Output watermarks are provenance signals, not proof of authorship

I think output watermarks are provenance signals, not proof of authorship. A detector can estimate whether a sufficiently long passage carries a statistical pattern associated with one generation system. It cannot establish who submitted the text, whether a human directed or edited it, whether another model transformed it, or whether the document is truthful. Treating that estimate as an authorship verdict turns a useful signal into an accusation machine.

The distinction begins in the mechanism. Token watermarks bias sampling toward a keyed subset of the vocabulary, then test whether the observed proportion is unlikely under an unwatermarked distribution. The result is a hypothesis test with a threshold and a false-positive rate—not a cryptographic signature attached to an identity. Detection depends on text length, entropy, tokenizer behavior, sampling configuration, and the operating threshold chosen for the population being tested.

Scale makes the threshold a product decision. A false-positive rate that looks small in a paper can create repeated false accusations when a platform scans millions of passages. Correcting for that many tests raises the evidence threshold and usually requires more text. Short answers, code, mathematics, names, and other low-entropy passages are especially poor evidence because the generator has too few plausible token choices in which to hide a signal.

Editing weakens the inference further. Paraphrasing, translation, span replacement, tokenization changes, and even ordinary human revision can reduce detectability. More robust schemes and edit-aware detectors improve survival, but robustness is not invariance. A negative result may mean no watermark was present, or that the text was too short, too constrained, generated by an unsupported model, or altered after generation. Open-weight models also break any fantasy of universal coverage because operators can omit the watermark entirely.

A positive result needs equally careful handling. If detection keys leak, attackers may forge the pattern or probe a public detection oracle until they learn how to evade it. Per-tenant keys can narrow attribution, but then key lifecycle, rotation, access, and detector audit become part of the trust boundary. That is why an agent audit trail must preserve authority: provenance becomes credible when model release, tenant, request, policy, and custody records agree, not when one statistic stands alone.

I would design watermark evidence as one field in a provenance record. Store the detector version, algorithm and key identifier, text normalization applied, token count, score, threshold, expected false-positive rate, and known transformations. Combine it with signed delivery metadata where available, content credentials for intact artifacts, and application logs that record which model produced which response. The decision should also preserve uncertainty instead of collapsing every score into “AI” or “human.”

This framing changes the operational response. A watermark can route suspicious corpus material to review, support aggregate disclosure audits, or help exclude likely synthetic text from a training pipeline. It should not by itself deny a student, employee, author, or customer a consequential outcome. As data rights belong in lineage, any enforcement decision needs sources, transformations, policy, and appeal—not merely a detector badge.

I concede one precise boundary: within a controlled service that owns generation, keys, logging, and delivery, a strong watermark match can be persuasive evidence that the service produced an ancestral version of the passage. Even there, it does not prove the identity or intent of the final author, and edits can make absence uninformative.

The right promise is therefore narrower and more defensible. Watermarks can add probabilistic provenance to an evidence chain. They can improve disclosure systems when calibrated, attacked, and monitored like any other control. But evaluation must define the operating contract, including false-positive harm and post-edit recall. Calling the result proof hides those boundaries exactly where governance needs to expose them.