OpenAI's textGrain explained: a watermark hidden in ChatGPT's word choices

In November 2022 a researcher at OpenAI described how to hide a secret signal in ChatGPT's choice of words. The company built it, tested it, and kept it on the shelf for fear of losing customers. On 5 October 2026 OpenAI announced that a descendant of that idea, called textGrain, will be switched on for ChatGPT and Codex users in the European Union within weeks, because an EU law now requires it. OpenAI's own figures say the mark is found in about 95% of clean 400-token passages, and in 17% of passages once a quarter of the words have been swapped for synonyms. That gap, between what the mathematics can promise and what a light edit can undo, is the whole story.

The plain-English version

When ChatGPT writes, it rarely knows the next word for certain. At most points it has several acceptable options, say "big", "large" and "huge", each with a probability, and it rolls a weighted die to choose. Because the roll is random, the same question can produce different answers on different days.

A text watermark swaps that die for something that only looks random. Picture a writer with a pocket calculator. Before each word, the writer types in a secret number and the last few words already written, and the calculator answers with a preference: this option rather than that one. The writer still chooses only among words that fit, so the sentence reads normally and no reader can tell. But anyone who owns the same calculator and knows the secret number can go back through the finished text, recompute the preference at each point, and count how often the writer followed it. A human author agrees with the calculator about as often as chance. The watermarked model agrees far more often. Over a few hundred words, the excess becomes statistical evidence.

That is what textGrain does. OpenAI describes it as "an invisible statistical signal" in the model's word choices. Its help pages stress that nothing is added to the text: no hidden characters, no invisible spaces, nothing that copy-and-paste would strip, because the mark lives in the words themselves.

It is arriving now because of law, not choice. Article 50 of the EU AI Act, in force since 2 August 2026, says providers of systems that generate text "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated". Systems already on the market have until 2 December 2026, according to a Paul, Weiss memo on the final rules. OpenAI has signed the accompanying Code of Practice, as have Anthropic, Google, Meta and Microsoft, TechCrunch reports.

Three things to hold on to. First, the watermark is regional and partial: EU users of ChatGPT and Codex on all plans will get it on "eligible" output over the coming weeks, developers elsewhere get an off-by-default switch, and OpenAI says it is "not making text watermarking a global default at launch". Not every answer counts as eligible: OpenAI's help pages note that the EU Code of Practice does not require watermarks on outputs shorter than 200 tokens, about 150 English words, or on code snippets. Second, you cannot check for it yourself; the detector is open only to approved researchers and expert organisations who apply. Third, OpenAI itself lists what the mark cannot do: it cannot say who used ChatGPT, how much a person contributed, who owns the text or whether it is true, and a missing watermark does not prove a human wrote something.

The weakness is in the company's own tests. The evidence is spread thinly across every word, so every word you change removes a little of it. Swap one word in ten for a synonym and detection fell from about 92% to 66% in OpenAI's evaluation. Swap one in four and it fell to 17%.

How it actually works

The problem. A language model produces text one token at a time (a token is a word or part of one). At each step it computes a probability for every token in its vocabulary, then samples one. Where the distribution is spread out, as in an essay, there is "entropy", meaning genuine freedom of choice. Where it is sharply peaked, as in the next digit of an arithmetic answer or the next character of code, there is almost none. Any watermark that works by steering choices can only live where there are choices to steer. That single fact explains most of the numbers in this story.

The old ways. Three families of generative watermark preceded textGrain, and its technical report positions itself against each.

1. Green lists. In 2023 Kirchenbauer and colleagues proposed hashing the previous token with a key to split the vocabulary into a "green" list and a "red" list, then nudging the green tokens' probabilities upward. Detection counts green tokens. It is simple and strong, but it changes what the model says; the report notes that such methods alter the output distribution "even after averaging over their keyed token subsets".

2. Gumbel-max. Scott Aaronson's 2022 proposal, developed at OpenAI, kept the model's distribution intact on average by replacing the random numbers used in sampling with pseudorandom ones derived from the key and the preceding tokens. The catch, as the textGrain report puts it: at a fixed context and key "it always selects the same token", so asking the same question twice yields the identical answer. Variety disappears.

3. Tournament sampling. Google DeepMind's SynthID-Text, published in Nature in 2024, draws several candidate tokens and runs them through a keyed knockout tournament across 30 layers, seeded by a hash of the previous four tokens. It is unbiased in its default mode, has run in Gemini since 2024, and is the method Anthropic adopted for Claude in August 2026.

