Everything I could find out about AI text watermarks

Recently Anthropic announced that its new Claude models will carry an invisible watermark in every text they write. Reddit exploded. Half the threads were people announcing the end of privacy, the other half were people selling “watermark removers” for a problem they clearly did not understand. Almost nobody noticed the most practical fact of all, which is that the text you are getting from Claude today is most likely not marked yet. I will get to that.

I run LLM pipelines every day, both at work and in my own AI writing tool, so this topic hit my own roadmap directly. I spent the last days reading the vendor docs, the actual papers and a depressing amount of reddit. This is the guide I wish someone had written for me. Simple words, no panic, sources mentioned along the way so you can check me.

What just happened

Claude models launched on or after August 2, 2026 weave a hidden mark into the text they generate. Worldwide, at the model level, so it does not matter if you use the chat app, the API or Claude through some cloud provider. Anthropic also attaches signed provenance metadata (the C2PA standard, the same thing camera makers use) to files Claude produces, like PNG and SVG images.

Now read that date again. Launched on or after August 2, 2026. Every Claude model you can actually pick today, including the newest one from late July, shipped before that date, so none of them mark their output yet. The watermark arrives with the next model releases. Older models got a transition period under the law (systems already on the market have until December 2, 2026), and Anthropic says it is working on retrofitting them. So the honest status for today is: the policy is live, the marked models are still coming, and the panic arrived early.

The reason behind all of it is a new European AI law (the EU AI Act) and a Code of Practice that goes with it. Anthropic signed the code, and so did roughly 190 other organizations, including Google, OpenAI, Microsoft, Meta, Amazon, IBM and Mistral. The loud holdout is xAI, which decided to skip it. My guess is that marking only European traffic would be more expensive than marking everything, so the whole world gets the watermark.

One more detail that most angry threads missed. You cannot check for this watermark, and neither can your boss or your professor. Anthropic has announced a detection API for third parties, and announced is the key word, nothing has shipped. So once marked models arrive, the mark will travel with copied text, and exactly one company on the planet will be able to read it.

What a text watermark actually is

Forget invisible ink. A text watermark is a statistical trick, and once you see it, it is almost disappointingly simple.

When a model writes, it picks the next word from several good candidates. “The results were great” and “the results were strong” are both fine. A watermarking model carries a secret rule that sorts candidate words into two invisible buckets and then leans, very slightly, toward one bucket. Think of a coin that is bent by one percent. One flip tells you nothing. A thousand flips tell you clearly which coin was used.

A detector with the secret key counts how often the text landed in the “preferred” bucket. Human text lands about half the time, because humans do not know the buckets exist. Marked text lands there noticeably more often. That statistical excess is the whole watermark.

Anthropic says its mechanism is a version of SynthID-Text, a method the DeepMind team published openly in Nature back in 2024 and has been running in Gemini since then. So the science is public, only the secret key is not.

Two things follow directly from this design, and they explain most of the confusion online.

First, the watermark needs length. A short answer is a handful of coin flips, and no statistician on earth reads a signal from five flips. Anthropic itself says short text may be impossible to check reliably.

Second, the watermark lives in word choice, and only in word choice. There is nothing attached to the file, nothing in the clipboard, nothing your text editor could show you. Which brings me to the next chapter.

What it is not

The most popular mistake in every thread. Someone pastes ChatGPT output into a character inspector, finds weird invisible Unicode characters (narrow no-break spaces, zero-width spaces), and declares they found the watermark. There was a wave of this in 2025, and it comes back every few months. Over the last month I found exactly one thread where a guy was running a “watermark remover” that proudly reported finding line breaks. Literal line breaks, the things you type with Enter.

Those hidden characters are real, but they are typography quirks and training artifacts. OpenAI directly said they are a side effect of training, and honestly, they would be a comically bad watermark, since find-and-replace kills them in one second. A real statistical watermark survives find-and-replace just fine, because there is no character to replace. The mark sits in the choice between normal words.

The em dash panic belongs here too. Yes, models love em dashes. So do many human writers who learned punctuation before 2022. A writing habit is a tell, maybe, but it is not a watermark. A watermark needs a secret key and a detector. A habit just needs a reader with prejudices.

Who marks text today

I keep this table maintained, with a source for every row.

Verified as of 2026-08-15. Manual check of vendor help-center docs, official FAQ pages, the EU Code of Practice signatory list, peer-reviewed papers and press coverage. Each row cites the strongest public source we could find. 'None known' means we found no public evidence of a deployed text watermark, not proof of absence.

