OpenAI’s invisible text watermark will start in the EU, but editing weakens detection

OpenAI plans to add an invisible watermark to eligible text generated by ChatGPT and Codex for users in the European Union over the coming weeks. API developers worldwide can opt in for supported models, but the signal will not be a global default at launch. OpenAI’s own tests show that synonym edits sharply weaken detection.^[1]^[2]

Checked on 6 October 2026. The rollout, detector-access and European legal-guidance claims below reflect the public material available on that date and may change.

What we know

TechCrunch reported that the rollout will cover eligible ChatGPT and Codex output for users on all plans in the EU. Developers using OpenAI’s API can opt in worldwide for supported models, with the feature off by default.^[1]

The mark is not a visible symbol. OpenAI describes textGrain as a statistical signal created by changing some model word choices. The technical report says the detector does not need the generating model, coupling or entropy budget, but it does assume the matching tokenizer, configuration and keyed construction.^[1]^[3]

The legal text says providers of AI systems generating synthetic text must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. It qualifies the technical solution as effective, interoperable and reliable, with resilience required only as far as technically feasible, taking account of content limits, implementation costs and the state of the art.^[5]

The provider marking duty does not apply where AI systems perform assistive standard editing, do not substantially alter the input or its semantics, or are authorised by law for criminal-offence detection or investigation.^[5] The separate deployer rule requires disclosure for AI-generated text published on matters of public interest, but has its own criminal-law carve-out and an exception where human review or editorial control exists and a natural or legal person holds editorial responsibility.^[5] The Commission says adherence to its Code of Practice is voluntary, while Article 50 obligations are legal and alternative adequate means can be used.^[4]^[6]

What we don’t know

The material reviewed here does not establish when a particular user’s output will receive the mark or how OpenAI will define every eligible output.^[1]

The 200/400-token comparison cited by BleepingComputer uses watermarked mathematics and psychology responses from the ELI5 dataset at a one per cent target false-positive rate. The public report does not give sample counts, raw confusion counts, prompts or detector configuration.^[2]

The 400-token synonym result is therefore provider-reported and cannot be independently reproduced or uncertainty-assessed from the cited public material. The technical report supplies theory and calibration limits, not the raw evaluation set or result vector.^[2]^[3]

A missing watermark cannot be treated as proof that a person wrote the text. OpenAI says short, edited or translated passages may evade detection.^[1]^[2]

Why it matters

OpenAI says initial detector access is limited to approved researchers and expert organisations. The available sources do not establish that publishers generally qualify or that a reader-facing organisation can obtain a key, threshold or service.^[1]^[3]

textGrain is therefore a possible research-access provenance signal, not a generally available authorship service or a measure of how much human judgement went into a passage.^[1]^[2]^[3]

That boundary will matter whenever a detector result is used in an editorial, academic or workplace decision.

A mark hidden in the words

OpenAI’s announcement describes a watermark that readers will not see while reading or copying a passage. Instead, the system slightly changes word choices so that the resulting text carries a statistical pattern that a detector can test.^[1]^[2]

The accompanying technical report gives the mechanism a more precise shape. textGrain uses keyed randomness and an entropy budget while generating tokens. Its detector does not need the generating model, coupling or entropy budget, but it does assume the matching tokenizer, block and column counts, context-window rule and keyed construction.^[3]

That design makes the watermark portable with the text. It does not depend on a file header or a visible label that disappears when someone pastes the words into another document. It also means the signal is tied to the exact text that reaches the detector, rather than to a record of the user’s account or conversation.^[1]^[3]

An EU rollout, not a global switch

The rollout described by OpenAI has two different scopes. Eligible ChatGPT and Codex output is due to receive the mark in the EU, while API developers elsewhere can choose to enable it for supported models. OpenAI is not making text watermarking a global default at launch.^[1]

