How AI Text Watermarks Work

Nish · August 23, 2026

NLP   Techniques
25 min read

Table of Contents

On 14 August 2026 Anthropic announced that new Claude models now carry an invisible watermark in every piece of text they write. Google’s Gemini app has done the same since 2024, and the reason the rest of the industry is now moving is regulatory: Article 50 of the EU AI Act, which came into force on 2 August 2026, requires providers of generative AI to mark their outputs in a machine-readable way, and Anthropic signed the accompanying Code of Practice in July alongside roughly 190 other organisations. The phrase “invisible watermark in text” sounds like a contradiction. Text is just words; there are no pixels to hide a pattern in. This post explains, from scratch, where the watermark actually lives, how a detector finds it without ever seeing the model, why it works better on an essay than on a bug fix, how much editing it survives, and what it can and cannot tell you about a piece of writing.

TL;DR

  • A language model writes by repeatedly scoring every possible next word and then picking one at random, weighted by those scores. A text watermark hijacks the random part: instead of a true coin flip, the choice among the words the model already likes is settled by a secret key combined with the previous few words. The words that come out are words the model would have written anyway, so the reader sees nothing.
  • Detection needs only the key, not the model. The detector re-derives the keyed “coin” for every word in a passage and counts how often it landed the way the watermark prefers. Human text lands about half the time; watermarked text lands noticeably more often, and the gap becomes statistically unmistakable over a few hundred words.
  • The signal lives only where the model had a genuine choice. Factual statements, code, and light proofreading offer few free choices, so they carry a weak watermark; short passages carry too few coins to judge. In the post’s toy simulation, 100 tokens of ordinary prose are detected 98% of the time at a 1% false-alarm rate, but 100 tokens of constrained, factual text only 50% of the time.
  • Scattered edits hurt more than you might expect, because each changed word also scrambles the keyed coins of the few words after it. In the simulation, rewriting 10% of a 400-token passage leaves detection at 100%, rewriting 20% drops it to 70%, and rewriting 30% to 22%. A full paraphrase by another model removes it entirely; Anthropic says as much.
  • A positive result means “a watermarked model produced these words”, never “this person cheated”, “this is false”, or “that other lab’s model wrote it”. Anthropic has not yet released the detector, and the EU gives providers until February 2027 to make watermarks from different companies checkable in one place.

Three things people mean by “detecting AI text”

Before the mechanism, it helps to separate three ideas that get blurred together in coverage.

The first is stylistic detection: tools such as GPTZero or Pangram read a passage and guess whether a model wrote it from its “tells”, the over-tidy structure, the favourite words, the em-dashes. These tools need no cooperation from the model’s maker, and they are also the ones that produce the famous false accusations of students, because a careful human writer can look like a model, and a model told to write sloppily can look like a human. Nothing in the EU rules is about this.

The second is provenance metadata: a signed label attached to a file saying “made with Claude”. For images and files, Anthropic now uses the C2PA standard (the same “Content Credentials” scheme camera makers and Adobe use) on .png, .jpg and .svg outputs.1 Metadata is honest and cheap, but it lives beside the content, so copying text out of a document, or screenshotting an image, discards it.

The third is the subject of this post: a statistical watermark woven into the choice of words themselves. It survives copy and paste because the words are the content. It needs no metadata, no special characters,2 and no stylistic fingerprint; a watermarked passage reads exactly like an unwatermarked one. And it is detectable only by whoever holds the key, which is both its strength and, as we will see, the source of most of the policy arguments around it.

How a model chooses the next word

Everything depends on one fact about how these models write. A language model does not produce a sentence in one go. It produces one token at a time (a token is a word or a chunk of a word), and at every step it does the same two things.

First it scores every token in its vocabulary as a candidate for the next position. The result is a probability for each of the tens of thousands of tokens it knows, summing to one. Given the prompt “The weather today was cold and”, a good model puts a lot of probability on overcast, grey, cloudy and windy, a little on wet, and essentially none on sugary. Anthropic’s announcement uses almost exactly this example.

