AI Text Watermarks: What SynthID-Text Actually Detects (and What It Doesn't)
On 14 August 2026 Anthropic published a full FAQ on how Claude now stamps an invisible statistical signature into its text output. It's not the first — Google shipped SynthID-Text for Gemini in 2024, and the same week Anthropic's post appeared, other frontier providers were quietly turning the same feature on. The forcing function isn't marketing. It's Article 50 of the EU AI Act, whose transparency obligations for generative AI became fully enforceable on 2 August 2026 — every provider serving the EU now has to mark AI-generated content in a machine-detectable way.
Coverage of the launch mostly said "AI text now has watermarks." That's the least interesting thing about it. This lesson is the mechanism: how the watermark is embedded, what a detector actually returns, the four ways it silently vanishes, and what "watermark detected" really tells you.
- Explain the SynthID-Text mechanism — how a secret key biases token selection without changing what the model can say
- Predict when detection will and won't work: passage length, factual vs creative prose, code, translation, proofreading
- Read a watermark detector's output correctly — it returns a probability score, not a yes/no verdict
- List the four common operations that erase the watermark, and the one that leaves it fully intact
- Understand the EU AI Act Article 50 rule that forced text watermarking live across providers on 2 August 2026
The core idea: bias the coin flip, don't change the words
An LLM generates text one token at a time. At each step it produces a probability distribution over the vocabulary — often thousands of candidate tokens with non-trivial probability — and samples from it. When you write "the weather was", the model may weight sunny, overcast, grey, mild, cool as roughly equivalent choices; sampling picks one. That final coin flip normally uses an arbitrary random source.
A watermark replaces the random source with a deterministic one derived from a secret key and a short window of the tokens that came just before. The vocabulary hasn't changed, the probabilities haven't changed, and no specific word is forced. What changes is which of the equally-plausible options tends to get picked. As Anthropic phrases it: it isn't that the model becomes biased toward overcast or grey in general — overcast might be selected in one sentence, grey in the next. What accumulates over a long enough passage is a statistical correlation between the local context and the token chosen that random text simply cannot reproduce. That correlation is the watermark.
Anthropic's implementation is a version of SynthID-Text, the scheme Google DeepMind published in Nature in 2024 (see the Google DeepMind SynthID overview). Because the bias sits inside sampling and only nudges between tokens the model already considered acceptable, quality on standard benchmarks is measurably unchanged — which is what let Google roll it out silently to Gemini traffic without users noticing.
- For token N+1 the LLM computes probabilities over the vocabulary as it always would. No re-training. No filter. This is why the model's capability is unaffected.
- A secret key combined with a short window of tokens just before position N+1 seeds a function that assigns each candidate token a pseudo-random g-value. Same key + same context = same scores, always.
- The sampler is tilted to slightly prefer candidates with favourable g-values, subject to keeping the output distribution close to the original. On any single choice this is invisible. Over many choices, it plants a repeatable pattern.
- Given the text and the same key, the detector computes what the g-values would have been at every position and measures how often the observed tokens landed on high-scoring options. Random human text scores near chance; watermarked text scores significantly above.
Why the mechanism decides when detection breaks
The four common ways the watermark disappears aren't bugs — they follow directly from what the algorithm actually does.
Short passages. Detection is a statistical test. A few sentences produce too few token choices for the signal to rise above noise. Anthropic explicitly notes: "detecting a watermark also doesn't work well on small samples, where there are fewer word choices and thus less information to go on." Practically: expect reliable detection to need hundreds of tokens, not tweets.
Factual text. When there's essentially one correct next token — a date, a name, a definition, a code identifier — the sampler has no acceptable alternatives to choose from, so the bias has nowhere to attach. Anthropic: "watermarking is sparser on factual passages where there are fewer choices that can be made without decreasing the accuracy of the text." A page-long Wikipedia-style summary will carry less signal per word than the same length of creative writing.
