Today, OpenAI officially announced the enabling of text watermarks. From that date, global API customers can open watermarks on some models themselves, and remain closed by default. In the coming weeks, EU-area eligible ChatGPT and Codex text output will be combined with invisible watermarks, covering all paid files.
Article 50 of the EU AI Act, which has been in force since 2 August 2026, requires generated AI providers to mark output content in a machine-readable manner. The EU Commission's Code of Conduct on Transparency in the Production of Content, published in June, further lists "unintelligible watermarks as a basic requirement, and points out that free text cannot carry metadata like image files, and watermarks are almost the only possible means of marking".
Text waterproofing is not a new topic for OpenAI. As early as 2023, computer scientist Scott Aaronson, a visiting researcher at OpenAI, publicly introduced a set of waterproofing schemes based on the Gumbel-max technique. In the years since, there have been several reports outside of OpenAI that it already has text waterproofing capabilities.
One of the reasons for the delay was the difficulty of water-printing text in engineering. The real problem was not "can't touch it", but whether it could be accurately measured: how much generating freedom the model gave in exchange for detectable signals.
At the same time, a technical report entitled "Entropy TextGrain: Entropy-Calibrated Watermarking for Language Model Text" was published, detailing how this set of watermarks alternated between the two challenges.
The report is titled: TextGrain: Entropy-Calibrated Watermarking for Language Model Text
Address of the report:
One of the authors of the report wrote a name familiar to the Chinese statistical community: Suzhou Jie, winner of this year's COPSS Presidents' Award.
From studying the watermarks of OpenAI to designing the watermarks of OpenAI
Weijie Su's involvement with OpenAI was much earlier than his involvement with OpenAI.
Large-language model watermarks are one of his core research directions in recent years. He and his collaborators published a paper in The Annals of Statistics in 2025, establishing a statistical framework for watermark detection, the object of the study being OpenAI's previous Gumbel-max program, and introducing better-than-practice detection rules for it.
This line of research has since been extended to robust testing under human editing, matching quality testing, estimating the proportion of watermarks in mixed text, etc. In other words, before joining OpenAI, he spent several years researching externally "how to measure the watermarks of OpenAI".
At the end of May, Suzuki announced on X that he would be joining OpenAI on academic leave to participate in model training and be promoted to associate professor in the Department of Statistics and Data Science at the University of Pennsylvania's Wharton School of Business.
On August 5, he was awarded the 2026 Corpus Prize at the Joint Conference on Statistics in Boston.
Established in 1976 by five major statistical societies, the prize is awarded annually to a young statistician, often referred to as the "Nobel Prize" in statistics.
He is the first Chinese statistician to win the prize since 2012, and the first of his contributions to the prize committee is the statistical foundation of generated AI.
Prior to that, his resume was a mathematical elite route: graduated from the School of Mathematical Sciences at Peking University in 2007, received his undergraduate degree in 2011 and his Ph.D. in statistics from Stanford University in 2016, taught by Emmanuel Candès, then taught at Wharton until today.
textGrain is the result of a collaboration of nine people, and the team of authors has also continued this academic connection. In addition to Suzhou, the authors include Xiang Li, Qi Long of the University of Pennsylvania, Garrett Wen, Xiaohong Chen of Yale University, and Arzav Jain, Florent Joly, Mike Lam, and Qingquan Song of OpenAI.
"Impartiality" is not the same as "freedom".
To understand what textGrain is solving, we need to see how waterproofing works.
LLM generates text word-for-word, with each step sampling from a "next word prediction distribution". The practice of watermarking is to generate a series of pseudo-random numbers with a key and a prefix, and then make the sampling process dependent on the string. When testing, the key can be used to reconstruct the same string of numbers to check whether there is a statistical correlation between the text and it.
An important attribute previously pursued by the academic community is called "impartiality": under arbitrarily fixed precedent, if the key is considered to be randomly extracted, then the output distribution of the watermark model is completely consistent with the original model after all the keys are taken on average.
The problem is that the key is fixed when it is actually deployed. For example, Aaronson's Gumbel-max scheme, a set of schemes that Suzette's team has previously studied, always selects the same word under a fixed prefix and a fixed key.
It's like a chef cooking on a cryptographic menu: from all possible cryptographic averages, the proportions of the dishes appear to match the menu perfectly; but as long as the cryptography is not changed, the same table guests point to the same dish every time and the end is always the same dish.
In a large model, the same suggestion is generated repeatedly and the answer is not bad. This is a real loss for the application of multiple sampling options or the hope of getting multiple different solutions.
The other extreme is that if the generating process is unrelated to the key, the randomness of the model is perfectly intact, but the watermark signal does not exist.
The question for textGrain to answer is whether it is possible to precisely control the position between these two extremes using an explanatory spindle.
Watermark is one of the best communication topics
The first key observation of the technical report is that any unbiased watermark can be seen as a "combination" between the generated word and the random number of keys, i.e. a fixed joint distribution of both edge distributions. In this perspective, the degree to which the combination deviates from each other "independently" can be measured using the KL scattering, which is exactly equal to the information between the two, and is equal to the average sample loss after a fixed key.
