{"slug": "how-ai-text-watermarking-works", "title": "How AI text watermarking works", "summary": "Google has watermarked text from its Gemini app and web experience since 2024, and as of August 2026, new Claude models from Anthropic mark text at the model level, using a statistical method that hides a mark in the choices between words rather than in the characters themselves. The technique, based on a 2023 paper by Kirchenbauer and similar to Google's SynthID, works by secretly coloring candidate words green or red and nudging the model's dice toward green, allowing a detector to re-color any text with the key and count how often green wins, flagging text that lands green too often to be luck.", "body_md": "A gentle, visual walk through how a statistical mark hides inside generated text, and what erases it.\n\nA watermark in plain text sounds impossible. Text has no pixels to hide data in, and no metadata survives copy-and-paste; every character is right there in front of you. Where could a mark possibly go?\n\nAnd yet the marks are real. Google has watermarked text from the Gemini app and\nweb experience since 2024 (its API is, at the time of writing, a\n[documented\nexception](https://discuss.ai.google.dev/t/does-gemini-api-text-output-carry-synthid-watermarking-gemini-2-5-flash-lite-gemini-3-1-flash-lite-eu-ai-act-art-50-2/177241)), and as of August 2026, new Claude models mark text at the model\nlevel, with earlier models being brought in behind them. They're\ninvisible, they survive copying, and they\nwork because they don't live in the characters at all. They live in the\n*choices between them*.\n\nFive short steps, each with something to poke at. Nothing harder than counting.\n\nThe one idea in this step: a model writes by rolling weighted dice between several words that would each be fine.\n\nWhen a model is mid-sentence, it doesn't know \"the next word.\" It has a shortlist, like autocomplete, with preferences. Here's a real kind of moment, one word from the end of a sentence:\n\nThe results of the study were quite ** **\n\nA page of text contains hundreds of these little forks, one per word, and at many of them several options are equally fine. That slack is the raw material. Whoever gets to lean on how the dice land can hide a pattern in the text without changing what it says.\n\nThe one idea in this step: the key secretly colours the shortlist and gives one colour a gentle nudge. The text still reads normally.\n\nHere is the classic recipe (Kirchenbauer 2023; Google's SynthID reaches the\nsame end by a subtler, tournament-style route). At each fork, secret-keyed maths splits\nthe candidate words into\n**green** and\n**red**, an arbitrary colouring only the\nkey-holder can reproduce. Then the dice get tilted a little toward green.\n\nThe results of the study were quite ** **\n\nTwo things make this sneaky. The nudge is mild: a red word can still win, it's just a little less likely. And the colouring is not a fixed property of the word: the key computes it from a short run of the words just before, so the same candidate is green after one prefix and red after another:\n\n(Two siblings, same principle.\nGoogle's SynthID (the one in production) replaces the nudge with a tiny secret\n*tournament*: a few candidates are drawn from the model's own odds, the key scores them,\nand the bracket is arranged so that, averaged over the key's draws, every word's odds\nstay exactly what the model intended. Aaronson's scheme, built at OpenAI, skips\neven that and derives the dice-rolls themselves from the key. Different maths, same\nprinciple: the mark lives in the choices.)\n\nThe one idea in this step: with the key, you can re-colour any text and simply count. Marked text lands green too often to be luck.\n\nDetection doesn't read the text or judge its style. The detector replays the key-holder's colouring over the words and counts how many came up green. Without a mark (or without the right key), green should win about half the time. A coin flip. Here's an ordinary-looking paragraph; try both keys on it:\n\nNote how demanding the bar is. This paragraph is visibly tilted and still too\nshort to flag. Detectors are tuned so that false alarms are vanishingly rare; the\nprice is that short, edited, or weakly marked text is often missed, and 55 words\nof a mild lean isn't enough evidence. Press **keep reading**: the lean stays\nexactly the same while the bar slides down to meet the growing evidence. Length is\npart of the test. (And this demo's tilt is drawn strong so you can see it; a\nproduction mark leans far more gently and needs correspondingly more text. In this\ndemo's 50/50 model, a 1,500-word document would flag at only ~55% green: small\nleans become persuasive only through length, which is why short texts are\ngenuinely hard to call, for anyone.)