Watermarks and Provenance: Marking Machine Text at the Source

Every detector in How AI detectors work starts from the finished text and guesses backward. A watermark works the other way around. The company running the model hides a pattern in the text while it is being written, keeps the key, and later checks for the pattern. There is far less guessing about style. The question becomes whether a known statistical pattern is present, and how strongly.

For years this was mostly a research topic. That changed on August 2, 2026, when the European Union's rule requiring machine-readable marks on AI output began to apply. As of October 2026, Anthropic watermarks text from its Claude models, Google watermarks Gemini text with SynthID, and OpenAI has started watermarking ChatGPT and Codex text for users in the EU. This lesson explains how the marks work, where they break, and what the related systems for images, audio and video do.

Three kinds of marks

People use "watermark" loosely, for marks that work very differently.

Kind	Where it lives	What removes it	Example
Statistical watermark	Inside the content itself: the word choices in text, the pixel values in an image, the waveform in audio	Heavy editing, paraphrase, translation; for images and audio, some transformations	SynthID Text, Claude's text watermark, OpenAI's textGrain
Metadata	Fields attached to a file, outside the visible content	Screenshots, re-saving, format conversion, many upload pipelines	IPTC "AI generated" fields Meta adds to its images
Content credentials	Signed metadata following the C2PA standard, recording origin and edits	Same as metadata, unless paired with a watermark or fingerprint that can find it again	Credentials Claude attaches to PNG and JPEG files it makes

Plain text has no file to attach metadata to. Copy a paragraph from a chatbot into an email and nothing travels with it but the words. So for text, the statistical watermark is the only mark that can survive a copy and paste. Anthropic's help page says exactly that about its own system: because the watermark is part of the text, it travels with the text when copied.

How a text watermark works

A language model writes one token at a time. At each step it has a list of candidates with probabilities, and a random draw settles which one it picks. (Tokens and sampling are covered in How machines write.) Often several candidates are about equally good. "The weather today was cold and grey" reads the same as "cold and overcast." A watermark hides in those low-stakes choices.

The method most later work builds on came from John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers and Tom Goldstein, published at ICML 2023. Before each token, a hash of the previous token seeds a random number generator. That generator splits the vocabulary into a "green list" and a "red list." The model then gets a gentle push toward green tokens. It still writes normally. It just lands on green more often than chance.

Detection does not need the model. Anyone with the hash rule can rebuild the green list for each position and count. Human writing, which knows nothing about the lists, lands on green about as often as chance predicts. Watermarked text lands there far more often. The paper turns the count into a z-score: how many standard deviations above chance the green count sits. With half the vocabulary green, the score is 2 times (green tokens minus half the tokens), divided by the square root of the token count. The authors suggest flagging text above z = 4, where the chance of a false alarm on innocent text is about 3 in 100,000.

SynthID Text and the methods now in use

Google DeepMind's version, SynthID Text, was described by Sumanth Dathathri, Abigail See, Sumedh Ghaisas and colleagues in Nature on October 23, 2024 (volume 634, pages 818 to 823). It changes only the sampling step, so the model itself is not retrained. Candidates for each token compete in a tournament, with each round scored by a different keyed random function, and the winner is written. The detector checks whether the text scores higher on those functions than chance would allow.

The paper's live test is the striking part. Google served about 20 million Gemini responses, some watermarked and some not, and compared user ratings. Thumbs-up rates differed by 0.01 percent and thumbs-down rates by 0.02 percent, differences the authors found statistically insignificant. Google released the code, and on the same day Hugging Face added SynthID Text to its Transformers library in version 4.46.0, so anyone running an open model can watermark its output with their own key.

Anthropic's text watermark, announced August 14, 2026, is described by the company as a version of the SynthID Text approach, part of a family that goes back to a 2022 proposal by Scott Aaronson. OpenAI calls its system textGrain. All of these share one design idea: the watermark changes only where the randomness comes from. The model picks from the same candidates it would have picked from anyway.

