# NOPE founder explains how AI text watermarks survive copying and fade under rewrites > Source: > Published: 2026-08-14 03:50:59+00:00 [James Padolsey (@padolsey)](https://x.com/padolsey?ref=runtimewire), the founder of [NOPE](https://nope.net/?ref=runtimewire), has published an [interactive guide to AI text watermarking](https://declaude.org/watermarking/?ref=runtimewire) that explains where an invisible mark can hide in plain text, how its owner detects it and why rewriting can make it disappear. The timing gives the tutorial a sharper purpose. In an [August 12 announcement](https://www.axios.com/2026/08/12/anthropic-claude-watermarks-ai-detection?ref=runtimewire), Anthropic said new Claude models would mark AI-generated content from launch. [Anthropic says Claude models launched in the EU on or after August 2, 2026 will support machine-readable marking at launch](https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content?ref=runtimewire), with embedded watermarks in generated text. Anthropic says markings for supported models will apply wherever Claude is offered worldwide. Padolsey's guide accompanies [Declaude](https://declaude.org/?ref=runtimewire), his tool for turning "AI-flavored text" into a meaning-preserving rewrite. It teaches readers how the new provenance machinery works while making the technical case for Declaude's full-recomposition approach. Padolsey comes to the problem from platform integrity and AI evaluation. [NOPE's team page](https://nope.net/about?ref=runtimewire) lists previous roles at Meta, Stripe and Twitter, followed by work as a founding engineer at the Collective Intelligence Project. His [personal site](https://j11y.io/?ref=runtimewire) also credits him with writing "Clean Code in JavaScript" and building open evaluation tools. He founded NOPE with his sister Alice Padolsey in 2025 to measure risks that emerge across ongoing human-AI conversations, including dependency, sycophancy and systems that keep accommodating users when they should introduce friction or human support. Text watermarking is a different part of the stack, though it fits Padolsey's broader fixation on signals that software can detect even when people cannot see them. ### The mark sits in token choices A text watermark does not require hidden characters, formatting or metadata. It is introduced while a language model chooses each successive token. At any point in a response, a model usually has several plausible continuations with different probabilities. The method described in the guide, based on the [2023 watermarking paper by John Kirchenbauer and his co-authors](https://proceedings.mlr.press/v202/kirchenbauer23a.html?ref=runtimewire), uses a secret key to divide possible next tokens into groups. The generation process gently favors one group, often described as "green" tokens, without making the alternatives impossible. One choice reveals little. Across hundreds or thousands of tokens, the favored group appears more frequently than chance would predict. A detector holding the same key can reconstruct which tokens were favored at each position, count the results and calculate whether the accumulated pattern is statistically persuasive. The secret coloring can depend on the words immediately preceding a token. A word might be green after one phrase and red after another. That prevents readers from identifying the watermark through a fixed vocabulary list and allows ordinary-looking prose to carry the signal through copying and pasting. [Google DeepMind's SynthID Text](https://ai.google.dev/responsible/docs/safeguards/synthid?ref=runtimewire) uses a more elaborate method, though the operating principle remains similar: generation choices carry a statistical pattern that a detector can score. [Google has watermarked text in the Gemini app and web experience since 2024](https://deepmind.google/blog/watermarking-ai-generated-text-and-video-with-synthid/?ref=runtimewire) and later released a [reference implementation on GitHub](https://github.com/google-deepmind/synthid-text?ref=runtimewire). ### The product argument begins where the watermark breaks Padolsey's guide is unusually direct about the weaknesses. Watermark evidence grows with length, leaving short answers, quotations, code and factual lists with fewer opportunities to carry a reliable signal. Light editing can dilute a mark while preserving enough original sequences for detection to recover across a longer document. A full rewrite attacks the dependency between neighboring words. When a model reconstructs prose from its meaning rather than editing individual phrases, the original token windows vanish. The detector is then left counting choices that bear no relationship to the original key pattern. Declaude says it routes submitted text through other models and checks the result with an evaluation harness. In tests cited in [Padolsey's guide](https://declaude.org/watermarking/?ref=runtimewire) using open KGW and EXP watermark implementations, Declaude's full-rewrite route left about 0.5% of the original detector windows intact and reduced detection accuracy from near certainty to roughly chance. That result should not be generalized to Claude. Anthropic has not published its production algorithm, key structure, thresholds or detector performance. Padolsey states that boundary prominently: his measurements cover open implementations that NOPE can test, while Anthropic's mark remains inaccessible to outside evaluation. The distinction matters because some watermark designs survive same-meaning rewrites better than others. A tool that defeats one open implementation has not established that it can erase every provider's mark. Declaude's present claim is narrower and defensible: complete recomposition can collapse schemes whose evidence depends on surviving runs of original wording. ### Regulation is pushing watermarking into production Anthropic's deployment follows the European Union's [AI Act Article 50](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50?ref=runtimewire), which requires providers of systems generating synthetic text, audio, images or video to make outputs machine-readable and detectable as artificially generated or manipulated, where technically feasible. Anthropic says supported models will add watermarks across Claude, Claude Code, Claude Cowork, its API and cloud partners, wherever those models are offered. Generated files can also receive signed provenance metadata under the C2PA standard. Earlier Claude models are being moved toward the same marking requirements. Detection access remains a central constraint. A statistical mark built around a secret key can only be verified by the key holder or a service the provider authorizes. Anthropic says third-party detection support is forthcoming. Until then, outsiders cannot independently test Claude's production watermark, verify its false-positive rate or measure how it performs after different kinds of editing. ### A detected mark does not establish authorship Anthropic's own documentation says a mark indicates that content may have been processed by Claude. Human-written copy can acquire the signal when Claude proofreads, translates, summarizes or reformats it. A detected mark therefore cannot establish who supplied the ideas or wrote the first draft. The reverse conclusion is equally unsafe. Claude-generated text may lose a detectable signal after heavy editing, translation, excerpting or combination with other material. Very short passages may never contain enough evidence for a confident result. [OpenAI raised related concerns in 2024](https://openai.com/index/understanding-the-source-of-what-we-see-and-hear-online/?ref=runtimewire), saying its researched text watermarking method resisted localized paraphrasing while remaining vulnerable to translation and regeneration by another model. OpenAI also warned that even a low false-positive rate can create a large absolute number of mistakes at internet scale and could disproportionately affect non-native English speakers who use AI as a writing aid. Padolsey's guide gives founders and product teams a useful mental model for the technology arriving inside major AI systems. Watermarks can supply evidence about a model's processing history. They cannot settle authorship disputes, replace editorial judgment or survive every transformation. That is also the commercial opening behind Declaude. As model providers add hidden provenance signals under regulatory pressure, rewriting tools can sell control over the final prose. Padolsey has turned that tension into a clear technical lesson, while leaving the decisive Claude question where it belongs: inside an undisclosed Anthropic system that independent researchers cannot yet measure.