Guide

What Is AI Watermarking? How Token Watermarks Actually Work

A plain-English 2026 guide to AI watermarking: how statistical token watermarks work, what Claude's new global watermark and Google's SynthID actually detect, C2PA metadata, the EU AI Act rules behind it all, and the honest limits — what a watermark can and cannot prove.

August 13, 2026 · The AI Rankings

Quick answer: AI watermarking is the practice of embedding an invisible, machine-readable signal into AI-generated content so that software can later identify it as AI-made. For text it works by nudging the model’s word choices in a secret, statistically detectable pattern — the words read normally, but a detector holding the key can spot the bias across a long enough passage. As of August 2026 the practice has gone mainstream: Google watermarks essentially all of its generated text, images, audio and video with SynthID; Anthropic became the first frontier lab to watermark text at production scale across every product, worldwide on 11 August 2026; and EU AI Act Article 50, enforceable from 2 August 2026, now requires machine-readable marking of AI output “wherever technically feasible”. The honest caveat, which the labs themselves state: a watermark shows content was processed by an AI model, not that the AI authored the ideas — and paraphrasing, translation or heavy editing can strip the signal. It is a transparency tool, not a lie detector.

This guide explains the mechanism in plain English. For the tools that try to detect AI text without a watermark — and their much worse track record — see best AI detectors.

What is AI watermarking?

AI watermarking embeds a hidden, machine-readable identifier directly into AI-generated content — text, images, audio or video — at the moment of generation, so the content itself carries evidence of its origin.

The word “watermark” borrows from paper money and stock photography, but the AI version is invisible by design. You cannot see it, it does not change what the content says or looks like, and it survives being copied out of the app that made it. Only a detector — usually one holding a secret key — can read it.

It helps to separate three things that get conflated:

• A watermark is embedded in the content itself at generation time, by the provider. It travels with the content.
• Provenance metadata (such as C2PA Content Credentials) is a signed label attached to a file — cryptographically trustworthy while present, but lost the moment someone screenshots the image or re-saves the file without it.
• An AI detector (GPTZero, Originality.ai, Turnitin and similar) has no inside information at all — it guesses from writing style. Detectors are the weakest of the three by a wide margin: independent testing shows they are easily fooled and carry real false-positive risk (our detector guide covers the evidence).

Watermarking is the provider saying “we will mark our own output so you can check”. That is why regulators like it, and why it only works for content from providers that actually do it.

How token watermarking actually works

Text is the hard case — you cannot hide pixels in a sentence — and the solution is one of the more elegant ideas in applied AI. It exploits the one degree of freedom a language model always has: choice among near-equivalent words.

When a model generates text, it produces a probability distribution over the next token (roughly, the next word fragment) and samples from it. Very often, several candidates are almost equally good — “large” versus “big”, “start” versus “begin”, a comma versus a dash. A watermarking sampler uses a secret key to deterministically prefer some of those near-equivalent candidates over others.

The canonical scheme, from a 2023 University of Maryland paper (Kirchenbauer et al.), works like this:

1. At each generation step, a pseudorandom function — seeded by the secret key and the preceding tokens — splits the vocabulary into a “green list” and a “red list”.
2. The sampler gives green-list tokens a small probability boost. The text still reads naturally, because the boost only matters when candidates were near-equivalent anyway.
3. To check a passage, the detector recomputes the green lists and counts how often the text chose green tokens. Unmarked human text hits green about half the time; watermarked text hits it far more often. Over a few hundred tokens, the odds of that bias arising by chance collapse towards zero.

Google’s SynthID-Text — the version actually deployed at scale in Gemini, published in Nature and open-sourced in October 2024 — refines the idea with “tournament sampling”, running candidate tokens through key-seeded comparisons, but the principle is identical: bias the choices, detect the bias statistically.

Three properties follow directly from the mechanism, and they explain almost everything about watermarking’s strengths and limits:

• It needs length. The signal accumulates token by token. A tweet-sized snippet has too few choices to score; a page of prose scores confidently.
• It needs choice. The watermark lives in near-equivalent alternatives. Text with only one right answer — code with a fixed syntax, a list of factual constants, boilerplate — carries little signal, and tools that rewrite those choices (a code formatter such as Prettier, aggressive copy-editing) erase it.
• It degrades with rewriting. Every token a human or another model replaces removes a vote. Light editing usually leaves the mark detectable; heavy paraphrasing or translation replaces most of the tokens and, with them, most of the evidence.

Who watermarks what (August 2026)

The landscape changed decisively in the two weeks around the EU deadline. This table reflects the state as of 13 August 2026.

