An interactive explainer · updated Sep 29, 2026
The watermark is the word choice.
Claude and Gemini now watermark the text they write. The signal is in which words they choose, so there’s nothing hidden to strip out. This interactive explainer shows how it works, and what happened when we tried to remove it.
- 1How a model writes
- 2How watermarks work: four approaches
- 3Our small study: can it be removed?
- 4Discussion
- +Research
0
hidden characters. The signal is in which words were chosen, so copy-paste keeps it.
1 key
needed to see it. Without the key the text reads, and scores, like any other.
≤5%
still detected after any AI rewrite in our 150-page study, from a cheap open model up to GPT-5.5.
0
on-record Google statements tying text watermarks to rankings, as of Sep 26, 2026.
1
Part 1
How a model writes
To see where a watermark can hide, start with how a model picks its words.
Part 1 · How a model writes
Every word is a weighted dice roll
A language model never picks a word directly. It scores every possible next word, then samples one. That sampling step is where a watermark hides.
It starts with a prompt
We gave Google’s Gemma 4 model the words “Search traffic fell after the” and asked it what comes next.
The model doesn’t return one answer. It gives every token it knows a probability. Gemma 4 knows 262,144 tokens (words and word pieces), and their probabilities add up to 100%. The chart shows the eight most likely next words. The last row combines all the other tokens.
Where the percentages come from: logits
Under the hood, the model first gives each token a raw score called a logit. Higher means more likely. A step called softmax turns those scores into percentages that add up to 100%.
The numbers on the right now show each word’s score relative to the top word. Every point lower makes a word about 2.7 times less likely. Watermarks work by adjusting these scores, or the roll that follows, before a word is picked.
Then it rolls the dice
“update”, “Google” and “algorithm” are all plausible. The model sampled “platform”, a 3% outcome. A different roll would have given a different, equally good sentence.
Word after word
Each new word shifts the odds for the next one. Watch the whole sentence come together from the model’s real choices.
Some words are barely a choice
After “became”, the word “frustrated” had a 100% chance. Grey chips are words the model was more than 90% sure of. They leave no room to hide anything.
2
Part 2
How watermarks work
Every text watermark shares one idea: use a secret key to nudge the dice roll in a pattern that only the key-holder can check. Below we cover the one limit they all share, then four approaches. They run from the original 2023 scheme to the one Claude and Gemini use today.
Part 2 · The limit they all share
No choice, no watermark
A watermark can only nudge words where the model had real options. Researchers measure that freedom as entropy, in bits. The useful question is simple: how many ways could this have been written?
One real website, scored
We ran Gemma over 364 pages from one real company’s website, a market research firm, and measured how much room each page left. On the right is the opening of a blog post our own model wrote in that style.
Every kind of prose lands together
Blog posts, service pages, guides, case studies and promo pages all averaged about 1.2 bits per word. The page type barely mattered. Individual pieces varied more than the types did.
Markup is where the room runs out
The HTML on those same pages left about half the room of the prose. Tags and class names decide most of the characters; only the text inside them is free.
Structured data is nearly locked
Schema markup left about a quarter of the room. The watermark has almost nowhere to go. It’s the same reason code carries a weak watermark: Anthropic says it mostly lives in code comments.
Part 2 · Approach 1 of 4
The orange list
The 2023 scheme that started the field (Kirchenbauer et al.). It isn’t what Claude uses, but every later method builds on its idea.
Look at the previous word
Before picking the next word, the watermarker combines the previous word with a secret key and hashes them into a number.
Split the vocabulary in half
That number splits every candidate word into an orange half and a blue half. The split looks random. Change the previous word or the key, and the split changes.
Put a thumb on the scale
Orange words get a boost before the dice roll. The dashed lines show the original odds. Good words stay likely, but orange words now win more often.
Write a whole sentence
Normal text lands about half orange by chance. Watermarked text comes out much more orange, but only someone with the key can tell which words are orange.
Detection is counting
The key-holder re-colors every word and counts. Forty sentences each: normal text hovers near 50% orange; watermarked text lands well outside that range. More words means more certainty.
