{"slug": "ai-text-watermarking-is-not-a-big-deal", "title": "AI text watermarking is not a big deal", "summary": "Anthropic's plan to add hidden watermarks to Claude model outputs will not degrade text quality, increase detectability, or violate privacy, according to an analysis by an unnamed author. The piece argues that watermarking methods like Google's SynthID-Text and Meta's TextSeal replace existing randomness in the logit sampler without affecting output quality, and that AI text is already effectively detectable by careful readers. The author predicts all AI labs will adopt watermarking by 2027.", "body_md": "# AI text watermarking is not a big deal\n\nPeople are [pretty](https://x.com/arturovilla/status/2088406939466084643?s=20) [unhappy](https://x.com/NickADobos/status/2088350712359256440?s=20) about Anthropic’s recent [announcement](https://www.anthropic.com/news/claude-text-watermark) that they’re planning to include a hidden watermark in Claude model outputs. Will this lead to a mass exodus from Anthropic models? Will the introduction of watermarking be a meaningful change for users?\n\nNo. AI text watermarking is not a big deal. It doesn’t make the text worse, it doesn’t make AI outputs more detectable in practice, it doesn’t violate user privacy, and everyone’s going to be doing it by 2027 regardless.\n\n### Watermarked text is not lower-quality\n\n**There is no meaningful difference in quality between watermarked and unwatermarked text.** I wrote about this more [here](/text-ai-watermarks/), but the two popular ways to do it — Google’s [SynthID-Text](https://github.com/google-deepmind/synthid-text) and Meta’s [TextSeal](https://github.com/facebookresearch/textseal) — are completely transparent to the user. They work by replacing the pseudo-random logit sampler with a different pseudo-random logit sampler.\n\nSuppose you were gambling on coin flips with your friends, and instead of flipping a coin you decided to do this:\n\n- Check the current time since midnight in seconds\n- Count that many words forward in the\n[Encyclopaedia Britannica](https://en.wikipedia.org/wiki/Encyclop%C3%A6dia_Britannica) - Count whether the word you land on has an even or odd number of letters\n[1](#fn-1)\n\nThat would still be random enough to gamble with, right? But, like a watermark, you could theoretically go back and identify that that method was used, so long as you recorded the exact time of each “coin flip”. Text watermarking works the same way: it chooses a method of “randomness” that can be detected after-the-fact. Watermarked models will not be any less capable than unwatermarked models.\n\nWhat about cases where the model is quoting something, or giving you the answer to a mathematical problem, or doing something else where the output is largely pre-determined? Wouldn’t enforcing a watermark there make the output worse? It would, which is why none of the AI labs are going to do that. Text watermarking approaches only replace the *existing* randomness in the logit sampler: in any case where the model is always going to pick the same tokens, there’s basically no randomness to play with, so there won’t be a detectable watermark in those tokens.\n\nI think all this comes from a worry that you were previously getting the *best* token, but now you’re getting a lower-quality token that satisfies the watermark. For instance, Anthropic’s announcement suggested that the watermarking is visible in choices like the decision between “overcast” and “grey”. Many people have [predictably](https://x.com/HamelHusain/status/2088392435047272651?s=20) [come out](https://x.com/suchenzang/status/2088760692488933409) to say that decisions like these are really important to good writing, and that only an illiterate tech bro could think these words are identical.\n\nThis is a misunderstanding of Anthropic’s position and of how watermarking works. Specifically, it’s a misunderstanding because it suggests that the unwatermarked model would choose “overcast” while the watermarked one would choose “grey”. This is not how it works! If Claude Fable prefers “overcast” to “grey” in a particular context (say, 80% to 20%), you’ll get “grey” 20% of the time from both the watermarked and unwatermarked model. **Models already include a healthy amount of randomness in order to promote creativity.** Text watermarking just introduces a way to make those random choices that’s detectable after the fact.\n\n### AI outputs are already “watermarked”\n\nThe other big reason to not worry about AI watermarking is that **AI text content has always effectively been watermarked**. Most careful readers can tell when they’re reading [AI outputs](/tags/slop/), because language models tend to gravitate towards certain [habits of language](/chatgpt-house-style/): em-dashes, rhetorical opposition, punchy one-liners, “claudese”, and so on. In fact, it’s possible to train classifier models that reliably [distinguish](/ai-detection/) AI from human writing.\n\nFrom what I can tell, some of the backlash to watermarking comes from [people](https://x.com/Seltaa_/status/2088353576259314024?s=20) who buy AI inference in order to pass it off as their own work, and who worry that watermarking will make it harder for them to do that. For these people, the watermarking announcement is akin to Anthropic saying “hey, instead of making you seem smart, we’re going to publicly brand you as AI users and make you seem dumb”.\n\nBut of course this has always been the case! Nobody who is currently getting away with passing off AI outputs as their own will be caught by watermarking. For the majority of cases, it’s already painfully clear what’s happening for anyone who reads the [slop](/tags/slop/). For sophisticated AI users who are avoiding the “house style”, any suspicious readers who would paste their stuff into Anthropic’s watermark detector could already have been pasting it into [Pangram](https://www.pangram.com/).