Why Watermark Detection Requires the Model Maker’s Cooperation (and Why That’s a Problem)

There’s a question buried under all the watermarking hype that almost nobody asks out loud: when an AI company stamps a hidden mark into the text its model writes, who actually gets to read that mark back? The honest answer surprises people. In most cases it’s just the company itself.

That single fact — that watermark detection runs through the model maker — quietly decides who can use the technology, who can’t, and why the watermark you keep hearing about probably won’t settle any argument you’ll ever have.

Key takeaways

• Most text watermarks can only be verified by the company that made the model, because checking the mark needs a secret key they keep private.
• That means your teacher, your editor, your client, and random websites generally can’t run a watermark check at all — they fall back to ordinary AI detectors instead.
• The cooperation requirement creates a trust problem: you have to take the maker’s word for the result, with no independent way to audit it.
• A public key would let anyone verify a watermark, but it would also let anyone learn to strip or forge it, so makers face a real bind.
• Because watermark checks are gated and easily evaded, the practical answer to “who can prove AI use” is still nobody, cleanly. Process and voice matter more than any mark.

What “detecting a watermark” actually involves

Start with how the mark gets there. When a language model writes, it doesn’t pick one obvious next word — it rolls weighted dice over a list of plausible options. A text watermark loads those dice. Using a secret key, the system nudges the model toward a specific pattern of word choices, faint enough that you’d never notice it but consistent enough to measure later. This is the green-list idea from Kirchenbauer and colleagues in 2023, and the production version Google DeepMind described in a 2024 *Nature* paper and wired into Gemini as SynthID-Text.

Here’s the part that gets glossed over. To *detect* the mark, you don’t just need software — you need that same secret key. The detector re-runs the text and asks: do the word choices line up with the pattern this key would have produced, at a rate that couldn’t happen by chance? No key, no answer.

And yes, DeepMind open-sourced SynthID-Text — the code sits on GitHub and ships inside Hugging Face Transformers. That sounds like it should crack the whole thing open, but it doesn’t. The code is the lock mechanism, not the key. DeepMind’s own guidance says the watermarking configuration “should be stored securely and privately.” So the recipe is public; the specific key that proves a given mark is not. Whoever holds that key does the verifying, and that’s almost always the maker.

So watermark detection isn’t a public utility. It’s a private check that the keyholder runs. Which raises the obvious question.

So who can actually detect AI watermarks?

Short version: the model maker, and pretty much only the model maker.

• The company that made the model. They hold the key, they applied the mark, they can verify it. Full stop.
• Whoever the company chooses to let in. A maker can expose a verification endpoint or hand a key to select partners. Access is granted, not assumed.
• Almost nobody else. Your professor can’t. Your editor can’t. The freelance client who thinks your article “feels AI” can’t. A site you found by searching “AI watermark checker” almost certainly can’t either — and if it claims to, be skeptical, because it has no path to the key.

That’s a strange shape for a tool people assume is going to catch cheaters. The one mark that’s genuinely reliable when it’s present is the one almost no real-world gatekeeper can read.

A quick scenario

Picture Priya, a writing instructor who suspects an essay was generated by Gemini. She wants to “check the watermark.” Where does she go? There’s no box on her dashboard for it. Her school’s tools — Turnitin, maybe GPTZero — don’t read SynthID; they were never given the key and aren’t built to. They do something else entirely: they estimate how AI-like the prose reads using statistical signals. That’s a guess, and a fallible one. (If you want the mechanics, we cover the statistics behind AI detectors.)

So Priya, who actually has a watermark question, ends up with a probability from a detector that doesn’t touch watermarks at all. The reliable signal is locked away; the available signal is a guess. That gap is the cooperation problem in one classroom.

Why the mark stays gated: the trust bind

You’d think the fix is easy — publish the key, let everyone verify. But the makers are stuck, and it’s worth seeing why, because the bind is real and not just corporate caginess.

A watermark’s strength comes from secrecy. The pattern has to be hard to guess. The moment you publish the key that proves the mark, you also publish a usable map of it. And once people have that map, two bad things become easy:

• Stripping. If you know exactly which word choices the watermark favors, you can systematically rewrite around them and wash the mark out on purpose — far more efficiently than blind paraphrasing.
• Forging. Worse, you can stamp the watermark pattern onto text a human wrote, framing a person as having used AI. A publicly checkable mark is a publicly forgeable one.