Part 2 · Approach 2 of 4
Loaded dice that aren’t loaded
Proposed by Scott Aaronson for OpenAI in 2022 and formalized as “distortion-free” watermarks. vLLM, a popular open-source tool for running models, now includes it. On average it doesn’t change what the model says, only which of its normal choices it makes.
Sealed envelopes
For each candidate word, the key and the previous words produce a secret random number between 0 and 1.
A race
Each word runs at a speed set by both its probability and its secret number: score = r1/p. Likely words run fast, but a lucky number can carry an underdog to a win.
Over many races, the odds are untouched
Across 3,000 races with different contexts, each word wins about as often as its real probability. The hollow bars are the model’s odds; the filled bars are how often each word actually won.
The winners give it away
Winners tend to hold high secret numbers. Normal text averages about 0.5; watermarked text averages much higher. Only the key-holder can compute those numbers.
Part 2 · Approach 3 of 4
The tournament: what Gemini and Claude use
SynthID-Text, from Google DeepMind (Nature, 2024). Anthropic says Claude uses “a version of” it. Candidate words play a knockout tournament judged by the secret key.
Draw eight candidates
The model samples eight candidates from its normal probabilities. Likely words can appear more than once, so the tournament still reflects what the model wanted to say.
Round one
The key scores every candidate 0 or 1 for this round and this context. Pairs face off: the higher score advances, and a tie is a coin flip.
Down to a champion
Each round uses fresh scores from the key. The champion is still a word the model found plausible, which is why quality holds. Google saw no significant difference across about 20 million Gemini responses.
Whole sentences
Every word with real alternatives gets a tournament. Forced words skip it, because all eight candidates are the same word. The real system runs about 30 rounds; we show 3.
How it’s detected
The key-holder re-runs the scoring on each word of a finished text. In ordinary text, a word’s scores average 0.5, like coin flips. Tournament winners got there by scoring high, so watermarked text averages higher. Across enough words, that gap becomes clear evidence.
Part 2 · Approach 4 of 4
Watermarking the meaning
Research schemes such as SemStamp and SIR mark sentence meaning instead of individual words. They aren’t deployed in any major product yet.
A map of meanings
Every sentence can be placed on a map where similar meanings sit close together. The key colors regions of that map orange or blue.
Retry until it lands orange
The model drafts a sentence. If its meaning lands in blue, it tries again. Faint dots are rejected drafts.
Paraphrase barely moves it
Rewording keeps the meaning, so the dot jiggles but stays in its region. Compare the orange list, where a paraphrase re-rolls every word’s color. The downsides: generation is slower, and it’s still at the research stage.
3
Part 3 · original research
Our study: can a watermark be removed?
We can’t test Claude’s or Gemini’s watermark directly, because their keys are private. So we made our own, using the same SynthID-Text method Gemini uses and a key we made up. We ran it in two rounds.
First a pilot: a small Gemma 4 model on a laptop wrote 12 short articles, each with and without the watermark. Then the main study: the larger Gemma 4 26B model, on a rented GPU, wrote 150 web pages based on the page types of one real company’s website, again with and without the watermark.
Then we tried what people commonly do to AI text: light edits, cutting it short, mixing in other writing, translating it, rewriting it with another AI, and one trick of our own. We weren’t trying to write a removal guide. We wanted to know where things stand.
Part 3 · Step 1: Check the watermark is there
First, confirm we can detect it
Before trying to remove anything, we checked that our detector could tell our watermarked articles from the plain ones. This chart shows one real article from the pilot.
Re-score every word
The detector replays the tournament scoring for each word, using the text itself and the key. Unmarked words average 0.5. Words that won tournaments lean higher.
The watermarked text climbs
The orange line is the running average for the watermarked article. Early on it wobbles. As words pile up, it settles well above 0.5 and leaves the grey noise band.
Normal text stays in the band
Same prompt, same model, no key during generation: the blue line never leaves the band.
Wrong key, nothing
The dashed line is the watermarked article scored with a different key. It looks exactly like normal text. The key is the only thing that makes the signal readable.
Why length matters
The band narrows as more words are scored. A tagline sits in the wide part, where nothing can be concluded. Neither Anthropic nor Google publishes a minimum length.