\n\nTools like Pangram 2 only give you an estimate of the\n\n*chance*that output is AI-generated. Wouldn’t a watermark be a more solid confirmation? Not really. Text watermarks are probabilistic too, because any token chosen by SynthID could theoretically have been chosen by a human. I suppose the Anthropic watermark page could be considered more trustworthy than Pangram, because it comes right from the source, but it’s not impossible that in some cases Pangram might actually be\n\n*better*at identifying AI-generated text than the watermarking too.\n\n### AI text watermarking is not a violation of privacy\n\nI’ve also seen theories floating around that watermarking encodes secret content into your outputs, or somehow tags outputs with your personal information. **I don’t think AI labs are using watermarks to encode data into your outputs.** Text watermarking is *hard*: like I just said, you can’t do it when the model can only respond with the same words, it doesn’t work for very short responses, and even on long responses it can only provide a probabilistic fingerprint. And that’s encoding one single bit 3 of information!\n\nI’m not saying that encoding longer messages into a watermark is technically impossible — there are [papers](https://arxiv.org/pdf/2605.11653) describing ways it might work — but there’s no way any of the labs are doing it 4. If they wanted to associate you with your responses that badly, they’d just secretly store every model response they generated.\n\n### AI text watermarking is inevitable\n\nAnother reason to not get too angry at any individual AI lab for watermarking is that **every single AI lab is going to do text watermarking this year**. It won’t just be Anthropic. The alternative is to completely stop doing business in the EU, because of the [EU AI Act](https://artificialintelligenceact.eu/article/50/). That’s currently a [sixty-billion-dollar](https://www.fortunebusinessinsights.com/europe-artificial-intelligence-market-113967) market. I am not a lawyer, but to me it seems genuinely unclear whether an AI lab could even legally do something like only watermarking EU responses: short of having an entirely different `claude-eu.ai`\n\nservice, the plain text of the Act seems like it applies to any *service offered in the EU*, not just the content that service outputs to EU citizens specifically.\n\nIf people *really* hate watermarking enough, some labs might stand up a completely separate EU service, or make an aggressive interpretation of the EU AI Act and see how the legal battle goes. When I try to be maximally charitable to anti-watermarking histrionics, I adopt an interpretation like this: people are saying that watermarking is an invasion of privacy and makes outputs worse and so on not because they believe it, but because they’re trying to pressure AI labs to firewall EU AI regulations behind a completely separate interface. In this case, it probably doesn’t matter — text watermarking is not a big deal — but I can see an American consumer being worried about more aggressive future regulation, and wanting to draw a firm line in the sand as early as possible.\n\n-\nInterestingly, this\n\n[might be](https://www.reddit.com/r/asklinguistics/comments/apes6p/comment/eg7sife/)very slightly even-favored.[↩](#fnref-1) -\nI am not sponsored by Pangram. As I understand it, Pangram is by far the best AI-detection tool right now (in part because many of its competitors are shady and\n\n[exist to promote](/ai-detection/)paid “AI-detection-evasion” services).[↩](#fnref-2) -\nTechnically, this is called a “zero-bit watermark”, because you can’t recover a yes-or-no value from the watermark itself (merely from the\n\n*presence*of a watermark).[↩](#fnref-3) -\nI saw someone suggesting that an AI lab could use per-user secret keys to watermark text, and then simply iterate over the keys to figure out who generated what. I just don’t see how you could do this at any scale: watermark detection is cheaper than model inference, but it’s still (a) computationally intensive enough to be implausible, and (b) probably has a high enough false-positive rate that any run against hundreds of millions of users would match multiple people.\n\n[↩](#fnref-4)\n\nIf you liked this post, consider [subscribing](https://buttondown.com/seangoedecke) to email updates about my new posts, or [sharing it on Hacker News](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fwww.seangoedecke.com%2Fai-text-watermarking-is-not-a-big-deal%2F&t=AI%20text%20watermarking%20is%20not%20a%20big%20deal).\n\nHere's a preview of a related post that shares tags with this one.\n\nText AI watermarks will always be trivial to remove\n\nThe European Union\n\n[AI Act]will begin to be enforceable in August 2026, one month from now. One of the biggest new requirements is[Article 50], which requires all AI outputs to be “detectable as artificially generated”. In other words, if LLM providers want to do business in the EU, they will have to apply a watermark to their outputs: some hidden signature that can be used to identify AI content.[Continue reading...]", "url": "https://wpnews.pro/news/ai-text-watermarking-is-not-a-big-deal", "canonical_source": "https://www.seangoedecke.com/ai-text-watermarking-is-not-a-big-deal/", "published_at": "2026-08-16 08:00:38+00:00", "updated_at": "2026-08-16 08:10:41.025488+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-policy", "ai-ethics"], "entities": ["Anthropic", "Claude", "Google", "SynthID-Text", "Meta", "TextSeal"], "alternates": {"html": "https://wpnews.pro/news/ai-text-watermarking-is-not-a-big-deal", "markdown": "https://wpnews.pro/news/ai-text-watermarking-is-not-a-big-deal.md", "text": "https://wpnews.pro/news/ai-text-watermarking-is-not-a-big-deal.txt", "jsonld": "https://wpnews.pro/news/ai-text-watermarking-is-not-a-big-deal.jsonld"}}