Anthropic also says what its watermark is not. Nothing is added to the text. There are no hidden characters. The mark carries no information about the user, the organization or the chat, so it cannot be traced to a person. That matters, because a common rumor holds that AI text carries invisible characters you can find in a text editor. A statistical watermark is a pattern in the word choices, and you cannot see it by looking.

Where text watermarks break

Every party that runs a text watermark publishes a list of its limits, and the lists match the research closely.

Condition	What happens	Evidence
Light editing	Signal weakens but often survives	OpenAI's October 2026 figures for 400-token passages, at a 1 percent false positive target: about 92 percent detected unedited, 66 percent after replacing 10 percent of words with synonyms, 17 percent after replacing 25 percent
Paraphrase by another model	Large drop in detection	Krishna et al. (NeurIPS 2023) built an 11-billion-parameter paraphraser, DIPPER, that evaded a watermark and several other detectors; Sadasivan et al. (TMLR) showed repeated "recursive" paraphrasing cuts detection further
Long human paraphrase	Pattern leaks through if the text is long enough	Kirchenbauer et al. (ICLR 2024): after strong human paraphrasing the watermark was detectable after about 800 tokens on average, at a 1-in-100,000 false positive rate
Translation	Can erase the mark	He et al. (ACL 2024): generating in one language and translating into another pushed detection to random-guess level for the methods tested; the SynthID Text release notes say translation can greatly reduce detector confidence
Short text	Too little evidence	OpenAI: about 80 percent detected at 200 tokens versus about 95 percent at 400 tokens, for psychology answers
Factual answers, math, code	Few free choices to steer	The SynthID Text release notes and Anthropic both say marks are weaker on factual text; OpenAI's results dropped for mathematics
Light proofreading of human text	Almost nothing to mark	Anthropic: the watermark can only live in the handful of words Claude changed
Open models run by anyone	No one forces a mark	The Nature authors call enforcing watermarks on decentralized open models "difficult"
A determined attacker	Can copy or remove the mark	Jovanovic, Staab and Vechev (ICML 2024) reverse-engineered several schemes by querying them, then spoofed and scrubbed them for under $50, succeeding over 80 percent of the time

Spoofing deserves a second look, because it cuts against the people a watermark is meant to protect. Vinu Sankar Sadasivan and colleagues showed in 2023 that an attacker could learn a watermark's pattern well enough to make human-written text look watermarked. If watermark checks become the standard of proof somewhere, a forged positive becomes a way to frame someone. The Nature paper lists "stealing, spoofing and scrubbing attacks" among SynthID's limitations.

And one limit is built in. A key answers one question. Anthropic's key can tell you whether Claude was likely involved. It cannot tell you whether a human wrote the text, and it cannot see Gemini's or ChatGPT's marks, which use different keys. A negative result from one company's checker rules out very little.

What changed in 2026

OpenAI had a working text watermark well before it shipped one. In August 2024 the Wall Street Journal reported that OpenAI's system had been ready for about a year and could detect ChatGPT text with 99.9 percent certainty. OpenAI then updated a blog post to say its teams had developed a method "that we continue to consider as we research alternatives." It said the method was effective against localized tampering such as paraphrasing but less resistant to translation, rewording with another model, or asking the model to insert and then delete a special character between every word. It also said the method could disproportionately affect some groups, such as non-native English speakers.

The EU settled the question for companies serving its market. Article 50(2) of the AI Act requires providers of systems that generate text, images, audio or video to mark the output in a machine-readable format so it is detectable as artificially generated, applying from August 2, 2026. There is an exception for tools that only perform "an assistive function for standard editing." The European Commission's Code of Practice on Transparency of AI-generated Content gives companies an approved way to comply. It does not prescribe one technique. Anthropic, for one, combines a text watermark with content credentials on the files Claude makes. By the end of July 2026 about 190 organizations had signed it, including Anthropic, Google, Meta, Microsoft, Mistral and OpenAI. The legal side, including the separate disclosure duty for AI-generated text published to inform the public, is in Law and policy.