Two vendors have live text watermarks. One built a detector years ago and sat on it. The rest signed a European commitment and have shipped nothing yet. And the open-weight world (DeepSeek, Qwen, the old Llama line) ships models with no marking at all, which is exactly why every watermark thread ends with someone posting “just use a local model”.

By the way, the top thread on r/LocalLLaMA claimed that Meta and Microsoft signed the code too and concluded that even local models will be forced to watermark by law. When I first checked this, I read a law firm’s July summary that listed Meta as a non-signatory, and I almost repeated it here as a gotcha. Then I found Meta’s own press release from July 28. They did sign. The signatures in that thread were right, the conclusion still is not: Meta frames its commitment around labelling images, video and audio on its platforms, and nobody has explained how you would force a model whose weights sit on your own disk to watermark anything. Which is a good reminder about this whole topic, half the confident claims out there are one press release out of date, including, briefly, mine.

Why is Anthropic the one doing this first

A fair question, because nearly every big lab signed the same code and only one of them flipped the switch on text.

Google is the quiet exception. Gemini has carried SynthID marks since 2024, they published the method in Nature and moved on. No drama, and most Gemini users have no idea.

OpenAI is the interesting case. Reporters found out in 2024 that OpenAI had a working watermark and a detector that recognized long ChatGPT text with 99.9 percent accuracy in internal tests. They never shipped it. The reported reasons were fear of false accusations, worry about non-native English speakers getting flagged (and I understand them perfectly, being one!), and a survey where about a third of users said they would use ChatGPT less if it watermarked. I find that last number the most honest fact in this whole story. The watermark did not threaten their safety record. It threatened their revenue. Since then OpenAI started stamping provenance metadata and SynthID marks into ChatGPT images and audio, so the machinery clearly exists over there. Text stays unmarked.

So why did Anthropic jump first? They have not explained beyond “the EU code asks for it”, so what follows is my speculation. Anthropic sells itself as the safety company, and being the first mover on transparency fits that brand perfectly. The August 2 date also lines up with when the new European obligations start to bite for freshly released models, so someone had to be first, and the company whose marketing is built on doing the responsible thing had the least room to stall. The others promised the same thing on paper. Watch what they ship, and when.

Why all of this started now

The European AI law has a transparency article that says machine-generated content must be marked as machine-generated, in some machine-readable way. The law itself is vague on how, so in June 2026 the EU published a Code of Practice that translates the vague words into concrete practices, and the big labs signed it.

Behind the legal story there is a quieter business story. The internet is filling with AI text, and the labs themselves suffer from it, because training new models on the output of old models (surprise!) is how you get worse models. A reliable way to recognize your own output is useful for the vendor even if no regulator asked. Some folks on reddit present this as a hidden conspiracy. I would call it an obvious aligned interest, and Fortune quoted people saying the same thing out loud.

What a watermark proves, and what it does not

This part matters more than the mechanism, and it is where I expect the most real-world damage.

The watermark marks text that passed through the model. It does not know why the text passed through. If you write your own paragraphs and ask Claude to fix the grammar, the output carries the mark. If you dictate your genuine thoughts and the model only cleans them up, mark. If you translate your own writing, mark. Anthropic says this in its own FAQ, in plain words: the mark shows Claude processed the text, and it may be your text, your ideas, your voice.

So a watermark detector is a provenance tool, and people will inevitably use it as an authorship judge. Those are different jobs. “This text touched Claude” is a fact. “You did not write this” is an accusation, and the mark alone cannot carry it. Nobody running a detector at scale will stop to ask which one they are looking at. Keep this asymmetry in mind, because the last chapters of this guide are about what to do with it.

And remember the current asymmetry of power too. Today no school, no employer and no platform can check for the Claude mark, because the detector is not public. Anyone who claims otherwise this month is selling something.

What survives, and what kills it

This is the chapter everyone actually wants, so let me be precise about what published research says.

Copy and paste changes nothing. The mark is in the words, and the words came along.

Light editing usually leaves the signal alive. Anthropic’s careful wording is that the mark “may persist through some editing”. You fixed a typo and swapped two sentences, most of the biased word choices are still there.

