AI text watermarking has moved from research papers into models people actually use. On August 14, 2026, Anthropic said Claude would use a version of Google DeepMind’s SynthID-Text, and its current documentation says supported Claude models embed watermarks in generated text.
The immediate reason is regulatory. Article 50 of the EU AI Act requires providers of generative AI systems to make qualifying synthetic text, images, audio and video machine-readable and detectable as artificially generated or manipulated. That requirement makes the mechanics of text watermarking much more important than they were when the technology lived mostly in research papers.
There is no hidden “Made by Claude” string buried in the output. Modern generative text watermarks do not need an invisible Unicode character to survive copy and paste, and the model does not need to insert an extra sentence or obvious code.
Instead, the watermark can live in which plausible tokens the model chooses while generating the text. A detector that knows the watermark key later examines those choices and asks a statistical question: Is this sequence unusually consistent with the secret pattern the generator was instructed to follow?
That is the basic trick. The interesting part is how a watermark creates enough of a pattern to detect without making the model write worse answers.
Key takeaways
Modern AI text watermarks usually live in the model’s token-selection process, rather than in hidden characters or file metadata. Copying the same wording into another application therefore does not inherently remove the watermark.
A secret key and the preceding tokens can generate pseudorandom preferences for future tokens. The generator follows those preferences when several reasonable continuations are available, giving a detector a pattern it can later reconstruct.
Early LLM watermarking systems made a secret “green list” of tokens more likely to be selected. Google’s SynthID-Text uses the more sophisticated Tournament sampling method instead.
Detection is statistical rather than a complete record of authorship. A strong result can provide evidence that a particular watermarked generation system was involved, but it cannot tell you who wrote every sentence or how much human work followed.
Long, open-ended prose is easier to watermark than short answers, code and tightly constrained factual text. Those constrained outputs give the generator fewer harmless choices through which to encode a signal.
Copying and pasting does not inherently remove a generative text watermark because the token sequence survives. Heavy rewriting, paraphrasing and translation can change enough of that sequence to weaken or destroy the detectable pattern.
Anthropic says Claude’s current watermark contains no user, organization or conversation identifier. Other research systems can encode multiple bits, so that privacy property should not be generalized to every possible text watermark.
Start with how an LLM normally writes
A large language model does not usually compose an entire paragraph internally and then reveal the finished text. It generates the output token by token, repeatedly predicting what could reasonably come next.
A token can be a whole word, part of a word, punctuation or another small unit used by the model’s tokenizer. Given everything generated so far, the model calculates a probability distribution over possible next tokens.
Imagine the model has written:
The weather this morning isIts simplified next-token distribution might look something like this:
cloudy: 31%cold: 23%gray: 18%wet: 9%beautiful: 6%thousands of other tokens: the remaining probability
Those numbers are illustrative, but the mechanism is real. Sampling settings such as temperature, top-p and top-k can alter which parts of the distribution are available or how strongly the model favors its most probable choices.
The system then selects a token, appends it to the existing context and calculates a fresh distribution for the next position. A paragraph therefore contains a long sequence of individual sampling decisions, not one indivisible act of generation.
That gives watermark designers an opening. If cloudy, cold and gray would all produce acceptable prose, the model has room to choose one rather than another without substantially changing the meaning.
A watermark can use thousands of choices like these. No individual word needs to look suspicious if the detector can measure the pattern across many of them.
Entropy gives a text watermark room to hide
Researchers describe the amount of freedom in a token distribution using entropy. High entropy means several next tokens have meaningful probability, while low entropy means one continuation dominates.
Compare this prefix:
She stepped outside and found the morning surprisingly...A model could continue with cold, bright, quiet, warm, dark, peaceful or many other choices. The exact wording can change while the sentence remains sensible.
Now consider:
The capital of France is...If the model intends to answer correctly, Paris should dominate the distribution. A watermark that forces another token into the output has stopped being a harmless provenance signal and started damaging factual accuracy.
This constraint runs through generative text watermarking. A model can embed a statistical preference cheaply when several tokens are acceptable, but it has much less room when syntax, facts or the user’s requested wording constrain the answer.
Google DeepMind’s SynthID-Text research identifies both passage length and generation entropy as major factors in watermark detection. The same mechanism explains why code, precise editing and factual responses are difficult cases compared with long, open-ended prose.
A useful watermark therefore has to balance two competing goals. It needs to influence enough choices for a detector to recognize its pattern while leaving the model free to choose the tokens needed for a good answer.
That tension is easier to understand through an earlier approach to LLM watermarking. The method divides tokens into secret red and green groups and then gives the green ones an advantage.
Red and green tokens make the basic idea easy to see
John Kirchenbauer and colleagues described one influential version in the 2023 paper A Watermark for Large Language Models. Their method provides a clean mental model for how a generator and detector can coordinate without inserting an explicit identifier into the text.
At each generation step, the vocabulary is divided pseudorandomly into two groups:
a green list
a red list
The colors have no permanent linguistic meaning. Paris is not permanently green, London is not permanently red, and a reader cannot build a static dictionary of approved words.
