How AI Text Watermarking Works, and What It Cannot Prove

On 11 August 2026, Anthropic said Claude would begin embedding an invisible mark in the text it writes. The reaction arrived within hours and most of it described a technology that does not exist. Hidden characters. A logging database of every response ever served. Neither. How AI text watermarking works is stranger than either guess, and the strangeness is the substance: nothing is added to the finished text. The mark is made out of the text, by steering which word the model picks, several hundred times, in a pattern only a key holder can see.

The trigger was regulatory and dull. Article 50 of the EU AI Act requires providers of generative systems to mark outputs in a machine-readable format, and that duty began applying on 2 August 2026. Anthropic's marking covers Claude models launched on or after that date, and it applies worldwide rather than only in Europe.

How AI text watermarking works: the green list and the red list

Everything descends from one paper. Kirchenbauer, Geiping, Wen, Katz, Miers and Goldstein posted "A Watermark for Large Language Models" to arXiv on 24 January 2023.

The idea fits in a paragraph. At every position a language model produces a score, a logit, over its entire vocabulary. Before those scores become probabilities, you interrupt. Take the preceding token, hash it with a secret key and use the result to seed a pseudorandom generator. That generator splits the vocabulary in two: a green list containing some fraction γ of the tokens, and a red list containing the rest. Add a small constant δ to the logit of every green token. Then let sampling run as normal.

Nothing else changes. The model is untouched, the prompt is untouched and not a single character is inserted. Because the split is random and γ is typically 25 or 50 percent, there are always plenty of green words that fit the sentence, so the prose stays fluent. The nudge only decides a very large number of near-ties.

Detection is counting. Tokenize the suspect text, regenerate the same green lists with the same key and count how many tokens landed green. Text written by a human knows nothing about the key, so it should hit γ by chance. Watermarked text overshoots. Compare the count against the binomial expectation, get a z-score, get a p-value. Two hundred greens out of three hundred tokens at γ = 0.5 is not something you explain away.

The detector never needs the model. It needs the key and the tokenizer. That property is what makes this practical at scale, and it is also what decides who gets to accuse whom.

The strong method sits with a party that has no stake in your disciplinary hearing, and the weak method is what the person accusing you actually runs.

Tournament sampling, and the version that actually shipped

Adding δ to green logits does bend the output distribution. A small bend, but a measurable one. Google DeepMind's answer, published in Nature on 23 October 2024 as "Scalable watermarking for identifying large language model outputs" (Dathathri et al., volume 634, pages 818 to 823), avoids the bend by never touching the logits at all.

SynthID-Text draws several candidate tokens from the model's own distribution, then runs a knockout tournament between them. Each layer uses a different pseudorandom scoring function, g1 through gm, seeded by the key and the preceding n-gram. Candidates are paired, the higher g value wins, ties break at random and survivors advance. After m layers one token is left, and that is what gets emitted.

The signal lives in the fact that winners tend to carry high g values. Detection sums the g values of the observed tokens and asks whether the mean sits implausibly high. Since every candidate came from the model's own distribution to begin with, the non-distortionary configuration leaves the distribution over sequences intact.

Google ran it in production before publishing. Across close to 20 million Gemini responses split between watermarked and unwatermarked models, the difference in thumbs-up rate was 0.01 percent and the difference in thumbs-down rate was 0.02 percent. Inside the noise.

The reference implementation went public the same day under Apache 2.0, and a production version shipped in Hugging Face Transformers v4.46.0 as a logits processor applied after top-k and top-p. Default n-gram length is 5, and Google recommends 20 to 30 keys. Two detectors come with it: a weighted mean detector needing no training, and a Bayesian detector that is stronger but must be trained per key on roughly 10,000 examples. Anthropic says its text marking is a version of this approach. The practical consequence for anyone serving models is that watermarking is a sampler change, so it belongs where your sampler lives, which usually means inside a serving stack like vLLM rather than in the weights.

Three things called watermarking that share no mechanism

C2PA and Content Credentials come first, because they are the most commonly confused with the above. A C2PA manifest is cryptographically signed metadata travelling with a file, recording what created it and what edited it. The coalition passed 6,000 members and affiliates by January 2026 and it is genuinely in hardware, from Leica's M11-P to Nikon's Z9 to the Pixel 10 signing with hardware-backed keys. Anthropic uses C2PA for files Claude produces, SVG, PNG and JPG, and statistical watermarking for text. The split matters, because metadata rides alongside content rather than inside it. Screenshot the image and the manifest is gone. Paste text into an email and there was never a manifest to lose.

