OpenAI Text Provenance and textGrain Watermarking
OpenAI has announced a phased rollout of text watermarking to comply with the EU AI Act, which requires generative AI providers to make AI-generated text machine-readable. The company is introducing a new technology called textGrain to add invisible statistical signals to model outputs, allowing for the identification of OpenAI-generated content while maintaining output quality.
Implementation Strategy and Rollout
OpenAI is deploying text watermarking through a tiered approach based on region and user type:
- EU Users: In the coming weeks, an invisible watermark will be added to eligible ChatGPT and Codex text outputs for users within the European Union.
- API Customers: Global API customers can now opt in to text watermarking for select models. This feature remains off by default.
- Cloud Partners: OpenAI is working with cloud partners to extend watermarking availability to model outputs accessed through their services in the coming weeks.
Technical Overview of textGrain
textGrain is a watermarking technology that embeds an invisible statistical signal into the model's word choices. A corresponding detector then analyzes text to determine if that signal is present.
Performance and Limitations
OpenAI reports that textGrain matched or exceeded the performance of other tested approaches, including SynthID for text. However, the company highlights several critical limitations in detection reliability:
- Text Length and Constraints: Detection is more effective on longer passages. At a 1% false positive rate, the detector identified watermarks in approximately 95% of 400-token passages but only 80% of 200-token passages (using psychology content). Detection rates are significantly lower for constrained content, such as mathematics, where word choice flexibility is limited.
- Sensitivity to Editing: Modifying the text can degrade the watermark signal. In evaluations of 400-token passages, replacing 10% of the words with synonyms reduced detection from 92% to 66%, and replacing 25% of the words reduced it to 17%.
Impact on Model Quality
Evaluations using the Astra frontier model show no meaningful performance degradation when watermarking is enabled. Benchmarks include:
| Benchmark | Unwatermarked (Astra, max) | Watermarked (Astra, max) |
|---|---|---|
| Artificial Analysis Intelligence Index | 49.57 | 49.76 |
| AutomationBench | 34.09% | 34.86% |
| DeepSWE v1.1 | 72.80% | 71.68% |
| Terminal-Bench 4.0 | 53.90% | 56.06% |
| Terminal-Bench Science 0.1 | 56.90% | 60.00% |
| BrowseComp | 87.92% | 87.35% |
| HealthBench Professional | 64.27% | 64.60% |
| GPQA Diamond | 94.44% | 93.94% |
Detector Access and Governance
Due to the risk of false positives and missed watermarks, OpenAI is not making the text watermark detector publicly available at launch. Access is currently limited to approved researchers and expert organizations to help evaluate and improve the technology.
Interpretational Limits of Text Watermarks
OpenAI emphasizes that a detection result does not provide a complete picture of a text's origin. Specifically, a watermark:
- Does not measure human contribution: It cannot quantify the amount of human editing or creativity involved.
- Does not establish ownership: It does not determine legal ownership, lawful use, or responsibility for the content.
- Does not identify the user: It does not link the text to a specific person, account, or prompt.
- Does not verify accuracy: It does not indicate whether the text is true or harmful.
- Does not prove human authorship if absent: The absence of a watermark does not guarantee the text was written by a human, as it may be too short, edited, or generated by an unsupported model.
Broader Content Provenance Framework
Text watermarking is part of a layered provenance strategy. OpenAI utilizes C2PA-conformant Content Credentials for images, as well as SynthID invisible watermarks for images and audio, which are verified via the Content Provenance API and openai.com/verify. This multi-layered approach combines open standards and durable watermarking to help platforms and users identify AI-generated content, particularly to mitigate the spread of deepfakes.