Second it picks one. The model does not simply take the top-scoring token every time; text generated that way is repetitive and stilted. Instead it samples: it draws a token at random in proportion to the probabilities, so overcast at 0.31 is chosen a bit more often than grey at 0.28, and sugary at 0.0001 essentially never.3 That randomness is the reason asking the same question twice gives two different answers.

The picked token is appended to the text, and the whole process repeats for the next position. A 500-word reply is a few hundred of these score-then-pick steps in a row.

Now notice what the second step really is. When overcast and grey are both excellent continuations, the decision between them is a coin flip. Nobody, including the model, cares which way the coin lands, because either word is a word the model was happy to write. There are hundreds of such coin flips in any substantial piece of text, and each one is a place where information can be hidden without changing what the text says or how it reads. A text watermark is nothing more than a way of rigging those coins so that someone who knows how they were rigged can check them later.

Rigging the coin with a secret key

The idea traces to a proposal by Scott Aaronson, then at OpenAI, in 2022: replace the model’s true randomness with pseudo-randomness derived from a secret key.4 The scheme Anthropic adopted, SynthID-Text, was published by Google DeepMind in Nature in 2024 and refines that idea; the figure below shows the shape both share.

Three-panel schematic. Panel 1, Model scores words: the prompt 'The weather today was cold and' goes into a language model, which outputs probabilities for overcast (0.31), grey (0.28), cloudy (0.22), windy (0.12) and sugary (0.0001). Panel 2, Pick one: a secret key plus the previous four words produces a keyed coin for each candidate; two candidates, overcast and grey, are drawn by their probabilities, overcast's coin shows 1 and is kept, grey's shows 0 and is dropped. Panel 3, Detect later: a detector with the same key re-flips the coin for every word in a passage; human text shows 1 about half the time, watermarked text clearly more than half.
Where the watermark lives. The model scores candidate words exactly as it always has (left). The only change is in how one of the good candidates is chosen (middle): a secret key and the previous few words generate a keyed coin for each candidate, and the sampler prefers candidates whose coin shows 1. A detector (right) needs only the key: it re-flips every coin in a passage and checks whether 1s are over-represented.

Walk through the middle panel slowly, because this is the whole mechanism.

Step 1: derive a seed from the key and the recent context. At each position, the watermarker takes the secret key (a long random string known only to Anthropic) together with the last few tokens already written (Sebastian Raschka’s walkthrough uses the previous four) and feeds them through a hash function. A hash function is a deterministic scrambler: the same input always gives the same output, the output looks completely random, and you cannot work backwards from output to input. The point of including the recent context is that the “coin” for a given word then depends on where it appears, so the same word can be favoured in one sentence and disfavoured in the next; without that, the watermark would amount to a fixed list of preferred words, which would both be easy to spot and warp the model’s vocabulary.

Step 2: give every candidate token a coin. Extend the hash with the candidate token itself, and take one bit of the result. Every token in the vocabulary now has, for this position, a 0 or a 1 that looks random but is perfectly reproducible given the key. In SynthID’s vocabulary these bits are called g-values.

Step 3: let the coins break ties among good candidates. The simplest version, which is the one the post’s simulation uses, draws two candidate tokens from the model’s probabilities in the ordinary way and keeps the one whose coin shows 1 (if both or neither show 1, it keeps the first draw). Both candidates were sampled from the model’s own distribution, so the kept word is always one the model would plausibly have written; the coin only settles the tie. SynthID-Text runs this as a bracket, which the paper calls tournament sampling: draw a set of candidates, pair them off, advance the winner of each pair by its coin, then repeat with fresh coins for the next round until one token remains. More rounds push the winning token’s coins further from fair, so the signal gets stronger at the price of being a little more selective than the model’s raw distribution.5

The crucial property, and the reason this is invisible, is that the watermark only ever chooses among words the model already rated highly. Anthropic’s announcement makes the point with the word nubilous, an obscure synonym for overcast: the watermark would never pick it, because the model would never have put it among the candidates in the first place. Rigging a coin between overcast and grey does not change the weather report.

