AI Detection in Publishing and Journalism Contexts

A managing editor who runs a submission through an AI detector is not receiving a forensic verdict.

What editorial teams deploy when they run AI detection

Two distinct categories of tool sit under the single label "AI detection," and editorial teams routinely treat them as interchangeable despite their differences. The first category, statistical classifiers, predates watermarking entirely: these systems are trained to distinguish AI-generated text from human writing by surface patterns in word choice, sentence rhythm, and predictability. The second category, watermark detectors, depends on a signal that a cooperating model provider has to embed at the moment of generation, using a scheme like KGW, SynthID, or Unigram. A detector built for one scheme can only read a signal planted by that same scheme.

The watermarking landscape in 2026 is uneven across providers, and that unevenness shapes what any editorial screening process can actually see. OpenAI has published years of research into text watermarking, but it has not shipped it.

That unevenness produces a direct operational problem for any newsroom or publishing house running screening software. The accuracy problems that made detection tools controversial when they first appeared in newsrooms have not been resolved in the years since, and the sections that follow lay out, mechanism by mechanism, why that resolution has not arrived and is unlikely to.

KGW Watermarking's Statistical Logic Under Editorial Conditions

KGW, the watermarking scheme introduced by Kirchenbauer and colleagues in 2023, works by splitting a language model's token vocabulary into "green" and "red" lists at each generation step, using a hash of the preceding token to determine the split. Detection then checks whether a finished piece of text contains an unusually high proportion of green tokens, using a z-score: z = (|S|_G − γ|T|) / √(|T|γ(1−γ)), where |S|_G counts the green tokens found, |T| is the length of the sequence, and γ is the green-list fraction expected under the null hypothesis of no watermark.

The z-score's behavior is the root of the problem for editorial use. Headlines, breaking news alerts, social captions, and short-form copy, the bread and butter of daily publishing output, are exactly the kind of text this statistic was never built to catch reliably.

This scheme also trades off quality, and editors need to understand that before they trust it as an enforcement tool. Any intervening step, a second model's rewrite, a summarization pass, a translation, resamples from an entirely new distribution and severs the link the detector depends on.

Related research has tried to patch specific weaknesses. WaterSeeker addresses the problem of locating watermarked segments inside large, mixed-source documents, a scenario directly relevant to journalism, where an AI-drafted paragraph may sit embedded inside otherwise human-written copy, something the baseline KGW detector was never designed to isolate. Other adaptations, including SSG, WaterPool, and VOW, are active areas of research aimed at shoring up robustness. Their gains, however, are specific to the configurations the researchers tested, not general properties that carry over to every deployment of the scheme.

What empirical testing reveals about detection accuracy before adversarial attack

Testing of watermark detectors against legal and forensic standards shows failure rates that would disqualify the technology from evidentiary use, and these failures occur on pristine, unattacked text before anyone attempts to remove the watermark. One evaluation measured KGW, Unigram, and the MarkLLM implementation of SynthID-Text against the Daubert admissibility criteria, the standard U.S. federal courts use to assess scientific evidence, and against the NIST SP 800-86 digital forensic process. False-negative rates on pristine, unattacked watermarked text came in at 70% for KGW, 83% for Unigram, and 80% for SynthID. KGW correctly flagged only 9 of 30 watermarked texts with no adversarial intervention applied whatsoever.

The pre-watermark statistical classifiers do no better, and their failures show a troubling bias. A 2023 study published in Patterns (W. 4, issue 7) tested seven detectors on 91 TOEFL essays written by non-native English speakers, and it found a false-positive rate of 61.3%. The same detectors classified essays by native English speakers with near-perfect accuracy, so that gap points to bias against non-native writing patterns, not to a real signal of machine authorship.

Why paraphrase is the structural weakness undermining watermark-based enforcement

A line editor or copy desk reworks a sentence this way in any editorial workflow, and that same meaning-preserving paraphrase strips the watermark from nearly every tested scheme.

Across 846 valid paraphrase runs spanning 15 diverse prompts per method, every single initially-detected KGW and Unigram text lost its watermark after a single paraphrase pass: 100% conditional removal. SynthID's true-positive rate fell from 0.998 on clean text to 0.498 when you add moderate paraphrasing.