The legal text says provider marking solutions must be effective, interoperable and reliable, with resilience required only as far as technically feasible, while the separate deployer rule concerns certain public-interest text and includes a human-review or editorial-control exception.^[5] The Commission says Article 50 applies from 2 August 2026, the Code of Practice is voluntary, and providers or deployers can demonstrate adequate compliance through other means.^[4]^[6]

The rollout can therefore be described as a compliance-related product change in OpenAI’s account, not as proof that Article 50 mandates textGrain or this particular implementation. The public material does not specify the complete eligibility rules or give a timetable for every account and product surface.^[1]^[5]^[6]

Editing is the weak point

OpenAI’s tests, as reported by BleepingComputer, show how quickly the signal can weaken. In 400-token passages, replacing 10 per cent of words with synonyms reduced detection from about 92 per cent to 66 per cent. Replacing 25 per cent reduced it to 17 per cent.^[2]

The same report says detection in 200-token psychology responses was about 80 per cent at a one per cent false-positive target, compared with roughly 95 per cent for 400-token responses. It also says mathematics answers were harder to detect because the model has less freedom to vary its word choices.^[2]

These are provider-reported results under the stated test conditions, not a universal accuracy score. They cannot be generalised to all models, languages, prompts or editing workflows. The technical report makes its own assumptions visible: its idealised false-positive calculation depends on independence conditions, while fixed keys and finite-precision arithmetic require empirical calibration. The report says the idealised calculation does not guarantee the same error rate for every key or application.^[2]^[3]

The cited sources document editing, translation and short passages as conditions that can weaken this signal, but they do not establish rates for ordinary documents, every language or every kind of revision. A result from a clean, long passage should not be silently generalised to a short answer, a translated article or a document revised by a person.^[1]^[2]^[3]

Provenance is not authorship

OpenAI says a missing watermark does not prove human authorship because the passage may be too short, heavily edited, translated or generated by another company’s system.^[1]^[2] A detected mark has a similarly narrow meaning: it can indicate that an OpenAI system generated or processed part of a passage, but it does not identify the user, account, prompt or conversation.^[1]^[2]

That distinction also limits what the technology can say about human contribution. A detector may provide evidence that an OpenAI system generated or processed some of the text, but it cannot determine how much judgement, editing or creativity a person supplied to the final work.^[1]

For editors, teachers and employers, the sensible use is as one signal in a wider review rather than as an automatic verdict. The cited sources do not establish a threshold at which a detector result should trigger a disciplinary or publishing decision, and a negative result cannot rule out AI assistance.^[1]^[2]^[5]

Other watermarking schemes are not a proxy

Independent research points in both directions, but not at textGrain. Vaporizer evaluates several other watermarking schemes against lexical changes, machine translation and neural paraphrasing, reporting that watermarks can be removed with reasonable effort while semantic content is preserved.^[7] A separate study of Dual-Embedding Watermarking examines a semantic design intended to improve robustness against paraphrasing and translation.^[8]

Those studies show that robustness is scheme-specific. Neither evaluates textGrain, so neither confirms nor refutes OpenAI’s reported percentages. They are useful counter-context, not a substitute for a public evaluation of OpenAI’s system.^[7]^[8]

The next test is outside the laboratory

Several operational questions remain open. The technical report’s detector procedure assumes the matching tokenizer, block and column counts, context-window rule and keyed construction, while the public announcement limits initial access to approved researchers and expert organisations.^[1]^[3] The cited sources do not explain how an organisation requests the required configuration, what threshold or record accompanies a result, or how a disputed result should be challenged.^[1]^[3]

OpenAI says initial detector access will be limited to approved researchers and expert organisations while reliability and responsible uses are evaluated.^[1] The restriction means the current public record does not establish general publisher access or a reader-facing service.

Until OpenAI publishes the detector’s access conditions and fuller evaluation details, a positive result can support only a bounded claim that text generated or processed by an OpenAI system may be present under the tested configuration. It cannot establish who wrote the passage, how much a person edited it or that a negative result rules out AI assistance.^[1]^[2]^[3]