A useful way to hold this in your head: the model decides what to say and which words are acceptable; the watermark only decides which acceptable word, and it makes that decision in a way that leaves a fingerprint.

The older “green list” scheme of Kirchenbauer et al. (2023) does the same job with a different lever: the key and previous token split the vocabulary into a “green” half and a “red” half, and a small bonus is added to every green token’s score before sampling. That visibly biases word choice towards green words (it is distortionary by design) but is easier to explain and to analyse, and its detection statistic is the one we use below.

Detecting it without the model

Here is the part that makes the scheme practical. To check a passage, the detector does not need to run the language model, re-create the prompt, or know anything about what the text is about. It needs the key.

For every position in the passage, the detector takes the previous few tokens and the token that actually appears, recomputes the hash with the key, and reads off the coin. Then it averages. Under the watermark, the sampler preferred coins showing 1, so the average sits above one half. In ordinary human writing the coins are just pseudo-random bits that nobody was steering, so about half show 1 and half show 0.

How far above one half, and how many words does it take to be sure? The simulation behind the figures answers that with a deliberately minimal scheme: a toy “language model” that emits a next-token distribution over a 2,000-token vocabulary, the two-candidate rule from the previous section, a real keyed hash (blake2b), and a detector that averages the coins.6 Its design lets us vary one thing that matters a great deal, the peakiness of the model’s distribution, which stands in for how much free choice the text offers.

Start with the theory. With two candidates that are different tokens, each carrying an independent fair coin, the kept token’s coin shows 1 unless both coins showed 0, so the per-token rate is \(1 - \tfrac{1}{4} = 0.75\). The simulation measures 0.746 for its “free-choice prose” regime, where the distribution is flat and the two draws are almost always different words. Human text sits at 0.5. So each watermarked token leans the detector’s average by a quarter, and the question is how many tokens it takes for that lean to stand out from chance.

The chance side is a textbook calculation. For a human passage of \(T\) tokens, the count of 1s is a binomial with mean \(T/2\) and standard deviation \(\sqrt{T}/2\), so the average has standard deviation \(1/(2\sqrt{T})\). At \(T = 200\) that is \(0.035\). If we want to accuse at most 1% of innocent passages, we set the threshold about 2.33 standard deviations above one half, which gives \(0.5 + 2.33 \times 0.035 \approx 0.58\); the simulation’s exact binomial threshold is 0.585.7 Meanwhile the watermarked passages average 0.722, more than six standard deviations above. The two worlds barely overlap.

Two panels. (a) Histograms of detector scores for 600 human-written and 600 watermarked passages of 200 tokens: the human scores cluster around 0.50, the watermarked scores around 0.72, with a dashed threshold at 0.585 that 1% of human passages exceed. (b) Detection power against passage length on a log axis from 25 to 800 tokens, for three regimes: free-choice prose reaches 0.83 at 50 tokens and 0.99 at 100; typical prose 0.70 at 50 and 0.98 at 100; constrained or factual text 0.21 at 50, 0.50 at 100 and 0.94 at 200.
(a) The detector's score on 200-token passages in the toy simulation: human-written text averages 0.498, watermarked text 0.722, and a threshold of 0.585 accuses 1% of human passages. (b) The share of watermarked passages that clear that threshold, as a function of length, for three levels of word-choice freedom. Length and freedom both drive detection; constrained text needs roughly four times as many tokens as free prose to be caught as reliably.

Panel (b) turns this into the number everyone actually wants: how long a passage must be before the detector reliably flags it, at the same 1% false-alarm rate. For ordinary prose the simulation reaches 70% detection at 50 tokens and 98% at 100, and is essentially certain from 200 tokens on. A tweet-length fragment of 25 tokens is caught only 28% of the time: not because the watermark is absent, but because 25 coins cannot separate “a bit above half” from luck. This is exactly the limitation Anthropic states, that detection “doesn’t work well on small samples”, and it is statistical, not an engineering gap that a better detector could close.

