Table of Contents

• Watermarking is coming to AI text, across the board
• How it works
• From a mark of authenticity to a mark of artificiality
• What it says, and what it doesn’t
• Images, files and code work differently
• Getting around it
• What it is actually for

Anyone who makes content now works under a background suspicion. Even a well-crafted piece of writing gets waved away as “probably AI”, and the label drags down its perceived value even when there is real work behind it. Part of that suspicion is earned. We are surrounded by AI slop, by people who reach for these tools lazily and without judgement, publishing text that is empty or riddled with errors. But when AI is used like a pen, a tool in the hands of the writer and not a system to hand everything over to, the output can reach a quality that used to take far longer to achieve. The line between “AI-generated” and “handmade” is blurrier than the stigma suggests.

Watermarking is coming to AI text, across the board

The question moved to the front of the queue in mid-August, when Anthropic announced that its Claude models would start embedding a watermark in the text they generate: a signal invisible to the reader, but detectable by anyone holding the key that encodes it. 

The move is not specific to Claude. It follows the EU Code of Practice on Transparency of AI-Generated Content, signed in July 2026 by around 190 organisations, which from 2 August asks providers serving the European market to mark AI-generated content. Google has watermarked Gemini’s text since 2024, OpenAI is reported to have built its own tool and held it back, and other major providers are falling into line, each with its own key. It is better read as an industry-wide requirement tied to the EU AI Act than as one lab’s initiative.

One point matters more than the rest, and it is the one usually misunderstood: nothing is added to the text. No hidden characters, no extra tokens, and therefore no added cost or slowdown. It is not a watermark in the old visible sense, the kind you can hold up to the light on a banknote. To a reader, watermarked and unwatermarked text are indistinguishable.

How it works

The mechanism is worth understanding, because it also explains the limits. A language model generates one word at a time, choosing among several plausible candidates at each step. In the sentence “the weather today was cold and…”, the next word is unlikely to be “sugary”, though it might be “grey” or “overcast”: the meaning barely changes either way. Normally that choice is settled by a random number.

Watermarking steps in here. The choice stays random, but its source changes: instead of an arbitrary random number generator, the model uses the key and a few preceding words to steer the selection. The resulting sequence, checked with the key, is consistent with the choices the model would have made using that key, and from there one can estimate the probability that the text came from it.

The method is a version of SynthID-Text, developed by Google DeepMind and published in Nature in 2024, building on a 2022 proposal by Scott Aaronson.

Detection, incidentally, does not require re-running the model. A quick analogy helps: imagine playing Monopoly using the digits of pi instead of dice. The moves stay random and nothing changes for the players, but anyone who knows pi can check afterwards whether that game used pi to move. The watermark does the same with words.

From a mark of authenticity to a mark of artificiality

To see what is really at stake, it helps to look at where the watermark comes from. The idea is old and, as it happens, Italian: as early as the 13th century, papermakers in Italy pressed distinctive marks into their sheets to identify the mill they came from, as CNN recounts. Over the centuries, it became a sign of quality and authenticity, appearing on banknotes and official documents, from postage stamps to contracts, often as an anti-fraud measure. In 1954, the same logic moved to audio, with a patent for embedding inaudible identification codes into background music, and in the 1990s to digital media, to protect music and film from piracy.

With AI, as computing historian Gili Vidan told CNN, that sign flips. The traditional watermark certified authenticity and ownership. The one on AI text works the other way: it signals that a machine sat behind the words, and it casts doubt on whether the user can claim to be the author at all. That tension sits right on top of the perceived-value problem we started with.

What it says, and what it doesn’t

On text, this is where things get subtler than with images or video. The key answers only one question: how likely it is that a given passage was written, in part, by the model. That is not a binary verdict. As Daniel Susser, who studies AI ethics and policy at Cornell, told CNN, it is a statistical signal that has to be interpreted, not a clean yes or no.

And detection has real limits. It works poorly on short passages, where there are few choices to go on, and it is weaker on factual writing, where a single correct answer often leaves the watermark nothing to act on. The same holds for proofreading: if the model only fixes grammar and punctuation in a human’s text, the edits may be too few to register. For now, the detection API is not even available yet.

The announcement still stirred anxiety among users worried about what a label might say about them: the fear of a new caste of “dirty” creators, penalised for daring to use a tool. Susser reads this as a symptom of norms that have not settled. In some fields AI is all but mandatory, in others it is frowned upon, and the idea that a technical means could reveal you used it feels threatening.

Images, files and code work differently

For files such as images, the usual approach is a content credential rather than a watermark. A cryptographically signed note in the file’s metadata recording that AI was involved. Anthropic uses the open C2PA standard for this, the same one camera makers and photo-editing software rely on, and nothing is hidden inside the image itself. Code carries little watermarking, because the output often has to be exact and leaves no arbitrary choice to steer, so any signal lives at most in the comments.

Getting around it

The obvious question follows quickly, can it be removed? To some extent, yes. Light editing probably will not strip it completely, while a full word-by-word rewrite will. At that point, though, it is arguable whether the text still counts as AI-generated.

And you do not necessarily need to rewrite by hand. Independent research has found that SynthID-Text degrades under meaning-preserving transformations, such as automated paraphrasing or a round-trip translation into another language and back. In the discussion that followed the announcement, people were already floating routines that push the output through several successive rewrites, like shuffling a deck of cards, until the signal is gone. Which confirms what the watermark really is: a probabilistic clue, more than tamper-proof evidence.

There is an almost ironic detail here too. The most common detection tools, such as Pangram, do not read the watermark at all, because they lack the key. Instead they look for the usual tells of AI phrasing. Among them, Anthropic itself points to the “this isn’t X, it’s Y” construction and an over-fondness for the word “quietly”. For anyone who writes, it is a useful reminder that certain stylistic habits give a text away more than any watermark.

What it is actually for

Back to value. On any single text the watermark says little: it identifies no only certifies probable involvement. 

It does not tell you who produced what, but it does show how far synthetic content has spread through the information ecosystem, a concern the SynthID authors themselves raised in Nature.

There is a trust dimension as well. Vidan recalls what happened with banknotes in the 1980s: fear of colour-copier forgeries risked making people doubt the authenticity of all cash, and new watermarks helped rebuild that trust. 

The same holds for media, if the belief spreads that much of what we read is fake, people start doubting everything. In that sense, the watermark works more as a thermometer for the state of information than as a stamp on any individual author.

At the individual level, then, disclosing AI use stays mostly a matter of transparency. As Sarah Fisher of Cardiff University notes, a lecturer or a publisher has good reason to know whether an idea was worked out by a person or handed over just as the model produced it. The real measure, though, is something else, how the tool is used.