So the choice is genuinely lousy. A mark anyone can audit is a mark anyone can defeat or fake. A mark that resists tampering is a mark only the keyholder can confirm. Most makers picked the second, which is why detection lives behind their walls.

That hands the public a trust problem. If only the maker can run the check, then a watermark result is only as trustworthy as the maker’s word and process. There’s no independent lab you can send the text to for a second opinion. For a signal that might affect someone’s grade, job, or reputation, “trust us” is a weak foundation — and it’s the foundation watermark detection currently sits on.

What this means in practice

The cooperation requirement isn’t an abstraction. It shows up in concrete ways.

A clean check proves almost nothing. Suppose a maker did run a check and found no mark. That doesn’t mean a human wrote the text. It could mean the text came from a model that doesn’t watermark at all — most don’t, including a long list of open-source ones. It could mean someone paraphrased, edited, or translated the passage and rubbed the mark off, since the signal lives in word choice. It could mean the text was too short to carry a reliable pattern. “No watermark found” and “a human wrote this” are not the same sentence.

The cases that cause real fights are the uncovered ones. Watermark detection cleanly handles untouched output from a cooperating model — which is the easy case nobody argues about. The disputes that wreck someone’s week involve non-participating tools, heavy edits, or paraphrasers, and those slip right past a watermark check even when someone *can* run it.

The fallback inherits all the old flaws. Because watermark checks are gated, the world keeps leaning on statistical detectors for everyday decisions. Those are the tools that output probabilities, not proof — the kind OpenAI found so unreliable it retired its own AI text classifier in July 2023, and the kind a 2023 Stanford study (Liang et al.) found flagged a majority of essays by non-native English writers as AI-generated. Gating the good mark doesn’t make the guessing tools better. It just keeps them in charge.

You can read more on the PaperBleach blog for how these failure modes play out, or see what PaperBleach offers if you want a tool on your side of the table.

Frequently asked questions

Who can actually detect an AI watermark in text?

In most cases, only the company that built the model and applied the mark. Verifying a text watermark like SynthID-Text generally requires a secret key tied to that generator, and the company keeps it private. The maker can check it; a teacher, editor, client, or random website usually can’t. That’s why AI-use disputes almost never involve a watermark result — they involve a statistical detector score, which is a guess.

Can my teacher or my client detect an AI watermark on my writing?

Almost never. They’d need the model maker’s private key, which isn’t public, and there’s no easy paste-and-check service most schools or businesses can use. So they reach for tools like Turnitin or GPTZero, which don’t read watermarks at all. Those estimate how AI-like the writing looks from patterns — probabilistic, and prone to false positives.

Why don’t model makers just publish the key so anyone can detect watermarks?

Because the key that lets you verify a mark also reveals how the mark is built, which makes it far easier to strip the watermark out or forge a fake one onto human text. A publicly checkable watermark is a much weaker, more forgeable watermark. Makers are stuck choosing between a mark anyone can audit but also defeat, and one that’s harder to defeat but only they can confirm. Most chose the second.

If a watermark check comes back clean, does that prove a human wrote it?

No. A clean or absent result might mean the text came from a model that doesn’t watermark, that the mark was washed out by paraphrasing or translation, or that the passage was too short to carry a signal. “No watermark found” is not “a human wrote this.” It just means there’s no mark to find.

So who can prove I used AI, or that I didn’t?

Cleanly, nobody — and that’s the honest state of things in 2026. Watermark checks are gated behind private keys and easily evaded, and statistical detectors output probabilities, not proof. The strongest evidence about how a piece was written is your own process: drafts, version history, notes, plus writing that genuinely sounds like you.

The bottom line

Watermarking gets sold as the thing that will finally make AI text verifiable. But verification runs through the model maker, by design, because a watermark anyone can read is a watermark anyone can break. So the reliable signal stays locked up, and the rest of us are left with detectors that guess. That doesn’t change what protects you — keeping your drafts, and writing with real specificity and voice, beats any mark or score.

Want to know how your draft reads before anyone else runs it through anything? Check how a draft reads with PaperBleach.