OpenAI 公布 EU AI Act 下的文本溯源方案，推出 textGrain 文本水印
Key Highlights
OpenAI has rolled out a text-provenance plan for the EU AI Act, centered on a watermarking technique called textGrain. It does not change the words you see, but embeds an invisible statistical signal into the very process of how the model chooses its words. As regulators move from principles to enforcement, a technically credible watermark is the missing piece that makes "prove where this came from" actually possible.
The policy weight behind this is real. The EU AI Act does not merely suggest labeling; it creates obligations for providers of general-purpose AI models, and provenance is a recurring theme across the regulation. A watermark that survives editing and translation is therefore not a nicety — it is one of the few technical mechanisms that could satisfy a regulator asking, after the fact, whether a given text was machine-generated.
What Happened
Unlike image watermarks, textGrain operates at the generation step: each time the model picks a token, it applies a subtle preference shift along a specific distribution, giving the output a statistically detectable fingerprint while remaining invisible and semantically neutral to humans. API customers can selectively enable the watermark on some models starting now, which means the feature is live for builders rather than just announced in a blog post.
Rollout to everyday users is also coming: over the next few weeks, ChatGPT and Codex outputs in the EU will progressively carry this invisible watermark. That means even if a passage is copied, rewritten or translated, as long as enough of the original remains, the detector can still likely tell it came from an OpenAI model. Provenance, in other words, survives transformation — the property regulators have wanted most, because the real world edits and rephrases everything.
Technical Detail
The emphasis is on selective and reversible or controlled. OpenAI stresses the watermark is an opt-in switch that enterprises can turn on per compliance need; the detector is not publicly released and is open only to approved researchers and expert institutions. Both choices are deliberate: keeping the detector narrow prevents adversarial stripping and avoids reverse-engineering of the watermark pattern, which would let bad actors forge or erase it at will.
There is a quiet arms-race logic here. The moment a watermark detector is public, attackers study it and learn to strip the signal; the moment the watermarking scheme is public, they learn to forge it. By gating the detector, OpenAI trades openness for durability, betting that a smaller, trusted circle of verifiers is harder to game than a global,公开 endpoint would be.
Versus Competitors
Compared with Google's SynthID text approach or early synonym-substitution watermarks, textGrain takes the statistical-distribution route, with less impact on fluency and harder to erase by simple editing. The trade-off is that detection needs the original model vendor's cooperation, and cross-vendor recognition remains a hard problem — a watermark only helps if the verifying side knows the scheme, which today it does not across competing labs.
Interoperability is the unresolved frontier. A watermark that only OpenAI can detect is useful for OpenAI's own compliance, but regulators want a level playing field where any authorized verifier can check any provider. Until there is a shared standard — or at least mutual recognition of schemes — watermarking will feel like a per-vendor patch rather than a market-wide solution.
Industry Impact and Use Cases
For regulators: the EU's provenance clause finally has a workable technical handle instead of a reporting checkbox. For enterprises: generative products launched in the EU now have an extra compliance option that does not require rebuilding the pipeline. For developers: once watermarking is on, outputs become traceable, raising auditability of AI ghostwriting in tightly regulated scenarios, at the cost of slight latency and expense.
The deeper implication is cultural. For three years the industry treated "is this AI-written?" as an unsolvable parlor game; textGrain and its peers suggest it is becoming a solvable engineering problem. That will not end debate about disclosure, but it moves the conversation from vibes to verification — and verification is what law, procurement and academic integrity actually require.
The practical takeaway for builders is to treat watermarking as a default rather than an afterthought — enable it wherever a regulator or a customer might ask, because retrofitting provenance after content has already spread across the web is effectively impossible.