Part 3 · Step 2: Try to remove it
What removed it
In the pilot, we put every article through 17 removal tactics. Pick one below to see what was left of the signal in a real article. Words tinted orange carry watermark evidence; blue words count against it.
Part 3 · Step 3: The main study
150 real-world pages, 19 tactics
For the main study we started from one real company’s website. We picked 30 pages of each kind (blog posts, guides, service pages, case studies and promo pages), had the model turn each into a brief with the names removed, and then write a fresh page from it. That gave 150 watermarked pages and 150 plain ones, roughly 2,700 scored texts in all.
What we saw
Copy-paste changed nothing. AI rewrites removed the watermark almost completely, from a cheap open model to GPT-5.5, and the rewrites still scored well for quality.
Edits weakened it gradually. By the time about 17% of the words had changed, most pages had dropped below the detection line. Past about 25%, almost nothing was left. The pilot showed the same curve, which makes the 20% mark look like a real pattern rather than a fluke of one small test. It’s still one model and one key, so we treat it as an indicator, not a rule.
Room mattered at the start, not at the end. Pages the model wrote with the most room were detected 96% of the time untouched, against 70% for the least. By 15–20% reworded, all three groups had fallen to the same low level.
The bigger model didn’t hold on longer. It left less room than the small one, and its watermark faded at about the same point, a little earlier if anything.
The numbers
AI pages leave half the room
Median bits per word. The model writes its own most predictable text, so its pages leave about half the choices the company’s human-written pages did.
Removal without rewording
We also tried a trick that changes no word choices at all. We asked the model to write the page in an odd format, then converted it back with a find-and-replace: a symbol after every word, one word per line, or all capital letters. The model followed each format 100% of the time.
After converting back, the watermark was gone. The reason is how the tournament scores words: each word’s score depends on the words just before it. Write with a symbol after every word, and each word is scored next to a symbol. Delete the symbols and every word sits in a context it was never scored in. Researchers described this in 2023 as the “emoji attack”. Providers can defend against it by ignoring symbols and spacing when they compute the watermark.
Reformatting after the fact is different. Adding odd spacing to finished text hid the watermark, but only until the spacing was cleaned up again, which any detector can do first. If you can reverse a change, so can the detector.
05 · Three things people confuse
Watermarks, credentials, and “AI detectors”
In the words
Text watermark
| Where | The choice of words itself |
| Survives | Copy-paste, reformatting, light edits |
| Erased by | AI paraphrase, translation, heavy rewriting |
| Who can check | Only the key-holder |
| False alarms | Set by design (we saw 1.4%) |
In the file
C2PA credentials
| Where | Signed metadata attached to images and files |
| Survives | Sharing the original file |
| Erased by | A screenshot or re-save that drops metadata |
| Who can check | Anyone, with a free checker |
| Used by | Claude for PNG/JPG/SVG; OpenAI, Google for images |
A guess
“AI detectors”
| Where | Nowhere. They guess from writing style |
| Survives | Not applicable |
| Accuracy | Seven detectors flagged 61% of non-native English essays as AI (Stanford, 2023) |
| Who can check | Anyone, which is the problem |
| Reads Claude’s mark? | No. No public tool has the key |
4
Part 4
Discussion: what this means
A watermark that works in a lab is only part of the story. This part covers who can actually check for one, what Google has and hasn’t said, and what the SEO community has found. We finish with where we land. Where the evidence is thin, we say so.
Who can check for a watermark
Almost nobody. Anthropic’s text detector is a private preview, open to the groups that EU law says must have access: regulators, law enforcement, media, fact-checkers, independent researchers, and educational and civil-society groups. Companies that must verify watermarks for their own compliance can apply too. The public checker at claude.com/check-content only reads credentials attached to image files. It can’t check text.
What Google has said
Very little. Google called the August 2026 spam update (Aug 18–21) “a normal spam update” and announced no new policy. The September update began Sep 24, and John Mueller said it would likely take longer than earlier ones. Google hasn’t said what either update targets, and no one at Google has said whether text watermarks play any part in Search. Its long-standing policy targets pages made at scale to game rankings, however they were produced.
