AI Models Are Watermarking Text—Will You Notice?

What happened

On 11 August, Anthropic announced that all future Claude models will generate text that contains a watermark that identifies its results as AI generated. The company is not alone. Google has its own text watermark (which Anthropic’s is based on) it uses on the output of its Gemini models. OpenAI has yet to introduce a text watermark but it plans to do so.

The model then picks a word at random, weighted by those numbers. The most probable word usually wins, but not always. “[A watermark] wouldn’t be detectable if there wasn’t a change. ” —John Kirchenbauer, Vector Institute This process provides an opportunity to hide a text watermark by introducing subtle changes to how words are selected.

The 2023 paper by Kirchenbauer and his colleagues provided one of the first examples of how to implement a text watermark, and it remains the most widely cited technique. The researchers describe a watermark which sorts words into a red list and a green list. The red-list words are unaltered, but the green-list words are nudged to be slightly more probable.

“If we sample from this modified distribution, then while any one token choice won’t necessarily come from that preferred set, over many samples, we’ll preferentially pick words from that up-weighted subset,” Kirchenbauer says. The text watermark is embedded in the choice of words used, which is why it is effectively invisible to humans. 4 percent, and zero false positives, in responses that contain about 200 tokens.

Why it matters

The rapid spread of watermarking is in part a response to the European Union’s AI Act, which mandates watermarks for AI models released after 2 August, 2026, along with other planned and proposed regulations aimed at curbing the spread of deceptive or manipulative AI-generated content. But the new rules may come at a cost for AI users who simply want the best possible results.

AI watermarks can apply to many forms of content: The EU AI Act also requires them for images, audio, and video. Such media watermarks have been in use for years, and while their effectiveness as a holistic solution to marking AI remains up for debate, they can achieve detection rates above 99 percent. Image and video watermarks are already deployed by OpenAI, Google, and Meta, among others.

Images consist of millions of pixels, he notes, whereas text responses often span just dozens or hundreds of words. Text seems to provide far less space to alter AI output in a way that is detectable yet not disruptive. John Kirchenbauer, postdoctoral fellow at the Vector Institute and co-author of a 2023 paper which was among the first to describe a text watermarking method, disagrees.

“[A watermark] wouldn’t be detectable if there wasn’t a change. This is a very fundamental point,” he says. ” Does watermarking AI-generated text meaningfully degrade the experience of the person using it? The answer is still under dispute. The term “watermark” is so familiar that it can cause confusion about how the technology works when applied to AI.

A text watermark is not metadata or invisible characters; it is something much more subtle. The exact details vary between methods, but text watermarks are generally impossible for a human (and, in many cases, even a computer) to detect without access to the specific key used to detect a specific watermark. Understanding why requires an understanding of how LLMs work.

An LLM produces a probability for every word that could come next at each step in its response to a prompt. (From here on, I’ll be using “words” interchangeably with “tokens,” although tokens also represent numbers, punctuation, and more). A likely word might get a 40 percent probability, a plausible alternative 10 percent, and an unlikely one a fraction of a percent.

What to watch

The embedded pattern of word probabilities also means that simple paraphrasing won’t obscure the watermark. The paper reports that removing the watermark from a long response requires changing roughly one quarter of its words or more. Although AI text watermarking is designed to be invisible to human readers, by definition it influences the word patterns in AI-generated text.

That algorithmic meddling is what makes critics like Gruber concerned that watermarking reduces the overall quality of the output. The strongest evidence that text watermarking doesn’t impact quality comes from a 2024 paper by a team from Google, which introduced the company’s watermarking scheme called SynthID-Text. Anthropic’s watermark is also based on SynthID-Text, though altered in ways that Anthropic hasn’t detailed.