Instead, the assignment changes with the generation context. The system takes information from the preceding tokens, combines it with its watermark configuration and produces a new random-looking division of the vocabulary for the next sampling step.
Suppose the model is choosing token 100. The watermark can use recent tokens to determine which candidates count as green at that position.
After token 100 is selected, the context changes. The system then produces a different partition for token 101, followed by another for token 102.
A detector with the correct key can later repeat those calculations against the finished text. It can reconstruct which choices would have counted as green at each position even though the text itself never contains a copy of the key.
That property is central to secret-key watermarking. The output carries evidence of the generator’s decisions without carrying the secret needed to define those decisions.
A hard red list makes detection easy and writing worse
The most aggressive implementation would prohibit every red token. If half the vocabulary is classified as red, the model could choose only from the green half at every scored position.
Such a signal would be easy to detect. Ordinary text should hit green and red tokens according to chance, while a generator restricted to green tokens would produce an extreme imbalance.
Language does not cooperate with that rule at every position. Imagine Paris lands on the red list after:
The capital of France isA generator that refuses to output Paris has sacrificed the answer to strengthen its watermark. Similar failures could appear in names, quotations, formulas, code, technical terminology and other places where the correct continuation is heavily constrained.
The harder the watermark pushes against the model’s original distribution, the greater the risk of damaging the answer. Production watermarking therefore needs room to back off when the underlying model has a strong reason to prefer a particular token.
Soft red-list watermarking adds a bias instead
The Kirchenbauer approach handles much of this problem by making green tokens more likely instead of making red tokens impossible. The model can still select a red token when its underlying probability is strong enough.
Internally, an LLM calculates values called logits before converting them into probabilities. In a soft red-list scheme, the watermark adds a bias, commonly represented as δ, to the logits of green tokens.
A highly probable red token can still win. If Paris is vastly more probable than every alternative, a moderate green-list boost does not necessarily push the model toward a bad answer.
The watermark has more influence when the model is already undecided. If cloudy and gray have similar probabilities and only one is green at that position, the bias can make that candidate more likely to be sampled.
One influenced decision tells the detector very little. Repeating the process across hundreds of usable tokens can create a measurable excess of choices favored by the secret watermark.
A reader sees ordinary prose. The detector sees a sequence containing more agreement with its keyed preferences than chance would normally produce.
A detector can turn those choices into a statistical score
Suppose the fraction of the vocabulary assigned to the green list is γ. If γ=0.5, ordinary text with no knowledge of the watermark should land on green tokens roughly half the time.
For a passage containing T scored tokens, let G represent the number of observed green tokens. A basic detector can calculate a z-score:
The variables have straightforward meanings:
G is the number of scored tokens that land on the reconstructed green list.
T is the total number of usable token positions examined.
γ is the expected green fraction under ordinary sampling.
z measures how far the observed green count sits above the chance expectation.
Take a passage containing 200 usable tokens with γ=0.5. An unwatermarked sequence would be expected to produce about 100 green tokens, with a standard deviation of roughly 7.1.
If the detector instead observes 130 green tokens, the resulting score is approximately:
That amount of deviation would be difficult to explain through chance alone under the assumptions of the test. The original Kirchenbauer experiments used thresholds around z = 4 in some evaluations, although that does not create a universal detector threshold for every watermark.
Real deployments require calibration for the watermark design, tokenizer, text length, language, decoding settings and acceptable false-positive rate. The later Kirchenbauer reliability research also examined how detection changes when watermarked material is paraphrased or mixed with human text, reinforcing the point that detection behavior depends on how much usable signal survives.
The statistical machinery can become considerably more sophisticated than a single z-score. The basic idea stays the same: the detector asks whether the observed token sequence agrees with a secret generation rule far more often than an unrelated text should.
Production detectors need calibration for the actual watermark, text lengths, languages, tokenizer behavior, decoding settings and acceptable false-positive rate. Google’s open-source SynthID-Text reference implementation includes several scoring approaches, including mean, weighted-mean and Bayesian detectors.
The secret key is a rule for generating patterns, not a message in the text
Calling something a “watermark key” can create the wrong mental picture. The key does not need to be a hidden serial number inserted somewhere inside the paragraph.
It is better understood as an input to a pseudorandom process. Conceptually, the generator can calculate a seed using something like:
Here, k is the secret watermark key, the x values are recent tokens, and rt is the random-looking seed used for generation step t. The exact construction depends on the watermark scheme.
The important property is reproducibility. Give the generator and detector the same key and the same relevant token history, and both can derive the same random-looking preferences.
Someone without the correct key sees the final prose but does not automatically know which alternatives the watermark favored at each position. The detector therefore does not need to search the text for a literal copy of the secret.
SynthID research used a sliding context window of four previous tokens in its experiments. Anthropic says Claude uses a version of SynthID-Text, but public documentation does not expose Claude’s production key or every low-level configuration choice.
That difference is easy to miss. Understanding Google’s published method does not give somebody Anthropic’s production detector.