Two practical consequences follow directly from the mechanism. Because the detector needs only the key, checking text is cheap: a hash per token, no GPU. And because the key is the whole secret, whoever holds it holds the ability to detect; Anthropic has said it will offer a detection API and documentation for third parties, and that a detection result cannot identify the user, organisation, or conversation that produced the text, which is true by construction, since nothing about the user enters the hash.

Where the signal is thin

The watermark can only be written where the model had a genuine choice. That single sentence explains every caveat in Anthropic’s announcement, so it is worth making precise.

The grey line in panel (b) is the simulation’s “constrained / factual” regime, where the toy model’s distribution is peaked: its average entropy is 2.07 bits per token against 5.60 for typical prose and 10.24 for free-choice prose.8 With a peaked distribution, the two candidate draws are often the same token, and when they are, there is no tie for the coin to break; the watermarker has no choice to make. The measured per-token rate falls from 0.746 to 0.639, the lean per token halves, and the detector needs about four times as many tokens to recover the same confidence: 50% detection at 100 tokens, 94% at 200.

Real text has this structure everywhere. Anthropic’s example is “Isaac Newton’s most famous work was called Principia …”, where Mathematica is the only right continuation. A sequence of facts is a sequence of positions with no slack. The same goes for anything the model copies from the prompt, and for the most common case of all in practice, code, where an exact output is required and Anthropic says the watermark simply is not applied to the functional parts, leaving only comments and naming with enough freedom to carry it. Proofreading is the extreme case: if you hand Claude your own essay and ask it to fix grammar, the only watermarked tokens are the handful it changed, which is too few to register, and the rest is your unwatermarked writing. Anthropic’s support article states the corresponding rule of interpretation plainly: a mark indicates that Claude processed the text, not that it authored it.

There is one more way to remove the slack, and it sits on the user’s side: temperature 0. If an API caller asks for fully deterministic output, the model always takes its top token, every candidate draw returns the same word, and there is nothing for the coins to decide. Goedecke makes this point as a weakness; in practice consumer products do not run at temperature 0, and a provider can always choose to watermark at the sampling layer regardless of the requested setting, but it is a reminder that the watermark is a property of sampling, not of the model’s knowledge.

How much editing it survives

Anthropic’s own answer to “can it be removed?” is candid: “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.” The simulation lets us put a curve on the space between those two.

Take a 400-token watermarked passage of typical prose and have a “human editor” replace a fraction of its tokens with unkeyed words at random positions, then run the same detector.

Line chart of detection power against the fraction of a 400-token watermarked passage rewritten by a human. Power is 1.00 at 0%, 5% and 10% rewritten, 0.95 at 15%, 0.70 at 20%, 0.38 at 25%, 0.22 at 30%, 0.06 at 40%, and at or near the 1% false-positive floor from 50% onward. An annotation notes that each rewritten word also scrambles the keyed coins of the four words that follow it.
Detection power for a 400-token watermarked passage as a growing share of its tokens is rewritten. The signal survives light editing untouched, then collapses between roughly 15% and 40% edits, because every changed word also invalidates the context used to compute the coins of the few words after it. The dotted line is the 1% false-positive rate: below it, the detector is doing no better than accusing random human text.

Ten percent of tokens rewritten, which is a reasonable model of someone fixing phrasing as they read, leaves detection at 100%. But by 20% it is down to 70%, by 30% to 22%, and by 40% the passage is indistinguishable from human writing. The collapse is steeper than the fraction of edited words alone would suggest, and the reason is the context window from step 1. Each coin is computed from the previous four tokens, so changing one word does not just remove that word’s coin from the tally: it scrambles the coins of the next four words as well, which the detector now recomputes from the wrong context and reads as random. Scattered edits are therefore worth several times their weight in damage.9

This is the observation that drives Goedecke’s argument that text watermarks “will always be trivial to remove”, and Raschka’s prediction that the practical workaround will be to run a watermarked model’s output through a cheap local model that rewrites it. Both are right about the mechanism. A paraphrase that replaces most of the words replaces most of the coins, and an unwatermarked model doing the paraphrasing has no key to preserve. Independent testing by the SRI Lab at ETH Zürich found that a baseline paraphraser scrubbed SynthID-Text watermarks from the large majority of passages, and that the scheme is, in their phrase, “harder to spoof but easier to scrub” than earlier designs.10 Raschka’s second observation is the one worth remembering, though: a laundered output has been through a worse model, so it will usually be slightly worse text. The watermark does not stop determined evasion; it adds a cost and a quality tax to it.

