What Is AI Watermarking? How It Works, Explained Simply

If you have used a modern AI writing tool, there is a growing chance the text it produced carries an invisible signature — a statistical pattern woven into the words themselves that a matching detector can later recognize. This is AI watermarking, and it has quietly moved from research papers into products used by millions. Google's Gemini has applied a text watermark to some of its output since 2024, and Anthropic began adding a similar text watermark to Claude in 2026.

This guide explains what AI watermarking is, why it exists, and how it actually works — including the token-level statistics behind a text watermark, Google DeepMind's SynthID, and the C2PA provenance standard used for images and video. The goal here is understanding. By the end you should be able to explain how these systems function to a colleague, know their real limits, and reason clearly about what a watermark can and cannot tell you.

What is AI watermarking?

AI watermarking is the practice of embedding a hidden, machine-detectable signal into content generated by an AI model, so that the content can later be identified as AI-produced. Unlike a visible logo stamped across a photo, an AI watermark is designed to be imperceptible to a human reader or viewer while remaining recoverable by a purpose-built detector — often one that needs a secret key to read the signal.

The motivation is provenance: as generative models produce text, images, audio, and video that are hard to distinguish from human work, platforms, publishers, and regulators want a reliable way to know where a piece of content came from. Watermarking is one answer. It does not judge whether content is good, true, or ethical — it only aims to answer a narrower question: *did this come out of a particular AI system?*

Why AI watermarking exists

Watermarking gained urgency because the alternative — detecting AI writing after the fact — has proven unreliable. In July 2023 OpenAI retired its own AI-text classifier about six months after launching it, citing a low rate of accuracy. A 2023 Stanford study by Liang and colleagues, *GPT detectors are biased against non-native English writers*, found that several popular detectors disproportionately flagged writing by non-native English speakers as AI-generated, raising real fairness concerns. If you cannot detect AI text reliably or fairly after the fact, the logic goes, perhaps the generator should mark it at the source.

• Transparency and trust — helping readers and platforms know when they are looking at machine-generated content.
• Platform integrity — letting social networks and marketplaces label or filter synthetic media at scale.
• Model accountability — letting a provider check whether text plausibly came from its own system.
• Regulation — emerging rules, including transparency provisions in the EU AI Act, push providers toward marking or disclosing synthetic content.

Watermarking text vs. images, audio, and video

Watermarking is not one technique — it changes fundamentally with the medium, and text is the hardest case.

Images, audio, and video are made of thousands or millions of continuous values — pixel intensities, audio samples, frames. That gives a watermarking system enormous room to nudge many values by tiny, imperceptible amounts and spread a robust signal across the whole file. There is a lot of redundancy to hide in, which is why image and audio watermarks can survive compression, cropping, or re-encoding reasonably well.

Text is discrete and information-sparse. Every word is a deliberate choice from a fixed vocabulary, and changing even one word can alter meaning or read awkwardly. There is far less room to hide a signal, and any single edit is visible in a way that a single altered pixel is not. This is why text watermarking is a distinct, harder problem — and why it works through the *statistics of word choice* rather than by altering an imperceptible substrate.

How does AI watermarking work for text?

To understand a text watermark, you need one fact about how language models generate: at each step, the model produces a probability distribution over its entire vocabulary and samples the next token (roughly, a word or word-piece) from it. Statistical text watermarking works by subtly biasing *which* tokens get sampled, in a pattern that looks random to a reader but is anything but random to a detector holding the key.

The "green list" idea

The foundational approach was introduced in a 2023 paper by Kirchenbauer and colleagues, *A Watermark for Large Language Models*. At each generation step, the algorithm uses the preceding token(s) plus a secret key to seed a pseudo-random function. That function pseudo-randomly splits the vocabulary into a green list and a red list. The model then gives tokens on the green list a small probability boost, so it tends — not always, but measurably more often than chance — to pick green tokens.

To a reader, the output looks like ordinary fluent text; the boost is small and the green list is different at every step. But a detector that knows the key can recompute the green list for each position and count how many green tokens actually appear. Human text, or text from a different model, will hit roughly the chance rate. Watermarked text will contain conspicuously *more* green tokens than chance — and with enough tokens, that surplus becomes a statistically strong signal. The detector is essentially running a hypothesis test on word choice.

Keyless statistical vs. keyed and cryptographic schemes

Text watermarking schemes fall along a spectrum:

• Keyed statistical schemes — like the green-list approach — embed a bias that only someone with the secret key can read. Detection is a statistical test: is there significantly more of the keyed pattern than chance would produce? The answer is a confidence score, not a yes/no certainty.
• Keyless / distributional schemes try to make output detectable without a shared secret, often by shaping the overall token distribution. These are generally easier to analyze publicly but can be easier to strip.
• Cryptographic schemes aim for stronger, sometimes provable properties — for example, making the watermark verifiable only with a private key while being hard to forge. These are more robust in theory but harder to deploy without hurting text quality.

