AI Text Watermarking: The Statistics Hiding Inside Every Sentence

Something changed on August 2, 2026. Every new Claude model started embedding an invisible mark into the text it generates. You can't see it, strip it with backspace, or find it with Ctrl+F. But it's there — baked into which words were chosen. Google's been doing the same thing since 2024. OpenAI still hasn't shipped text watermarking, though the research has existed for years. This isn't a niche topic anymore. It now touches text you generate every day. Here's how it actually works. First: what a watermark is not Not hidden characters. Not invisible Unicode. Not metadata appended to the file. The watermark is the text — specifically, a statistical bias in which words the model picked. That single insight is what everything else follows from. How an LLM picks the next word A language model doesn't know "the next word." It calculates a probability score over its entire vocabulary — typically 50,000 to 100,000+ tokens — then samples from that distribution. If the model is mid-sentence and large, big, substantial, and considerable would each fit, they each get a score. Sampling turns that weighted distribution into an actual pick. The watermark lives here — in which token gets picked. The KGW mechanism (the green list) The dominant approach comes from a 2023 ICML paper by Kirchenbauer, Geiping, and Wen. It's called KGW. Before each token is sampled: Take the previously generated token as a seed. Use a secret key + a hash function to split the vocabulary into two groups: a green list and a red list (roughly 50/50). Add a small constant δ to the logit scores of every green-list token. Sample normally from the nudged distribution. The bias is tiny — on any single token, nothing looks off. But over 300 tokens, if 62% came from the green list when chance predicts 50%, that's a statistically significant event. It doesn't happen by accident. Detection needs just two things: the text, and the same secret key. Re-derive the green/red split at each position using the same hash — it's deterministic, so it reproduces exactly. Count the green tokens. Run a one-proportion z-test. If the z-score clears the threshold, the watermark is there. The z-score grows with the square root of document length. Short texts rarely have enough tokens to reach significance. Google's SynthID: tournament sampling Google's SynthID-Text, published in Nature in 2024, takes a different path. Instead of a green/red split, it samples multiple candidate tokens, assigns each a pseudorandom g-value keyed to a secret, then runs a tournament-style knockout to pick the winner. Less quality degradation than KGW's binary approach, and harder to spoof. The tradeoff is compute. Google has used SynthID on Gemini app and web outputs since 2024. The API has been a documented exception. Claude's watermark (August 2026) Anthropic hasn't published the exact mechanism. What's confirmed: Effective August 2, 2026, all newly launched Claude models embed an imperceptible watermark in generated text. This applies globally — not just EU users — across Claude.ai, the API, Claude Code, and cloud partners. Files (.svg, .png, .jpg) get C2PA-compliant provenance metadata instead of a token-level signal. Older models will follow before the EU grace period ends December 2, 2026. GPTZero's CTO Alex Cui published a technical thread on August 11 explaining how frontier labs typically implement text watermarking at production scale. He described the KGW approach — hash over previous tokens plus a secret key, green/red vocabulary split, detection by counting green draws — as the method fast enough for streaming models. Worth noting: he was describing the general industry method, not Claude's confirmed implementation. Anthropic hasn't disclosed what they actually use. But what Cui described is consistent with everything public. One confirmed detail: the model itself isn't aware it's being watermarked. The signal is injected at the sampling layer. What erases it Light paraphrase dilutes, doesn't erase. A one-pass rewrite weakens the signal but rarely kills it. The WaterPark benchmark (J. Liang et al., EMNLP Findings 2025) tested ten watermarking methods against twelve attack types. A single ChatGPT paraphrase pass dropped every tested method below 30% TPR. For SynthID specifically, TPR fell from 0.998 on clean text to 0.498 under moderate paraphrasing — half the signal, one pass. Re-composition kills it. The harder attack isn't "rewrite this paragraph" — it's "read this, then write a new version from scratch." When a model regenerates from a summary or outline, the original token choices are gone and so is the fingerprint. Published literature on summarization-based attacks consistently shows detection collapsing toward chance under full rewrite. Translation. Translate to another language, then back. The vocabulary partition was defined for the source language. A different tokenizer sees different splits. Fine-tuning. If the watermarked model gets fine-tuned on new data, the sampling distribution shifts and the signal fades. What doesn't erase it: copy-paste, reformatting, changing fonts, or adding punctuation. None of that touches which tokens were picked. The authorship trap The biggest misconception about this technology is what it proves. A watermark doesn't mean a human didn't write the text. It doesn't mean one did. It doesn't prove authorship at all. It means Claude processed that text — even if you only asked it to proofread a paragraph or fix formatting. Anthropic says the mark only shows Claude "had a hand in something," not that Claude wrote the whole thing. This matters for academic integrity enforcement. The pre-watermark AI detectors — pure statistical classifiers — already have documented false-positive problems. A 2023 study (W. Liang et al., Patterns, vol. 4, issue 7) tested seven detectors on 91 TOEFL essays written by non-native English speakers. False-positive rate: 61.3%. The same detectors classified native-speaker essays with near-perfect accuracy. UCLA opted out of Turnitin's AI detection at launch. UC San Diego Extended Studies deactivated it in April 2025. Watermarks are more reliable than classifiers when the signal is intact. But "intact" is a big caveat. And a watermark's absence proves nothing. Files: C2PA Text gets a token-level signal. Files get something different. C2PA (Coalition for Content Provenance and Authenticity) is an open standard for attaching cryptographically signed provenance metadata to media files. It records that a file was processed by Claude and flags whether it's been tampered with since. Any C2PA-compliant reader can verify the signature. The catch: it lives in the file's metadata layer, not the content. Strip the metadata and the signal is gone — meaningfully different from a text watermark, which travels with the words. Where this is heading No detection API has shipped yet. Anthropic confirmed one is coming ("that you can use yourself"), but as of mid-August 2026, there's no public tool to check whether a given piece of text carries the Claude watermark. An Anthropic engineer put it plainly on August 12: "it's not perfect, you can edit it, but it's a first step." The EU AI Act's Article 50 is what triggered deployment. OpenAI hasn't announced a text watermark. The research has existed since Aaronson and Kirchner's 2022 proposal — the deployment gap has just been long. The mechanism is real. The gap between "signal is embedded" and "signal can be verified by anyone" is also real. The one-sentence version An LLM generates text by sampling from a probability distribution over its vocabulary; a watermark biases that sampling using a secret key, leaving a statistically detectable pattern in which tokens were chosen — a pattern that survives copying and light editing, but collapses under full re-composition. Sources: Kirchenbauer et al., A Watermark for Large Language Models (ICML 2023) Kirchenbauer et al., On the Reliability of Watermarks for Large Language Models (ICLR 2024) Dathathri et al., Scalable watermarking for identifying LLM outputs (SynthID-Text, Nature 2024) W. Liang et al., GPT detectors are biased against non-native English writers (Patterns, vol. 4, issue 7, 2023) J. Liang et al., Watermark under Fire: A Robustness Evaluation of LLM Watermarking (WaterPark, EMNLP Findings 2025) TechCrunch, Anthropic says it will watermark text generated by its AI models (Aug 11, 2026) Alex Cui / GPTZero, technical thread on text watermarking methods (Aug 11, 2026) Originally published on ZyVOP 💡 For more articles like this, subscribe to the ZyVOP newsletter!