Signals and Limits of Black-Box Text Watermark Detection

Independent auditors must assess text watermark deployment without detection keys or an unmarked reference endpoint. We investigate what the SRI repeated-prefix test can establish under this access constraint. Measurements on deployed models reveal strong Gemini signatures, including replicated temperature-dependent choice reversals, alongside model- and carrier-dependent outcomes on Claude. Matched Opus 4.8 and Opus 5 probes produce different SRI decisions despite persistent prefix preferences in both models. We explain this behavior through the geometry of task, prefix and interaction effects. SRI removes task offsets from its residuals but retains them in its threshold, creating a detection blind spot even for an ideal prefix-only watermark at exact response probabilities. Controlled SynthID experiments establish both missed marking and unmarked stripes. Prompt wording and output order expose ordinary prefix dependence, while key mixing and stochastic activation weaken the field available to public probes. Keyed controls recover part of this evidence, with aggregation determined by key persistence. Repeated-carrier and locality interventions further distinguish stable response patterns from evidence about a watermark's mechanism. Together, these results show how model behavior governs black-box detection and provide an empirical framework for separating pattern estimation, detector sensitivity and watermark attribution.