SynthID and SynthID-Text

SynthID is Google DeepMind's watermarking toolkit, spanning images, audio, video, and text. Its text component, SynthID-Text, was described in a *Nature* paper published in October 2024 and is the first text watermark deployed at production scale — it runs inside Gemini, and Google has open-sourced tooling for it. It is a refinement of the green-list idea rather than a departure from it.

Instead of a single green/red split, SynthID-Text uses a method DeepMind calls Tournament Sampling. At each step it seeds a pseudo-random function from the recent context and scores candidate tokens with several pseudo-random functions arranged in multiple layers. Candidate tokens compete in successive rounds — a tournament — and the winner is emitted. Tokens that consistently score well are more likely to be chosen. Spreading the watermark across multiple layers lets SynthID-Text keep text quality high while leaving a detectable statistical fingerprint. A detector with the key looks for that fingerprint and reports a confidence score. DeepMind offers the scheme in both non-distortionary and distortionary configurations. In 2026, Anthropic began applying a SynthID-based text watermark to Claude, starting with newer models, as part of complying with EU AI Act transparency rules.

C2PA and Content Credentials: provenance for media

For images, audio, and video, a complementary approach has gained wide traction alongside pixel-level watermarking: provenance metadata. The main standard is C2PA, maintained by the Coalition for Content Provenance and Authenticity — an industry group whose members include Adobe, Microsoft, Google, and many others. Its user-facing form is called Content Credentials.

A Content Credential is a cryptographically signed manifest attached to a file that records where the content came from and how it was modified — the tool or model that created it, when, and what edits followed. Because it is signed, tampering with the manifest can be detected. It is best thought of as a verifiable "nutrition label" for a piece of media rather than a hidden signal buried in the content itself.

The trade-off is the mirror image of a watermark's. Metadata is rich, human-readable, and standardized — but it can be lost simply by removing it, for example by screenshotting an image or re-exporting a file through software that does not preserve it. That is why some providers pair C2PA metadata with a durable in-content watermark like SynthID: the metadata carries detail, and the watermark persists when the metadata is gone. C2PA is primarily a media standard; it is not the mechanism behind token-level *text* watermarking.

Robustness and the real limits of AI watermarking

Watermarks are useful signals, not proof. Understanding where they weaken is essential to reading them honestly — and the researchers who build these systems are candid about the limits.

• Short texts carry little signal. Detection confidence grows with length. A sentence or two may not contain enough tokens for a statistical test to say anything reliable — the surplus of watermarked tokens is indistinguishable from noise.
• Editing and paraphrasing dilute the signal. Because the pattern lives in specific token choices, rewriting, heavy editing, or translation disrupts the sequence the detector expects. Studies of SynthID-Text and green-list schemes consistently find that meaning-preserving rewrites reduce detection confidence.
• Cross-model regeneration effectively resets it. A given watermark is tied to one provider's key and that model's token distribution. Regenerating text through a different model produces tokens from a different statistical universe, so the original fingerprint no longer applies.
• Mixing sources blurs the result. A document that combines watermarked AI text with human writing dilutes the signal across the whole.
• Detection needs the key. Keyed schemes like SynthID-Text can only be checked by whoever holds the key. There is no universal reader that verifies every AI system's watermark, and different providers' watermarks do not interoperate.
• False positives and negatives exist. Because detection is a probability, not a certainty, it can miss watermarked text and — rarely — flag text that was not watermarked. Confidence scores should be read as evidence, never as a verdict.

Where editing tools fit in

The value of watermarking is *transparency* — a shared way to trace where content originated — and that value holds only when people treat these signals honestly rather than as obstacles to route around. Editing tools serve a separate, legitimate purpose: making writing clearer and more genuinely your own.

When you take an AI-assisted draft and actually revise it — tightening sentences, fixing tone, cutting filler, and checking every claim — you are doing the editorial work that turns a machine draft into your own writing. That is what a good rewriter is for. nowatermarking.com is a rewriter designed to preserve your meaning while improving clarity and natural phrasing, and it shows every change so you stay in control of the edit. If you are refining a draft, our rewrite text workflow and our guide to making AI writing sound natural cover the editing habits that matter most.

To go deeper on the detection side of this topic, see how AI detectors work — a useful companion, since detectors and watermarks are the two very different ways people try to answer the same question about where a piece of text came from.