10 percent word changes cut detection of the OpenAI text watermark

OpenAI released textGrain in October. A watermark is a pattern in the words that a detector can find. The EU AI Act tells providers to put a mark on AI text that machines can read from 2 August. In OpenAI tests, the detector does not find the mark after edits or in text of less than 150 words. The law gives no test level. It is not known if textGrain is sufficient for the law.

How it works

The AI model selects each next word. textGrain uses a secret key to push that selection into a pattern. A detector with the same secret key finds the pattern. Developers set a limit on entropy, a measure of how much the word selection can change.

The numbers

• With text of about 150 words, the detector finds the mark in about 80 percent of tests.
• With text of about 300 words, it finds the mark in 95 percent.
• If 25 percent of the words change, detection is 17 percent.

What is not known

OpenAI made these tests and no external group made tests of them. Researchers at Cornell University and a Slovak institute get access only at this time. They do not test it at this time. Thomas Souverain, a researcher in Paris, says the maximum penalty is 7 percent of the income in one year.

Insight: Two suppliers release marks that break after small changes

OpenAI textGrain is weak after small edits. Anthropic marks four Claude models, but the mark works only if three parameters for word selection stay at default. The EU law wants a strong mark but gives no test level. This seems a standoff: suppliers release marks for the date, and no one says how strong a mark must be. The first test level from the EU will select which marks are sufficient.