The new idea. textGrain treats the watermark as a budgeting problem: how much of the model's randomness are you willing to spend on the signal? A generation step runs like this.

1. Keyed randomness. The secret key and a window of preceding tokens seed a pseudorandom generator, exactly as in the earlier schemes.
2. Blocks and columns. The pseudorandom numbers sort the whole vocabulary into a fixed number of groups, called blocks, and lay out a small cost table between those blocks and a handful of equally likely "columns". Each cell's cost is minus a random Gumbel value, so a large Gumbel draw means a low cost, and a low cost means "the watermark would like this block to go with this column".
3. A small transport problem. The model's probabilities for the blocks form one side of the table and the uniform columns form the other. The algorithm finds a joint plan that favours low-cost cells but pays a penalty for every bit of dependence it creates between block and column. The penalty is the Kullback-Leibler divergence from independence, and the report proves it equals exactly the average amount of sampling randomness the watermark removes. A budget, written β, caps that at a chosen fraction of the step's entropy.
4. Sampling. The key picks a column. The plan gives the probability of each block given that column, a block is drawn, and finally a token is drawn inside the block using the model's original relative probabilities.
5. Detection. Someone holding the key and the text, but not the model, recomputes the blocks, cost table and column at each position, reads off the cost of the block the observed token belongs to, turns it into a score and adds the scores up. Under human text the sum follows a known distribution; an unusually large sum is the watermark.

Why it works: averaging over the columns gives back the model's original probabilities exactly, so a reader without the key faces text whose statistics are those of the unwatermarked model. Grouping tokens into blocks shrinks the optimisation from the size of the vocabulary to the number of blocks, which is what makes solving a transport problem on every token affordable. And because the budget is defined in information-theoretic terms, "spend 10% of the entropy" means precisely that, on average over keys. The report also shows the scheme can be combined with speculative decoding, the trick production systems use to generate several tokens per model call, provided the draft and target models share the key. OpenAI's help pages say the effect on speed is negligible.

The deep dive

Watermarking as a coupling

The report, by Xiang Li, Garrett Wen, Xiaohong Chen, Qi Long, Arzav Jain, Florent Joly, Mike Lam, Qingquan Song and Weijie Su, with Su as corresponding author, frames every unbiased watermark as a coupling. Let $P$ be the next-token distribution at some prefix, $\Xi \sim \mu$ the keyed pseudorandom variable, and $W$ the emitted token. A watermark is unbiased if the joint law $\pi$ of $(W,\Xi)$ has marginals $P$ and $\mu$, so that averaging the conditional sampling distribution $Q(\cdot \mid \xi)$ over keys recovers $P$. Plain sampling is the independent coupling $P \otimes \mu$. Gumbel-max sits at the other extreme: $W$ is a deterministic function of $\xi$.

The report's central identity is that for any such coupling,

Mutual information between token and key equals the entropy the watermark removes on average. That turns "watermark strength" from a tuning knob into a quantity with units. The scheme is then an entropy-regularised optimal transport problem,

with a cost $c$ that rewards the dependence the detector will later look for.

Block optimal transport

Solving that over a vocabulary of $10^5$ tokens at every step would be too slow, so textGrain works on blocks. A keyed partition $g: \mathcal{V} \to [B]$ assigns each token in the support $\mathcal{A}$ to one of $B$ blocks, giving block probabilities $P^{\mathrm{blk}}_b = \sum_{w: g(w)=b} P_w$. The keyed randomness is a uniform choice $J$ among $m$ columns. For each block-column pair the key also draws a standard Gumbel variable $Z_{bj}$ with distribution function $F_G(z) = \exp\{-\exp(-z)\}$, standardised to $G_{bj}$, and the cost is $c(b,j) = -G_{bj}$: large Gumbel values are cheap. The budgeted problem is

and the token is sampled from

Because tokens inside a block keep their original relative probabilities, $m^{-1}\sum_j Q(w \mid j) = P_w$ exactly, and the coupling "retains at least a fraction $1-\beta$ of NTP entropy on average across columns". The solver is a Sinkhorn iteration in the log domain with an outer loop that adjusts $\lambda$ until the achieved entropy loss matches the target, followed by a marginal-correction step so that the sampled distribution stays unbiased even when the iteration has not fully converged. Each update costs $O(Bm)$ and a whole step $O(|\mathcal{A}| + N_{\mathrm{it}} B m)$. The report proves the optimal coupling's KL divergence is non-increasing in $\lambda$, which makes the outer loop well posed. It is explicit that a finite iteration limit "can leave that loss above or below the target", so the achieved loss should be reported alongside the request.