Using several previous tokens limits repeated watermark patterns
A watermark could derive its pseudorandom preference from only the immediately preceding token. That would be simple, but repeated contexts could then create repeated watermark behavior.
If every occurrence of the produced the same next-token preferences, correlations could accumulate around extremely common tokens. That could affect quality and give an analyst more repeated structure to study.
Using several recent tokens produces a richer context. The same word can lead to different watermark preferences depending on the words that came before it.
The sliding context also helps explain how a watermark behaves after small edits. Change one token and the detector’s reconstructed context for the following positions can temporarily stop matching the context used during the original generation.
Once enough unchanged tokens pass through the window, the detector can become synchronized with the surviving sequence again. A local edit therefore does not automatically corrupt every watermark decision that follows it.
Cropping behaves similarly. The detector may lose evidence around the cut, but a sufficiently long surviving excerpt can provide fresh context and additional scored tokens farther into the passage.
Google says SynthID-Text can survive cropping, limited word changes and mild paraphrasing. Thorough rewriting and translation are much harder.
This does not make the watermark indestructible. It explains why deleting a sentence or changing a few words is a different attack from rewriting most of a document.
SynthID-Text replaces a simple token boost with a tournament
Google DeepMind introduced SynthID-Text as a production-scale watermarking system built around Tournament sampling. Instead of permanently boosting a secret subset of the vocabulary, the generator draws candidates from the model’s own distribution and lets secret scoring functions help choose among them.
That difference matters because a direct logit boost changes the sampling distribution in an obvious way. Increase the boost and the watermark becomes easier to detect, but the generator also moves farther from the choices the original model would have made.
Tournament sampling approaches the problem differently. The model’s own distribution supplies the competitors, which reduces the temptation to promote an otherwise implausible token simply because the watermark likes it.
▪ Step 1: the model calculates its normal next-token distribution
The process begins with the same probability distribution the LLM would ordinarily use for its next token. The model still decides which words are plausible based on its prompt and the text generated so far.
At this point, the watermark has not replaced linguistic judgment with a separate vocabulary. A token the model considers extremely unlikely remains difficult to reach because the candidate pool comes from the model’s own distribution.
That property is especially important in low-entropy situations. When the model strongly prefers one continuation, repeated samples are likely to contain that continuation regardless of the watermark score.
▪ Step 2: the secret key produces token scores
SynthID then derives a seed from the watermark configuration and recent context. For each tournament layer, a pseudorandom function assigns candidate tokens a value called a g-value.
For the simplest mental model, imagine a g-value as a secret 0-or-1 preference. The actual method can be described more generally, but binary scores are enough to understand the tournament.
The score is not a permanent property of the word. A token that receives a favorable g-value in one context can receive an unfavorable value somewhere else, and different tournament layers use different pseudorandom scoring functions.
That changing relationship is the signal. The detector later asks whether the tokens that actually won are suspiciously well aligned with those context-dependent scores.
▪ Step 3: SynthID samples candidates from the real model
Tournament participants are drawn from the LLM’s existing probability distribution. A token with a 30 percent probability therefore has far more opportunity to appear among the candidates than one with a probability close to zero.
The watermark does not simply search the whole vocabulary for whichever token gets the best secret score. Doing so could promote bizarre or incorrect words that the underlying model had almost ruled out.
Instead, plausible candidates compete with other plausible candidates. This gives the watermark useful choices when the model is uncertain while giving it much less power when the model is confident.
The effect follows the entropy constraint discussed earlier. Open-ended prose provides many legitimate competitors, while exact factual or syntactic continuations offer fewer.
▪ Step 4: the watermark lets the candidates compete
Candidates are grouped into matches. A keyed g-function determines which candidate advances from each match, after which the winners can be paired again and scored using another tournament layer.
The process continues until one token remains. That token becomes the next token in the generated response, and the model moves on to a new generation step with updated context.
If the tournament has several layers, the surviving token has repeatedly done well according to secret, context-dependent scoring functions. A detector with the same configuration can later check whether the observed text contains the correlations those tournaments should create.
This is more subtle than assigning a permanent list of favored vocabulary. The preferred candidate changes from position to position and from layer to layer.
The tournament does not simply mean “always pick green”
Consider two candidates independently sampled from the distribution the model intended to use. One might be cloudy and the other gray, with both already judged plausible by the model.
If the first candidate has the better secret score for that match, it advances. Under another random watermark seed, the second candidate could receive the advantage instead.
Across the appropriate randomness, neither linguistic token has to receive a permanent global boost. The watermark can create a relationship between the selected token and the secret scoring functions without simply declaring part of the vocabulary superior forever.
The SynthID paper analyzes useful non-distortion properties for particular Tournament sampling configurations. In those configurations, averaging over the relevant randomness preserves defined properties of the model’s underlying output distribution while individual outputs still contain correlations the detector can measure.
This is the technical basis for the otherwise strange-sounding idea that a system can influence token selection for watermarking without introducing an obvious permanent word bias. The watermark changes which candidate wins a particular secret tournament, not which words are universally preferred.