\n\nThe one idea in this step: the mark lives in runs of untouched wording. Editing erases it exactly where the runs break, and nowhere else.\n\nEach word's colouring is derived from a short run of the words just before it (one to a handful, depending on the scheme). So a position only counts as evidence if a short window of the original wording (the word plus its neighbours) survives intact.\n\nHere is the same paragraph from step 3, at five edit depths. **Drag the slider and\nwatch the highlighted runs shrink.** A highlight means that run of wording still\nmatches the original exactly, so the detector can count there. Everything faded is new\nwording, where there is nothing but coin-flip noise left to count.\n\nfix typos · surviving windows: –%\n\nOn real implementations (MarkLLM's KGW and EXP schemes on an open model, washed by\ndeclaude's full-rewrite route): about 0.5% of windows survive, and detector accuracy\nfalls from essentially certain to a coin flip. The published literature agrees on the\nshape of this. Light or one-pass paraphrase *dilutes* the mark rather than\ndeleting it; in Kirchenbauer et al.'s experiments, detection recovered given enough\ntext, with even human paraphrase becoming detectable again after roughly 800 tokens\n(about 600 words). What removes\nthe mark is re-composition that shares no runs of wording with the original.\n\nThat is why a tool that rewrites from the meaning (like [declaude](/)'s\nfull-rewrite route) is what actually erases this family of mark, and why a light\npass that keeps most of the phrasing does not.\n\nOne boundary stated plainly: those numbers come from open implementations we can measure. Anthropic's production scheme is undisclosed, so no one outside Anthropic can yet run this test against Claude's own mark. What our experiments support is the mechanism, for the family of schemes this page describes.\n\nThe one idea in this step: detection is private, probabilistic, and\nabout *processing*, not authorship.\n\nWritten by [James Padolsey](https://j11y.io) at\n[NOPE](https://nope.net) as an\naccompaniment to [declaude](/). The interactive figures are a teaching model\nwith illustrative parameters, not any provider's actual scheme.\n\n**Sources & further reading.**\nKirchenbauer et al., *A Watermark for Large Language Models* (ICML 2023) ·\nDathathri et al., *Scalable watermarking for identifying LLM outputs*\n(SynthID-Text, Nature 2024) ·\nAaronson & Kirchner, *Watermarking GPT outputs* (2022) ·\nKirchenbauer et al., *On the Reliability of Watermarks for Large Language Models*\n(ICLR 2024) ·\nSadasivan et al., *Can AI-Generated Text be Reliably Detected?* (2023) ·\nZhao et al., *The Mark Fades: Adaptive Evolutionary Paraphrase-based Attack*\n(ACL Findings 2026) ·\nAnthropic, [ How\nClaude marks AI-generated content](https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content) (Help Center, Aug 2026) ·\nOur own known-key experiments: re-composition collapses KGW/EXP detection to chance\n(AUC 0.99 → ≈0.5), context-free unigram marks survive (0.73–0.84); outline-level\nregeneration is the only answer we know for meaning-space marks.\n\nFor the specialist: the residual-evidence model behind the step-4 verdict is z ≈ f·√N·z₁ (surviving fraction f, document length N, per-token strength z₁). The figures count words; real detectors count the model's own tokenizer's tokens. Same shape.", "url": "https://wpnews.pro/news/how-ai-text-watermarking-works", "canonical_source": "https://declaude.org/watermarking/", "published_at": "2026-08-13 23:16:55+00:00", "updated_at": "2026-08-13 23:40:50.627643+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "ai-tools", "ai-research"], "entities": ["Google", "Gemini", "Anthropic", "Claude", "SynthID", "Kirchenbauer", "OpenAI", "Aaronson"], "alternates": {"html": "https://wpnews.pro/news/how-ai-text-watermarking-works", "markdown": "https://wpnews.pro/news/how-ai-text-watermarking-works.md", "text": "https://wpnews.pro/news/how-ai-text-watermarking-works.txt", "jsonld": "https://wpnews.pro/news/how-ai-text-watermarking-works.jsonld"}}