How AI text watermarking works

← declaude

A gentle, ocular locomotion done really a statistical people hides inside generated text, and what erases it.

From the folks astatine NOPE, arsenic a companion to declaude.

A watermark successful plain matter sounds impossible. Text has nary pixels to hide information in, and nary metadata survives copy-and-paste; each characteristic is correct location successful beforehand of you. Where could a people perchance go?

And yet the marks are real. Google has watermarked matter from the Gemini app and web acquisition since 2024 (its API is, astatine the clip of writing, a documented exception), and arsenic of August 2026, caller Claude models people matter astatine the model level, pinch earlier models being brought successful down them. They're invisible, they past copying, and they activity because they don't unrecorded successful the characters astatine all. They unrecorded successful the choices betwixt them.

Five short steps, each pinch thing to flick at. Nothing harder than counting.

1. Writing is simply a bid of mini choices
2. A concealed cardinal leans connected those choices
3. Whoever holds the cardinal tin count
4. What editing does to the mark
5. What this intends successful practice

1. Writing is simply a bid of mini choices

The 1 thought successful this step: a exemplary writes by rolling weighted dice betwixt respective words that would each beryllium fine.

When a exemplary is mid-sentence, it doesn't cognize "the adjacent word." It has a shortlist, for illustration autocomplete, pinch preferences. Here's a existent benignant of moment, 1 connection from the extremity of a sentence:

A page of matter contains hundreds of these small forks, 1 per word, and astatine galore of them respective options are arsenic fine. That slack is the earthy material. Whoever gets to thin connected really the dice onshore tin hide a shape successful the matter without changing what it says.

2. A concealed cardinal leans connected those choices

The 1 thought successful this step: the cardinal secretly colours the shortlist and gives 1 colour a gentle nudge. The matter still sounds normally.

Here is the classical look (Kirchenbauer 2023; Google's SynthID reaches the aforesaid extremity by a subtler, tournament-style route). At each fork, secret-keyed maths splits the campaigner words into green and red, an arbitrary colouring only the key-holder tin reproduce. Then the dice get tilted a small toward green.

Two things make this sneaky. The nudge is mild: a reddish connection tin still win, it's just a small little likely. And the colouring is not a fixed spot of the word: the key computes it from a short tally of the words conscionable before, truthful the aforesaid campaigner is green aft 1 prefix and reddish aft another:

(Two siblings, aforesaid principle. Google's SynthID (the 1 successful production) replaces the nudge pinch a mini secret tournament: a fewer candidates are drawn from the model's ain odds, the cardinal scores them, and the bracket is arranged truthful that, averaged complete the key's draws, each word's odds enactment precisely what the exemplary intended. Aaronson's scheme, built astatine OpenAI, skips moreover that and derives the dice-rolls themselves from the key. Different maths, same principle: the people lives successful the choices.)

3. Whoever holds the cardinal tin count

The 1 thought successful this step: pinch the key, you tin re-colour immoderate matter and simply count. Marked matter lands greenish excessively often to beryllium luck.

Detection doesn't publication the matter aliases judge its style. The detector replays the key-holder's colouring complete the words and counts really galore came up green. Without a mark (or without the correct key), greenish should triumph astir half the time. A coin flip. Here's an ordinary-looking paragraph; effort some keys connected it:

Note really demanding the barroom is. This paragraph is visibly tilted and still too short to flag. Detectors are tuned truthful that mendacious alarms are vanishingly rare; the value is that short, edited, aliases weakly marked matter is often missed, and 55 words of a mild thin isn't capable evidence. Press keep reading: the thin stays precisely the aforesaid while the barroom slides down to meet the increasing evidence. Length is portion of the test. (And this demo's tilt is drawn beardown truthful you tin spot it; a accumulation people leans acold much mildly and needs correspondingly much text. In this demo's 50/50 model, a 1,500-word archive would emblem astatine only ~55% green: small leans go persuasive only done length, which is why short texts are genuinely difficult to call, for anyone.)

4. What editing does to the mark

The 1 thought successful this step: the people lives successful runs of untouched wording. Editing erases it precisely wherever the runs break, and obscurity else.

Each word's colouring is derived from a short tally of the words conscionable earlier it (one to a handful, depending connected the scheme). So a position only counts arsenic grounds if a short model of the original wording (the connection positive its neighbours) survives intact.

