Watermark Embedding Specifications in Leading LLM APIs

Watermark embedding specifications in leading LLM APIs reveal a distinction between detectable output and durable provenance. Providers embed statistical signals that persist through light editing, but those signals can fail when text is rewritten or routed between models. Multi-model authorship belongs at the generation stage, rather than being treated as a paraphrasing step applied after one model has written the text.

Why major LLM providers are embedding watermarks now

The European Commission AI Office’s voluntary Code of Practice on Transparency of AI-Generated Content drew approximately 190 signatories, including OpenAI, Anthropic, Meta, Google, and Microsoft. Platform-level commitments followed within weeks of the July 27 deadline. Article 50 of the EU AI Act requires disclosure and machine-readable marking, moving watermarking from an optional technical feature into a compliance requirement. The voluntary code and the legal obligations are distinct. Together, however, they explain why embedding specifications now describe production decisions.

For content and compliance teams, those choices affect both the output they get and the evidence they have to assess it. A provider can embed a watermark without giving customers unrestricted access to its detector. Another can make embedding optional at an organizational boundary. These differences affect what teams can establish about a document after generation, so the technical specifications need to be read as part of the provenance system.

The KGW framework that most deployed watermarks descend from

Kirchenbauer et al.’s 2023 KGW framework provides the baseline for most deployed and proposed watermarking schemes. It partitions candidate tokens into green and red groups, then biases generation toward green tokens. A secret key and recent context set the partition. The mark is a statistical preference spread across the token stream, with no visible label or phrase added to the text. No post-hoc editing is needed to create it.

Detection looks for more green tokens than chance would predict. A one-sided z-test compares the observed green-token count with the expected count, then scales that difference by the standard deviation under a binomial null. The score shows how unusual that excess would be in unwatermarked sampling. A score above a predefined threshold classifies the text as watermarked. This makes detection computationally lightweight, but its evidence is the exact identity of the generated tokens.

That dependence creates a trade-off between length and bias. For a fixed bias strength, denoted by δ, longer text produces a stronger z-score because the detector has more tokens over which to measure the excess. Short text offers less evidence. Increasing δ can make short passages more detectable, but a sufficiently strong preference for green tokens degrades output quality. Production systems must balance these needs without assuming that a setting that works for an article will work just as well for a brief response.

How each major provider implements watermarking in production

Google’s SynthID-Text, used in the Gemini API and Google AI Studio, departs from pure KGW through tournament sampling. This produces a variable rather than fixed logit bias while retaining a place in the red-green family. The structural change is in how generation applies the preference, while the same z-test family can still detect its signal. That distinction separates the embedding mechanism from the interface through which customers inspect its results.

Google’s detection interface returns three states, namely not watermarked, watermarked, or uncertain. It does not show raw confidence scores through Gemini’s chat interface or API. Consequently, content teams cannot use that interface to perform their own quantitative provenance verification or examine how close an uncertain result lies to a decision threshold.

OpenAI’s textGrain has been available since October 5, 2026, as a worldwide opt-in option for API customers using select models. Configuration operates at project or organization level. Its internal token-level mechanism is not specified in the supplied material, so it cannot be classified here as either KGW-based or structurally separate from KGW. The documented distinction is its deployment scope and optional activation.

Anthropic’s Claude provides a different access model. Anthropic launched a detection API in private preview in September 2026 for regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, EU civil society groups, and enterprises with EU AI Act compliance obligations. Access to the API remained limited to private preview participants, restricting who could inspect the mark, although a public detection API was announced as forthcoming.

xAI exposes an explicit response-level indication through an HTTP header named x-watermark, set to true on marked API responses. Its token-level mechanism is not described in the supplied material. The header identifies a marked response, but it does not explain how the text’s statistical signal is formed.

vLLM, the open-source inference infrastructure, places more of the embedding configuration under the operator’s control. It added native text watermarking in September 2026, with configuration specifying an algorithm such as Gumbel and a secret key at engine startup. Efficiency is part of the implementation. Instead of materializing a full batch × vocabulary noise tensor, vLLM fuses pseudorandom-number generation, the Gumbel transformation, and argmax reduction into one GPU kernel.

For speculative decoding, vLLM uses separate keys for draft tokens and for target residual and bonus tokens, preserving the ordinary acceptance rate. It also provides a minimal HTTP detection server that checks text using the matching tokenizer and watermark key. This couples detection to specific generation settings. Unlike a classification interface hosted by a provider, this setup leaves operators in charge of the configuration needed to read the signal.

Why the statistical signature is persistent by construction

KGW-family watermarks resist light editing because their signal is distributed across token choices. The secret key and recent context establish locally consistent green-token preferences throughout a document. Editing a few words changes some token positions, but leaves an excess across the remaining text. The signal has no single removable location. Its persistence comes from repeated statistical evidence rather than from any particular sentence or conspicuous word choice.

