How AI text watermarking works, ELI5
Claude now hides an invisible mark in everything it writes. Not in the letters. In the choices between words.
A watermark in plain text sounds impossible. There are no pixels to hide data in, and no metadata survives copy-and-paste. Every character is right there in front of you. So where could a mark possibly go?
And yet it’s real, it’s shipping, and it’s in text you’ve probably already read. Google has watermarked Gemini app text since 2024. As of August 2026, Claude marks text at the model level too. It survives copying. It survives retyping. And it works because it doesn’t live in the characters at all.
Here’s the whole thing in plain English, with two demos you can poke at.
The short version
| Question | Answer |
|---|---|
| Where is the mark hidden? | In which words got picked, not in the characters. |
| Can I see it? | No. Nothing is added to the text. |
| Does copy-paste remove it? | No. Neither does retyping it by hand. |
| Does light editing remove it? | No. It only gets quieter. |
| What does remove it? | A genuine rewrite that shares no phrasing. |
| Can GPTZero or Turnitin see it? | No. They have no key. Different tech entirely. |
| Can I check my own text? | Not yet. No public detector exists. |
| Does a hit mean I cheated? | No. It means Claude touched the text. |
1Writing is picking tickets out of a hat
The one idea: when several words would all work fine, the model just picks one at random. Nobody notices which.
When a model is mid-sentence, it doesn’t know “the next word.” It has a shortlist, like autocomplete, with preferences attached.
Imagine a hat with 100 raffle tickets in it. Forty say important, thirty say significant, twenty say substantial, ten say notable. Reach in, pull one out. That’s your word.
Press Roll once below a few times. Notice the thing that never changes: every single pull makes a perfectly good sentence.
The results of the study were quite ____
The nudge here is drawn strong so you can see the bars move. A real watermark leans far more gently, closer to 52 to 55% green.
One caveat about the numbers above: a near four-way tie like this is the minority case. Most word choices are far more lopsided than this, often 90% or more on a single option. After something like “the capital of France is” it’s closer to 99%. This slot is one of the genuinely open ones, which is exactly why a watermark can hide here and not everywhere.
A page of text contains hundreds of these little forks, one per word. At many of them, several options are equally fine. That slack is wasted space. Normally it just gets thrown away on a random number generator.
Whoever gets to lean on how those tickets come out can hide a pattern in the text without changing what it says.
2A secret key stuffs extra tickets in the hat
The one idea: the key quietly picks half the words as “green” and adds extra tickets for them. The sentence still reads normally.
Now go back up and press Apply the secret key.
The key does some secret maths and declares two of the four words green. Then it drops extra copies of those two into the hat. Nothing is removed. The hat just gets fuller on one side.
Watch what happens to significant. It falls from 30% to about 14%. But it still has exactly its original 30 tickets. It didn’t lose anything. It just got outnumbered, because the hat grew from 100 tickets to over 200.
| Word | Tickets before | Tickets after | Odds |
|---|---|---|---|
| important (green) | 40 | 112 | 40% → 54% |
| significant (red) | 30 | 30 | 30% → 14% |
| substantial (green) | 20 | 56 | 20% → 27% |
| notable (red) | 10 | 10 | 10% → 5% |
Two things make this sneaky.
- •The nudge is mild. A red word can still win, it’s just a little less likely. In the demo, red still wins about one roll in five. That’s deliberate. If green always won, the writing would suffer and the key would be trivial to reverse-engineer.
- •Green isn’t a property of a word. The key computes the colouring from the few words just before it. So important is green after one phrase and red after another. There’s no list of green words to steal, because no such list exists.
This is also why the model never writes anything odd. If the key colours a nonsense word green, the boost is far too small to overcome the model’s own near-zero preference for it. The whisper simply gets ignored, and that position carries no mark at all.
3Whoever holds the key can just count
The one idea: with the key you can re-colour any text and count. Marked text lands green too often to be luck.
Detection doesn’t read the text or judge its style. It replays the key’s colouring over the words and counts how many came up green.
Without a mark, or with the wrong key, green should win about half the time. A coin flip. Watermarked text lands consistently above that line.
And here’s the part that surprises people: nothing is stored anywhere. There’s no database of everything Claude has ever written. The only thing kept is one short secret key.
