OpenAI Submits Its Response to the EU: textGrain Watermark System's Measured Detection Rates and Fragility Controversy Explained

On October 5, 2026, OpenAI announced in its official blog post “Our approach to EU text provenance rules” that it will embed an invisible statistical watermark called textGrain in compliant text outputs from ChatGPT and Codex within the EU; at the same time, API users worldwide can, as of that day, selectively enable watermarking for designated models, with the feature off by default. The detection tool will not be open to the public; initially, access will be authorized only to approved researchers and professional institutions.

The institutional background driving this decision is clear: Article 50 of the EU AI Act took effect on August 2, 2026, requiring generative AI service providers to label output content in a machine-readable way; existing institutions serving EU users are given a transition period and must complete compliance by December 2, 2026.

How the watermark “hides” in text

Understanding how textGrain works is a prerequisite for judging its value and limitations. OpenAI describes it as “embedding a statistical signal through the model's word choices” — this is not an invisible character appended to the end of the text, nor metadata annotation, but something completed during the generation process itself.

Specifically: when the model chooses a word at a given position, there are usually multiple semantically equivalent candidate words. textGrain uses a key, combined with the sequence of preceding words at the current position, to silently bias the probability of this choice, making the model more inclined to choose words from a certain “preference set.” Viewed alone, any single word is completely natural; but in a sufficiently long passage, this bias pattern accumulates into a measurable statistical signal. A detector holding the same key can re-derive the “preferred word” for each position on any text, count how often the text actually follows that preference, and compare this with random probability; if the gap is significant, the watermark can be judged present.

This mechanism embeds two hard constraints that determine what it can and cannot do. The first is length dependence: statistical confidence grows with the number of tokens. Under a target false-positive rate of 1%, textGrain's detection rate on 200-token text is about 80%, and on 400-token text reaches about 95%. A two-line email can hardly carry an effective signal; a thousand-word report is far more reliable. The second is entropy dependence: when the next word is almost the only choice — such as code syntax, template wording, or direct quotations — there is no room for bias, and the watermark cannot be embedded. The OpenAI announcement also clearly notes that detection performance declines markedly in highly constrained domains such as mathematics.

“A slight edit” can bypass it

The most central criticism facing textGrain is its fragility. In 400-token text, replacing 10% of the words with synonyms drops the detection rate from about 92% to 66%; replacing 25% drops it further to 17%. OpenAI does not avoid this, and explicitly states: the absence of a watermark cannot prove that text was written by a human.

This limitation reveals a fundamental contradiction at the industry level that remains unresolved: the detection capability of statistical watermarks rests on textual integrity, while any text that has gone through a real editing process — even merely light polishing — will lose the signal to varying degrees. This is not a flaw unique to textGrain, but a structural fragility of the entire class of “word-order bias” watermarking schemes.

OpenAI strictly limits detection tool access to approved researchers and expert institutions, partly for this reason: once detection capability is made public, potential evasion research will systematically test every attack vector and accelerate the failure of watermarking technology. This is an expedient design that trades access restrictions for system robustness, but it also means that the public and enterprise users cannot verify it themselves, leaving an obvious transparency gap.

The gains and losses for stakeholders

For platforms and developers operating directly for EU users, textGrain's EU default-on simplifies the compliance path to a certain extent — at least within the subset of “ChatGPT and Codex,” they do not need to implement a separate watermarking scheme. But the scope of compliance needs to be carefully checked against the specific provisions of EU AI Act Article 50: that article adopts a technology-neutral standard, requiring watermarks to be “effective, interoperable, robust, and reliable to the extent technically feasible,” while whether textGrain's bypassability meets the “robust and reliable” standard currently has no public ruling from regulators.

For enterprise users, especially organizations using APIs in fields such as content creation, legal documents, and news production, the default-off design gives them the right to actively choose, but also brings a new decision burden: Should the watermark be enabled? If enabled, will it affect downstream business processes? Can third-party content distribution platforms accept watermarked output? There are currently no industry-wide answers to these questions.

For the academic and detection research community, initially restricted access rights are a double-edged sword. Controlled access allows OpenAI to collect high-quality independent evaluations before the system matures, rather than being overwhelmed by disorderly adversarial testing in a public environment; but it also means that the currently public detection performance data — 80% (200 tokens) and 95% (400 tokens) — have not yet been sufficiently independently reproduced.

For the competitive landscape, the launch of textGrain moves AI text watermarking formally from the “each company's research project” stage to the “regulatory compliance standard component” stage, creating pressure across the industry. Google DeepMind's SynthID has been used for Gemini text output since 2024, and its technical implementation has been open-sourced on Hugging Face, allowing developers to run it themselves; according to reports, Anthropic announced in August 2026 that Claude models adopt a watermarking scheme derived from SynthID-Text, with the detection API open to compliance entities such as regulators, researchers, and media. The intensive moves by three major suppliers within the same regulatory cycle indicate that the compliance window of EU AI Act Article 50 is substantively reshaping industry behavior.

Side-by-side comparison of the three schemes

The three currently known schemes show observable differences on key dimensions. Google SynthID's main advantages are the longest coverage period (since 2024), an already open-source technical scheme, developers being able to run detection themselves, and its use in conjunction with C2PA Content Credentials (cryptographically signed provenance metadata) to form dual-track protection; but as the pioneer, it is also the target with the most research and the deepest accumulation of adversarial testing. Anthropic Claude's watermarking scheme covers API output, which it claims is the broadest coverage among the three; but its independent verification data is likewise limited in public availability. OpenAI textGrain takes another path on transparency: it has published its own performance data and acknowledged fragility, but strictly controls detection access and keeps the API side off by default.

EU AI Act Article 50 explicitly lists two compliance paths: statistical watermarking (such as textGrain/SynthID) and cryptographically based provenance metadata under the C2PA specification. The former is embedded in the content and requires no archiving; the latter relies on signing infrastructure but can provide tamper-proof proof of origin. At present, all three mainly adopt the former, and the C2PA path has not yet become mainstream in the text domain.

Forward-looking judgment

The following are forward-looking judgments based on the above analysis, explicitly labeled as analysis rather than fact.

The most likely path is: around the EU compliance deadline of December 2, 2026, mid-sized AI service providers will face substantive decision pressure on “whether to develop their own watermarking,” and some platforms will choose to rely on existing schemes from OpenAI or Google to meet compliance requirements rather than implementing them independently. This will further solidify these two institutions' infrastructure discourse power in the EU market.

At the same time, access control over detection tools will itself become a focus of controversy. If regulators determine that the design of “only approved institutions can verify compliance” does not meet Article 50's transparency requirements, OpenAI will have to adjust its access strategy. The signal to watch is whether the European AI Office issues a compliance inquiry regarding textGrain's detection access restrictions.

At the technical level, the fact that replacing 20% to 30% of words can push the detection rate down to nearly random levels will continue to drive academia and regulators to seek more robust provenance solutions — C2PA cryptographic credentials are viewed by many analysts as a medium- to long-term direction, but their implementation requires coordination across the entire infrastructure chain and will not replace statistical watermarking as the first line of defense in the short term.

For developers and enterprise users who need to make decisions now, the most pragmatic advice is: within the scope of EU regulation, treat textGrain as a necessary compliance baseline, not as a trustworthy content attribution tool. The absence of a watermark does not equal non-AI generation, and the presence of a watermark cannot prove a specific author's identity — OpenAI itself has made both points clear in its announcement. Relying on watermarks for legal-grade content attribution currently lacks sufficient technical support.