Code. Same reason, harder. Programming syntax is largely fixed; token flexibility lives mostly in identifiers and comments. Anthropic acknowledges "code — which in very many cases has to be exact — has generally less watermarking than some other forms of text." Treat detector scores on code as low-confidence.
Proofreading and rewriting. When Claude edits human text instead of generating it, most tokens are the user's tokens; only the edits carry the watermark. A gentle proofread is essentially invisible. On the flip side, running watermarked text through a different, non-watermarking model to paraphrase it heavily removes the signal because a new sampler produced the tokens.
Two things that surprise people, but shouldn't:
- Light human editing survives. Swapping a few words leaves most of the signal intact — the detector is aggregating a small bias over thousands of positions, not looking for specific phrases.
- Translation is still watermarked — because a translation is a fresh generation where every token is chosen by the model. It's a different watermarked passage, not a diluted copy of the original.
What the detector actually returns
The most misread thing about watermarks in press coverage: a detector does not output "AI: yes / no." It outputs a score — essentially "how far above chance does this text's token pattern fall for our key?" — and a threshold turns that score into a decision, with two error rates that trade off against each other.
- A high score is Bayesian evidence, not proof. On a long, creative passage it can be strong evidence. On a short or factual one, the same score means much less.
- A negative result never proves the text wasn't AI-generated. Paraphrasing, mixing with human writing, or using a non-watermarking model all defeat detection while producing AI-authored text.
- The detector needs the secret key. Anthropic is offering the detection API to trusted partners; there is no public 'is this Claude?' tool for anyone to run on arbitrary text.
Anthropic's own summary of the detector's guarantee is calibrated exactly this way: given a long enough passage and the right key, "one can assign a probability that the text was generated by Claude." Probability. Not verdict.
The gatekeeping matters. Google's SynthID API documentation is explicit that the detector is currently limited-access; Anthropic is on the same posture — access is being extended in stages to journalists, educators, and platforms with a legitimate verification need. This is deliberate: if the detector were public, adversaries could iteratively edit text until the score dropped below threshold. Restricted access buys some robustness.
Watermark vs C2PA vs classifier — three completely different tools
Provenance discourse mashes these three together. They're not the same and don't compete.
| Tool | Signal lives in | Requires the generator to cooperate? | Survives paraphrase? | What it tells you |
|---|---|---|---|---|
| SynthID-Text / statistical watermark | Token choices inside the text | Yes (turned on at sampling time) | Partial — light edits yes, heavy rewrite no | "This text was generated by a model that shares this key, with probability X." |
| C2PA / Content Credentials | Cryptographically signed metadata attached to the file | Yes (signer includes credential) | No — trivially stripped by copying text out | "This file was published by this signer with this history." Aimed at images/audio/video where metadata rides along. |
| Third-party AI-text classifier (GPTZero, Pangram, etc.) | Statistical properties of the text itself, no key | No | Partial — improves as models leave detectable style, but fights an arms race | "This text looks like AI-generated text, based on my model." A guess, not a signature. |
The lesson: a watermark answers "did this specific provider's model generate this?" with the provider's own detector. A classifier answers "does this look AI-generated in general?" with no ground truth. C2PA answers "who signed this file and what's its edit history?" for media where a file wrapper exists.
A safer disclosure prompt for AI-written pieces
When you finish, add a footer: "AI assistance: Draft written by Claude (Anthropic). Edited by [name]. Substantive claims verified against cited sources." Then list any factual claim you couldn't verify from the sources I provided, so I can check or cut it before publishing.
Why this matters even with watermarks live: a watermark plus a human disclosure line covers both automated and human verification paths. A watermark alone becomes a legal fig leaf — technically compliant, useless to a reader glancing at the page.
The rule that forced this live: EU AI Act Article 50
The August 14 announcement wasn't primarily a product decision. Article 50 of the EU AI Act requires providers of generative AI systems to mark their outputs "in a machine-readable format and detectable as artificially generated or manipulated." The AI Act entered into force on 1 August 2024; the transparency obligations under Article 50 became fully enforceable on 2 August 2026. That's the deadline every frontier provider has been quietly building against.