What a positive result means, and what it does not

It is easy to read “Claude now watermarks its text” as “there is now a reliable AI-text detector”. The mechanism above says something narrower and more useful.

A confident detection tells you that a watermarked model produced most of these words, and they have not been heavily rewritten since. It tells you nothing about who asked for them, why, or whether the text is true. It cannot tell you that a student cheated: a student who drafted their own essay and asked Claude to tighten it will carry a faint mark on the tightened sentences and none on the rest, and a student who had Claude write it and paraphrased the result will carry none at all. It is also blind to every other provider’s models. Each company holds its own key, so Anthropic’s detector cannot see a Gemini watermark and vice versa, and a passage from an open-weights model run on a laptop has no watermark to find.

A negative result is even weaker. Short text, factual text, code, edited text, text from an older Claude model not yet covered by the rollout, and text from any non-watermarking model all come back “nothing found”, and the detector cannot tell these cases apart.

That asymmetry is the honest frame for the whole technology. A watermark is a cooperative signal: it lets a provider answer “did one of our models write this?” for anyone who asks, cheaply and with a controllable false-positive rate, in the common case of unedited output. It is not an adversarial tool, and Google’s own announcement called it “not a silver bullet”. The EU’s framing matches this: the Act asks for marks that are effective, interoperable, robust and reliable, and the Commission’s Code of Practice acknowledges that no single technique meets all four, which is why Anthropic is using a statistical watermark for text and C2PA metadata for files, and why the rules allow a phase-in.11 The interoperability requirement, a single place where a journalist or platform can check a passage against every major provider’s watermark, is due by February 2027 and is the piece that will decide whether any of this is usable outside the labs.

What Anthropic has actually shipped

For completeness, the concrete facts as of the announcement and support article, since they are easy to lose in the commentary:

  • What: a statistical text watermark, described as “a version of the SynthID-Text approach”, on text from new Claude models, plus C2PA Content Credentials on .png, .jpg and .svg files.
  • Which models: models launched from 2 August 2026 support it at launch; earlier models are being brought in over the following months under the EU’s transition period. Anthropic has not named which older models are already covered.
  • Where: the Claude apps, Claude Code, Claude Cowork, the Claude Platform API, and Claude on AWS, Google Cloud and Microsoft Foundry where supported, worldwide rather than EU-only. No opt-out is described.
  • Detection: a detection API is “coming soon”, with details of the detection mechanism promised in technical documentation. As of writing, nobody outside Anthropic can check for a Claude watermark.
  • Quality: Anthropic reports no measurable impact on content, creativity or readability, citing DeepMind’s live Gemini experiment for the same finding.

OpenAI, for comparison, disclosed in 2024 that it had built a text watermarking system of this kind and chosen not to deploy it, citing paraphrasing attacks and the risk of disproportionately affecting non-native English writers who use its models for help; the EU timeline is what has changed since.

The simulation, for anyone who wants to poke at it

The block below is the complete toy scheme used for every number in this post: the keyed coin (g_value), the two-candidate watermarked sampler, the detector, an exact false-positive threshold, and a power estimate. It is numpy plus the standard library. The figures ran the same functions at larger sample sizes; this demo runs a single regime in a few seconds, with its output shown at the end.

