How AI Text Watermarks Work: Statistical Marks, Hidden Characters & Provenance
When people hear “Claude watermarks its text,” the intuition is usually wrong. There is no logo, no hidden character, nothing you could find by pressing Ctrl+F. Modern text watermarks live somewhere less obvious: in the choices the model makes.
The core idea: bias the coin flips
A language model produces text by repeatedly choosing the next token from a probability distribution. At many steps, several candidates are almost equally good — “large” vs “big”, comma vs “and”, one sentence order vs another.
A statistical watermark exploits that freedom. Using a secret key, the generator subtly prefers certain candidates — often described as a “green list” that changes pseudo-randomly at each step. Any single choice looks completely natural. But across a few hundred words, the marked text agrees with the key-derived preferences far more often than chance. The provider, holding the key, can measure that agreement and state, with quantifiable confidence, that the text carries its mark.
Three properties follow directly:
- Imperceptible by design. The mark changes which good word gets picked, not the quality or meaning. That is why Anthropic can say the watermark “doesn’t change the meaning” — and why no character-level inspection can reveal it.
- Statistical, not binary. Detection strength grows with length. A tweet-sized quote may be undecidable; an essay gives a strong signal.
- Fragile under transformation. Paraphrasing, translation, heavy editing — anything that re-chooses the words — erodes the pattern. Anthropic explicitly warns that heavily edited or translated content may no longer be detectable.
Public research behind this family of techniques includes the University of Maryland “green list” scheme (Kirchenbauer et al., 2023) and Google DeepMind’s SynthID-Text, published in Nature in 2024 and deployed in Gemini. Anthropic has not published its exact scheme; the description above is how the published family works, not a claim about any provider’s secret internals.
What text watermarks are not
Not hidden characters. Zero-width spaces and friends are a real phenomenon — a different one. They are trivially checkable by anyone (this site does it deterministically) and trivially removable, which is exactly why serious provider watermarks don’t rely on them.
Not AI classifiers. A classifier guesses from style with no key and no provider attestation — see watermark vs detector.
Not provenance metadata. C2PA Content Credentials travel with a file as signed metadata. Plain text — copied out of a chat window — carries no file to attach metadata to, which is precisely the gap statistical watermarks fill.
Who deploys what for text, today
| Provider | Text watermark | Who can verify |
|---|---|---|
| Anthropic (Claude) | Deployed in models launched since Aug 2, 2026 | Anthropic; third-party detection announced, not yet released |
| Google (Gemini) | SynthID-Text deployed | Google (Gemini app; detector portal on waitlist) |
| OpenAI (ChatGPT) | None deployed | — (researched, never shipped) |
Current details and sources live on the status page.
Why providers keep the detector private (for now)
Publishing a detector means publishing an oracle: run it in a loop, edit until the signal disappears, and you have a washing machine for watermarks. Providers therefore tend to gate verification (Google’s waitlisted portal) or stage the rollout (Anthropic’s “technical documentation to follow”). The trade-off is real: a watermark only builds public trust once the public can check it. That tension — and each provider’s current answer to it — is the most useful thing to track in this space.
When third-party verification does ship, it plugs into the Claude checker and text checker as a clearly labeled official check. Until then, those pages do only what can be done honestly: deterministic inspection, provenance validation, and accurate status.