Watermarking
Hiding a detectable signal in AI output — technically clever, deployed almost nowhere, and there's a proof that it can't do what people want from it.
When not to use it
- To accuse anyone of anything. Detectors are systematically biased against non-native speakers. This is happening now and it's wrong.
- On short text. The statistics need length. A tweet can't be watermarked.
- On low-entropy output. Code, quotations, factual answers — there's no room to nudge.
- Expecting it to cover open-weight models. The weights are on someone's disk. It can't.
Reach for something else instead
- Provenance (C2PA) — sign what's real at capture. The approach that can work.
- Platform-level disclosure — require the uploader to declare it.
- Not needing to know — for a lot of use cases, "was this AI" is the wrong question. "Is it correct" is answerable.
- Assessment redesign — in education, this is the real answer and everyone knows it.
Sources & further reading
- Kirchenbauer et al. (2023), A Watermark for Large Language Models — the green-list method; it works.
- Sadasivan et al. (2023), Can AI-Generated Text be Reliably Detected? — the impossibility bound as distributions converge, and the paraphrase attack.
- Liang et al. (2023), GPT Detectors Are Biased Against Non-Native English Writers — the deployed harm, measured.
Primary sources, listed so you can check the claims on this page rather than take them on trust.
Where people go wrong
- Using an AI-text detector on student work. It's biased against non-native writers in a measurable, systematic way.
- Conflating watermarking with detection. One is an injected signal, the other is a guess. Different failure modes.
- Expecting it to survive paraphrasing. It doesn't.
- Missing that it only marks the cooperating models — the output you were least worried about.
At a glance
FieldSafety & Ethics
Methodnudge generation toward a keyed pseudorandom token subset
The bound on detectionimpossible as distributions converge (Sadasivan et al.)
The bound on watermarkingcooperation and paraphrasing
The deployed harmdetectors biased against non-native English writers
The workable directionprovenance
DifficultyIntermediate
Flashcards for this concept
Question
—
Answer
—
1 / 4
Often compared with
Watermarking vs. provenance — one asks every generator to mark its output forever; the other asks cameras to sign what's real. Only the second answers the question people actually have.