How AI Watermarks Work

The core idea: a hidden bias in word choice

A language model writes one token (roughly a word or word-piece) at a time. At each step it has many acceptable options with similar probabilities. A text watermark quietly steers those near-ties using a secret key. Any single choice looks perfectly natural. Over hundreds of words, though, the text ends up with far more 'key-approved' choices than chance would produce. A detector with the same key counts them and runs a statistical test. Nothing is added to the text: no hidden characters, no extra words.

Text watermarking, step by step (green-list method)

1. 1

   Split the vocabulary

   Before each word is chosen, the previous token and a secret key are hashed to split the vocabulary into a 'green' list (for example, a quarter to half of all tokens) and a 'red' list. This method was introduced by Kirchenbauer et al. in 2023.

2. 2

   Nudge toward green

   A small boost is added to the scores of green tokens. The model still picks sensible words, just green ones slightly more often.

3. 3

   Repeat for every token

   Because the split changes at every position, the pattern is spread through the whole text rather than sitting in one place.

4. 4

   Detect with a z-score

   The detector recomputes the green lists, counts how many tokens are green, and compares that with what random text would contain. A high z-score (for example above 4) means the text is almost certainly watermarked, with a very low false-positive rate.

SynthID Text and Claude's watermark

Google DeepMind's SynthID Text, published in Nature in October 2024 and open-sourced, uses 'tournament sampling'. Candidate tokens are scored by several keyed pseudorandom functions, compete in rounds, and the winner is emitted. The method can be tuned so the output distribution is essentially unchanged; a live test on about 20 million Gemini responses found no difference in user ratings. Anthropic says Claude's text watermark, introduced in August 2026, is based on this approach. A secret key replaces the random source used to choose between acceptable words, so no extra tokens are added and cost and speed are effectively unchanged.

The limits of text watermarks

1. 1

   Short text is hard to detect

   The signal accumulates token by token, so a sentence or two rarely contains enough evidence. Detection needs a reasonably long passage.

2. 2

   Low-entropy text carries little signal

   Facts, code, lists and formulaic answers leave the model few free choices, so there is little room to embed the pattern. Anthropic notes this limitation for Claude.

3. 3

   Editing dilutes it

   Every word a human or another model changes removes some of the signal. Light edits usually leave enough behind; a full rewrite does not.

4. 4

   Translation and paraphrasing

   Research (He et al., ACL 2024; Nemecek et al., 2026) found that translating or paraphrasing with a different, unwatermarked model largely erases the mark.

5. 5

   Detection isn't public

   Watermark detectors are controlled by each provider. Anthropic's text detection API is in private preview for groups such as regulators, researchers and educators.