A hidden statistical signal embedded in an AI model’s word choices as it writes, letting a detector later confirm the text was machine-generated.
Last verified · 2026-08-13 · by Moe Ameen
AI text watermarking is a technique that plants an invisible, machine-readable signal inside AI-generated writing at the moment it is produced, so the text can later be identified as coming from a model. Unlike a visible label or a file's metadata, the mark lives in the words themselves — in the specific pattern of tokens the model chose — which means it survives copy-paste, screenshots-to-text, and moving the text between apps that would strip any attached metadata.
The dominant approach works by nudging the model's sampling process. A large language model writes one token at a time, picking from a probability distribution over its vocabulary. A watermarking scheme uses a secret key to bias that choice — for example, tagging a pseudo-random "green" subset of the vocabulary at each step and slightly favoring it — in a way a reader cannot perceive but a statistical test can. To detect the watermark, you run that same test over a suspect passage: if the biased tokens appear far more often than chance would produce, the detector reports the text is likely machine-generated. Crucially, detection needs only the key and the text, not access to the original model.
Text watermarking is one branch of a broader AI-provenance effort. The other main branch is metadata-based provenance like C2PA Content Credentials, which attaches a cryptographic record of how a file was made. For images, audio, and video, metadata provenance is robust; for plain text it is fragile, because text is routinely retyped, quoted, and stripped of any wrapper. That fragility is exactly why in-content statistical watermarking exists — it is the only provenance signal that rides inside the prose itself.
The modern technique was defined in 2023 by Kirchenbauer and colleagues at the University of Maryland in "A Watermark for Large Language Models" — the green-list/red-list scheme that hashes the previous token to seed a favored subset of the vocabulary, adds a small bias to those logits, and detects the result with an efficient statistical test that needs no model access. It became the reference method the field builds on.
Google DeepMind productionized the idea as SynthID-Text, which modifies only the sampling step and preserves text quality with minimal latency. The algorithm was peer-reviewed and published in Nature (vol. 634) in October 2024, and DeepMind open-sourced it the same month, integrating it into Hugging Face's Transformers library so any developer could watermark and detect their own model's output.
OpenAI, by contrast, built a text-watermarking system it says was around 99.9% accurate in internal testing but chose not to release it. The company cited that it was easy to defeat by routing output through another model or a paraphraser, that a user survey suggested roughly a third of ChatGPT users would use the product less if it watermarked their text, and that detection systems can disproportionately flag non-native English writers. Anthropic moved the other way: surfacing in August 2026, it said new Claude models would embed an imperceptible watermark in generated text alongside C2PA provenance for files — one of the first major deployments of the technique in a consumer AI product.
| Platform | Behavior |
|---|---|
| Google (SynthID-Text) | The most mature public implementation. Watermarks by adjusting token-sampling probabilities, detects without the underlying model, and is open-sourced via Hugging Face Transformers. Robust to cropping, minor edits, and mild paraphrasing; confidence drops sharply under heavy rewriting or translation to another language. |
| OpenAI (ChatGPT) | Has a highly accurate text watermark built internally but has not shipped it, citing easy circumvention, projected user drop-off, and unfair impact on non-native English writers. ChatGPT text is not watermarked as of 2026. |
| Anthropic (Claude) | Announced in August 2026 that new Claude models embed an invisible text watermark plus C2PA provenance on generated files — a rare consumer deployment aimed at transparency and traceability. |
| Third-party AI detectors | Tools that estimate whether text is AI-written (perplexity/burstiness classifiers) are a separate category — they guess from statistical style rather than reading a planted key. A true watermark detector is decisive where it applies; a general detector is probabilistic and prone to false positives. |
| "Humanizer" rewriters | Paraphrasing tools exist specifically to scrub these signals. Light edits leave most watermarks intact, but a thorough rewrite or a round-trip translation degrades or removes them — which is the technique’s central weakness and why no scheme claims to be tamper-proof. |
Watermarking is easy to misread as a threat to anyone who uses AI to write. It is not. The platforms and the research both landed in the same place in 2026: the goal is provenance and disclosure, not a ban on assisted writing. A watermark answers "did a model help make this," and the honest answer for most working creators is "yes, and that is fine" — the thing that gets punished is pretending otherwise, not the tool.
So the practical stance is boring and correct: disclose AI use where it matters, and make sure the output is actually worth reading. That second half is where a content engine earns its keep. The failure mode a watermark can never fix is [AI slop](/glossary/ai-slop) — generic, default-voice output that reads like every other account running the same model. Kompozy attacks that directly: every generation runs through a [Persona Brief](/glossary/persona-brief) that owns your voice and banned-word list, then [quality gates](/glossary/quality-gates) that reject invented statistics and off-brand language before anything schedules. The point is not to dodge a watermark — it is to publish AI-assisted work you would happily label, across a blog, eight social platforms, and email, that sounds like you rather than the machine. Provenance you have nothing to hide from is the only durable position once detection is everywhere.
It is a technique that embeds a hidden, machine-readable signal into AI-generated text as the model writes it — inside the specific pattern of words chosen — so a detector with the right key can later confirm the text came from that model. Because the mark lives in the words rather than in attached metadata, it survives copy-paste and moving the text between apps.
The most common method biases the model’s token sampling with a secret key. At each step it favors a pseudo-random "green" subset of the vocabulary in a way a reader cannot perceive. To detect it, you run a statistical test over the suspect text: if those favored tokens appear far more often than chance allows, the text is flagged as likely machine-generated. Detection needs the key and the text, not the model.
Not as of 2026. OpenAI built a text-watermarking system it says was about 99.9% accurate internally but chose not to release it, citing easy circumvention, a projected drop in user engagement, and unfair impact on non-native English writers. Google’s SynthID-Text and Anthropic’s Claude watermarking are the notable deployments; most models ship no text watermark.
They can be weakened or removed, which is their central limitation. Light edits usually leave the signal readable, but thorough paraphrasing, running the text through another model, or translating it to another language degrades or scrubs the watermark. No published scheme claims to be tamper-proof — they are a transparency and deterrence layer, not a lock.
A watermark is a signal the model deliberately planted and reads back with a key, so it is close to decisive for text that model watermarked. An AI detector estimates whether text is AI-written from statistical style cues like perplexity, with no planted signal to read — it is probabilistic and can false-positive on human writing. They are different tools that people often conflate.
SynthID-Text is Google DeepMind’s production text-watermarking scheme. It modifies only the model’s sampling step, preserves text quality, and detects without needing the underlying model. Its algorithm was published in Nature in October 2024 and open-sourced the same month through Hugging Face’s Transformers library.