A 30-layer tournament does not require a literal billion-entry bracket
The mathematical description can sound alarming when taken too literally. With mm binary tournament layers, the conceptual construction can be described using 2m initial samples, and Google’s experiments commonly used m=30.
A literal bracket containing 230 separately materialized token entries would exceed one billion candidates. Building that physical structure for every generated token would obviously be impractical.
The conceptual tournament is useful for understanding the probability distribution, but an implementation does not need to construct that cartoon bracket naively. The paper describes efficient implementations and integration with speculative decoding.
In one Gemma 7B-IT experiment, adding 30-layer Tournament sampling increased measured generation latency from 15.527 milliseconds per token to 15.615 milliseconds per token. That was an increase of roughly 0.57 percent in the reported configuration.
The overhead measurement is important because watermarking that multiplies inference cost would be much harder to deploy across a large hosted service. SynthID was designed around the assumption that watermarking needs to survive production economics as well as statistical evaluation.
SynthID detection reconstructs the secret scoring environment
Detection does not require replaying a literal tournament bracket. The detector already has the final text and can reconstruct the keyed values that would have applied to its tokens.
For each usable token, the detector can:
reconstruct the relevant recent token context
combine that context with the watermark configuration and key
reproduce the pseudorandom g-values associated with the observed token
measure how strongly that token agrees with the expected watermark preferences
accumulate the evidence across the passage
The simplest score described in the SynthID paper averages g-values across token positions and tournament layers. Because Tournament sampling preferentially selects candidates that score well, genuinely watermarked text should produce an unusually high aggregate score.
Unwatermarked text has no knowledge of the key. Relative to the secret pseudorandom functions, its choices should therefore look much closer to chance.
The detector does not need to load the original language model or regenerate the response. It needs the tokenized text, the watermark configuration and the information required to reconstruct the scoring process.
Google’s open-source SynthID-Text reference implementation includes weighted-mean and Bayesian detection approaches. The repository also warns that its reference hashing function does not itself provide a guarantee of cryptographic security, which is a useful reminder that “secret key” and “cryptographically secure construction” are not synonyms.
Long passages give the detector more evidence
One coin landing heads tells you almost nothing about whether it is biased. A thousand suspiciously one-sided flips tell you considerably more.
Text watermark detection follows the same logic. Each useful token can contribute a small amount of evidence, and a long passage gives the detector more opportunities to accumulate that evidence.
A 1,500-word essay can contain hundreds or thousands of relevant sampling decisions. A two-word answer contains almost none.
Length alone is not enough because some long passages can still contain tightly constrained material. It does, however, explain why watermark providers warn against drawing strong conclusions from tiny samples.
This limitation has direct consequences for enforcement. A detector that performs well on long generated essays should not be assumed to have the same confidence on a headline, a short social post, one paragraph of edited prose or a handful of copied sentences.
Factual answers and code give the watermark less freedom
The same mechanics explain why watermark strength varies by task. Consider:
2 + 2 =There is no useful reason for a model to become linguistically creative at the answer. A watermark that pushes the completion away from 4 has broken the model for the sake of making it easier to detect.
Code creates similar pressure. Operators, variable names, punctuation, parameters and syntax can all determine whether a program runs.
Even when several implementations would solve the same problem, an individual token position can be highly constrained by the surrounding program. Arbitrarily substituting a different token can introduce a syntax error, change behavior or make the output inconsistent with the user’s existing codebase.
Anthropic says Claude applies less watermarking where exact output is required, while less constrained material such as comments offers more room. That is the sensible failure mode because output correctness should win when the watermark and the requested answer conflict.
Proofreading creates another difficult case. Give a model a 2,000-word human-written document and ask it to correct punctuation only, and the model may change relatively few tokens.
The final document can therefore remain mostly the user’s original sequence. A detector cannot recover watermark evidence from token choices the model never made.
AI text watermarking is different from ordinary AI detection
General-purpose AI text detectors try to infer where text came from by examining linguistic patterns. They may use vocabulary, syntax, predictability, structure, model-derived representations and other signals learned from human and machine-written examples.
They do not need the generator to cooperate. That is useful because a classifier can attempt to evaluate output from many models, including systems that never embedded a watermark.
The weakness is provenance. A classifier sees the finished text and estimates which class it resembles, but it cannot directly observe the actual writing process behind the document.
Popular AI’s analysis of Pangram’s AI detector shows why even a strong classifier remains an estimate about linguistic output rather than a record of authorship. Human editing, mixed workflows, unfamiliar models and changes in writing style can all complicate the result.
A watermark detector has a different advantage. The generator intentionally planted a signal using a rule the detector already knows.
When the signal is strong, that relationship gives the result much more specific provenance value than noticing that a paragraph happens to resemble machine-written text. The detector is checking for evidence deliberately produced by a cooperating generation system.
The limitation is just as important. Only generators that apply the compatible watermark create that evidence.