This constant equation transforms an abstract normal into a quantity that has a clear informational meaning. The team thus introduces the "aluminium budget"β, valued between 0 and 1, which represents the proportion of the original predicted distribution of aluminum that is allowed to be lost.
The larger the key controls the generation, the stronger the signal. It can be understood as a book: the model used to have a number of "freedoms of choice" at each step, and β specifies how much of it is given to the key. The report also specifically emphasizes that this budget is limited to the average post-secret key loss, which does not guarantee that each specific key, each location, will actually lose that much.
The team adopted the optimal transmission (OT) with the KL rule: to each pair of candidates assigned a cost generated by Gumbel's random variable, the lower the price, the more watermarked the preference, while the KL project was responsible for pressing the degree of dependence within the budget.
Block: Let the best transmission run
TextGrain's second design was split-block.
The report illustrates the entire process with an example. Assuming the preface is "The morning was", the candidate for the next word is warm 0.30, cold 0.25, mild 0.15, calm 0.10, sunny 0.10, bright 0.10, respectively.
First, the key and prefix window randomly divide the word list into several blocks, such as {warm, calm}, {cold, sunny}, {mild, bright}, where the probability of each block is the sum of the probabilities of the blocks, respectively, 0.40, 0.35 and 0.25.
The second step is to combine these three blocks with "columns" of probabilities such as m as the optimal transmission, the price table is generated by the key, constantly adjusting the regular intensity during the query process, so that the actual loss of nickel is close to the budget.
The third step is to select one of the columns from the key, which determines the probability of each of the three samples, which in this example becomes 0.04, 0.69, 0.27.
Finally, in the selected block, a specific word is extracted according to the relative probability of the original, with cold extracted in the example.
Watermark embedded processes based on optimum block transfer
There are two advantages of fracking:
The optimized dimension is reduced from the scale of the word table to "block number × column number", with a single Sinkhorn iteration requiring only O(Bm) operations.
The relative probability of words within a block is completely unchanged, and the watermark only changes "which one to choose", without touching the language preferences within the block.
The report appendix also provides a solution compatible with speculative sampling: the draft model shares the same key with the target model, the verification link uses the watermark distribution on both sides, and acceleration can be introduced on the condition that the watermark output of the target model remains unchanged, although the actual acceleration still needs to be tested.
Detection: only text and keys
The design of the detector end is equally simple. The detector does not need access to the generating model, does not need to know the hydrogen budget used when generating, and only needs text and keys.
At each location, the detector rebuilds the blocks, price tables, and selected columns using the key and prefix window, then finds the blocks according to the observed words, reads the corresponding price, and converts it into a score.
Under the idealized assumption, individual scores of waterproof text obey the unit index distribution, and n scores obey Gamma (n, 1) distribution, so that a default error rate α can be set. To avoid repeated use of the same random table, the detection only counts the first occurrence of each pre-text window.
Watermark detected from observed text
The report maintains the consistent discretion of statisticians here. It makes clear that both fixed deployment keys and finite precision operations require experimental calibration, and that idealized null hypothesis calculations themselves cannot guarantee the same error rate for every key, every application scenario.
What is the result?
According to data published by the OpenAI blog, the results of the waterproofing and non-waterproofing tests of its flagship model Astra are not significantly different. For example, GPQA Diamond stands at 94.44% for 93.94%, DeepSWE v1.1 stands at 72.80% for 71.68 and Terminal-Bench 4.0 stands at 53.90% for 56.06%.
OpenAI also said that in its internal evaluation, TextGrain performed similarly or better than other methods, including Google SynthID text waterproofing, but did not disclose specific comparison figures.
In terms of detection capabilities, OpenAI also gives less good figures. At a target error rate of 1%, the detector can recognize about 80% of the 200 token paragraphs and about 95% of the 400 token paragraphs in the psychology class.
The impact of rewriting was greater: replacing 10% of the words as synonyms in 400 token paragraphs, the detection rate dropped from about 92% to 66%; replacing 25% was only 17%.
These limitations also explain why OpenAI limits the detector to researchers and professional bodies. The blog specifically lists what the watermark "doesn't explain": it can't measure human contributions to text, it can't determine ownership or responsibility attribution, it can't be associated with specific users, it can't judge the content to be false; and it can't detect watermarks, nor can it prove that the text came from human hands.
What is the meaning of this verse?
The value of textGrain lies not only in the addition of a watermark algorithm, but also in the fact that it gives a long-term vague weighting to the unit of measurement. In the past, the impact of watermarks on the model has often remained in qualitative expressions such as "unbiased" and "untrue"; now, "in order to give the signal how much randomness" can be written directly into a ratio, assigned to the engineering team to set and assigned to the supervisor to review.
The writing of this report is also statistical in color: each assurance is accompanied by a hypothesis, and each number distinguishes between the ideal value and the asserted value.
A few years ago, he was also searching for the best way to detect the old watermark in his paper, OpenAI; today, the new watermark he and his collaborators designed will appear in an EU user-qualified ChatGPT response.
OpenAI says the technical report will add more details in the coming weeks and plans to open-source related technologies. Whether text watermarks can be rewritten, translated and contrasted in the real world will require more researchers to test them with detectors.
Reference links