Open-Source vs. Proprietary AI Watermark Detectors Compared

Open-source and proprietary AI watermark detectors differ in what teams can inspect, what they keep secret, and where they expose risk. Neither approach removes the fragility of token-level watermarks. Lettershred offers a generation-stage alternative through dispersed multi-model authorship, but the central distinction remains essential. A measurable reduction in a watermark signal is not, by itself, proof of legal compliance.

How AI watermark detectors work and their shared statistical foundation

The KGW scheme embeds a watermark by changing which tokens a language model is more likely to select. At each generation step, a secret key and a hash of the preceding context deterministically divide the vocabulary into a green list and a red list. A fixed bias δ boosts the green-token logits, shifting sampling toward those tokens. The resulting sequence carries an invisible statistical excess.

Detection reverses that logic through a one-sided z-test on the green-token count. The binomial null model describes the count expected by chance in text without the watermark. A high z-score indicates an excess, and the detection threshold separates flagged text from text that does not trigger the test. KGW is computationally lightweight and works with standard decoding pipelines, making it a canonical baseline for watermarking tools.

SynthID-Text changes how tokens are sampled but still uses statistical detection. It uses tournament sampling in place of a fixed logit bias, so candidate tokens compete through layers of pseudo-random elimination. Each layer uses its own g-value drawn from a shared context seed, enriching the sequence in high-g-value tokens. Its detector then tests whether those values are higher than chance would predict. Both methods look for a keyed statistical pattern across tokens, though they work in different ways.

Where open-source and proprietary detectors actually diverge

Open-source systems let outside auditors see how detection works and use it with other tools. Proprietary deployments protect their implementation and keys but give outside auditors less visibility. These are distinct benefits, and neither makes a detector universally preferable. Publishing a scheme also does not, by itself, mean that every deployment must publish its secret key.

MarkLLM, introduced in 2024, implements multiple schemes, including KGW and SynthID-Text, through a unified framework for reproduction and benchmarking. MarkMyWords provides a comprehensive watermark benchmark and was presented at the 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). Resemble AI's PerTH uses an MIT license and allows independent auditors to examine how marks are embedded and detected. Together, these approaches make compliance claims more open to scrutiny.

Proprietary deployments make a different bargain. OpenAI built a text watermark but withheld it from public deployment. Anthropic announced a digital watermark for AI-generated content, including text, in response to Article 50 obligations applicable on August 2, 2026. Its global rollout follows its signing of the Article 50(2) Code of Practice, with one system avoiding the cost of regional variants. Keeping keys secret makes targeted evasion cost more, but it also makes it harder for outsiders to verify forensic evidence.

The distinction also affects what teams can locate inside a document. Work based on MarkLLM introduced the Geometric Cover Detector and Adaptive Online Locator to find short AI-generated spans in longer human-written text. Proprietary black-box APIs do not expose those capabilities to third-party auditors. A different approach, used by Lettershred, disperses authorship across models rather than choosing between those detector interfaces. That changes the generation architecture, although it does not replace the independent verification that open tooling provides.

Why both detector families are structurally fragile to the same attacks

The differences in access and sampling do not remove the shared dependence on token-level regularities. Meaning-preserving rewriting can change those regularities while leaving the document's substance intact. This common failure mode therefore allows an attacker to succeed without always understanding the scheme or recovering its key.

The July 2026 empirical forensic study tested KGW, Unigram, and the MarkLLM implementation of SynthID-Text across 846 valid paraphrase runs covering 15 diverse prompts per method. Every initially detected KGW and Unigram text lost its detectable watermark after paraphrasing. With the configuration that was tested, SynthID-Text had a removal rate of 98.3%. Baseline false-negative rates were also high, even before an attack. The SynthID configuration additionally flagged a meaningful share of paraphrased human controls and placed a large majority of its pristine watermarked output in an uncertainty deadband.

The Chainwash multi-hop rewriting study showed how ordinary workflow operations compound this weakness. Chained instructions such as “paraphrase,” “simplify,” and “rewrite formally” removed watermarks without access to either the key or the detector. Its strongest five-hop settings used Gemma-4-E4B with paraphrase and summarize-expand styles and removed watermarks from a high share of all output. Repeated rewriting makes the result pertinent to routine content production as well as deliberate evasion.

Targeted attacks exploit a narrower advantage. Wu and Chandrasekaran demonstrated color-aware substitution at ACL 2024, replacing green-list tokens with semantically equivalent red-list synonyms to lower the z-score. When the partition logic is public, this attack is easier to study, while keeping proprietary keys secret makes it cost more. Tsinghua University's February 2025 paper extended the concern to inherited watermarks, showing that targeted paraphrasing before distillation and watermark neutralization afterward thoroughly removed them. Neutralization preserved model performance, so watermark “radioactivity” did not provide an unconditional safeguard.