The General-Purpose AI Code of Practice — the voluntary compliance framework the European Commission published on 10 July 2025 — takes an important position: no single marking technique is sufficient today. It recommends a multi-layered approach combining metadata (C2PA-style content credentials on files) and interwoven watermarking (SynthID-style bias inside the content), together with logging and fingerprinting to identify content even after marks are stripped. That's why you'll see providers turning on all three at once.
- Article 50 is provider-side. It obligates the AI *provider* to mark, and downstream deployers to disclose — it does not make watermarking evidence in court, and it does not stop you from stripping the mark from your own text. Compliance is on OpenAI/Anthropic/Google/Meta, not on you as a reader.
- The Code of Practice is voluntary — but signatories get a presumption of compliance with the AI Act. Non-signatories can still comply through their own means, but face heavier documentation demands.
What this changes in practice
For four different readers, four different takeaways:
- Assume anything Claude, Gemini, or the next model you use writes carries a watermark by default. Long creative passages are the most detectable; heavily edited or reference-heavy passages, the least. Disclose AI assistance directly rather than relying on the absence of a watermark to hide it — a watermark is easy to defeat, but the ethical/policy expectations don't relax because the detection did.
- Preserve provenance you receive (C2PA content credentials on uploaded media). Consider a policy that requires disclosure of AI-generated text, and remember the current watermark detectors give probabilities — not verdicts — and won't be reliable on short posts.
- Nothing in your code changes. Watermarking happens inside sampling, downstream of any prompt or tool-use decision. Do not add your own 'AI-generated' banners as a substitute for good UX disclosure. Do think about your users' rights: if you offer text that will be republished, an opt-in disclosure line is friendlier than relying on invisible marks.
- When detector access opens up, use it as one signal in a triangulation — alongside citations, source consistency, and the writer's own history. Never treat a positive score on a short passage as proof, and never treat a negative score anywhere as proof of human authorship. The right frame is Bayesian evidence, not verdict.
What could still change
Two big open questions to watch:
- Cross-provider detection. Today each provider has its own key and its own detector. A watermark from Claude will not be flagged by Gemini's detector, and vice versa. The Code of Practice hints at eventual interoperability — for example, a public metadata field that says "this content was watermarked, ask this endpoint to verify" — but nothing production-grade exists yet.
- Adversarial robustness. Academic literature on statistical watermarks (start with the Kirchenbauer et al. 2023 paper that popularised the g-value approach) already shows several attacks: cross-model paraphrasing, token-level substitution, and back-translation each degrade the signal. Providers know this. Expect the schemes to iterate — watermark schemes will get more robust, attacks will keep pace, and the informational value of a "detected" verdict on adversarially edited text will remain limited.
Check yourself
0/5Related on AILmanac
- Choosing a Model Provider — where provider policies (like watermarking, data retention, safety tiers) fit into a picking decision.
- Privacy — how outputs are handled beyond just watermarks: retention, training use, and enterprise controls.
- Hallucinations — watermarks don't tell you whether AI text is true, only whether it was generated. Verification is a separate job.
- Generative Media: Image, Audio, Video — the same provenance question, for the modalities where C2PA is doing most of the work.
Sources & further reading
- How Claude's text watermarking works — Anthropic (14 Aug 2026) — the primary FAQ this page synthesises.
- SynthID overview — Google DeepMind — the family of watermarking tools SynthID-Text is part of.
- SynthID Text safeguards docs — Google AI — how SynthID-Text is exposed as an API, with detector access notes.
- Kirchenbauer et al., "A Watermark for Large Language Models" (2023) — the g-value / red-list mechanism the current schemes are built on.
- EU AI Act — Wikipedia summary of Article 50 and the 2 August 2026 enforcement date — the regulation that forced watermarking live across providers.
- General-Purpose AI Code of Practice — Wikipedia — the voluntary framework recommending layered watermark + metadata + logging.
- Coalition for Content Provenance and Authenticity (C2PA) — the media-provenance standard that complements text watermarks.