A different provider, an older unwatermarked model, a local model with watermarking disabled or text that has been transformed enough can leave nothing for that particular detector to find. Failure to detect the watermark therefore cannot establish that a human wrote the text.
More on AI text detection:
A text watermark is also different from C2PA provenance metadata
Watermarking is only one technical approach to provenance. NIST separates digital watermarking, metadata, authentication and synthetic-content detection into related but distinct technical approaches, which is a useful way to avoid treating every provenance technology as the same mechanism.
Anthropic now uses more than one approach. Its documentation says supported Claude text can carry an embedded watermark while supported generated files can receive signed C2PA provenance metadata.
Those mechanisms fail differently. A signed metadata record can make explicit statements about a file’s provenance and use cryptographic signatures to help reveal later tampering.
Metadata can also disappear when someone takes a screenshot, strips metadata during export, copies text into another application or passes the file through software that does not preserve the provenance record. The content can survive even when the separate metadata channel does not.
A generative text watermark lives in the token sequence itself. Copying the same words from a browser into a plain-text editor preserves the sequence and therefore does not automatically erase the signal.
That does not make token watermarks inherently stronger in every situation. Rewriting the words attacks the watermark directly, while signed metadata can describe provenance in ways a zero-bit token signal cannot.
Popular AI’s analysis of AI provenance as potential creator gatekeeping examines the broader control consequences when these technical systems become requirements for proving origin. The technical difference between metadata and watermarking becomes much more important once institutions start assigning consequences to either one.
More on AI provenance:
There is no single design for AI text watermarking
Red-green watermarking and SynthID receive much of the attention because the first is easy to explain and the second has reached large-scale production. Research covers several other ways of placing and recovering signals from text.
The main difference is the control point. Some watermarks operate inside generation, others modify completed text, and still others encode information through sentence-level or semantic choices.
▪ Generation-time statistical watermarks change sampling
Red-green methods, Gumbel-based approaches, Tournament sampling and related techniques modify or control the token-sampling process while the LLM is generating its response. They can exploit thousands of small choices that already occur during autoregressive generation.
This approach can be efficient and mathematically clean when the model provider controls decoding. It is less convenient for a third party that receives only completed text from an API and has no access to the sampling process.
The deployment question therefore depends partly on who controls the inference stack. Hosted providers can modify their own samplers, while downstream developers using a closed generation API may have no such option.
▪ Post-generation watermarks change completed text
A watermark can also be inserted after the LLM has finished generating. The 2024 EMNLP paper PostMark describes a black-box method that inserts an input-dependent set of words after generation without requiring access to the model’s logits.
That control point makes post-processing useful to organizations that do not own the underlying model. A third party can receive ordinary generated text and then apply its own watermarking procedure.
The tradeoff is easy to understand. Once generation is complete, the watermarking system has to modify a finished piece of writing, so its choices can directly affect wording, style or meaning.
Post-generation systems therefore face their own quality-versus-detectability problem. They simply encounter it at a different point in the pipeline.
▪ Semantic watermarks can encode information through paraphrasing
Token-level sampling is not the only place to create a signal. Researchers have also investigated watermarks that operate across sentences or semantic alternatives.
A 2025 ICML paper demonstrated multi-bit text watermarking using specially trained LLM paraphrasers. Its system uses different paraphrasing behavior to encode binary information at the sentence level and then trains a decoder to recover those bits.
This kind of design is interesting because ordinary synonym replacement attacks the surface token sequence directly. A watermark represented through larger semantic choices may survive some transformations that quickly disrupt a token-level pattern.
There is no free durability. A sufficiently strong transformation can still change the decisions on which the detector relies, and the watermarking system must preserve the intended meaning while encoding its signal.
Secret-key watermarks are not automatically cryptographically secure
Some watermarking research starts from stronger security definitions. The 2024 COLT paper Undetectable Watermarks for Language Models describes constructions designed so that an observer without the secret key cannot efficiently distinguish the watermarked output distribution from the original one under cryptographic assumptions.
That is a stronger and more specific claim than saying a system happens to use a secret key. Cryptographic security depends on the construction, assumptions, threat model and implementation.
A production watermark can use keyed pseudorandom behavior without satisfying every security property studied in cryptography. The practical vocabulary therefore needs some discipline.
“Secret” tells you who is supposed to know a value. It does not by itself tell you what an attacker can infer, whether the key can be stolen through queries or whether the implementation meets a formal definition.
Zero-bit and multi-bit watermarks answer different questions
Claude’s described implementation is essentially a zero-bit provenance watermark. The detector is looking for the presence of a known signal rather than decoding a rich hidden message.
Its question is roughly:
Is this passage statistically consistent with having passed through this watermarked generation process?
That is useful even if the watermark contains no customer identifier, timestamp or conversation number. The presence of the signal is itself the information being detected.
▪ Multi-bit watermarks can do more. They encode a payload that the detector attempts to recover from the generated text.
A 2025 USENIX Security paper on provably robust multi-bit watermarking studies longer embedded messages for applications such as source tracing. A payload could theoretically represent information such as a model version, deployment or user identifier, depending on how a system is designed.