As of October 2026, here is who marks text and who can check it:

• Anthropic. Claude models launched in the EU on or after August 2, 2026 carry text watermarks at launch, applied worldwide because, the company says, it has no reliable way yet to limit the mark by region. Earlier models are being added. Watermark detection is in private preview for eligible organizations, which the help page lists as regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations and EU civil society groups, plus companies that must verify marks for their own compliance.
• OpenAI. On October 5, 2026 OpenAI said it would add its textGrain watermark to eligible ChatGPT and Codex output in the EU over the following weeks. API customers worldwide get an opt-in setting that is off by default. A detector is open by application, at first only to approved researchers and expert organizations. "The absence of a detected watermark does not prove human authorship," OpenAI said.
• Google. The Nature paper says SynthID Text is deployed in Gemini and Gemini Advanced, and Google's SynthID page says it marks text from the Gemini app and web experience. Google's SynthID Detector, which its SynthID page now describes as open to everyone, checks images, video and audio. That page does not list text.

So an ordinary teacher, editor or county clerk holding a suspicious paragraph cannot, as of October 2026, paste it into a public watermark checker from these three companies and get an answer about text. Access is limited, and each checker only sees its own company's mark.

Content credentials and metadata

For files, the main standard is C2PA, from the Coalition for Content Provenance and Authenticity. Its credentials are signed, tamper-evident records attached to a file that can say which camera or program made it, when, and what edits followed. The coalition compares them to a nutrition label. If someone alters the file without updating the credential, the signature no longer matches and a checker can tell.

Anyone reading a credential should know where it falls short.

• It can come off. C2PA's own FAQ says manifests "can be separated" from the file. Anthropic lists format conversion, re-saving and screenshots as ways metadata gets stripped. C2PA's answer is "durable content credentials": a watermark or fingerprint in the content that lets a checker look the credential up again after it is gone.
• It records history and says nothing about truth. A credential reports what the tools in the chain wrote down. A real camera can photograph a staged scene. A missing credential means only that no credential is attached, which describes most files on the internet.

Anthropic's setup shows the split between files and text clearly. Its help page sends you to a free checker for Claude-issued credentials in files such as PNG and JPEG images, while text can only be checked through the watermark detection API in private preview. Two different marks, two different tools.

Why images and audio are easier to mark

A one-minute audio clip or a single photo contains an enormous number of values, and nearly all of them can shift slightly without anyone noticing. That gives a watermark room to spread out and repeat itself. Google says SynthID's audio mark is inaudible and survives adding noise, MP3 compression and speeding up the track.

A 300-word answer gives a text watermark a few hundred word choices, and many of those are forced: names, numbers, terms of art, the one correct verb. Each choice the watermark does get to steer carries only a little evidence. Worse, text is meant to be edited. People reword sentences constantly without changing the meaning, and every reworded phrase scrubs part of the mark. A photo that gets cropped is still mostly the same pixels. A paragraph that gets rewritten is a different set of word choices.

Platform labels

The labels you see on social media come from marks like these, or from the person posting.

• Meta. In February 2024 Meta said it adds visible markers, invisible watermarks and IPTC metadata to images from its own AI tool, and that it would label images from other companies that embed C2PA or IPTC signals. It said it would require people to disclose photorealistic AI video and realistic-sounding audio. In April 2024 it announced "AI info" labels for a wider range of video, audio and images, based on detected industry signals or self-disclosure, starting in May 2024. In September 2024 it moved the label into the post menu for content only edited, not generated, by AI. Meta has said it is not yet possible to identify all AI content and that people can strip out invisible markers.
• YouTube. Since March 18, 2024, creators must disclose realistic altered or synthetic content, meaning content a viewer could mistake for a real person, place, scene or event. Clearly unrealistic or animated content and AI used for production help are exempt.
• TikTok. On May 9, 2024 TikTok said it would read C2PA content credentials to label AI-generated images and videos uploaded from some other platforms, and called itself the first video-sharing platform to do so.

All of these policies are about images, video and audio. A text post written by a chatbot typically carries no platform label at all, because there was no metadata to read and the platforms have not described scanning post text for watermarks.