Length strengthens that design. A 500-token article generated with a moderate δ can keep a signal above the detection threshold after light surface editing removes some green tokens. The detector assesses the remaining excess across the sequence rather than requiring every original token to survive. Local changes can weaken the evidence without eliminating it. This explains why ordinary copy editing and full rewriting have different effects even when both keep the document’s meaning.

Tsinghua University’s research on watermark radioactivity demonstrates that a new model trained on watermarked output can inherit the statistical pattern without access to the original key. The training process can propagate the preference into a student model, making the watermark relevant to the lineage of generated data as well as the identification of individual outputs.

Where persistence breaks: paraphrase, re-translation, and multi-step rewriting

Meaning-preserving paraphrase attacks the exact feature on which token-based detection depends. It retains the message while replacing the sequence that supplies the statistical evidence. Light editing leaves much of that sequence intact. A rewrite does not need to preserve it, which creates a structural gap between resistance to routine corrections and resistance to transformations that content pipelines already perform.

AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation found that every initially detected KGW and Unigram text lost detection after one meaning-preserving paraphrase pass across 846 valid paraphrase runs. The 100% conditional removal rate applies to samples that were initially detectable. SynthID fared only slightly better, with nearly all watermarked samples losing detection. The evaluation used the MarkLLM implementation of SynthID-Text. Its results should not be taken, without that caveat, as a direct measure of how every production implementation performs.

The same evaluation found high false-negative rates on pristine watermarked output for KGW, Unigram, and SynthID. SynthID’s failures appeared in an uncertain deadband. This complicates interpretation because an uncertain or negative result, by itself, leaves open whether the document has an AI origin or a watermark was embedded.

The transformation does not require the watermark key, original model, or detector. An instruction-tuned language model can alter the token stream through paraphrasing, simplification, formalization, or summarization followed by expansion. Chainwash, a 2026 framework, found that combined paraphrase and summarize-expand attack styles produced its highest observed evasion rates, achieved by Gemma-4-E4B. Multiple transformations can compound the loss of evidence.

Re-translation produces a similar failure for SynthID. Translating watermarked text into Chinese and then back into English reduced the F1 score to 0.711 and the true positive rate to 0.675. These are distinct measures and should not be read as interchangeable probabilities. Together, they show how much detection can weaken when a passage is changed in a way that can keep its broad meaning. The gap between a requirement for sufficiently robust marking and these results is therefore not merely a question of adjusting a detection threshold.

What fragile provenance means for content teams running multi-model pipelines

A multi-model pipeline compounds this fragility by separating authorship, transformation, and detection across providers. Text drafted by Claude, edited by another provider’s model, and localized through Gemini Flash may have parts with different marks or no detectable mark. No single provider’s watermark chain can cleanly attribute the final document. A detector result addresses only part of the history. It cannot reconstruct all the model-task assignments that produced the published text.

For teams in that position, granular audit trails require documentation of routing logic, model-task assignments, and classifier decisions to establish which model handled each request and why. That documentation is distinct from a legal requirement to record every transformation. Article 50 imposes disclosure and machine-readable marking obligations, but does not require transformation chain logs tracing paths such as agent → translator → user.

False attribution further limits reliance on detector outputs. The forensic readiness evaluation found that a standard typing test sentence scored above the SynthID detection threshold, while paraphrased AI-generated text often went undetected. Errors can run in both directions. Combined with classification-only access to SynthID results, this means a content team cannot treat either a positive label or an absent signal as a complete provenance account. The workflow history and the detector result answer different questions.

Why architectural diversity — not paraphrasing — is the structurally sound response

A 2026 study found that a single ChatGPT paraphrase pass brought every tested watermarking method below 30 percent detection. That result establishes the weakness of the tested marks under rewriting. A paraphraser changes the evidence after generation. It does not change the fact that the original draft came from one model’s statistical distribution, and downstream re-watermarking can reinstate detectability.

The proposed approach has models from multiple providers share authorship during generation. This moves diversity upstream. Instead of passing one completed draft through a surface rewrite, the system selects text line by line from multiple model outputs, dispersing token-level authorship across different keys and vocabularies. A judge panel can select the strongest token sequence for each line, with a final enhance pass supporting a unified on-brand voice.

The rationale follows from the detector’s target. A KGW-family detector looks for an abnormal green-token fraction associated with one key, while blended output does not necessarily share one common green-list bias throughout. The final enhance pass is also subject to the downstream re-watermarking limitation. Multi-model authorship and an undetectable final document are not equivalent claims.

For content teams, this approach changes the generation stage while briefs, outlines, approval processes, downstream review, and publishing can remain in place. The blending step supplies diverse authorship before a single draft becomes the pipeline’s fixed starting point. Teams still need to document routing to explain how the finished text was produced.