On 11 August, Anthropic announced that all future Claude models will generate text that contains a watermark that identifies its results as AI generated. The company is not alone. Google has its own text watermark (which Anthropic’s is based on) it uses on the output of its Gemini models. OpenAI has yet to introduce a text watermark but it plans to do so.
The rapid spread of watermarking is in part a response to the European Union’s AI Act, which mandates watermarks for AI models released after 2 August, 2026, along with other planned and proposed regulations aimed at curbing the spread of deceptive or manipulative AI-generated content. But the new rules may come at a cost for AI users who simply want the best possible results.
AI watermarks can apply to many forms of content: The EU AI Act also requires them for images, audio, and video. Such media watermarks have been in use for years, and while their effectiveness as a holistic solution to marking AI remains up for debate, they can achieve detection rates above 99 percent. Image and video watermarks are already deployed by OpenAI, Google, and Meta, among others. (Anthropic doesn’t provide an image generation model.)
Text watermarks have been less frequently deployed, however, and not everyone is convinced that text watermarking can work without compromising the quality of an AI model’s response. John Gruber, a prolific technology writer and co-creator of the Markdown language, calls the watermark a “perversion of writing” and disputes Anthropic’s assertion that a watermark doesn’t change the meaning or quality of text. Images consist of millions of pixels, he notes, whereas text responses often span just dozens or hundreds of words. Text seems to provide far less space to alter AI output in a way that is detectable yet not disruptive.
John Kirchenbauer, postdoctoral fellow at the Vector Institute and co-author of a 2023 paper which was among the first to describe a text watermarking method, disagrees. “[A watermark] wouldn’t be detectable if there wasn’t a change. This is a very fundamental point,” he says. “The question is, do you care if it’s not the exact original distribution if, for all intents and purposes, it doesn’t change the utility to you?”
Realistically, the issue comes down to that word, “utility.” Does watermarking AI-generated text meaningfully degrade the experience of the person using it? The answer is still under dispute.
The term “watermark” is so familiar that it can cause confusion about how the technology works when applied to AI. A text watermark is not metadata or invisible characters; it is something much more subtle. The exact details vary between methods, but text watermarks are generally impossible for a human (and, in many cases, even a computer) to detect without access to the specific key used to detect a specific watermark. Understanding why requires an understanding of how LLMs work.
An LLM produces a probability for every word that could come next at each step in its response to a prompt. (From here on, I’ll be using “words” interchangeably with “tokens,” although tokens also represent numbers, punctuation, and more). A likely word might get a 40 percent probability, a plausible alternative 10 percent, and an unlikely one a fraction of a percent. The model then picks a word at random, weighted by those numbers. The most probable word usually wins, but not always.
“[A watermark] wouldn’t be detectable if there wasn’t a change. This is a very fundamental point.” —John Kirchenbauer, Vector Institute
This process provides an opportunity to hide a text watermark by introducing subtle changes to how words are selected.
The 2023 paper by Kirchenbauer and his colleagues provided one of the first examples of how to implement a text watermark, and it remains the most widely cited technique. The researchers describe a watermark which sorts words into a red list and a green list. The red-list words are unaltered, but the green-list words are nudged to be slightly more probable.
“If we sample from this modified distribution, then while any one token choice won’t necessarily come from that preferred set, over many samples, we’ll preferentially pick words from that up-weighted subset,” Kirchenbauer says.
The text watermark is embedded in the choice of words used, which is why it is effectively invisible to humans. Kirchenbauer and colleagues reported a detection rate of 98.4 percent, and zero false positives, in responses that contain about 200 tokens. The embedded pattern of word probabilities also means that simple paraphrasing won’t obscure the watermark. The paper reports that removing the watermark from a long response requires changing roughly one quarter of its words or more.
Although AI text watermarking is designed to be invisible to human readers, by definition it influences the word patterns in AI-generated text. That algorithmic meddling is what makes critics like Gruber concerned that watermarking reduces the overall quality of the output.
The strongest evidence that text watermarking doesn’t impact quality comes from a 2024 paper by a team from Google, which introduced the company’s watermarking scheme called SynthID-Text. Anthropic’s watermark is also based on SynthID-Text, though altered in ways that Anthropic hasn’t detailed.
To show that the SynthID-Text watermark doesn’t impact quality, the Google authors randomly routed Gemini user queries to watermarked and non-watermarked variants of Google’s text models. Then they compared overall user feedback on the output. The authors found no significant difference in user feedback across 20 million responses.
Still, some researchers remain skeptical that watermark methods have no impact on the quality of an AI-generated response. Their skepticism stems from edge cases that can make a watermark more difficult to implement.
Vinu Sankar Sadasivan, an AI research scientist at Meta who co-authored a widely cited paper on the detectability of AI text watermarks, says watermarks particularly struggle when the number of potential word choices is small. “For a tweet that is 20 words, I would need to have 50 or 60 percent of the words to be from ‘green list’ for it to be detected well,” he says. A basic Python function generated by AI would create a similar tension between the strength of the watermark and the quality of the model’s response.
“This is where I have a disagreement with some of the PR posts from Anthropic, where they say it has no quality change,” says Sadasivan. He explains that it’s possible to dynamically increase or decrease the strength of a watermark to preserve the quality of a response in difficult situations, but doing so can also decrease the strength of the watermark. Google’s SynthID-Text paper includes an example of this in a graph that plots detection rates against the number of tokens in a response. The detection rate was up to 95 percent accurate in best-case scenarios, but it fell below 50 percent for short replies.
Without more information from Anthropic, it’s difficult to know how the company is walking the line between the quality of an AI response and the strength of its watermark. Anthropic declined to provide additional information for this article.
The dispute over AI text watermarks is not just about how well they work, but also about what kinds of tradeoffs are reasonable in exchange for a clear labeling of AI-generated text. Gruber’s position is that altering the text is not acceptable because it makes an AI model’s output different from what it would otherwise be. The EU’s AI Act, on the other hand, implies that some alteration is acceptable if it informs people that they are reading AI generated text.
“For a tweet that is 20 words, I would need to have 50 or 60 percent of the words to be from ‘green list’ for it to be detected well.” —Vinu Sankar Sadasivan, Meta
Further complicating the situation, AI researchers are increasingly focusing on text watermarks for purposes other than labeling individual examples of AI-generated text. In particular, watermarks can be used to track data at scale.
A 2026 paper co-authored by Kirchenbauer shows that an AI model trained on watermarked text will itself produce output bearing the watermark. A content owner who watermarked their documents before publishing them could therefore use those traces as statistical evidence that their text ended up in a model’s training data.
Alternatively, an AI company training a new model could use text watermarks to exclude content generated by previous generations of the model from its training data. Such guardrails could help avoid model collapse, in which AI models keep recycling and amplifying their own errors
These broader concerns shift the entire debate over text watermarking, in Kirchenbauer’s view. “It’s not necessarily about the ‘you used AI’ accusation as the goal. It’s headed into tracing data provenance, model recycling, and things like that,” he says. “I think you use [a text watermark] as a general piece of metadata, in some ways more robust, in some ways less robust, that can be attached to content and allows you to trace where it goes.”