Here’s a puzzle worth sitting with for a second.

You can hide a watermark in a photograph because a photograph has millions of pixels and you can nudge a few of them without anyone noticing. You can attach metadata to a file. But plain text has none of that. Every character is visible. Copy and paste strips out anything hidden. There’s nowhere to put a mark.

And yet AI text now carries one.

Google has been watermarking text from Gemini since 2024. As of August 2026, new Claude models mark generated text at the model level, with older models being brought in behind them. The marks are invisible, they survive copying, and they work because they aren’t in the characters at all.

James Padolsey published an interactive explainer of how this works, and it’s the clearest explanation of the mechanism I’ve come across. I want to walk through the idea, because once you see it, a lot of the confusion around AI detection sorts itself out. Then I want to get to the part that actually affects your business, which is different from what most people assume.

The Core Idea: Writing Is a Series of Small Choices

When a language model is partway through a sentence, it doesn’t know what the next word is. It has a shortlist of candidates with different weightings, a bit like a more sophisticated version of your phone’s autocomplete.

Take a sentence that starts: “The results of the study were quite…”

Several words work equally well there. Surprising. Encouraging. Unexpected. Mixed. The model has preferences among them, but more than one produces a perfectly good sentence.

So the model effectively rolls weighted dice and picks one.

Now consider that a page of text contains hundreds of these moments, one at every word. At many of them, several options are genuinely fine. That slack is the raw material. Anyone who can influence how those dice land can hide a pattern in the text without changing what it says.

The mark doesn’t live in the letters. It lives in the choices between words.

How the Key Gets Involved

The classic version of this comes from a 2023 research paper by Kirchenbauer and colleagues, and it works roughly like this.

At each point where the model is choosing a word, some secret-key arithmetic splits the candidate words into two groups. Call them green and red. The split is arbitrary and only the key holder can reproduce it. Then the dice are tilted slightly toward the green words.

Two details make this work better than you’d expect.

The nudge is gentle. A red word can still win. It’s just marginally less likely. So the text isn’t being pushed toward stilted or unnatural phrasing.

The colouring isn’t fixed to the word. The key calculates it from the handful of words immediately before it. So the same candidate word is green after one preceding phrase and red after another. There’s no dictionary of green words anyone could reverse-engineer by reading enough output.

Google’s SynthID, which is the version running in production on Gemini, reaches the same result by a subtler route. Instead of tilting the odds, it runs a small secret tournament between candidate words drawn from the model’s own preferences. The bracket is arranged so that, averaged across the key’s draws, every word’s odds remain exactly what the model intended.

That last point is worth pausing on, because it explains something people find hard to believe. When Google ran a live trial across roughly 20 million Gemini responses, users rated watermarked and unwatermarked text as equal in quality. The mark isn’t degrading the writing, because at each individual fork it’s choosing between options that were already acceptable.

How Detection Works

This is where it gets neat, and where most public confusion sits.

The detector doesn’t read your text. It doesn’t judge your style, look for phrases like “delve” or “tapestry”, or assess whether the writing feels artificial. It does something much simpler.

It replays the same secret colouring across your words and counts how many came up green.

In unmarked text, green should win about half the time, the way a coin lands heads about half the time. In marked text, green wins slightly more often than chance. Not dramatically. Padolsey’s demo, which is tuned strong so the effect is visible, produces about 55% green across a 1,500-word document. Production marks lean considerably more gently than that.

Which leads directly to the most important practical fact about all of this.

Evidence accumulates with length. A small statistical lean only becomes convincing across a lot of text. A short passage genuinely cannot be judged. Neither can text where there was never much choice to begin with, such as code, direct quotations, or lists of facts. If there’s only one sensible way to continue, the dice have no slack to hide anything in.

What Editing Does to the Mark

This is the part most people get wrong, in both directions.

Because each word’s colouring is derived from the short run of words just before it, a position only counts as evidence if a small window of the original wording survives intact. The word plus its immediate neighbours.

So editing doesn’t dilute the mark evenly across a document. It erases it precisely where you’ve broken the runs of wording, and leaves it fully intact everywhere you haven’t.

