AI Watermarking Research: A Map of the Literature

Text watermarks are applied at generation time, not after the fact. A logits processor sits between the model's raw output and the sampling step.

Before each token is chosen, it pseudorandomly splits the vocabulary into a green sublist and a red sublist, seeded by prior tokens or a key, then softly nudges sampling toward green. Detection scores a passage by checking whether green tokens appear more often than chance predicts.

That test gives an interpretable p-value without needing the model itself at detection time, which is most of why the idea caught on.

The source is Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein's "A Watermark for Large Language Models" (ICML 2023, arXiv:2301.10226), cited roughly 984 times.

• Distortion-free (Kuditipudi, Thickstun, Hashimoto, Liang, arXiv:2307.15593): maps a watermark key through the sampling procedure so the marginal output distribution is unchanged, while staying robust to edits up to a generation-length budget.
• Unigram-Watermark (Zhao, Ananth, Li, Wang, ICLR 2024): fixes the green and red split constant across every token position instead of re-randomizing it, trading that flexibility for a provable robustness guarantee under bounded editing.
• Undetectable watermarks (Christ, Gunn, Zamir, COLT 2024): defines watermarking cryptographically, so that without the secret key, watermarked and unwatermarked text are computationally indistinguishable.
• Open-weight watermarking (Christ, Gunn, Malkin, Raykova, arXiv:2410.18861): embeds the signal in model parameters, because once weights ship to someone else the operator controls decoding and a sampling-time watermark has nothing left to bias.
• Multi-bit schemes (Yoo, Ahn, Kwak, NAACL 2024; Qu et al., USENIX Security 2025): carry an actual payload rather than a single yes-or-no bit, the second using error-correcting codes for provable recovery under adversarial edits.

Kirchenbauer's own follow-up (ICLR 2024, arXiv:2306.04634) asked the practical question instead: how much text does a detector need? It found the original scheme stays detectable after strong human paraphrasing once roughly 800 tokens are observed, at a 1e-5 false-positive rate.

Three results dominate the attack literature: recursive paraphrasing, watermark stealing, and radioactivity. Sadasivan, Kumar, Balasubramanian, Wang, and Feizi's widely cited paper (arXiv:2303.11156, roughly 615 citations) introduced a recursive paraphrasing attack and argued watermarking is not reliable against an attacker willing to paraphrase repeatedly.

ETH Zurich's SRI Lab pushed further in "Watermark Stealing in Large Language Models" (ICML 2024). An attacker who approximates a provider's secret green and red rule using ordinary API queries, for under $50, can push scrubbing success from near 0% to over 85% in settings previously believed safe, and forge the watermark onto arbitrary attacker text over 80% of the time.

Meta and FAIR's "Watermarking Makes Language Models Radioactive" (NeurIPS 2024) found the effect travels further still. Fine-tuning a second, unwatermarked model on watermarked output leaves detectable contamination in that second model's own outputs, a provenance signal that survives distillation.

Of every scheme in this literature, only SynthID Text runs at real scale. Google's SynthID Text is described in a peer-reviewed Nature paper and open-sourced for developers. Google reports a live experiment assessing user feedback across nearly 20 million real Gemini responses with no detectable quality loss, and cites detection accuracy clearly ahead of prior state of the art at a fixed false-positive rate.

Independent researchers tested it anyway. Han, Li, Ni, and Zulkernine's SynGuard paper (IEEE TrustCom 2025) found it vulnerable to paraphrasing, copy-paste splicing, and back-translation, the same weakness Google's own documentation concedes, and their hybrid defense improved F1 by 11.1% on average.

A newer preprint (Omidi, Dong, Wang, March 2026) proved the mean-score detector grows more vulnerable as sampling layers increase, while the alternative Bayesian-scoring detector, also part of SynthID Text's own design, holds up better.

Every other scheme named on this page remains a proposal no provider has confirmed shipping.

Media watermarking embeds signals directly in pixels, video frames, or an audio waveform, invisible to a viewer but detectable by a matching algorithm, and built to survive compression, cropping, or a screenshot.

Fernandez, Couairon, Jégou, Douze, and Furon's Stable Signature paper (ICCV 2023), from Meta AI and Inria, fine-tunes a diffusion model's decoder so every image it generates carries a watermark recoverable by a pretrained extractor. It stays over 90% accurate at a false-positive rate below 1e-6 even after cropping to 10% of the original image, and at roughly 428 citations it is the most-cited image watermarking paper in this literature.

Google extends the approach across images, audio, video, and text under the SynthID name. A 2025 DeepMind paper reports the system has watermarked over ten billion images and video frames across Google's services, a self-reported figure not independently validated.

OpenAI separately states it uses SynthID as an invisible layer for images from ChatGPT, Codex, and the OpenAI API.

Google and DeepMind hold a documented patent family. It includes a 2024 filing on multi-stage text watermarking (US 2024/0320529 A1, filed 2024-03-20, assigned to DeepMind Technologies Limited) plus older filings on image watermark encoders and authenticity-verification decoders going back to a 2020 application.

Targeted searches for Meta, OpenAI, Microsoft, and Anthropic found no comparably specific watermarking patents. That is a real negative result with evidentiary weight, not proof none exists, since the searches were not exhaustive across subsidiary entity names, alternate terminology, or non-US jurisdictions.

As on the text side, robustness for media watermarks stays unresolved. These marks survive ordinary sharing and re-compression, while heavy editing and adversarial removal remain an active target rather than a solved problem.