, the output distribution matches the unwatermarked model exactly, which is the “unbiased” property.

2. A strength knob with a clear meaning. The report’s central identity is that the KL penalty equals the mutual information between the token and the keyed randomness, which is exactly the average entropy the watermark removes from sampling. The operator chooses a budget β, a fraction of the model’s next-token entropy, that the watermark may spend. This answers a practical complaint about Gumbel-max watermarking. With a fixed key and prompt, Gumbel-max always picks the same token, so asking the same question twice gives the same answer. That is a real problem for products that offer “regenerate” or sample several candidate solutions. textGrain keeps a guaranteed share of randomness on average, although the report notes this is not guaranteed for every individual key.

3. A cheap, model-free detector. Detection needs only the text, the tokenizer and the secret key. It does not need the model, the probabilities or β. For each new context window it reconstructs the cost of the observed token’s block and turns that cost into a score that follows a unit exponential distribution under the null hypothesis. It then sums the scores. For unwatermarked text, the sum follows a Gamma(n, 1) distribution, so the false-positive threshold can be computed analytically. The report also includes an appendix showing the scheme works with speculative decoding, which matters because almost every production inference stack now uses it.

OpenAI’s own numbers

According to the announcement and coverage of it, at a target 1% false-positive rate the detector found the watermark in about 80% of 200-token passages and about 95% of 400-token passages for flexible prose such as psychology writing. Rates for mathematics were much lower, because there are fewer plausible next tokens to choose between and so less entropy to work with. Robustness falls off quickly under editing. Replacing 10% of words with synonyms cut detection from about 92% to 66%, and replacing 25% cut it to 17%. Short passages and translated text are named as weak spots.

On quality, OpenAI reports essentially no cost. Its Artificial Analysis Intelligence Index score went from 49.57 to 49.76 with the watermark, and GPQA Diamond went from 94.44% to 93.94%. Both changes are within noise. All of these figures are OpenAI’s own. The detector is not public, so nobody outside the company can reproduce them yet.

What it means for developers

  • API users decide. Coverage of the launch says the watermark can be enabled at the project or organisation level, for the models you choose. If you build on OpenAI outside the EU, nothing changes unless you turn it on. If your product serves EU users, you now have a provider-side way to meet a marking obligation without building your own.
  • Codex output is in scope. In the EU, code comments, commit messages and documentation generated through Codex may carry the signal. Code itself has low entropy, much like maths, so detection there is probably weak. OpenAI has not published code-specific results.
  • The detector is a gate, not an API. You cannot yet check incoming text yourself. A provenance system that only the vendor can verify is limited by design.

Skepticism worth keeping

OpenAI is unusually direct about the limits. A watermark shows that OpenAI’s model was involved. It says nothing about accuracy, ownership or how much human work went into the text. Above all, a missing watermark does not prove a human wrote the text. The text may be short, edited, translated, or produced by another vendor’s model or an open-weights model with no watermark at all.

That last point matters most. Open-weights models are now close to frontier quality and cost little to run, so anyone who wants to avoid detection has an easy option. Watermarks from regulated vendors will catch careless use, not determined misuse. The real risk is institutions such as schools, employers or publishers treating “no watermark detected” as evidence of anything. Two vendors now use incompatible schemes and keep their detectors private, so the EU’s goal of content that is “detectable by other systems” is still far from met.

Even so, textGrain is a serious piece of engineering. It has a public specification, a strength parameter with an information-theoretic meaning, provable unbiasedness, compatibility with speculative decoding, and a detector whose false-positive rate can be computed in closed form. The questions that remain are mostly about policy rather than maths: who gets the detector, and whether a shared standard ever lets one vendor’s tool read another’s mark.

Sources