The keyed-coin watermark in ~60 lines of Python (click to expand)

Try changing scale (peakier distributions = less free choice), CONTEXT (the edit-robustness trade-off), or edit_frac to reproduce the effects in the figures.

import hashlib
from math import comb
import numpy as np

KEY = b"anthropic-would-never-publish-this"
VOCAB = 2000
CONTEXT = 4


def g_value(key, context, token):
    """One secret bit per (context, candidate token): the keyed coin flip."""
    msg = ",".join(map(str, context)) + ":" + str(token)
    return hashlib.blake2b(msg.encode(), key=key, digest_size=1).digest()[0] & 1


def toy_lm(rng, scale):
    """Next-token distribution for one position. Larger scale = peakier."""
    logits = scale * rng.standard_normal(VOCAB)
    p = np.exp(logits - logits.max())
    return p / p.sum()


def sample_watermarked(rng, key, T, scale, watermark=True):
    """Generate T tokens. Watermarked: draw two candidates, keep one with g=1."""
    tokens = list(rng.integers(VOCAB, size=CONTEXT))   # a random prompt
    for _ in range(T):
        p = toy_lm(rng, scale)
        ctx = tuple(tokens[-CONTEXT:])
        a, b = rng.choice(VOCAB, size=2, p=p)
        if watermark and g_value(key, ctx, a) == 0 and g_value(key, ctx, b) == 1:
            a = b
        tokens.append(int(a))
    return tokens


def detector_score(key, tokens):
    """Mean g-value over the passage (0.5 expected for human text)."""
    gs = [g_value(key, tuple(tokens[i - CONTEXT:i]), tokens[i])
          for i in range(CONTEXT, len(tokens))]
    return float(np.mean(gs))


def threshold(T, fpr):
    """Smallest mean score a human passage exceeds with probability <= fpr."""
    counts = np.arange(T + 1)
    tail = np.array([sum(comb(T, j) for j in range(k, T + 1)) / 2 ** T
                     for k in counts])
    k_star = int(counts[tail <= fpr][0])
    return k_star / T


def power(rng, key, T, scale, n, fpr=0.01, edit_frac=0.0):
    """True positive rate at the given false positive rate, from n passages."""
    thr = threshold(T, fpr)
    hits = 0
    for _ in range(n):
        toks = sample_watermarked(rng, key, T, scale)
        if edit_frac > 0:
            idx = rng.choice(np.arange(CONTEXT, len(toks)),
                             size=int(round(edit_frac * T)), replace=False)
            for i in idx:                      # a human rewrite: unkeyed word
                toks[i] = int(rng.integers(VOCAB))
        hits += detector_score(key, toks) > thr
    return hits / n


rng = np.random.default_rng(1)
human = sample_watermarked(rng, KEY, 1000, 3.0, watermark=False)
marked = sample_watermarked(rng, KEY, 1000, 3.0, watermark=True)
print(f"per-token bit rate  human {detector_score(KEY, human):.3f}"
      f"  watermarked {detector_score(KEY, marked):.3f}")
print(f"200-token threshold at 1% FPR: {threshold(200, 0.01):.3f}")
for T in (50, 100, 200):
    print(f"power at {T} tokens: {power(rng, KEY, T, 3.0, 100):.2f}")
print(f"power at 400 tokens, 25% rewritten: "
      f"{power(rng, KEY, 400, 3.0, 100, edit_frac=0.25):.2f}")
# per-token bit rate  human 0.496  watermarked 0.729
# 200-token threshold at 1% FPR: 0.585
# power at 50 tokens: 0.67
# power at 100 tokens: 0.94
# power at 200 tokens: 1.00
# power at 400 tokens, 25% rewritten: 0.39

Sources and further reading

  1. C2PA is the Coalition for Content Provenance and Authenticity, an open specification for cryptographically signed manifests describing how a file was made and edited. Anthropic’s support article lists the supported file types and notes that the label records that Claude processed the file, not that it authored everything in it. ↩

  2. There is a cruder trick worth distinguishing: swapping ordinary characters for look-alike Unicode code points (a three-per-em space for a normal space, a curly apostrophe for a straight one). That is trivially visible in a text editor and trivially stripped by retyping, so it is not what Anthropic or Google mean by a watermark, although Sean Goedecke speculates about its use for tagging. ↩

  3. The sampling “temperature” setting that API users see rescales these probabilities before the draw: temperature 0 always takes the top token, higher temperatures flatten the distribution. This matters for watermarking, as a later section explains. ↩