I watch the other version of this bet from Shenzhen. China's labelling Measures took effect on 1 September 2025, with the mandatory standard GB 45438-2025 alongside them, and they require two marks: an explicit one the user can see, and an implicit one in the file metadata. The visible 生成 tags have been unavoidable on Chinese consumer apps ever since, and they work, because a human reads them. The implicit half is header metadata, which dies the instant anyone copies the words out of the app and pastes them into WeChat. Two jurisdictions, two different bets about where a mark should live, and only one of them survives the clipboard.

Post-hoc classifiers come second. GPTZero, DetectGPT, Turnitin's detector and the rest hold no key and no privileged information. They read perplexity and burstiness: machine text tends to sit in a lower, flatter band of surprise than human writing, which spikes and sags. That is a hunch about style, not evidence about origin. OpenAI shipped one on 31 January 2023 and withdrew it on 20 July 2023 for low accuracy. Its published numbers: 26 percent of AI-written English correctly flagged, 9 percent of human writing wrongly flagged.

Invisible characters come third, and they are the most durable myth. In April 2025 people noticed narrow no-break spaces, U+202F, in output from o3 and o4-mini, identical on screen to ordinary spaces. The internet decided it had found the watermark. OpenAI told Rumi, the group that published the observation, that these were not a watermark but a quirk of large-scale reinforcement learning. The engineering argument is stronger than the denial anyway: a mark you can strip with one find-and-replace is not a mark.

What survives a rewrite, and what was never marked to begin with

The mark is made of choices, so wherever the model has no choice, there is no mark.

Ask for the boiling point of water and the answer is nearly forced, with almost no entropy to hide a signal in. Code is worse, because syntax removes options. Anthropic states both plainly: watermarking is sparser on factual passages, and code carries less of it than other text. The case that should worry people most is editing. When Claude reworks a paragraph a person already wrote, in Anthropic's own wording, nearly all the words are the person's, so there is very little for the watermark to attach to.

Length is the other limit. This is a statistical test and statistical tests need samples. A tweet gives you nothing.

Then the attacks. Krishna, Song, Karpinska, Wieting and Iyyer built DIPPER, an 11-billion-parameter paraphraser, and showed at NeurIPS 2023 that it dropped DetectGPT from 70.3 percent detection to 4.6 percent at a fixed 1 percent false-positive rate. SynthID-Text is not exempt. ETH Zurich's SRI Lab probed it on 20 December 2024 and found a baseline paraphraser scrubbed the mark in over 90 percent of cases, a higher rate than the other schemes they tested. Their analysis of tournament sampling also cut the other way: it reduced spoofing success from 82 percent to 30 percent in one configuration, which matters, because spoofing, forging the mark onto human text so that somebody else gets accused, is the attack almost nobody discusses. In March 2026 Omidi, Dong and Wang published a layer inflation attack against the mean-score detector and found the Bayesian score held up better.

Light editing survives. Translation and full rewriting do not. A determined adversary wins. The mark is a speed bump for the casual and no obstacle at all for the motivated.

Detection is a bet, and someone has to pick the false-positive budget

Every detector output is a probability, and the threshold is a policy choice a human makes. Set the false-positive rate at 1 in 1,000 and a university processing 50,000 essays a term should expect roughly 50 innocent flags. Set it at 1 in a million and you stop catching anything short. No setting gives you both, and the institution choosing the setting is rarely the one that understands it.

Turnitin is the standing example. At launch in April 2023 it was promoted with a document-level false-positive rate under 1 percent; by that June the company had conceded the sentence-level rate was around 4 percent. The technology had not changed. Real submissions are simply not lab data.

SynthID's detector is more honest about the shape of the problem, returning three states, watermarked, not watermarked and uncertain, with the thresholds exposed as configuration. Anthropic's own help documentation states the ceiling in one line: a detected mark provides a signal that content was processed by Claude, but is not fully conclusive.

A watermark shows a model was in the room, not who wrote the sentence

This is the part the policy documents skip.