Heavy rewriting is a different story. Researchers have been attacking these schemes since the first one appeared (the green-list method from a 2023 paper by Kirchenbauer and colleagues). The strongest known attack is simply paraphrasing the text with another model. One dedicated paraphrase model called DIPPER dropped watermark detection from one hundred percent to fifty seven in a published test, and a group at ETH Zurich that probed SynthID specifically found the same weak spot. Translation to another language damages the signal even harder, for the same reason. New words, new choices, old statistics gone.

Now the twist that most removal advice on reddit misses. The mark comes from the model that writes, so whatever model does your “cleaning” pass matters. Paraphrase marked text with a model that also watermarks, and you scrubbed one mark and stamped a fresh one on top. Every pass through a marking model marks again. The paraphrase that removes without re-marking is one done by a model that does not mark, and right now that describes most of the market: DeepSeek, Qwen, Mistral’s models, Meta’s models (the Llama line and their newer Muse family), anything open-weight running on your own hardware, and, funny enough, even today’s Claude and ChatGPT, whose marked models have not shipped yet.

So the marks can be weakened or removed, the research is public about it, and I see no point pretending otherwise. The real question is a different one, and it is the question I think the law got wrong.

Text generated by AI and your own text that AI touched are two fundamentally different things. A machine wrote the first one. You wrote the second one, every idea in it is yours, and the model fixed commas or smoothed the style. The watermark cannot tell these apart. The law does not ask it to. And the person pointing a detector at your writing will not spend one minute on the difference, you will just be “flagged as AI”.

So if your texts are genuinely yours and a model only polishes them, I think you are fully in your right to make sure they do not carry a mark, and the clean way to do that exists: run the polishing pass on a model that does not mark. That is a tool choice, it is allowed, and it is exactly what I did with my own pipeline. Hiding machine-written work where machines are banned is a different act, and I am not advising it. The difference between those two situations is the entire point of this guide, and the law has not caught up to it yet.

What this changes for you, by role

If you use Claude at work for ordinary tasks, calm down first. Nobody can scan your emails for the mark today, and when detection tools appear, the mark will still only say “AI touched this”, which for most jobs in 2026 is about as scandalous as “spellcheck touched this”. The people who should actually think are those working under rules that ban AI use. The mark did not create their risk, it only made the existing risk more real.

Now one prediction, and one trap inside it. Once detectors exist, someone will build a dashboard that shows the “share of AI” in your document, because the statistics inside the watermark can be summed into exactly that kind of number. Sounds reasonable, until you notice the trap. Take a text you wrote entirely yourself, in your own language, and translate it with a marking model. The output is one hundred percent machine-chosen words, so it will read as one hundred percent AI on any such dashboard. Fully your ideas, fully your text, branded as fully machine-made. That is not a corner case, that is every non-native speaker who translates their own writing, and it is flatly unfair to them. If that is you, translate with a model that does not mark. Today that choice is still yours to make.

If you are a student, your situation is the ugliest one, because the incentive to misuse detectors as authorship judges is strongest in education, and the false-accusation problem (which OpenAI itself cited as a reason not to ship) lands on you. The standard advice says keep your drafts as evidence. I will be honest with you: nobody is going to read your drafts. If your text is genuinely yours and you only used AI to clean it up, be smart instead, and do the cleanup with tools that leave no mark. The list is one chapter up.

If you write and care about your voice, like I do, the meaningful question is quieter. When a model polishes your dictated thoughts, the mark blends your authorship with the machine’s statistics, and you may simply not want that blend in your text. This is a preference, and you are allowed to have it. It is the main reason my own pipeline moved its final writing pass to open-weight models.

If you build AI products, two practical notes. The transparency duties from the European law can land on you as the deployer, so read what your model vendor marks and what it expects you to disclose. And your model choice is now also a provenance choice for every one of your users, which is a strange new kind of responsibility to inherit from an API.

What I expect next

Anthropic says older Claude models will get the watermark later, so the “models launched after August 2” line will quietly expand. The detection tools will show up, first for platforms, then for everyone, and the first public false-accusation scandal will follow shortly after. Other signatories will ship their own marks, because they promised the EU they would. And the paraphrase arms race will continue, since the strongest removal tool is just another language model, and those are not getting worse.

The open-weight escape hatch stays open, as far as anyone can tell. Nobody has shown a mechanism that forces a model running on your own hardware to mark its output, and the companies that did not sign keep releasing weights.

I will keep the table above updated as statuses change. If I got a fact wrong or you know a status changed, send it through the form below, I would honestly rather fix it than be right on the internet.