Think of asking someone “what is 7 × 8?” They don’t look it up in a book of every multiplication ever performed. They just redo the sum, and get 56 every time. The colouring works the same way: feed in the key plus the words, out comes green or red, identically, forever. So when text is submitted for checking, the colours aren’t recalled. They are recreated on the spot.
That makes it far more private than the obvious alternative. Anthropic can tell you a text bears their mark while having no record of what you generated, when, or who you are.
4Why a sentence proves nothing and an essay proves everything
The one idea: the lean is always the same tiny size. Only the pile of evidence gets bigger.
A real watermark is far gentler than the demo above. It shifts green from 50% to something like 55%. On one sentence that is meaningless. Flip five coins and getting four heads happens about one time in five.
Drag the slider. The lean stays at 55% the whole way. Only the length changes.
The lean never changes. It stays at 55% green on every setting, and only the amount of text moves. That is the whole reason a sentence proves nothing and an essay proves everything.
This is the single most important thing to understand about AI watermarks, and it cuts both ways. Long documents are damning. Short ones (captions, comments, chat messages, a paragraph of an email) carry almost nothing usable.
The same logic explains why code is nearly unmarkable. A watermark needs positions where several outputs would be equally correct, and code rarely offers any. Anthropic notes the mark may only appear in genuinely arbitrary choices, like the wording of a comment. Quotations, lists of facts and numbers have the same problem.
5What editing actually does to it
The one idea: the mark lives in runs of untouched wording. It dies exactly where those runs break, and nowhere else.
Each word’s colour is computed from the handful of words just before it. So a position only counts as evidence if a short window of the original wording survives intact.
Change one word and you break more than that word. You also scramble the colouring of the next few words after it, because their run-up just changed. One swap knocks out maybe four positions rather than one.
That sounds promising until you do the arithmetic. To flatten a 1,500-word document you would need to change roughly one word in four, spread evenly throughout. That isn’t tweaking. That’s rewriting.
And you’re working blindfolded. You can’t see which words are green, so half your swaps accidentally add evidence rather than remove it. Research on this is blunt: after strong human paraphrasing, meaning real people rewriting in their own words, the mark was still detectable after about 800 tokens, roughly 600 words.
What genuinely removes it is re-composition that shares no runs of wording with the original. Anthropic says as much: a complete rewrite where every word is replaced will remove it, and fairly points out that such text is arguably not AI-generated any more. There’s no clever shortcut in the middle.
This isn’t what GPTZero and Originality.ai do
This is the most confused point in the entire topic, so plainly: Originality.ai, GPTZero, Copyleaks, ZeroGPT and Turnitin can’t read watermarks. They have never had a key and never will.
They do something completely different: guessing from writing style. Perplexity asks how predictable your text is. Burstiness asks whether your sentence lengths vary the way a human’s do. Newer versions use a trained classifier, but the idea is the same: does this look like AI?
| Watermark check | Style detectors | |
|---|---|---|
| What it measures | A planted signature, counted | Whether prose seems robotic |
| Needs a secret key | Yes | No |
| Who can run it | Only the AI provider | Anyone, for a few dollars |
| Is it evidence? | Yes. Real maths, stated error rate | No. A vibe with a number on it |
| Fooled by | A genuine full rewrite | Writing plainly. Being ESL. |
| Available today | No | Yes, widely sold |
The difference matters because style guessing causes real damage. A 2023 Stanford study ran these detectors on TOEFL essays by non-native English speakers and found 61.3% were falsely flagged as AI. Not because those students cheated, but because clear, simple, careful English is exactly what these tools score as machine-like.
A watermark can’t make that mistake. It isn’t judging your style. It’s counting whether a specific secret pattern is present. If you wrote the text, it simply isn’t there, however robotic your prose sounds.
The irony is sharp: the honest version of the technology is locked behind a key with no public detector, while the unreliable version is on sale right now and being used on students today.
What this actually means for you
- •Only the key-holder can check. Your teacher, editor or favourite detector website can’t run this test. Anthropic has said a detection API is coming but hasn’t shipped one. Anything claiming to detect Claude’s watermark today isn’t doing so.
- •A hit means “processed by”, not “written by”. Anthropic’s own documentation notes that text you wrote yourself, then asked Claude to proofread or translate, picks up the mark. That’s the part people are right to find unfair.