The signal is per-token and additive. It measures how many of these words were chosen by the model. That is the entire measurement. A 2,000 word essay in which Claude drafted 300 words has a diluted statistic and may fall under any sane threshold. A 2,000 word essay in which a person supplied every argument, every source and every structural decision, then asked Claude to phrase it, is fully marked, and a naive reader concludes the machine wrote it. Both readings are wrong, in opposite directions.

One Claude user put it more sharply than any position paper: "Who will get caught? You. The student who used Claude to reorganize a paragraph." Another objected that they had supplied the instructions, context, decisions and countless refinements. The watermark sees none of that. It sees tokens.

Then the asymmetry, which is the actual story. Key-based detection is enormously stronger than classifier guessing, because it is a hypothesis test against a known random process rather than a guess about writing style. But the key belongs to the provider. Google announced its SynthID Detector portal at I/O on 20 May 2025 and put it behind a waitlist for journalists, media professionals and researchers. Anthropic has said it will offer a detection API, which is not the same as having one. The strong method sits with a party that has no stake in your disciplinary hearing, and the weak method, the one with the 4 percent sentence-level error rate, is what the person accusing you actually runs.

The strongest objection: institutions have a real problem and "detection is flawed" does not solve it

Everything above is easy to write and useless to a course leader holding 180 scripts, an editor with a submissions queue or a hiring manager facing 4,000 applications that all open the same way. Those problems are real, they arrived quickly and observing that detection is probabilistic answers none of them. People in my position have been better at demolition than construction.

So, the answer I actually hold. Watermarking does not solve the accusation problem, but it changes the class of evidence, and that is worth something. A key-based hit is a statistical claim with a stated error rate, which is a thing you can argue about in the open. A classifier score is not. Treat a hit as the trigger for a conversation and never as a verdict: ask for drafts, ask for version history, ask for five minutes of oral defence of the argument. That is cheap, it is fair to the person who used a model to fix their prepositions and it requires nobody to pretend a p-value is a confession.

The structural hole stays open regardless. Marking is an obligation on providers. It is not an obligation on the person running a Qwen or DeepSeek checkpoint locally through Ollama on hardware that costs less than a term's tuition, because no regulation reaches a sampler on someone's own machine, and deleting a logits processor from an open-weights serving stack is a code change, not a research project. Detection polices the compliant.

Compliance deadlines as a map of who has lawyers

The EU set 2 August 2026. Anthropic shipped nine days later. That is a company with counsel, a compliance calendar and a reputation to protect, doing exactly what such a company does.

Nobody will serve a notice on a graduate student in Lagos running a 30-billion-parameter checkpoint on a rented GPU, and nobody could enforce it if they tried. So the mark will be carried, faithfully and at real cost to the people paying for it, by the users of precisely the products that were never the problem.

Which leaves the uncomfortable part. As marking spreads across the compliant providers, unmarked text stops meaning "written by a human" and starts meaning "written somewhere nobody was watching". The absence of a watermark is about to become the most misread signal of all.

Tools referenced

Claude, reviewed here: Claude review.

ChatGPT, reviewed here: ChatGPT review.

Google Gemini, reviewed here: Google Gemini review.

DeepSeek, reviewed here: DeepSeek review.

Ollama, reviewed here: Ollama review.

vLLM, reviewed here: vLLM review.

Sources

Kirchenbauer et al., A Watermark for Large Language Models (arXiv:2301.10226, 24 January 2023): https://arxiv.org/abs/2301.10226

Dathathri et al., Scalable watermarking for identifying large language model outputs, Nature 634:818-823 (23 October 2024): https://www.nature.com/articles/s41586-024-08025-4

Hugging Face, Introducing SynthID Text (Transformers v4.46.0 implementation and configuration defaults): https://huggingface.co/blog/synthid-text

google-deepmind/synthid-text reference implementation, Apache 2.0: https://github.com/google-deepmind/synthid-text

Anthropic, How Claude's text watermarking works (11 August 2026): https://www.anthropic.com/news/claude-text-watermark

Anthropic Help Center, How Claude marks AI-generated content: https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content

EU AI Act, Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems: https://artificialintelligenceact.eu/article/50/

Krishna et al., Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense (NeurIPS 2023): https://arxiv.org/abs/2303.13408