What you do to the text	What happens to the mark
Fix typos	Almost nothing. Isolated characters, not runs of wording.
Light touch edit	Diluted, not deleted. Detectors can recover given enough text.
Heavy edit	More survives than expected. Untouched sentences still count fully.
Full re-composition	Signal collapses to roughly chance, in tests on open implementations.

In the original Kirchenbauer research, light paraphrasing diluted the mark rather than deleting it, and the detector recovered given enough text. Even human paraphrasing became detectable again at roughly 800 tokens, which is around 600 words. In tests against open implementations, full re-composition left roughly 0.5% of windows surviving and dropped detector accuracy from near-certain to a coin flip.

One honest boundary, which Padolsey states plainly and I’ll repeat: those measurements come from open research implementations that can be tested. Anthropic’s actual production scheme hasn’t been published, so nobody outside the company can currently run these tests against Claude’s own mark.

Five Things That Matter in Practice

Here’s what I’d take away from all of this if you run a business or write professionally.

1. You cannot check this yourself

A genuine watermark check requires the provider’s secret key, or a detection service the provider operates. Your editor can’t run it. Your client can’t run it. Neither can any of the AI detector websites currently charging for subscriptions.

Google runs an early-access detection portal for SynthID. Anthropic says its detection tooling is forthcoming and hasn’t shipped yet.

2. A watermark check is not an AI detector

These get conflated constantly and they’re opposites.

Tools like GPTZero guess from writing style. They’re well documented as unreliable, and they misfire on non-native English speakers and on people who simply write cleanly.

A watermark check is a deliberate, key-gated statistical test on a signal that was intentionally placed there. It’s a genuinely different thing. Don’t let anyone treat a style-guessing tool’s output as if it carries the same weight.

3. A found mark means “processed by”, not “written by”

This is the distinction that matters most for your reputation, and Anthropic’s own documentation is explicit about it.

If you write something yourself and then ask Claude to proofread it, tidy the grammar, or translate it, the output can carry the mark. The ideas were yours. The argument was yours. The mark says only that the text passed through the model.

Someone who doesn’t understand that distinction could see a detection result and draw entirely the wrong conclusion about your work.

4. Absence proves even less

No mark found doesn’t mean no AI involved. The text might come from a model released before marking existed, from a provider that doesn’t watermark at all, or from output that’s been rewritten enough to wash the signal out. It might simply be too short to judge.

So the test is asymmetric. A positive result is weak evidence of processing. A negative result is close to no evidence of anything.

5. Files work differently from text

Alongside text watermarking, Claude attaches signed provenance metadata to generated files like SVG, PNG and JPG, following the C2PA standard used across the industry. That’s a separate mechanism with different properties. It can be verified with existing tools today, and it can also be stripped by format conversion, re-saving or screenshotting.

Worth keeping the two apart in your head. They get bundled together in coverage and they behave very differently.

The Criticism Worth Taking Seriously

Not everyone thinks this is a good idea, and the strongest objection is a practical one rather than a philosophical one.

The argument, made by Padolsey and echoed by John Gruber, is that this design is hardest on honest users and weakest against dishonest ones.

Think about who gets marked. Someone who writes their own article and uses AI to tighten the grammar picks up a mark on work that is substantially theirs. Meanwhile someone deliberately passing off fully generated text can run it through one non-compliant paraphrasing tool and wash the signal out. Padolsey’s own tool, declaude, does exactly that, which he’s upfront about.

So the people most likely to be flagged are the ones using AI in the mildest, most defensible way. The people the system is nominally aimed at have a straightforward route around it.

This all traces back to regulation. Anthropic signed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, which is what these commitments implement. The marking applies worldwide, not only in the EU, and covers output across the API, the chat interface, Claude Code and other surfaces.

I don’t think the criticism means the technology is worthless. But it does mean you should be sceptical of anyone who starts treating watermark results as proof of anything about a person’s honesty.

What This Actually Means for Your Business

Now the useful part.