That capability creates different privacy and governance questions. A zero-bit signal saying “this system was involved” is not equivalent to a watermark carrying an identifier.
Anthropic explicitly says its Claude watermark does not encode the user, organization or chat. That statement describes Anthropic’s implementation and should stay attached to it rather than becoming a general claim about the entire field.
A detected watermark proves less than “AI wrote this”
What does a detected watermark actually prove? The strongest interpretation of a watermark result is usually the wrong one. A detector sees statistical evidence associated with a generation process, not the complete history of a document.
A positive result does not by itself establish:
that Claude or another detected system originated every idea
that the submitted passage is unchanged from the generated output
that no human substantially rewrote or reorganized the material
that a particular person personally used the detected model
that the named author made no meaningful contribution
that the resulting content is false, plagiarized or low quality
Those are different claims about authorship, workflow, responsibility and quality. Token-level provenance cannot reconstruct all of them from the final wording.
▪ A human could write a document and ask Claude to translate it. A writer could produce a rough draft, use Claude for restructuring and then edit the result extensively.
▪ Someone could also generate several paragraphs and combine them with human-written sections. All of those workflows can produce some amount of watermarked text while representing very different kinds of human involvement.
The inverse error is just as serious. A failed watermark detection does not prove that a document was written without AI.
▪ The text may come from another model, an unwatermarked deployment or an older system. It may have been heavily rewritten, or the sample may simply be too short and constrained to provide enough evidence.
A watermark can support a provenance claim about a particular generation system. It cannot provide a complete account of authorship from the final prose alone.
Editing can weaken an AI text watermark without touching metadata
Because a generative text watermark is encoded through token choices, changing those choices is the obvious route to weakening it. The practical question is how much text must change before detector confidence falls.
Google says SynthID-Text can remain detectable after cropping, changing a few words and mild paraphrasing, while thorough rewriting or translation can substantially reduce detector confidence. That behavior follows directly from the way evidence accumulates across token positions.
A small edit disturbs only part of the sequence. Much of the original watermark evidence can remain elsewhere in a long passage.
A thorough rewrite is different. If most of the tokens and their surrounding contexts change, the detector loses many of the relationships created during the original generation.
Translation can be particularly disruptive because the tokenizer, vocabulary and sequence are replaced across most of the document. Even when the meaning survives, the original token-level decisions may not.
A 2025 IEEE evaluation reported that SynthID-Text detectability could degrade under meaning-preserving paraphrasing, copy-paste modifications and back-translation. The exact result still depends on the attack, text length, detector threshold and quality constraints.
That is why a universal rule such as “change 20 percent of the words and the watermark disappears” is not useful. Two edits affecting the same number of words can disrupt very different amounts of detector evidence.
An indestructible text watermark runs into a deeper language problem
The weakness is not simply that current engineers have failed to design a strong enough watermark. Natural language itself gives an attacker many ways to preserve useful meaning while changing surface form.
A passage can be shortened, expanded, reorganized, translated, paraphrased, turned into bullet points and reconstructed as prose. Each transformation changes the token sequence and can move the text farther from the statistical decisions made during the original generation.
The ICML 2024 paper Watermarks in the Sand formalized limits on strong watermarking under assumptions that give an attacker access to quality-preserving perturbations. Under those assumptions, the authors show that a strong watermark that cannot be erased without significant quality degradation is impossible.
Their experimental attacks also removed several studied LLM watermarks while keeping the resulting text reasonably close in quality. The result does not imply that every watermark vanishes after trivial editing.
It sets a boundary on the security promise. Text watermarking can make provenance easier to detect during ordinary use and can raise the effort required to hide generation history.
It cannot make prose behave like a permanently serialized physical object. As long as meaning can be re-expressed, an attacker has room to search for another sequence.
Attackers can try to forge a watermark as well as remove it
Removal is only one side of the security problem. A detector used to identify AI-generated writing creates an incentive to make unrelated text appear watermarked too.
That attack is usually called spoofing. If a detector result can trigger moderation, an academic investigation or another consequence, an attacker may want to frame human-written or rival-model text as coming from the protected generator.
One route is to query a watermarked system repeatedly and learn correlations between contexts and its preferred outputs. The attacker does not necessarily need to recover the provider’s literal secret key if they can approximate enough watermark behavior to influence detector scores.
Researchers demonstrated this pressure in Watermark Stealing in Large Language Models, where an automated attack approximately reverse-engineered studied watermark behavior and used it for both scrubbing and spoofing. In the experiments, attacks costing under $50 achieved average success rates above 80 percent against the evaluated schemes.
That result should stay tied to the schemes the researchers tested. It does not establish that Claude’s current production watermark can be defeated for $50.
It does show why secrecy alone cannot end the security discussion. A deployed model can become an oracle that reveals information about its watermark through repeated outputs.
Detector access becomes part of the security design
A provider also has to decide who can run its detector. That choice affects independent verification, key exposure, attack research and the practical power of the organization controlling the detection service.