Appendix B extends the construction to speculative sampling with a shared key: both draft and target apply the watermark, the target verifies proposals jointly using the block-verification rule of Sun et al., and the output law equals direct watermarked sampling from the target. Whether this speeds anything up "requires empirical measurement".

The detection statistic

Detection needs the tokenizer, the key, the block and column counts and the context-window rule, and nothing else. At scored position $t$ the detector rebuilds the partition, cost table and selected column, finds the cost $c_t$ of the observed token's block, undoes the standardisation to recover $Z_t$, and computes

If the text is independent of the key, each $Z_t$ is a standard Gumbel variable, each $Y_t$ is unit exponential, and $S_n \sim \mathrm{Gamma}(n,1)$. The detector declares a watermark when $S_n$ exceeds the $(1-\alpha)$ quantile, giving a conditional false-positive rate of $\alpha$ under the stated assumptions. Only the first occurrence of each distinct context window is scored, to avoid reusing the same pseudorandom table. The report is careful about what this does not guarantee: "A fixed deployed key and finite precision arithmetic require empirical calibration checks; the idealized null calculation does not by itself guarantee the same error rate for every key or application." It also notes that because the reconstructed Gumbel values have a different distribution under textGrain than under Gumbel-max, optimality results for Gumbel-max detectors "do not transfer automatically".

What OpenAI measured

The technical report contains no experiments. The numbers below come from OpenAI's blog post, as relayed by TechCrunch, The Decoder and others, and are vendor-reported.

The language chart on OpenAI's help pages matters for an EU-only deployment. OpenAI says the watermark has "an adjustable strength parameter", a knob it turned up for languages whose detection fell below 60%, which is the entropy budget of the technical report put to work. The blog post's 80% and 95% headline figures do not say which language they were measured in.

On quality, OpenAI reports eight benchmarks for its GPT-6 Astra model with the watermark off and on. Two of them, as relayed by Unite.AI: an Artificial Analysis Intelligence Index of 49.57 against 49.76, and GPQA Diamond of 94.44% against 93.94%. OpenAI calls the differences not meaningful, which is what the unbiasedness theorem predicts for average quality. OpenAI also says textGrain "matched or exceeded" the other methods it tested, including SynthID for text, without publishing the comparison.

How it compares

The closest relatives are the other coupling-based schemes the report cites: Xie et al. and Long et al. optimise worst-case detection power over a class of next-token distributions, Huang et al. jointly optimise a coupling and an e-value, and Tsur et al. use optimal transport with costs drawn from coding theory or heavy-tailed distributions. The report's claimed distinction is the objective: it uses the coupling's KL divergence from independence to control the average entropy loss, so the watermark's strength is a budget rather than a by-product. SynthID-Text's large-scale evidence remains the benchmark to beat: its Nature paper compared about 20 million live Gemini responses and found thumbs-up rates differing by 0.01% and thumbs-down rates by 0.02%, both statistically insignificant. OpenAI has published no comparable live data yet.

Why it matters

For everyday users. If you use ChatGPT or Codex in the EU, text you generate over the coming weeks will carry a statistical signature that OpenAI, and the organisations it approves, can test for. OpenAI has not said whether EU users can switch it off, a gap Search Engine Journal flagged. The signature does not identify you, and a positive result means only that an OpenAI model wrote or touched part of the passage. A negative result means nothing: the text may be short, edited, translated or from another company's model.

For developers. The API switch sits in project and organisation settings, applies per model and is off unless you turn it on. Opting in does not grant you the detector. Code is the weakest case because there are few plausible alternatives at each position; OpenAI's help pages say code is harder to watermark for that reason, the EU Code of Practice does not require marks on code snippets, and Anthropic says plainly that where an exact output is required its own watermark is not applied. OpenAI's stated plan to open-source textGrain matters more in the long run: an open implementation, combined with the entropy-budget framing, gives anyone running open-weight models a documented way to add provenance signals with a quantified cost in variety.