The more consequential threat to detection isn't a dedicated paraphrasing tool. When a model or a human regenerates text from a summary or an outline, the original token choices the watermark depended on are gone, so detection accuracy collapses toward chance once a full rewrite has occurred, as published research on summarization-based attacks consistently shows.

This creates what amounts to an authorship trap for anyone relying on watermark detection as proof of who wrote what. A detected watermark does not tell you that a human did not write the underlying text. It establishes only that the relevant model processed the text at some point, even if that processing amounted to proofreading a single paragraph or fixing formatting. Anthropic itself states that its mark indicates only the likelihood that Claude "was involved in writing the text," not that Claude authored the piece in its entirety.

Translation compounds the problem for any publisher operating across languages. Research presented at ICLR 2025 ties the argument together at the structural level: watermark signals embedded across vocabulary channels are lost whenever text passes through a second or third model's rewriting stage, because each generation step resamples from a new distribution and breaks the token distribution the original watermark relied on. Multi-model editorial workflows, in other words, are incompatible with watermark-based enforcement by design, not by accident.

How LLM fingerprinting differs from watermarking in a publishing context

Fingerprinting offers a different technical route to the same question watermarking tries to answer, and it works without requiring a provider to have embedded anything at generation time.

FDLLM (Fu et al., presented at IEEE TrustCom) built a bilingual fingerprinting benchmark called FD-Dataset, comprising 90,000 text samples drawn from 20 proprietary and open-source language models. The resulting system beat the strongest prior baseline and generalized to newly released models with high accuracy, and it stayed robust even when text was polished, translated, or run through synonym substitution. That robustness is a genuine advance over watermark detection's fragility under the same conditions.

But fingerprinting has its own limits, especially under the configurations real editorial teams actually use. AdaptPrint (Li et al., arXiv) identifies a specific gap: existing fingerprinting approaches collect responses using a fixed set of queries and perform poorly under realistic, complex configurations such as custom system prompts and varied sampling settings, precisely the setup most content teams run in production. Separate work titled "Reading Between the Lines," published in the WWW '26 proceedings of the ACM Web Conference 2026, applies zeroth-order gradient estimation to fingerprint models without requiring white-box access to their internals, a capability that matters because black-box API access is how nearly all commercial deployment actually happens.

Even a mature fingerprinting system answers a narrower question than editorial accountability requires. Multi-model pipelines undercut fingerprinting for the same structural reason they undercut watermarking: content routed through several models in sequence produces stylistic and statistical features that reflect a blend of sources.

What regulatory mandates require versus what the technology can deliver

Regulators are writing rules that assume a level of reliability the empirical record does not support. The EU AI Act requires AI-generated content markings to be "sufficiently reliable, interoperable, effective and robust as far as this is technically feasible." California's SB 942 requires disclosure that is "permanent or extraordinarily difficult to remove." Both statutes assume watermarking can meet a durability standard, but testing has not confirmed it can.

Recent analysis (Nemecek et al., 2025) warns that watermarking risks becoming "symbolic compliance" absent real, enforceable standards, and the empirical testing described earlier backs that warning with numbers: none of the tested watermark configurations meet the evidentiary bar courts require under Daubert. So if an editorial team runs watermark screening to satisfy a regulatory transparency obligation, it may be building a paper trail that looks like compliance, even while the underlying detection produces results that would not survive a legal challenge.

How multi-model content pipelines make the attribution problem harder

Routing content through multiple models in sequence is the operational norm for content teams in 2026, with one model handling briefs, another handling drafts, and a third handling research or localization. No single model's watermark survives that full sequence intact, and the teams running these pipelines are not evading detection so much as operating inside an architecture that detection was never built to track.

A governance audit of one marketing team's multi-model workflow, which used ChatGPT for briefs, Claude for drafts, and Gemini for research, sampled 40 finished assets and found three outdated claims, two off-brand product descriptions, one unapproved customer quote, and no record at all of which prompt had produced which page.