There are three broad deployment options:
keep the detector private
expose detection through a controlled API while keeping the internals private
publish the detector for others to run
A private detector gives the provider tight control over the key and implementation. The cost is that everyone else must trust the provider to perform the test correctly and describe its result accurately.
An API offers wider access while preserving some control. The provider can authenticate users, impose rate limits, monitor unusual query patterns and change the service without distributing the key.
A public detector makes independent verification easier. It can also reveal more information to researchers and attackers trying to understand or imitate the watermark.
Anthropic currently sits toward the controlled end of that spectrum. As of September 15, 2026, its Claude watermark detector is in private preview for specified eligible organizations, including regulators, law enforcement, media, fact-checkers, researchers, educational organizations, civil-society groups and some enterprises with relevant compliance needs.
Anthropic says it plans to expand access over time. Until then, the detector is itself a controlled part of the provenance system rather than an open tool anyone can run locally.
Claude’s watermark does not mean Anthropic has a database of everything you wrote
Another misleading mental model treats the watermark as a serial number tied to an account. Under that model, Anthropic would receive a paragraph, find its hidden identifier and look up who generated it.
That is not how the described text watermark works. The detector examines the submitted token sequence for statistical agreement with a secret keyed pattern.
Anthropic says the watermark carries no information identifying the individual user, organization or chat. The detector therefore cannot recover those details from the watermark payload because the described watermark does not contain them.
That privacy property also limits attribution. A positive detector result may indicate that Claude’s marked generation process touched enough text to leave evidence, but the watermark itself does not tell the detector who submitted the prompt.
Separate service logs are a different matter. A hosted platform may retain account, request or operational records according to its own policies, but those records should not be confused with information encoded in the watermark.
Watermarking and platform logging are separate control points. One operates through the generated token sequence, while the other depends on what the service records about its users and requests.
The EU AI Act explains why Claude watermarking arrived now
Anthropic’s rollout is happening as the EU’s AI-content transparency rules become applicable. Article 50(2) requires providers of systems that generate synthetic audio, images, video or text to ensure relevant outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.
The obligation is qualified by technical feasibility, the content type, implementation cost and the generally acknowledged state of the art. The law also provides an exception where the AI system performs standard editing or does not substantially alter the user’s input or its meaning.
The European Commission’s final Code of Practice on Transparency of AI-generated Content provides a voluntary route for demonstrating compliance with the Article 50 transparency obligations. The underlying legal obligations began applying on August 2, 2026.
The law does not require providers to use SynthID specifically. Different media support different technical approaches, including watermarks, metadata and other forms of provenance marking or detection.
Anthropic chose a version of SynthID-Text for its text-generation system and initially applied marking globally rather than only to EU users. That means users outside Europe can encounter a technical change driven in large part by European regulation.
Popular AI’s guide to the EU AI Act’s AI-content labeling rules covers the wider marking and disclosure requirements, including the exceptions that prevent the law from becoming a universal label on every AI-assisted edit. Those legal details matter because watermarking is only one part of a much broader transparency regime.
More on the EU AI Act:
The strongest benefit of watermarking is generator-specific evidence
Ordinary classifiers ask whether a passage resembles the kinds of text they learned to associate with machine generation.
A provider watermark can ask whether the passage contains a deliberate signal associated with a particular generation process.
That is a cleaner technical question. It avoids relying on folklore about neat paragraph structures, transition phrases, punctuation habits or words people happen to associate with AI.
A secret-key detector is not looking for whether the writer “sounds like Claude.” It is looking for correlations the generator intentionally created while choosing tokens.
When enough signal survives, this gives a positive result a more specific interpretation than a general AI classifier can offer. The result can connect the text to a cooperative watermarking system rather than to a broad stylistic category.
That advantage disappears when no compatible watermark was inserted. The method is powerful inside its own coverage area and silent outside it.
The biggest risk is turning provenance evidence into an authorship verdict
A detector result can be technically accurate while the institution using it asks the wrong question. That problem becomes especially serious when schools, employers, publishers or platforms treat provenance as equivalent to misconduct.
Suppose a detector reports very strong evidence that Claude touched a passage. The score still cannot tell you why Claude touched it.
A human author may have asked for translation. They may have supplied a complete draft and requested line editing, or used the model to restructure paragraphs before rewriting the result again.
Another author may have generated most of the first draft and then performed extensive reporting, fact-checking and editing. Those workflows involve very different amounts of human work even if enough watermarked text survives to trigger the same detector.
The watermark sees token history. It does not see notebooks, interviews, source files, drafts, editorial comments or the reasoning that led to the final argument.
That evidentiary gap is why institutions need a workflow for interpreting detector results rather than a threshold that automatically becomes a verdict. Popular AI’s analysis of the evidentiary pressure placed on human creators when “human-made” claims require paperwork examines the same problem from the creator side.
A positive watermark result can justify a question about provenance. It cannot substitute for answering that question.
