AI Watermark vs AI Detector

An AI watermark gets inserted deliberately, at the moment content is created. It can live in pixels, in an audio waveform, in a metadata manifest, or in how a language model picks its own words.

Every provider that claims one describes the same timing. Not applied afterward, applied during.

• OpenAI: images generated by ChatGPT carry both C2PA Content Credentials metadata and a SynthID watermark, applied at creation time.
• Google: SynthID Text runs as a logits processor that nudges token selection inside Gemini's own generation loop, not bolted on afterward.
• Anthropic: compatible Claude models "weave an imperceptible watermark directly into the text itself" as they generate it.

That timing is the entire distinction. A detector never gets the privilege, because it only ever sees the finished output and has to work backward from there.

None of the big three text detectors verify a watermark. Their own published descriptions say what they do instead.

• GPTZero scores seven components covering perplexity and burstiness, essentially how predictable and how varied writing is, plus other style signals.
• Originality.ai describes its detector as "a modified version of the BERT model," a statistical classifier trained to recognize patterns.
• ZeroGPT calls its method "DeepAnalyse."

Not one of the three mentions SynthID, C2PA, or any provider's watermark anywhere in its own materials.

That's why these tools return a score regardless of whether a watermark was ever present. An unusual sentence rhythm, a non-native English speaker's phrasing, or a topic that simply reads as predictable can all push a style score toward "AI-generated" with no embedded signal involved.

OpenAI has named exactly that risk, disproportionate false positives for non-native English writers, as one reason it held back a ChatGPT text watermark it reportedly already built.

Watermark-specific detection beats style guessing, but it isn't unbreakable. Google's own SynthID Text documentation describes detection as score-based: a detector checks whether a passage's token choices match a known configuration more than chance would predict, which means it needs the right key and enough text to work with.

Researchers at ETH Zurich showed in 2024 that an attacker can approximate a provider's secret watermarking rule from public API queries for under $50.

That stolen approximation does two jobs at once. It forged the watermark onto text the provider never generated with over 80% success, and it pushed removal success from close to 0% to over 85% in settings previously believed safe.

A separate, widely cited 2023 paper by Sadasivan and coauthors made the broader argument: watermarking and other AI-text detectors aren't reliable against a motivated attacker willing to paraphrase aggressively.

Verification is strongest when it checks one specific signal from one specific provider and says so plainly.

OpenAI frames its own image-verification tool that way. It checks for the supported signals OpenAI's tools produce, and deliberately avoids a definitive conclusion when it finds nothing.

The narrowness is the point. A check that admits what it cannot see is worth more than a broad detector that returns a number for anything you paste into it.

Neither kind of tool can prove a negative. A clean result means one specific check didn't find its one specific signal, and nothing beyond that.