If you already disclose AI use accurately, this changes very little for you. There’s no gap between what you’ve said and what a mark would show. That’s the whole benefit of having been straightforward in the first place.

If you’ve been quiet about it, this is a slow-moving liability. Not because detection will catch you tomorrow, since the tooling isn’t even public yet. But because the direction is one way. More providers are marking, detection is being built, and regulation is pushing both. Content you publish today may be checkable later.

The mildest use is the most exposed. This is the awkward bit. If you use AI to polish your own writing, which is exactly the use most people consider harmless, your text may carry the mark while a fully generated and heavily rewritten piece may not. That’s an argument for describing your process accurately rather than hoping nobody asks.

Precision in how you describe things is now doing real work. If someone ever raises this with you, there’s a large difference between saying “I wrote this and used AI to edit it” and having said nothing at all. The first is a description you can stand behind. The second leaves the interpretation to someone else.

Client and employer policies are going to get messy. Expect a period where organisations write rules referencing detection results without understanding that a mark indicates processing rather than authorship. If you work with clients who have AI policies, it’s worth reading them now and asking what they’d actually do with a detection result, before it becomes a live question.

Frequently Asked Questions

Can I check whether my own text has a watermark?

Not at the moment. A real check needs the provider’s secret key or a service the provider runs. Google operates an early-access detector for SynthID. Anthropic has said its detection tooling is forthcoming. No third-party website can do this today, whatever it claims.

Do AI detector tools like GPTZero detect watermarks?

No. Those tools guess based on writing style and have a well-documented reliability problem. Watermark detection is a completely separate mechanism that requires a secret key. The two are often discussed as though they’re the same thing, and they aren’t.

Does the watermark make AI writing worse?

The evidence says no. Google’s live trial across roughly 20 million Gemini responses found users rated watermarked and unwatermarked text as equal in quality. The mechanism only chooses between continuations that were already acceptable to the model.

If I edit AI text heavily, does the mark disappear?

Partially, and less than most people expect. The mark survives wherever runs of original wording survive. Fixing typos removes almost nothing. Light paraphrasing dilutes the signal but research found detectors recover given enough text. What removes it is rewriting from the meaning so that no runs of the original phrasing remain.

Does a watermark prove someone used AI to write something?

No. It indicates the text was processed by that model, which is a different claim. Anthropic’s documentation notes that text merely proofread or translated by Claude can carry the mark even when the ideas and writing are the author’s own.

What about images and files?

Those use a separate system. Claude attaches signed C2PA provenance metadata to supported file types. That can be verified with existing tools now, but it can also be removed by converting formats, re-saving or taking a screenshot.

Is short content watermarked?

It can be, but the signal is too weak to be reliable. Detection depends on accumulating a small statistical lean across many word choices. A social post or a paragraph doesn’t offer enough. Content with little linguistic choice, such as code or quoted material, also carries very little mark.

Should I stop using AI tools because of this?

That isn’t the conclusion I’d draw. The practical response is to be accurate about how you work rather than to avoid the tools. A watermark only creates a problem when it contradicts something you’ve claimed.

Where This Leaves You

The technical mechanism is elegant and worth understanding, but the decision it forces isn’t technical at all.

Watermarking makes your description of your own process checkable in a way it wasn’t before. Not reliably, not yet, and not in a way that proves what most people think it proves. But the direction is clear enough to plan around.

Which means the question isn’t how to avoid the mark. It’s whether what you say about how your content gets made would hold up if someone looked. That’s a content policy question, and it’s one most businesses haven’t actually worked out yet.

If you’re thinking through how your business should handle AI in its content and SEO work, what to disclose, what to keep human, and how to write it down so your team and your clients are working from the same understanding, that’s worth getting right before it becomes urgent.

Click here and tell me what you’re working on

Happy to talk through where you stand and what a sensible policy would look like for your situation.

This article is for informational purposes only and shouldn’t be treated as legal or compliance advice. This is a fast-moving area, so check current provider documentation before relying on any detail here.

Deepak Vankar is a digital marketing consultant working with businesses and professionals on SEO, content, performance marketing and brand strategy.