Z-Score Thresholds Used by AI Watermark Detectors

AI watermark detectors are built to answer one question: did a hidden statistical bias get introduced into this text at the moment it was generated? That question is a formal hypothesis test, not a style analysis. The null hypothesis holds that the text in front of the detector is ordinary human writing. The alternative holds that something biased the sampling process toward a particular subset of the vocabulary when the text was produced. The KGW architecture, developed by Kirchenbauer and colleagues, is what makes this test possible in practice. A verifier that holds the same hashing key can walk back through any candidate text, replay that partitioning step by step, and count the tokens that landed on the green list. That count is the raw evidence on which everything else in detection depends. By itself, the count means nothing: a document with a suspiciously large share of its tokens landing on the green list sounds suspicious only if someone can say how suspicious, compared to what a fair, unbiased vocabulary split would have produced by chance. Converting that raw count into a standardized score, one with known and quantifiable false-positive behavior, is the entire purpose of the z-score, and it is why a single number ends up governing a decision with real legal and reputational consequences.

How the z-score formula converts a green-token count into a detection signal

The formula itself is z = (|x|_G − γT) / √(Tγ(1−γ)), and each term in it carries a distinct piece of information. |x|_G is the observed number of green tokens in the text under review. T is the total token count of that text. γ is the green-list fraction fixed at generation time, typically set to 0.5, so that half the vocabulary counts as green at any given step. The numerator, |x|_G minus γT, measures the excess: how many more green tokens showed up than would be expected if the text had been produced with no bias at all, a fair coin flip across the green-red partition at every position. If every token in a passage lands on the green side, that numerator grows large, so the z-score climbs with it. But when the split comes out close to even, roughly half green and half red, the numerator is near zero, and the test has nothing to report. The denominator, the square root of Tγ(1−γ), is the standard deviation of that excess under the null hypothesis, and dividing the numerator by it is the same move used in any one-sample test of a proportion: it converts a raw deviation into standard-deviation units, so that the output can be read directly against the standard normal distribution. The choice of γ = 0.5 is not incidental. The variance term γ(1−γ) is maximized exactly at 0.5. The denominator, and with it the sensitivity of the whole test, is largest at that setting. T sits inside that same square root, so the signal strengthens only with the square root of the text's length, a detail that matters more than it first appears and resurfaces later as one of the formula's real-world weak points.

The Field's Agreed Detection Threshold

If a one-sided z-test rejects the null hypothesis at z = 4, that corresponds to a nominal significance level of roughly 3.17 × 10⁻⁵. So in practical terms, the chance of a detector flagging genuinely human-written text as AI-generated, purely as a statistical fluke, is roughly three in one hundred thousand. The field reads the resulting scores on a tiered scale rather than as a flat pass-fail line: a z-score between 4 and 10 counts as moderate detection confidence, while anything above 10 counts as high confidence, both readings sitting on the same threshold. The number 4 itself, rather than something nearby like 3 or 5, follows from how the field weighs the two kinds of error a detector can make. Flagging a human writer as an AI system carries real reputational and legal cost. Missing an actual watermark is an operational shortfall, inconvenient but not damaging in the same way. That asymmetry pushes the threshold toward the conservative side of the distribution. The practical consequence is binary and unambiguous: fall below z = 4 and the detector finds nothing worth reporting; sit above it and the text gets flagged. Everything that follows in this article is an account of how that binary gate holds up, and where it doesn't.

Green-List Fraction and Logit Bias

The threshold itself is fixed, but the z-score a given piece of watermarked text produces is not. It depends on two parameters chosen before a single token gets generated: γ, the green-list fraction, and δ, the logit bias applied to green tokens. A larger δ pushes the numerator of the z-score formula up more aggressively. Watermarked text clears the z = 4 gate with fewer tokens required to do so. That strength comes at a cost: a larger bias distorts the model's underlying output distribution more severely, nudging word choice away from what the model would otherwise produce. A smaller γ works in a related but distinct way. Shrinking the green list makes each green-token hit more statistically surprising, and therefore more diagnostic when it occurs, but it also narrows the pool of words the model can draw from at each step, which can make the resulting text sound stilted or unnatural. Research on watermarking one large language model illustrates the trade-off concretely: achieving a high true-positive detection rate on that architecture required pushing the bias to δ = 7.0, well above the standard setting, and that stronger bias carried a real perplexity penalty, a measurable cost to the fluency of the output. The lesson generalizes beyond any one model family. Watermark strength and text quality pull against each other, so if you tune a pipeline to clear z = 4 with comfortable margin, you accept some degradation in how natural its output reads.

Where the Fixed-Threshold Model Breaks Down

The z = 4 threshold rests on an assumption: that the relationship between the observed green-token rate and the preset γ stays stable across the text being evaluated. Ordinary content production routinely breaks that assumption, with no adversarial intent required. Length is the most direct failure point. Entropy mismatch compounds the problem. The KGW formula assumes a roughly uniform probability of landing on a green token at every position, but natural language entropy varies enormously from one position to the next. The Entropy-Weighted Detection method responds to this directly: it assigns greater weight to high-entropy tokens in the z-score calculation, so the positions where a watermark's bias actually shows up count for more. Adaptive threshold methods go further still, replacing the fixed z = 4 gate with a threshold estimated from anchor data generated in advance, calibrating to the text's actual green ratio rather than assuming γ = 0.5 holds everywhere uniformly. None of these are exotic edge cases confined to a lab. Mixed lengths, mixed topics, and uneven entropy are what any enterprise content pipeline normally runs on, so z = 4 is a clean-room number, and real-world production stresses it before any attacker even gets involved.