Shadow AI widens the hole further.

You need provenance metadata attached at the moment of generation and preserved through every downstream step to get genuine attribution in a pipeline like this, and watermark detection applied after the fact to finished output cannot satisfy that requirement retroactively. Lettershred's architecture is the natural extension of this reality rather than a departure from it: a pipeline that deliberately disperses authorship across many models and mixes content at the token level produces a z-score that falls below the detection threshold by construction. Lettershred's contribution is to treat that dispersal as the designed result of the pipeline rather than an incidental side effect of using more than one vendor.

Provenance infrastructure as the workable editorial standard replacing detection

The industry's center of gravity is shifting from inferring authorship backward out of statistical patterns in finished text toward attaching verifiable records to content at the moment it's created. Only a forward-looking record can survive the transformations, paraphrase, translation, multi-model rewriting, that reliably defeat backward-looking detection.

The technology sector's standards response pairs SynthID, a sub-perceptual and comparatively transformation-resilient watermark, with C2PA, a system of cryptographically signed provenance metadata, as a dual-layer defense. The C2PA layer survives transformations that destroy the token-level signal entirely, and that is precisely the failure mode the earlier sections documented. The AI and Multimedia Authenticity Standards (AMAS) Collaboration, introduced in 2024, recommends embedding creator IDs, timestamps, and edit trails directly into file metadata for traceability a machine can verify, a record built forward from the moment of creation. Notably, files generated through Claude in formats like .svg, .png, and .jpg receive C2PA-compliant provenance metadata rather than a token-level watermark, a signal that even a provider committed to text watermarking treats metadata-based provenance as the right mechanism for other content types.

Journalism institutions are converging on the same logic from the disclosure side. The "News Integrity in the Age of AI" initiative, launched at the World News Media Congress in Krakow in May 2025, promotes requiring consent for training on news data, mandating transparency around AI-generated stories, and protecting original reporting from unauthorized model training. Academic publishing is building a parallel structure: COPE, WCRIF, the International Science Council, STM, and the Global Young Academy are jointly developing a Global Reporting Standard for AI Disclosure in Research, informally known as the Vancouver Standard, tied to the World Conference on Research Integrity held in Vancouver.

The logic running through all of this is the same: proving what's human-verified and accountable costs less, and works better, than chasing every synthetic signal through a detector that fails at rates measured in double digits even before anyone tries to beat it.

What editorial teams should change in their workflows given these structural limits

The evidence assembled across every preceding section points to one conclusion: the fix is not a better detector, because the statistics underlying detection are structurally unreliable under editorial conditions, not merely in need of refinement. So editorial and compliance teams should treat a detector's output as a measurement with a known, often severe, error rate, not as a verdict. A z-score below threshold does not confirm human authorship, and if a positive detection vanishes after a single editorial pass, that is not evidence of anything in particular.

Provenance should be attached at the moment content is generated. C2PA-compliant metadata, prompt records, model version logs, and edit trails are the records that survive the transformations that defeat watermark detection, and they belong inside the production workflow rather than in a retrospective audit conducted after a complaint.

Multi-model routing should be an explicit architectural decision, and it should not just happen informally through individual tool preferences. Teams should document which model handles which function, and they should keep that routing auditable. Any detection tool under consideration should be benchmarked against its actual, measured false-positive and false-negative rates before it's used to make editorial decisions, since the gap between a vendor's marketed accuracy and its forensic accuracy under real editorial conditions runs wide enough, as the Daubert testing shows, to matter in a legal or reputational dispute.

If an organization's compliance obligation centers specifically on watermark avoidance rather than detection, then the architectural answer is to deliberately disperse authorship across providers at the token level. Lettershred's multi-model approach, which drops z-scores from well above the detection threshold to below it through cross-provider dispersal of authorship across 177 of 240 tokens, formalizes what editorial multi-model routing already achieves inconsistently on its own. USA Today's documented approach offers the institutional model worth emulating more broadly: editors, reporters, and in-house legal staff providing human oversight over AI-assisted drafting, with that human accountability serving as the verification layer that detection software was never equipped to provide.