For companies. Three labs now run three different unbiased watermarks: Google's tournament sampling, Anthropic's variant of it, and OpenAI's block transport. Article 50's obligation to make watermark detection interoperable applies from 2 February 2027 after a deferral, according to the Paul, Weiss memo. A detector that needs each provider's key and each provider's algorithm is not interoperable in any practical sense, so expect the next year to be about shared detection interfaces rather than new sampling tricks.

For the field. For two years the research question was "distortion-free or not". textGrain replaces it with "how much entropy, and where". That makes the trade-off between detectability and variety a design parameter you can budget, audit and compare across schemes. It also exposes the hard limit: the signal is paid for in entropy, and low-entropy text, which includes maths, code and the formulaic prose a content farm produces, has little to pay with.

What to be skeptical of

Every number is OpenAI's. The headline detection figures are for "content such as psychology", which is high-entropy prose that flatters any watermark, and they do not state a language. OpenAI's own chart for the 24 official EU languages, the languages this deployment is for, ranges from 42.2% for Romanian to 69.0% for Spanish before OpenAI turned up the strength for the weakest languages. Mathematics is "substantially lower" with no figure, and code is not quantified at all. The quality numbers are eight benchmarks on one model.

Edits, paraphrase and translation. A drop to 17% after replacing a quarter of the words is not a corner case; it is a normal editing pass. OpenAI's own 2024 statement said its earlier method was "effective against localized tampering, such as paraphrasing" but "less robust against globalized tampering" such as translation or rewording by another model. Aaronson said in 2022 that "this can all be defeated with enough effort". Zhang and colleagues argued, in a paper published at ICML 2024, that no watermark can survive an attacker with a quality oracle and a perturbation oracle, and demonstrated their attack on three schemes. On the other side, Kirchenbauer's group found that even strong human paraphrasing leaves a detectable trace after about 800 tokens at a very strict false-positive rate, so the practical question is length, not possibility.

The detector is closed. Only approved organisations can test text. Nemecek, Chaudhary and Ayday argue in a September 2026 paper that "unverifiability, rather than watermarking itself, is the substantive governance failure" of the current EU regime. When Anthropic shipped its watermark, developers published removal tools within hours, WIRED reported, and nobody could verify whether they worked because no detector was public. The same will be true of textGrain.

False positives are a target, not a measurement. The 1% figure is the quantile of an idealised null distribution. The report itself says the real error rate for a deployed key needs "empirical calibration checks". At 1%, one human essay in a hundred would be flagged by design, and a detector used at scale by schools or employers would generate many such cases. OpenAI's 2024 worry that watermarks could "stigmatize use of AI as a useful writing tool for non-native English speakers" has not gone away, and the help pages' per-language chart shows the signal is weakest in exactly the languages this rollout serves.

Coverage and incentives. Text from Mistral, DeepSeek, Qwen, open-weight models or any non-watermarking provider is invisible to this detector, and Anthropic's and Google's marks need their own keys. The SynthID paper warned that enforcing watermarks on decentralised open models "is difficult". And the report is written by OpenAI staff and academic co-authors and evaluated by its makers; the "matched or exceeded SynthID" claim has no published comparison behind it.

What to watch next

• The EU rollout itself, due "over the coming weeks" from 5 October 2026: which models and outputs count as "eligible" beyond the Code's exemptions for short outputs and code, whether EU users get an off switch, and whether the cloud partners OpenAI mentions follow.
• 2 December 2026, when the Article 50 marking obligations apply to systems already on the market, and 2 February 2027, when the deferred Article 50 obligation to make watermark detection interoperable applies.
• The open-source release. Weijie Su said OpenAI will "open-source it so the community can build on top". Watch for code, a published default budget β and, above all, independent detection and robustness measurements from the partners OpenAI's help pages name at Cornell, ETH Zurich and the Kempelen Institute.
• Anthropic's detection API. It is in private preview for eligible organisations. Once it opens more widely, the removal tools published in August can be tested, and the first cross-vendor comparison of deployed watermarks becomes possible.
• Hybrid-text research. The report cites the Su group's work on estimating what fraction of a document is watermarked and on locating watermarked segments. That is the technical path toward the question regulators actually ask: not "did AI touch this" but "how much".

How this was made: researched and written by an AI model (Claude) from the primary sources listed above, then checked claim-by-claim against those sources in a separate AI fact-check pass. Spotted an error? Email [email protected] and we correct it publicly. Our process.