How multi-model generation mathematically collapses the z-score signal

The most consequential failure of the fixed threshold has nothing to do with editing text after it's written. When generation routes across multiple models, whether by averaging their outputs or switching between them, the independent watermark biases each model introduces work against each other, and the resulting z-score falls below the z = 4 gate as a direct mathematical consequence of the architecture, not because anyone altered the final text. The theoretical case, laid out by Wu and colleagues in 2025, starts from the observation that any watermark perturbs a model's output distribution away from what that model would otherwise produce unwatermarked. In a competitive market, where each provider has reason to use its own secret key for provenance tracking, these perturbations are statistically independent of one another. Averaging independent perturbations recovers something very close to the original, unperturbed distribution, with only a second-order error term left over. The watermark signal does not get hidden or masked. It cancels out mathematically. The empirical confirmation comes from WASH, presented at ICML 2026, the Watermark Attenuation via Statistical Hybridisation system. The paper grounds this result in market structure rather than in any clever manipulation: competitive providers need secret keys to establish provenance, which guarantees the independence of their respective watermark perturbations, and those same providers need to preserve output quality to keep users, which bounds how large any single perturbation can be. These two ordinary commercial pressures work together, so watermark collapse under averaging is a structural limit of the system, and no amount of better key management can patch it. A text produced by routing across providers does not carry a coherent single-model green-list signature for any detector to find, because no single model's bias survived the averaging intact. The z = 4 threshold was built for a single-model world, but enterprise AI pipelines increasingly run on ensembles and routing layers, so they no longer live in that world.

Attacks that target the z-score threshold directly without multi-model routing

Multi-model routing defeats the watermark at the architecture level, before any text exists to attack. A separate category of methods goes after already-generated, single-model text directly, each one exploiting a different assumption baked into the fixed threshold. The Bias Inversion Rewriting Attack, documented in 2025 research and known as BIRA, applies a negative logit bias to a proxy set of tokens likely to belong to the green list, suppressing their probability of appearing and weakening the resulting z-score, all without any access to the model's internals or its watermark key. Researchers have shown that you can reverse-engineer the green and red token lists underlying the KGW method well enough to forge text that scores above z = 4 despite never having been generated by a watermarked model at all, so the resulting false positives can be aimed deliberately at damaging a provider's credibility. The Pattern Stability Score framework, developed at George Mason University, was built specifically to hold detection signal together across as many as eight rounds of paraphrasing, improving detection AUC substantially over standard z-score baselines, and its existence is itself evidence of how much ground paraphrasing can take from a standard threshold test. All three require deliberate, post-hoc intervention on text that already exists, suppressing tokens, forging lists, or rewriting repeatedly, while multi-model routing never lets a coherent single-model signal form to begin with. For a content team choosing how to build a pipeline, that distinction is the one that matters most.

The EU AI Act Compliance Deadline and Z-Scores

Since August 2, 2026, the EU AI Act's transparency obligations have required machine-readable marking of AI-generated content, so legal and content teams now have to track z-score behavior as a compliance variable, not just a technical curiosity. The industry's response has converged on two complementary layers. SynthID provides sub-perceptual, transformation-resilient watermarking suited to copy tracing and leak detection, while C2PA provides cryptographically signed provenance metadata suited to recording origin and tracking edits. The two solve different problems, so a team cannot cover every compliance scenario it faces with just one of them. The scale of deployment on the watermarking side is already considerable. Google's SynthID has watermarked more than 180 billion images and videos, along with 240,000 years of audio, as of 2026. The infrastructure for z-score-based compliance, in other words, is being built at scale by the model providers themselves. That creates a genuine tension for any content team managing a pipeline. Output with z-scores consistently above 4 is detectable, and therefore meets disclosure requirements where those requirements apply, but if you can detect it, you can usually attribute it too. That tension is a design question a pipeline's architecture has to answer, not something the regulation resolves on its own.

Architectural Diversity as the Structurally Sound Response to Z-Score Detection

A single model leaves a repeatable green-list signature across every sentence it produces, because the bias enters at the moment of token selection, not afterward. Paraphrasing, token substitution, and manual editing all attempt to erase that signature after the fact, and all of them run up against the same limit: removing a signal embedded in the generation process itself, without discarding the draft entirely and starting over, is a losing proposition. The WASH results at ICML 2026 demonstrate the alternative directly. Genuine multi-model generation suppresses z-scores below the detection threshold as a direct consequence of how independent watermark perturbations interact with each other during generation, not as the result of any correction applied to the text afterward. Spoofing and BIRA complicate the picture from the opposite direction, showing that z-score manipulation is available to anyone with access to text, and a compliance framework that leans on z = 4 as its sole trust signal can be gamed by producers and by bad actors alike. For a content team building a pipeline, the practical implication is architectural rather than procedural: routing a brief through multiple independent models, selecting the strongest output at the sentence level, and assembling a unified final voice produces text that never carries a coherent single-model green-list signature to begin with. That pipeline reaches z-score compliance by construction, not through after-the-fact correction, and the WASH experiments show that the same averaging process which suppresses detectable signal also improves measured output quality, so dispersed authorship and a consistent final voice need not be in tension when you build the blending architecture for it. The z = 4 threshold, understood this way, is a diagnostic of whether a pipeline is genuinely distributed at the source, not a hurdle for a pipeline to clear through editing.