  4. Aaronson described the scheme in a November 2022 talk at UT Austin, later written up on his blog. His version picks, at each step, the token \(i\) that maximises \(r_i^{1/p_i}\), where \(p_i\) is the model’s probability and \(r_i\) is a keyed pseudo-random number in \([0, 1]\); a neat piece of probability shows that this samples exactly from \(p\) when the \(r_i\) are uniform, so the watermark is distortion-free by construction. ↩

  5. Watermarks are classed as distortion-free if the watermarked text has exactly the same distribution as unwatermarked text (Aaronson’s scheme, and Kuditipudi et al.’s 2023 construction, have this property over a single response), or distortionary if they nudge it. SynthID-Text can be configured either way, and DeepMind’s paper reports a live test on nearly 20 million Gemini responses in which users’ thumbs-up and thumbs-down rates showed no statistically significant difference between watermarked and unwatermarked replies; Anthropic cites the same result and reports no measurable effect in its own testing. ↩

  6. Everything quoted in this and the next two sections comes from the script that draws the figures; a runnable copy is in the foldable block at the end of the post. The scheme is a one-round tournament with two candidates, which is weaker than production SynthID with its multiple rounds, so treat the numbers as a lower bound on what a real detector sees, not an estimate of Claude’s detector. ↩

  7. This is the \(z\)-score test from Kirchenbauer et al.: \(z = (\text{count} - T/2)/(\sqrt{T}/2)\), compared against a normal tail. The script computes the binomial tail exactly rather than using the normal approximation, and cross-checks it against scipy.stats.binom. ↩

  8. Entropy here is the usual information-theoretic measure of how spread out a distribution is: a distribution with entropy \(h\) bits is as unpredictable as a fair choice among \(2^h\) options. Roughly, 10 bits means the model is choosing among a thousand plausible tokens, 2 bits among four. ↩

  9. Designers know this and tune the context length accordingly: a shorter context makes the watermark more robust to edits but makes it easier to forge and more likely to repeat the same coin in repetitive text; SynthID-Text pairs a longer context with a “repeated context masking” rule that skips watermarking at positions whose context has already been seen, so the same choice is never forced twice. Those are engineering trade-offs, not fixes for the underlying fact that the watermark lives in the words and goes wherever they go. ↩

  10. Scrubbing means removing a watermark from text that has one; spoofing means forging the watermark onto text that never came from the model, for example to frame someone or discredit the detector. Spoofing requires learning the key’s behaviour from many watermarked samples, and the SRI results suggest SynthID’s tournament design makes that harder than for green-list schemes. Their experiments used SynthID-Text on an open model they watermarked locally, not Gemini or Claude. ↩

  11. Per the final Code of Practice as summarised by Bird & Bird: Article 50 obligations apply from 2 August 2026, with marking and detection for generative systems already on the market deferred to 2 December 2026 and the interoperability solution to 2 February 2027. Content published before 2 August 2026 need not be marked retroactively. ↩

Citation Information

If you find this content useful, please cite this work as:

Bhana, Nish. "How AI Text Watermarks Work". Nish Blog (August 2026). https://www.nishbhana.com/AI-Text-Watermarking/

Or use the BibTeX citation:

@article{bhana2026aitext,
  title   = {How AI Text Watermarks Work},
  author  = {Bhana, Nish},
  journal = {nishbhana.com},
  year    = {2026},
  month   = {August},
  url     = {https://www.nishbhana.com/AI-Text-Watermarking/}
}

Related Posts 🔥

Reasoning Effort: The Dial That Sets How Long a Model Thinks
NLP Jul 2026
The Metric Is the Spec: Choosing and Designing Evaluation Metrics
ML Jul 2026
Speculative Decoding: Two Models, One Voice
NLP Jul 2026
Mixture of Experts: Trillions of Parameters, a Fraction at a Time
NLP Jul 2026
Online Experimentation: A/B Testing a Subscription Business Without Fooling Yourself
ML Jul 2026
J-Space: How Anthropic Reads Claude's Silent Thoughts
NLP Jul 2026

x.com, Facebook