OpenAI Enables Text Watermarking and Publishes textGrain

OpenAI turned on text watermarking for selected API models, default off, and will watermark eligible ChatGPT and Codex text in the European Union over coming weeks. The method, textGrain, is described in a technical report on entropy-calibrated watermarking.

On 6 October 2026, OpenAI said it had enabled text watermarking. From that day, global API customers can turn watermarks on for some models. The default remains off. Over the following weeks, eligible ChatGPT and Codex text outputs in the European Union will carry a machine-detectable, human-invisible watermark, covering all paid tiers. The detector is open by application to reviewed researchers and professional organizations, not to the public.

EU AI Act timeline

The rollout follows the EU Artificial Intelligence Act. Article 50 applies from 2 August 2026 and requires generative-AI providers to mark outputs in a machine-readable way. A European Commission Code of Practice on transparency of AI-generated content, issued in June, lists imperceptible watermarking as a baseline and notes that free text cannot carry image-style metadata.

Text watermarking is not new at OpenAI. In 2023, then guest researcher Scott Aaronson described a Gumbel-max scheme. Later public reports said OpenAI had internal text-watermark capability without a product launch.

textGrain report

OpenAI published a technical report, textGrain: Entropy-Calibrated Watermarking for Language Model Text.

• Title: textGrain: Entropy-Calibrated Watermarking for Language Model Text
• URL: https://cdn.openai.com/pdf/e9508624-d767-41b6-a26d-e34ca798ada6/textgrain-entropy-calibrated-watermarking-for-language-model-text.pdf

Corresponding author Weijie Su received the 2026 COPSS Presidents' Award.

Authors and prior work

Su's recent research includes watermark detection. A 2025 paper in The Annals of Statistics set a statistical framework for detecting watermarks, using OpenAI's earlier Gumbel-max design, and derived a detection rule the authors reported as stronger than prior methods.

Follow-on work covered detection under human edits, goodness-of-fit tests, and estimating the watermarked share in mixed text.

In late May 2026, Su said he had joined OpenAI on academic leave for model training and had been promoted to full professor in Statistics and Data Science at the Wharton School, University of Pennsylvania.

On 5 August 2026 he received the 2026 COPSS award at the Joint Statistical Meetings in Boston.

COPSS, founded in 1976 by five statistical societies, names one early-career statistician each year. Su is the first Chinese statistician to receive it since 2012. The citation listed statistical foundations of generative AI first. He graduated from Peking University's School of Mathematical Sciences (class of 2007, bachelor's degree 2011), earned a 2016 Stanford statistics Ph.D. under Emmanuel Candès, and has taught at Wharton since.

textGrain lists nine authors: Xiang Li and Qi Long (University of Pennsylvania); Garrett Wen and Xiaohong Chen (Yale); Arzav Jain, Florent Joly, Mike Lam, and Qingquan Song (OpenAI); and Weijie Su. Xiang Li is first author and was first author on the Annals of Statistics detection paper.

Unbiased watermarks and a fixed key

An LLM samples each next token from a predicted distribution. A watermark uses a key and prior text to make a pseudorandom sequence that the sampler depends on. A detector with the same key tests for statistical association.

Unbiasedness means that, averaging over a random key, the watermarked output distribution matches the original model for any fixed prefix. In deployment the key is fixed. Under Aaronson's Gumbel-max rule, a fixed prefix and fixed key always select the same token, so repeated sampling of one prompt can return identical text. If sampling ignores the key, randomness is preserved and the watermark signal vanishes.

Entropy budget and blocked optimal transport

The report treats an unbiased watermark as a coupling between generated tokens and key randomness. KL divergence from independence equals mutual information and equals average sampling entropy lost given the key. An entropy budget β in [0, 1] is the allowed fraction of original predictive entropy to spend. β = 0 is ordinary sampling. Larger β strengthens the key's influence. The constraint applies to average loss over keys, not to every key and position.

The chosen coupling is KL-regularized optimal transport, with pairwise costs from Gumbel random variables. Direct OT on a vocabulary of hundreds of thousands of tokens is expensive, so textGrain partitions the vocabulary into blocks using the key and a prefix window.

The report walks through a next-token example after the prefix "The morning was," with candidate probabilities warm 0.30, cold 0.25, mild 0.15, calm 0.10, sunny 0.10, bright 0.10. Tokens are grouped into blocks, block masses are coupled to equal-probability columns by OT, one column is selected by the key, and the token is then drawn inside the chosen block using original relative probabilities. In the example the draw is cold.

Blocking cuts Sinkhorn work to O(Bm) per iteration and leaves within-block relative probabilities unchanged. Cost tables can be stacked across positions. The appendix describes a speculative-sampling variant that shares the key between draft and target models. Measured speedup is still pending.

Detection

The detector uses the text and the key only. It does not need the generating model or the entropy budget used at generation. At each position it rebuilds blocks, costs, and the selected column, scores the observed token's block, and sums scores. Watermarked text scores higher because the sampler prefers low-cost pairs.

Under idealized assumptions, unwatermarked per-position scores are unit exponential and the sum is Gamma(n, 1), which sets a threshold at false-positive rate α. Only the first occurrence of each prefix window is counted. The report states that a fixed production key and finite precision require empirical calibration.

Quality and recall numbers

On OpenAI's Astra frontier-model benchmarks, watermarked and unwatermarked scores were close: GPQA Diamond 94.44% versus 93.94%, DeepSWE v1.1 72.80% versus 71.68%, Terminal-Bench 4.0 53.90% versus 56.06%.

OpenAI said internal tests placed textGrain at or above other methods including Google's SynthID text watermark, without publishing the comparison table.

At a 1% target false-positive rate, the detector identified about 80% of 200-token psychology Q&A passages and about 95% of 400-token passages. Math text, with a smaller word-choice set, had lower recall.

Edits cut recall further. On 400-token passages, replacing 10% of words with synonyms dropped detection from about 92% to 66%. Replacing 25% left 17%.

OpenAI listed limits: the watermark does not measure human contribution, assign ownership or liability, link to a user, or decide truth. Failure to detect a watermark does not prove human authorship. Those limits are one stated reason the detector stays limited to reviewed researchers and professional organizations.

OpenAI said the report will gain more detail in coming weeks and that it plans to open-source related technology. Reference: https://openai.com/index/eu-text-provenance/