Why Watermarking Images Was Easy but Watermarking Text Is Hard

Photographers, studios, and stock libraries have been quietly stamping invisible marks into images for decades, and most of those marks survive the rough handling of the real internet just fine. Then large language models showed up, everyone wanted the same trick for text, and it turned out to be genuinely hard. The reason isn’t that nobody’s tried. It’s that text and images are built differently, and that difference decides what you can hide inside them.

Key takeaways

• Images hold millions of pixels, most of which nobody inspects, so a watermark can hide in the parts no one looks at.
• Text is short and dense: nearly every word carries meaning, leaving almost no spare room to bury a signal.
• Common image edits (resize, compress) keep most pixels, but one paraphrase can rewrite text top to bottom and erase a text watermark.
• AI text watermarks work by nudging word choice, which is fragile against editing, translation, and synonym swaps.
• Because text watermarks are so easy to break, *detection* (probability estimates) still does most of the heavy lifting.

The thing images have that text doesn’t: spare room

Start with a single photo. A modest 12-megapixel image is twelve million pixels, and each pixel has three color values. That’s thirty-six million numbers describing one picture. Here’s the part that matters: a human looking at the photo notices almost none of those numbers individually. Shift the blue channel of a pixel by one or two steps and no eye on earth catches it.

That gap between “data present” and “data a person actually perceives” is where a watermark lives. You spread a faint pattern across thousands of pixels, each nudge too small to see, and the combined signal is recoverable by software that knows what to look for. The image still looks identical. The mark rides along in space the viewer was never going to check.

Now look at a paragraph. Maybe 80 words. Each word is doing a job, and a reader processes every one. There’s no equivalent of a “low-importance blue channel” you can quietly adjust. Swap a word and either the meaning shifts or a reader notices the odd phrasing. The medium is lean. It carries almost no passenger data you can hide a stowaway in.

That’s really the heart of it: images are redundant, and text is dense. Watermarking thrives on redundancy.

A quick way to feel the difference

Picture a 500-word essay. To embed a watermark you need somewhere to put bits of a hidden signal without anyone clocking it. In an image you’d have millions of candidate spots. In that essay you have a few hundred word slots, and changing any of them is conspicuous. It’s like being asked to hide a note in a crowded stadium versus hiding one in a haiku. Same task, wildly different odds.

How AI text watermarks actually try it

The cleverest text watermarks gave up on hiding data in “spare” characters and went after the one thing a language model controls: which word comes next.

The widely cited approach (Kirchenbauer and colleagues, ICML 2023) works like this. As the model generates, a secret key splits the vocabulary into a “green list” and a “red list” at each step, then gently pushes the model to prefer green words. Do this across a whole passage and the finished text quietly over-uses green words in a way that looks normal to a reader but is statistically detectable to anyone holding the key. Google’s SynthID for text uses a relative of this idea, nudging the model’s word probabilities with a secret key.

It’s elegant, and in clean conditions it works. The catch is that the entire watermark is stored *in the specific words the model picked.* That’s a very exposed place to keep a secret.

Why one paraphrase undoes everything

Here’s the asymmetry that defines text watermarking vs image watermarking.

Resize an image from 4000 pixels wide to 2000, or save it as a slightly more compressed JPEG, and you still have most of the original content. The watermark, deliberately smeared across the whole frame, mostly survives. Robustness against exactly these everyday edits is a core design goal of image watermarking, and decades of work have made it pretty good at it.

Paraphrasing text does the opposite of a resize. It keeps the *meaning* and throws away the *words.* And the words were the entire hiding place.

Mini-scenario. A model writes a watermarked paragraph that leans on green-list words like *therefore,* *moreover,* and *significant.* A student runs it through a rewriting tool, or just rewrites it themselves. Out comes *so,* *also,* and *big.* Same point, different vocabulary. The green-word bias the checker was counting on is gone. The watermark didn’t degrade gracefully; it got deleted, because the carrier got replaced. Translation does the same thing across languages, and even casual editing chips away at it. The watermarking researchers themselves have flagged how paraphrasing, translation, and synonym swaps erode these marks, so this isn’t a hypothetical weakness.