Two details worth pulling out. First, OpenAI built a text watermarker and shelved it: the company confirmed in 2024 that a ChatGPT text watermarking system existed and was highly accurate, but never shipped it, citing evasion ease and disproportionate impact on non-native English speakers — which makes Anthropic’s global deployment the more striking. Second, the EU’s Transparency Code signatories include Black Forest Labs, Google, Meta, Microsoft, OpenAI and Synthesia (TechCrunch), and the practice is spreading beyond the labs — Suno is marking generated music and Substack is implementing marking measures. Third-party trackers that state “Anthropic has no text watermarking” were accurate until 11 August 2026 and are now out of date.

Claude’s watermark — the first frontier lab to mark text everywhere

On 11 August 2026 Anthropic announced that Claude output now carries provenance marks — the first production-scale text watermarking by a major frontier lab, and the first applied globally rather than only where the law requires it.

The specifics, from Anthropic’s documentation:

• Which models: Claude models launched on or after 2 August 2026 support marking at launch; Anthropic says it is “working to add marking support” to existing models during a transition period.
• Which products: the Claude API, the Claude apps, Claude Code, Claude Cowork and Claude Tag — “wherever Claude is offered, worldwide”, including via AWS, Google Cloud and Microsoft Foundry.
• Text: an imperceptible statistical watermark that “doesn’t change the meaning, quality, or readability” of responses, travels with copy-paste, and “may persist through some editing”.
• Files: supported generated file types (.svg, .png, .jpg) carry signed provenance metadata under the C2PA open standard.
• Detection: promised in forthcoming technical documentation; there is no user opt-out.
• The stated limit: “a detected mark provides a signal that content was processed by Claude, but is not fully conclusive” — and content with no detectable mark may still be Claude-generated if it was heavily edited, short, or produced by an older model.

The reaction was split. Some users objected that routine assistance — reorganising a paragraph, polishing an email — now leaves what one called “a digital tattoo” that schools and employers may treat as a cheating verdict; others countered that the only reason to want unmarked AI text is to pass it off as your own (TechCrunch). Both sides are reacting to the same fact: the mark records processing, and most Claude use is assistance rather than wholesale ghost-writing.

Why now: EU AI Act Article 50

The timing is regulatory. Article 50 of the EU AI Act — the transparency article — became enforceable for the relevant systems on 2 August 2026. It requires providers of AI systems that generate synthetic text, audio, images or video to ensure outputs are “marked in a machine-readable format and detectable as artificially generated or manipulated”, wherever technically feasible, with deepfakes carrying an additional disclosure duty.

The law is deliberately technology-neutral — it does not mandate SynthID, C2PA or any specific scheme — which is why the industry response is a mix of statistical watermarks, signed metadata and visible labels. It is also why the response varies so much in ambition: Google and Anthropic embed marks in the content itself; several others attach strippable metadata and stop there. Anthropic’s distinctive choice was scope — applying the marking worldwide rather than geo-fencing it to the EU (Euronews).

What watermarking cannot do

Watermarking is the most honest technology in the AI-detection space precisely because its makers publish its failure modes. They are structural, not bugs to be patched.

Paraphrasing and translation strip text watermarks. The signal lives in specific token choices; replace the tokens and the signal goes with them. Running marked text through a paraphraser or translating it — including through another AI model — removes most of the evidence. Security researchers have argued from the start that text watermarks will always be trivial to remove for a motivated adversary; the labs’ counter is that most AI text is pasted unmodified, so marking still catches the bulk of real-world cases.

Short text carries no verdict. A sentence or two has too few near-equivalent choices for the statistics to accumulate. Watermark detection is meaningful for passages, not snippets.

Code is a weak carrier. Working code has low entropy — there is often exactly one right token — and formatters, linters and refactoring rewrite whatever stylistic freedom existed. Statistical marks in code should be treated as especially fragile.

Metadata is trivially stripped. C2PA credentials are cryptographically strong while attached, but a screenshot, a re-save, a format conversion or a platform’s image re-encoding on upload silently discards them. Absence of Content Credentials is meaningless.

Coverage is partial by definition. A watermark only exists in content from providers that embed one. Text from ChatGPT, an open-weight model you run yourself, or any pre-2026 model carries no mark at all — so “no watermark detected” can never mean “human-written”. Academic critics argue this coverage gap is the deepest problem: without common standards and universal adoption, watermarking is transparency theatre rather than governance.

Watermarks can be studied and spoofed. Research has shown that deployed watermarking schemes can be detected and reverse-engineered from the outside, raising the prospect of spoofing — deliberately embedding a provider’s pattern in text they never generated. Detection keys therefore stay secret, which in turn limits who gets detector access.

A mark is not authorship. The point the labs keep repeating, and downstream institutions keep ignoring: Claude’s mark on a document is equally consistent with “Claude wrote this essay” and “a student asked Claude to fix the grammar in their own essay”. The mark records that a model touched the text — nothing about whose ideas it contains.