More on AI content detection:
Local AI changes who controls the watermark switch
Running a model locally does not make text watermarking technically impossible. The same decoding-layer techniques can be applied to compatible models running on hardware you control.
Google, for example, has released an open-source reference implementation of SynthID-Text that can be applied to compatible local language models.
A local operator could deliberately configure watermarking and keep their own key. Developers could also use an open implementation as part of a self-hosted generation service.
The practical difference is control over the generation stack. With a hosted model, the provider operates the sampler and can change watermarking behavior without exposing a setting to the user.
With an open local model and a modifiable runtime, the operator generally controls decoding. They can inspect whether a watermarking processor is present, decide whether to enable it and choose which configuration their own system uses.
That does not make local inference automatically private, secure or trustworthy. It does move an important control point from the service provider to the person or organization operating the model.
Popular AI’s local AI guide covers the broader tradeoffs around models, privacy, hardware, APIs and reducing dependence on hosted providers. Watermark control is one more example of the difference between capability you operate and capability you rent.
More on local AI and privacy:
Writers should preserve workflow evidence, not try to write for a detector
Writers and publishers should not treat a watermark as a complete description of authorship. If provenance could later become contentious, drafts, notes, source files and revision history can explain the production process in ways a statistical score cannot.
Trying to edit prose merely to satisfy a detector is a bad substitute. It turns the detector into an unofficial style guide and can encourage people to distort perfectly good writing because an automated system dislikes its statistical profile.
Developers should also keep watermarking separate from general AI classification and signed provenance metadata. The technologies answer related questions but have different failure modes, control points and security assumptions.
Organizations using detector results need thresholds calibrated for the actual watermark and sample lengths they expect to evaluate. They also need an appeals process before a probabilistic result is attached to consequences such as plagiarism, fraud or misconduct allegations.
Local AI users have a different question to ask: who controls the sampler? For generation-time watermarks, control over decoding is often control over whether this class of signal is inserted at all.
The asymmetry should stay visible throughout all of these use cases. Detecting a valid watermark can provide evidence that a particular generation system was involved, while failing to detect one cannot prove that AI was absent.
FAQ about AI text watermarking
Can a human see an AI text watermark?
No. Generative token watermarks are statistical patterns created through token-selection decisions, so there is normally no visible mark for a reader to inspect. The text can look completely ordinary while a compatible detector measures its relationship to a secret key.
Does copying and pasting Claude text remove the watermark?
Plain copying preserves the words and therefore generally preserves the token sequence carrying the signal. Editing can weaken that signal, but moving unchanged text from one application to another does not inherently erase a generative watermark.
Does Claude’s watermark identify my account?
Anthropic says its current watermark does not encode the individual user, organization or conversation. That means the watermark itself is not described as a hidden account identifier, although separate service logs are a different system.
Can a normal AI detector detect Claude’s watermark?
Not merely by being a general AI-writing classifier. A watermark detector needs the relevant detection mechanism and configuration, while ordinary AI detectors generally estimate whether linguistic patterns resemble text associated with machine generation.
Can paraphrasing remove an AI text watermark?
Enough rewriting can sharply reduce detectability because it changes the tokens and contexts carrying the original signal. Mild paraphrasing may leave substantial evidence intact, so there is no reliable universal percentage of words that guarantees removal.
Are local LLMs automatically free of watermarks?
No. A local generation stack can implement the same class of watermarking techniques if its operator chooses to do so. The practical difference is that someone controlling an open local runner can normally inspect and change the decoding mechanism instead of accepting a hosted provider’s configuration.
AI text watermarking is provenance evidence, not authorship proof
AI text watermarking works because natural-language generation contains thousands of small decisions. A model does not need to hide a secret phrase in your paragraph when it can make enough ordinary token choices according to secret-keyed randomness for a detector to recognize the resulting pattern later.
Red-green watermarking made that mechanism easy to see. SynthID-Text pushed the same general idea toward production by using Tournament sampling, which lets plausible candidates from the model’s own distribution compete according to keyed scores.
The result is considerably more credible as provenance evidence than hunting for stereotypical AI wording. A compatible detector is looking for a deliberately planted relationship between tokens and a secret process, not a writing habit that humans can share.
The limitations are equally concrete. Short text contains little evidence, low-entropy text gives the generator fewer harmless choices, and code or exact factual answers constrain the watermark further.
Heavy rewriting can destroy the pattern. Translation can replace most of the relevant sequence, and an attacker may also try to study the watermark well enough to scrub or spoof it.
A positive result still cannot tell you who authored every idea, how much a human rewrote, whether the content is accurate or whether using the model violated any rule. Those are separate questions that require evidence about workflow rather than token statistics alone.
The real control points are therefore the key, the generation stack, detector access, detection thresholds and the institutions deciding how much a positive score is allowed to prove. Text watermarking can make AI provenance more specific, but it does not turn authorship into a binary property that a detector can recover from finished prose.
Explore more from Popular AI:
Start here | Local AI | Builds & gear | Autonomy & policy | Fixes & guides | Popular AI podcast