AI Text Watermarking: The Statistics Hiding Inside Every Sentence

On August 2, 2026, a significant change took place. Every new Claude model began embedding an invisible mark into the text it generates. This mark, which you cannot see or remove using standard methods, is actually statistical bias in the word choices made by the model. Google has been employing similar techniques since 2024, while OpenAI has yet to implement text watermarking despite possessing the research for years. This development is no longer confined to niche interests but now impacts the text you generate daily.

To understand how this watermark works, one must first comprehend what it is not. It is not hidden characters, invisible Unicode, or metadata appended to the file. Instead, it is the statistical bias in which words the model selects. A language model doesn't know the next word; it calculates a probability score over its vast vocabulary (typically 50,000 to 100,000+ tokens) and then samples from that distribution. The watermark resides in this selection process.

The KGW mechanism, developed by Kirchenbauer, Geiping, and Wen in a 2023 ICML paper, is the dominant approach for watermarking. Before each token is sampled, the previous token is used as a seed. A secret key, combined with a hash function, divides the vocabulary into two groups: a green list and a red list, roughly 50/50. A small constant is added to the logit scores of the green-list tokens, nudging the distribution.

When the model samples, this slight bias in word choice becomes the watermark. This bias is so tiny that it appears insignificant on any single token, but over hundreds of tokens, it can become statistically significant.

Detecting this watermark requires the text and the same secret key. By re-deriving the green/red split at each position using the same hash function and counting the green tokens, a one-proportion z-test can determine if the watermark is present. The z-score, which increases with document length, needs to surpass a certain threshold to confirm the watermark's presence.

Google's SynthID, published in Nature in 2024, takes a different approach. Instead of the binary green/red split, it samples multiple candidate tokens, assigns each a pseudorandom g-value keyed to a secret, and then uses a tournament-style knockout to select the winner. This method reduces quality degradation compared to KGW's approach and is harder to spoof.

However, it requires more computing power. Google has implemented SynthID on Gemini app and web outputs since 2024, although the API has been an exception. Claude's watermark, effective from August 2026, embeds an imperceptible signal in generated text. This applies globally, not just to EU users, across Claude.ai, the API, Claude Code, and cloud partners. For older models, this watermark will be added before the EU grace period ends on December 2, 2026.

Anthropic has not disclosed the exact mechanism of Claude's watermark, but a technical thread by GPTZero's CTO Alex Cui provides insight. He explained that the watermark is injected at the sampling layer of the LLM, and that even light paraphrasing (a single pass rewrite) can dilute but rarely erase the signal. Re-composition, or regenerating text from a summary, will completely eliminate the watermark.

The watermark does not prove authorship; it merely indicates that Claude was involved in the text generation process. This is important for preventing academic dishonesty, as existing AI detectors often have high false-positive rates, especially when dealing with non-native English speakers.