Here is the aforesaid paragraph from measurement 3, astatine 5 edit depths. Drag the slider and watch the highlighted runs shrink. A item intends that tally of wording still matches the original exactly, truthful the detector tin count there. Everything faded is new wording, wherever location is thing but coin-flip sound near to count.

On existent implementations (MarkLLM's KGW and EXP schemes connected an unfastened model, washed by declaude's full-rewrite route): astir 0.5% of windows survive, and detector accuracy falls from fundamentally definite to a coin flip. The published lit agrees connected the style of this. Light aliases one-pass paraphrase dilutes the people alternatively than deleting it; successful Kirchenbauer et al.'s experiments, discovery recovered fixed enough text, pinch moreover quality paraphrase becoming detectable again aft astir 800 tokens (about 600 words). What removes the people is re-composition that shares nary runs of wording pinch the original.

That is why a instrumentality that rewrites from the meaning (like declaude's full-rewrite route) is what really erases this family of mark, and why a light walk that keeps astir of the phrasing does not.

One bound stated plainly: those numbers travel from unfastened implementations we can measure. Anthropic's accumulation strategy is undisclosed, truthful nary 1 extracurricular Anthropic tin yet tally this trial against Claude's ain mark. What our experiments support is the mechanism, for the family of schemes this page describes.

5. What this intends successful practice

The 1 thought successful this step: discovery is private, probabilistic, and astir processing, not authorship.

• Only the key-holder tin check. Your teacher, editor, aliases favourite "AI detector" website cannot tally this test; an authentic cheque needs the provider's concealed key, aliases a checking work the supplier runs. Google runs an early-access detector portal for SynthID; Anthropic says discovery tooling is forthcoming.
• A watermark cheque is not an "AI detector." Tools for illustration GPTZero conjecture from style and are famously unreliable. A watermark is the opposite: a deliberate, key-gated statistical test. Don't fto the 2 blur.
• A recovered people intends "processed by," not "written by." Anthropic's own archiving notes that quality matter simply proofread aliases translated by Claude picks up the mark. And absence proves moreover less: aged models, short passages, aliases dense editing each output cleanable results connected genuine AI text.
• Short and low-choice matter carries small mark. Evidence grows pinch length, and matter pinch only 1 correct continuation (code, quotations, lists of facts) offers the dice excessively small slack to hide thing in.
• Certain marks outlive a rewrite. Schemes keyed connected the connection itself alternatively than its neighbours clasp up acold better: a same-meaning rewrite keeps capable of the words that overmuch of the people survives. (Their weakness is different: a colouring reused everyplace tin beryllium reverse-engineered from capable output.) Others hide successful the meaning, and a same-meaning rewrite partly preserves them. Those are a different problem.
• Production parameters are unpublished (context length, cardinal structure, thresholds), truthful everything present describes the family of schemes, not any circumstantial deployment.

Written by James Padolsey at NOPE arsenic an accompaniment to declaude. The interactive figures are a school model pinch schematic parameters, not immoderate provider's existent scheme.

Sources & further reading. Kirchenbauer et al., A Watermark for Large Language Models (ICML 2023) · Dathathri et al., Scalable watermarking for identifying LLM outputs (SynthID-Text, Nature 2024) · Aaronson & Kirchner, Watermarking GPT outputs (2022) · Kirchenbauer et al., On the Reliability of Watermarks for Large Language Models (ICLR 2024) · Sadasivan et al., Can AI-Generated Text beryllium Reliably Detected? (2023) · Zhao et al., The Mark Fades: Adaptive Evolutionary Paraphrase-based Attack (ACL Findings 2026) · Anthropic, How Claude marks AI-generated content (Help Center, Aug 2026) · Our ain known-key experiments: re-composition collapses KGW/EXP discovery to chance (AUC 0.99 → ≈0.5), context-free unigram marks past (0.73–0.84); outline-level regeneration is the only reply we cognize for meaning-space marks.

For the specialist: the residual-evidence exemplary down the step-4 verdict is z ≈ f·√N·z₁ (surviving fraction f, archive magnitude N, per-token strength z₁). The figures count words; existent detectors count the model's ain tokenizer's tokens. Same shape.