- •Absence proves even less. Older models, short text, code or heavy editing all produce clean results on genuine AI output.
- •It isn’t costing anyone much. Generating text needs GPUs. Detecting needs hashing on a CPU, so milliseconds, with no model involved. The reason there’s no public detector isn’t cost. It’s that an unlimited free checker doubles as a removal tool: edit, check, edit, check, until it reports clean.
- •The mark didn’t make Claude write worse. Google’s SynthID tournament design is built to leave the output distribution mathematically unchanged, and their Nature paper found no significant difference in user feedback across nearly 20 million Gemini responses.
Is this actually proven, or vendor marketing?
Genuinely proven, and unusually well for something this new. The original scheme was published at ICML 2023. SynthID-Text appeared in Nature in 2024, including the first large-scale live deployment of a text watermark. The robustness follow-up was published at ICLR 2024. Google then open-sourced the implementation, so anyone can reproduce it.
What isn’t settled is how well it survives determined attack.
That fight is live in the literature and always has been. The Nature authors say it themselves: detector accuracy drops considerably when text is rewritten thoroughly. Nobody serious claims the mark is unremovable.
So: “you can hide a statistical signature in word choice without hurting the writing” is proven, peer-reviewed and shipped to millions. “And it can’t be washed out” isn’t claimed by anyone, including the people who built it.
Frequently asked questions
It's a statistical pattern hidden in which words the AI chose, rather than in the characters themselves. At every point where several words would work equally well, a secret key gently tilts the model toward one half of the options. Over a long piece of text that half wins slightly too often, and anyone holding the key can prove it by counting.
Yes. Anthropic confirmed that every Claude model launched on or after 2 August 2026 embeds an imperceptible watermark, with older models being retrofitted. It applies across the Claude API, claude.ai, Claude Code, Claude Cowork and Claude Tag, including Claude accessed through AWS, Google Cloud and Microsoft Foundry. It's applied worldwide, not only in the EU.
No. There's nothing to see. It isn't hidden characters, zero-width spaces, unusual punctuation, or metadata. Every character in the text is exactly what it appears to be. The mark exists only as a statistical lean across hundreds of word choices, which is invisible to a reader by design.
No. Those tricks target a different and much older kind of watermark. Because this mark lives in the words themselves, retyping the text by hand reproduces it perfectly. Copying, pasting, changing fonts, converting to PDF or stripping all formatting leaves it fully intact.
No, and this is the most confused point in the whole topic. Those tools have never had access to any provider's secret key and cannot read a watermark. They guess from writing style, using signals like perplexity and burstiness. A watermark check is a key-gated statistical test. A style detector is an educated guess. The two are completely unrelated technologies.
Poorly, and unevenly. A 2023 Stanford study found style-based detectors falsely flagged 61.3% of TOEFL essays written by non-native English speakers, because clear, simple English produces the same low-perplexity signature they associate with AI. GPTZero has since added de-biasing. Most competitors haven't. A real watermark check can't make this mistake, since it counts a planted pattern instead of judging your prose.
Not yet. Detection requires Anthropic's secret key. Anthropic has said a watermark detection API is coming but hasn't shipped it or given a date. Google runs a gated early-access portal for SynthID rather than a public API. Any website today claiming to detect Claude's watermark is not doing so.
Mostly security, not cost. An unlimited free detector doubles as a removal tool, because anyone could edit, check, edit, check, until it reports clean. That feedback loop hands attackers exactly what they need. Working out how to let teachers and editors verify text without giving cheaters an iteration oracle is an unsolved design problem.
Light editing doesn't. The colouring of each word is computed from the few words just before it, so a position only stops counting once a short run of the original wording is broken. Fixing typos leaves the mark essentially intact. Research found that even strong human paraphrasing left the mark detectable after roughly 800 tokens, about 600 words.
Re-composition that shares no runs of wording with the original, meaning you genuinely rewrite from the meaning instead of swapping words. Anthropic states plainly that a complete rewrite where every word is replaced will remove it, and adds the fair point that such text is arguably no longer AI-generated. There's no clever shortcut between light editing and a real rewrite.
It depends entirely on how much of Claude's wording survives. A light paraphrase leaks chunks of the original phrasing, and every surviving chunk still counts, so the mark gets diluted rather than deleted. A genuine regeneration from the meaning produces the second model's own word choices, which carry no trace of Claude's key.