You can see the parallel to detection here, since both ride on word-level statistics. If you want the underlying math, we walk through the statistics behind AI detectors elsewhere; perplexity and burstiness are cousins of the same signals a watermark tries to plant on purpose.

What about invisible characters?

The obvious objection: just hide a watermark in zero-width characters or weird spacing, the way some tools do. Sure, you *can* embed a mark that way. But it’s the most fragile option of all. Paste the text into a plain editor, retype it, or run any formatting cleanup, and the invisible characters evaporate. They’re also trivial to strip deliberately. So they technically watermark the text, but they don’t survive the ordinary life of a document, which is the only test that counts.

The cooperation problem text adds on top

Images have one more quiet advantage: the people watermarking them *want* the mark there. A studio stamps its own photos. With AI text, the mark can only exist if the model’s maker chose to add it during generation.

That means an AI text watermark covers exactly one slice of the world: cooperating generators. Open-source models that ship without watermarking, or any tool that simply turns it off, produce text with no mark at all. There’s nothing to find, no matter how good your checker is. And typically only the provider can verify the mark, because the check needs their private key, so a teacher or a platform can’t run it independently anyway.

Image watermarking has the same “only if someone added it” limit, but in practice the people who care about provenance control the source. With text flooding in from countless models and being edited constantly, that control mostly doesn’t exist.

So what does this mean if you write for a living or for class

A few honest conclusions fall out of all this.

First, watermarking is not the thing standing between you and a flag. Because text marks are so easy to wash out and so often absent, schools and platforms lean on *detection* instead. Detectors don’t hunt for a hidden mark; they estimate how AI-like writing reads and spit out a probability. That works on any text but it’s a guess, not proof, which is why detector scores get things wrong and shouldn’t be treated as verdicts on their own. OpenAI even retired its own AI text classifier in July 2023, citing its low accuracy, and a Stanford study the same year found detectors biased against non-native English writers.

Second, the fragility cuts both ways. The same density that makes text hard to watermark also makes it hard to detect reliably, which is genuinely good news for anyone writing in their own voice. Specific, varied, human writing doesn’t carry an obvious statistical fingerprint to begin with.

For the wider picture on provenance, detection, and where this is all heading, there’s more on the PaperBleach blog, and what PaperBleach offers lays out the tooling side.

Frequently asked questions

What is the core reason text is harder to watermark than an image? Spare room. A photo has millions of pixels a viewer never inspects, so you can hide a signal in data nobody checks. A paragraph has a few hundred words a reader actually reads, with almost no redundant capacity to bury a mark in. Less hiding space plus a reader who notices everything makes it a much harder problem.

Do AI text watermarks actually exist? Yes. The leading method biases a model’s word choices with a secret key so the text statistically favors certain words, and Google’s SynthID for text uses a related idea. They work in controlled settings; their weakness is robustness against paraphrasing, translation, and editing.

Why does paraphrasing break a text watermark but resizing rarely breaks an image one? Resizing keeps most pixels, and the watermark is spread across them, so it survives by design. Paraphrasing replaces nearly every word while keeping the meaning, and a word-choice watermark lives entirely in those words. Change the words and you’ve erased the mark.

Can’t you hide a watermark in invisible characters? You can, but it’s the most brittle option. Retyping, plain-text pasting, or any cleanup strips it instantly, and it’s easy to remove on purpose.

If text watermarks are fragile, how is AI writing flagged? Mostly by detection, which estimates how AI-like text reads and returns a probability. It works on anything but it’s a guess, not proof.

The short version

Image watermarking won because images are roomy and forgiving; text watermarking struggles because text is tight and every word is load-bearing. That’s not a temporary engineering gap, it’s a property of the medium. If you’d rather understand how your own writing reads than gamble on a hidden mark that may not exist, see how a draft reads and write from there.