Does this mean teachers and employers can now catch AI text?

Partially, for some models, with serious caveats — and the caveats are where institutions keep getting it wrong.

Where a watermark detector exists and the text came unmodified from a marking model, detection is far more reliable than the style-guessing detectors that preceded it — there is a real signal to find, not a statistical hunch. That is a genuine change: for Gemini output Google operates the SynthID Detector portal, and Anthropic has promised detection tooling for Claude’s marks.

But the practical picture in classrooms and workplaces is messier:

• Most AI text still carries no watermark. ChatGPT — the most-used assistant on earth — does not watermark text, and neither do open-weight models. A watermark regime cannot catch what was never marked.
• The evasion path is the same as before. Paraphrasing tools that already defeat style-based detectors also degrade watermarks. The arms race moved; it did not end.
• The verdict problem transfers. More than 50 universities had already banned or discouraged AI detectors by early 2026 over false-positive harm (our detector guide documents the collapse). Watermark hits invite the same misuse in a new form: a mark that means “Claude processed this” will be read as “Claude wrote this”, despite Anthropic’s explicit warning that the two are different. Proofreading, translation and reorganisation all leave marks.

The defensible institutional posture in 2026 is the one the evidence supported before watermarking arrived: treat any detection signal — watermark or classifier — as a prompt for a conversation about process, never as standalone proof of misconduct.

The bigger picture

Watermarking marks a genuine shift in how the industry thinks about provenance: from detecting AI content after the fact (a losing game) to declaring it at the source (a winnable one, for cooperating providers). The EU forced the timing, but the direction was already set — C2PA adoption across cameras, creative tools and platforms is building an infrastructure where content carries its history by default, and “credentialed” media may eventually be the trusted baseline with everything else treated as unverified.

The unsolved problems are adoption and asymmetry. Marking is voluntary outside the EU’s reach, absent from open-weight models by nature, and skipped entirely by some labs — xAI publishes no watermarking at all. As long as the most permissive provider defines the floor, watermarking tells you where content did come from, never where it didn’t.

Frequently asked questions

Does ChatGPT watermark its text?

No. As of August 2026, OpenAI does not embed a watermark in ChatGPT’s text output. OpenAI built and tested a text watermarking system, confirmed in 2024, but never shipped it, citing how easily paraphrasing defeats it and the risk of disproportionately flagging non-native English writers. OpenAI does attach C2PA provenance metadata to DALL-E 3 and Sora media, and tracker Presenc AI reports SynthID marks in ChatGPT images and GPT-Live audio.

Does Claude watermark its output?

Yes. Since Anthropic’s announcement of 11 August 2026, Claude models launched on or after 2 August 2026 embed an invisible statistical watermark in generated text, and supported generated files carry signed C2PA metadata — across the API, apps, Claude Code, Cowork and Claude Tag, worldwide, with older models being transitioned and no user opt-out. Anthropic states that a detected mark shows content was processed by Claude, not that Claude authored it.

Does Google watermark Gemini’s output?

Yes — most comprehensively of any lab. Google’s SynthID watermarks essentially all Gemini-generated text plus Google’s generated images, audio and video, and Google operates a SynthID Detector portal for checking content. SynthID-Text was published in Nature and open-sourced in October 2024.

Can an AI watermark be removed?

Text watermarks degrade under rewriting: heavy paraphrasing, translation or substantial editing replaces the token choices that carry the signal, and short passages never carry enough signal to score. C2PA file metadata is lost by screenshots, re-saves or platform re-encoding. This fragility is openly documented by the labs themselves — which is why a missing watermark proves nothing, and why watermarking is best understood as catching unmodified copy-paste use rather than determined evasion.

How can I check whether text or an image is AI-generated?

For content from marking providers: Google’s SynthID Detector checks for SynthID marks, C2PA credentials can be inspected with any Content Credentials verifier, and Anthropic has promised detection tooling for Claude’s marks. For everything else you are back to style-based AI detectors, which are far less reliable — independent research puts serious false-positive risk on every major tool. See best AI detectors for the evidence-based rankings.

Is AI watermarking required by law?

In the EU, effectively yes: AI Act Article 50, enforceable from 2 August 2026, requires providers of generative AI systems to mark synthetic output in a machine-readable, detectable way wherever technically feasible, with extra disclosure duties for deepfakes. The law does not mandate a specific technology. There is no equivalent US federal requirement as of August 2026, which is why Anthropic’s decision to apply its marking worldwide — rather than only in the EU — was the notable part of its announcement.

Written 13 August 2026. Watermarking deployments and detector access are moving quickly; provider coverage reflects announcements to that date. Vendor claims about robustness are treated as claims — the failure modes above are drawn from the providers’ own documentation and independent research.

← All guides