How AI text watermarks work
An AI text watermark is a hidden statistical pattern in a model's word choices. While the model writes, a secret key nudges it toward certain words at each step. A reader sees ordinary prose. A detector holding the same key counts how strongly the pattern appears and reports a confidence. Google has done this in Gemini since May 2024, Anthropic announced it for Claude in August 2026, and OpenAI announced textGrain in October 2026. All three are variants of one idea, and all three share the same limits: the signal needs a few hundred words to be reliable, it fades as text is edited, and only the provider can check it.
Where the mark lives
A language model writes one token at a time, and at each step it has a probability for every possible next token. Most of the time several candidates are fine. "The results suggest" and "The findings indicate" mean the same thing. A watermark exploits that freedom. A keyed function looks at the last few tokens and marks some candidates as preferred; the model's sampling is tilted toward them. Because the choice between good candidates was arbitrary anyway, the text does not get worse. Google's Nature paper on SynthID-Text reports a live test across about 20 million Gemini responses with no measurable drop in quality, and OpenAI published benchmark scores for its models with and without textGrain that sit within normal variation.
The first practical scheme, from Kirchenbauer and colleagues at the University of Maryland in 2023, split the vocabulary into a green list and a red list at each step and nudged the model toward green. SynthID-Text refines that with tournament sampling, where candidate tokens compete in rounds judged by keyed random functions. The refinements change how strong the signal is per token and how little the text is distorted, but the detection logic is the same: count the pattern, compute how unlikely that count would be by chance.
Why length is everything
One tilted word choice proves nothing. A hundred of them, all leaning the same way, is hard to explain except by the key. Detection confidence therefore grows with the amount of marked text. OpenAI's numbers make this concrete: at a 1 percent false positive target its detector found textGrain in about 95 percent of 400-token passages but only about 80 percent of 200-token passages, and far fewer in mathematics, where the model has little freedom in word choice. A single sentence, a code snippet, a list of facts or a short email is usually undecidable, and the providers say so.
Why editing weakens it
Every word a person changes removes one tilted choice from the count. Light proofreading leaves most of the pattern. Heavy editing removes much of it. A full rewrite in new words removes it entirely, because none of the surviving words were chosen by the model. Anthropic's announcement puts it in one sentence: light editing probably will not remove the watermark completely; a complete rewrite where every word is replaced will. OpenAI measured the slope: replacing 10 percent of words with synonyms dropped detection on 400-token passages from about 92 to 66 percent, and replacing 25 percent dropped it to 17 percent. The separate guide on paraphrasing and watermarks covers the research.
Who can check
Detection needs the key, and the key belongs to the provider. There is no public button. Google offers a SynthID detector portal for images, audio and video, and the open-source text library detects only marks made with your own key. Anthropic's detection API is in private preview for regulators, law enforcement, media, fact-checkers, researchers, educators, EU civil society groups and enterprises with their own compliance duties. OpenAI grants textGrain detector access case by case to approved researchers and expert organisations. Each says access will widen as the technology matures. For a teacher or an editor in late 2026, the practical consequence is that provider watermarks are not yet something you can use.
What a positive result means
All three providers are careful about this, and the care is worth repeating. A watermark indicates that a provider's model likely generated or processed part of a passage. It does not measure how much a person contributed, what the prompt was, whether the person edited and verified the text, or whether the text is accurate. The absence of a mark proves nothing either: the text may be too short, too edited, translated, written by a model that does not watermark, or written before watermarking began. Treat a watermark result as one signal about provenance, and never as a verdict about a person.
Why the marks arrived in 2026
Article 50 of the EU AI Act applies from August 2, 2026 and requires providers to mark generated output in a machine-readable, detectable way. The Commission's Code of Practice, final on June 10, 2026, interprets that as two layers: secured metadata plus a watermark, kept as non-removable as the provider can manage, with detection available to appropriate parties. Anthropic applied its mark globally because it had no way to scope by region. OpenAI chose the opposite: on by default only in the EU, opt-in elsewhere. Those two choices are why "is my ChatGPT output watermarked" has a different answer from "is my Claude output watermarked", and the model-by-model guide keeps the current answer.
Questions people ask
Is an AI text watermark a hidden character?
No. Zero-width characters and odd spacing are a different, fragile trick. Statistical watermarks live in the choice of ordinary words and survive copy and paste.
Can a watermark be seen by a reader?
No. The text reads normally. Only a detector with the provider's key can measure the pattern.
How much text does a detector need?
Providers quote results at 200 to 400 tokens, roughly 150 to 300 words. Shorter passages, and constrained text such as code or maths, are often undecidable.
Does a watermark prove a person did not write the text?
No. It indicates that a provider's model likely produced some of the words. It says nothing about how much a person planned, edited or verified.