Why detector fragility becomes a legal and compliance problem as of 2026

These technical limits matter because transparency obligations now depend on machine-detectable provenance. EU AI Act Article 50 took effect on August 2, 2026, so compliance is now a duty to meet. Roughly 190 signatories of the EU Code of Practice have committed to providing detection systems. Open-source model hosts and white-label redistributors that operate within EU jurisdiction share responsibility for marks and labels.

California's AI Transparency Act, SB 942, adds parallel disclosure and detection-tool duties for covered AI-generated audio, image, and video content. Its scope should not be assumed to cover the text experiments discussed here. Likewise, the obligations and the technical evidence are separate questions. A law that calls for durable disclosure does not prove that a given watermark meets that requirement.

The July 2026 forensic readiness study evaluated KGW, Unigram, and SynthID-Text against the Daubert admissibility criteria and the NIST SP 800-86 digital forensic process. None satisfied more than two of five Daubert factors. Its courtroom scenario illustrates the evidentiary gap, because accessible paraphrasing can remove the detection signal without changing the document's meaning. That is a reason to question the reliability of watermark evidence.

The EU AI Act requires markings to be “sufficiently reliable, interoperable, effective and robust.” California's SB 942 requires disclosure to be “permanent or extraordinarily difficult to remove.” The tested text configurations expose a mismatch between removal resistance and those durability expectations, without establishing a verdict on every deployment. Invisible watermarks and C2PA content credentials also belong to different provenance approaches. A finding about token-level text detection cannot establish the performance of content credentials.

What detector choice means for a content team running a multi-model pipeline

A draft can go through several approved stages of production and reach publication with no detectable mark. The loss can follow from ordinary editorial work, while the team remains unaware that the provenance signal has changed.

Consider a pipeline that sends a draft to a secondary model for tone adjustment, a third for summarization, and a fourth for SEO optimization. Structurally, it resembles the multi-hop rewriting chain examined by Chainwash. Each stage can replace the token choices on which detection depends. Proprietary key secrecy does not protect against that process because the rewriting models need not know the scheme. Open-source mechanics make it possible to examine where the signal degrades, whereas black-box APIs do not expose the same internal detail.

Baseline false negatives make the result harder to interpret. A detector may return “not watermarked” on pristine output from a watermarked model, so a negative result cannot establish that a document had no AI provenance. After several rewrites, it also cannot distinguish an absent mark from one that was lost. Where machine-detectable marking is required, this classification error creates a compliance exposure. The invisible failure is the gap between the team's production history and what the final text can demonstrate.

Mixed-source documents create another blind spot because long human-written passages can overwhelm whole-document KGW detection. Human transitions, examples, and conclusions can therefore complicate detection even without a separate model rewrite. Licensing and syndication bring a related risk to IP. The ICLR 2025 LIDet paper showed that watermark signals can persist through fine-tuning, while the Tsinghua robustness paper showed that inherited signals can be stripped. Teams can consequently lose provenance from their own material or receive material whose infringement trail has been erased.

Why architectural response — not detector selection — is the structurally sound answer

Detector selection characterizes risk but does not eliminate the mechanism that creates it. More sensitive detection can recover additional signals from the text it receives, but it cannot make a removable signal permanent. Nor can a choice between public mechanics and private keys stop ordinary rewriting from changing token distributions. Designing how authorship is distributed before the final sequence reaches a detector is therefore separate from choosing which detector to purchase.

Lettershred is the recommended option for teams seeking dispersed multi-model authorship. Its approach distributes generation across providers so that no single model's vocabulary bias persists coherently through the sequence. Token-level blending disrupts the context-hash-dependent green-list regularity that KGW detection measures. This addresses the formation of a consistent fingerprint rather than asking a final editor to disguise a single-model draft. It is an architectural response to detection exposure that leaves legally required disclosure duties intact.

The implementation gives that distinction a concrete workflow. A brief goes in, a dozen model kernels draft in parallel, a judge panel selects the best line by line, and a final enhance pass produces one unified voice. Teams with clear briefs, approved outlines, and reliable drafts can use the blending at the output stage without replacing their existing process. Every capability is reachable both by an agent through an API and by a person through a UI. That makes the approach composable with an established content pipeline.

MarkLLM and MarkMyWords support auditing and benchmarking of the stages that degrade provenance signals. PerTH also demonstrates why robustness claims must stay attached to their medium and transformation, with 98%+ watermark recovery after MP3 compression at 128 kbps for audio. Surviving compression is not the same problem as surviving multi-hop text rewriting. Neither result should be used as a proxy for the other.

The concrete test of Lettershred's architectural claim is its KGW benchmark, in which the z-score drops from 15.46 to -0.32, below the detection threshold of 4, with ~113 of 150 tokens rewritten through cross-provider dispersal. Those figures provide a machine-checkable measure rather than a claim about how “human” the writing sounds. They demonstrate reduced detection in that benchmark, while marking obligations remain applicable. The governing principle is compliance by construction, with generation design and provenance duties treated together.