No. Anthropic is explicit that a detected mark means the content may have been processed by Claude, not written by it. Text you wrote yourself and then asked Claude to proofread, translate, summarise or reformat picks up the mark. Absence proves even less, since older models, short text and heavy editing all yield clean results on genuine AI output.
Barely. Evidence accumulates with length. A single sentence offers only a handful of genuine word choices, and picking up a few extra greens by luck is completely ordinary. Confident detection generally needs hundreds to thousands of words, which is why short messages, captions and comments are effectively unmarkable.
Very poorly, and Anthropic says so directly. Watermarking needs positions where several outputs would be equally correct, and code rarely offers any, because the syntax usually admits one right answer. Anthropic notes the mark may only appear where there's an arbitrary choice of wording, such as inside comments or variable names.
The evidence says no. Google's SynthID-Text uses a tournament design that's non-distortionary, meaning that averaged over keys, the output distribution matches what the model intended. Their Nature paper compared user thumbs-up and thumbs-down feedback across nearly 20 million Gemini responses, watermarked versus not, and found no significant difference.
No, and this is the elegant part. There's no database of outputs. The only thing stored is a single secret key. When text is checked, the colouring gets recomputed from scratch using the key and the text itself. It was never recorded anywhere. That makes the watermark far more private than the obvious alternative of fingerprinting every generation.
The immediate trigger is Article 50 of the EU AI Act, enforceable from 2 August 2026, which requires providers of generative AI to embed machine-readable marks in their outputs, text included. Anthropic applies the mark globally rather than only in the EU. Google has watermarked Gemini app and web text since 2024.
Not publicly, as far as anyone outside OpenAI can tell. Scott Aaronson built a watermarking scheme at OpenAI in 2022 and it's one of the three foundational designs, but OpenAI has never confirmed shipping it. OpenAI also shut down its own style-based AI Text Classifier in 2023 for poor accuracy.
For Claude, yes. Anthropic's coverage explicitly includes the Claude Platform API. Google is the notable contrast: SynthID is applied to the Gemini app and web experience, and the Gemini API is a documented exception. So the answer differs by provider, and it's worth checking rather than assuming.
It's genuinely peer-reviewed. The original green/red scheme was published at ICML 2023, SynthID-Text appeared in Nature in 2024 with a large-scale live deployment, and the robustness follow-up was published at ICLR 2024. Google also open-sourced SynthID-Text, so anyone can reproduce it. What remains contested isn't whether it works, but how well it survives determined attack.
References
- 1.Anthropic: How Claude’s text watermarking works
The primary source on Claude’s scheme, published 14 August 2026.
- 2.Anthropic Help Center: How Claude marks AI-generated content
Coverage, C2PA file metadata, and the “processed by, not written by” wording.
- 3.Dathathri et al.: Scalable watermarking for identifying LLM outputs
SynthID-Text. Nature, 2024. Includes the ~20 million response live quality test.
- 4.Kirchenbauer et al.: A Watermark for Large Language Models
ICML 2023. The original green/red list scheme the demos above are based on.
- 5.Kirchenbauer et al.: On the Reliability of Watermarks for LLMs
ICLR 2024. Source of the ~800 token figure after strong human paraphrase.
- 6.Sadasivan et al.: Can AI-Generated Text be Reliably Detected?
The counterargument: paraphrase attacks against watermark detection.
- 7.Liang et al.: GPT detectors are biased against non-native writers
The Stanford study behind the 61.3% TOEFL false-positive figure.
- 8.google-deepmind/synthid-text
The open-source implementation. Run it yourself.
- 9.declaude.org: How AI text watermarking works
An excellent interactive explainer that prompted this piece. Note that it accompanies a product which rewrites text to strip the mark.
Credit: this piece was inspired by declaude’s visual guide to text watermarking by James Padolsey, which is well worth reading. I’ve rewritten the explanation from scratch for a non-technical reader and verified the claims against the primary sources above. Worth knowing that the original accompanies a product which rewrites text to strip the mark.
The interactive figures above are a teaching model with deliberately exaggerated parameters, not any provider’s actual scheme. Claude uses a version of SynthID-Text, which reaches the same end by a subtler tournament-sampling route rather than the green/red nudge shown here.