What else we know
The clearest evidence comes from sites that were hit. Glenn Gabe’s case studies of the August update describe programmatic health and finance pages paired with fully AI-written text, thin Amazon affiliate sites, and one site with 1.5 million mostly templated URLs. None of his write-ups mention watermarks. SE Ranking measured unusual churn: 16.7% of top-10 results fell out of the top 100 in the update window, against 9.2% in July.
Several studies find AI-heavy pages doing somewhat worse, but none shows why. Ahrefs found 5.3% of top-10 pages were fully AI-written and that those pages were indexed less often. Lily Ray tracked 220+ sites that scaled up AI content: 54% later lost at least 30% of their peak traffic. A First Page Sage study reported that “watermarked” content ranked lower on average. But it doesn’t say how it detected watermarks, and its authors note they didn’t control for quality.
Google researchers have also published two systems for catching coordinated “AI slop”, called S-CTS and SAFE. Both describe networks of video channels, not web pages. Some commentators think similar methods feed Search spam systems. Google hasn’t said so.
The theories, and how strong the evidence is
| Theory | Evidence | Our read |
|---|---|---|
| Google demotes watermarked text | One correlational study that doesn’t show how it found watermarks. Google would need Anthropic’s key, and hasn’t used its own SynthID against Gemini text in two years. | Unsupported |
| Google runs its own AI-text detector on each page | AI-heavy pages do worse in several studies, but AI text and low-quality text overlap heavily. | Possible, no direct evidence |
| Google looks for patterns at scale: templates, networks, coordination | Fits the August case studies and Google’s published research, though that research is about video. | Most plausible |
| The long September rollout means a new system | Only the unusual length and Mueller’s comment. The SAFE link is a journalist’s guess. | Speculation |
Where we land
- A watermark shows an AI was involved. It says nothing about quality or authorship. It can’t tell drafting from editing, and a missing watermark proves nothing, because edits and rewrites remove it.
- It’s a compliance tool, not a policing tool. Removing it is cheap, as our study showed, even without changing a word, and checking for it is restricted. Its real audience is regulators, researchers and newsrooms.
- For search, the watermark is a distraction. Nothing we found links it to rankings. What gets hit is content published at scale without adding anything.
- Don’t strip watermarks for SEO. There’s no evidence it helps. Editing AI drafts is normal, though, and it’s what makes the work yours. Human editorial review is also what exempts AI-assisted text from the EU’s disclosure rule.
- Keep your own records. Drafts, sources and editor sign-offs will settle an authorship question better than any watermark.
How to judge a vendor’s claim
- Does it claim to detect Claude or Gemini text? Neither company has shared its key publicly, so a public detector is guessing.
- Does it sell a “humanizer” alongside the warning? Any AI rewrite removes the watermark, and so does your own editing.
- Does it cite a ranking penalty? Ask how the watermarks were detected and whether quality was controlled for.
Timeline
- Oct 2024SynthID-Text published in Nature and open-sourced; in Gemini since.
- Jun 10, 2026EU Code of Practice on marking AI content finalized. Free-form text over 200 tokens gets a watermark.
- Aug 2, 2026EU AI Act Article 50 applies. Fines up to €15M or 3% of global turnover.
- Aug 14, 2026Anthropic explains Claude’s text watermark: a SynthID-Text variant, applied worldwide.
- Aug 18–21Google August 2026 spam update. No mention of AI content or watermarks.
- ~Sep 1Claude text detection opens as a private preview for eligible organizations.
- Sep 14Opus 5 watermarking reaches cloud partners (AWS, Google Cloud, Microsoft).
- Sep 24Google September 2026 spam update begins; expected to run until about Oct 8.
- Dec 2, 2026All Claude models released before Aug 2 must be watermarked.
- Feb 2, 2027Providers’ detectors must interoperate under the EU Code.
07 · The research
What the papers say
Keyed watermarks come with a known false-positive rate. They survive casual edits but not a determined rewrite. Researchers have now tested SynthID-Text itself. Highlighted rows are the studies this page relies on.
| Year | Paper | Venue | Finding |
|---|---|---|---|
| 2026 | AI Watermark Evidence Fails Forensic Readiness | arXiv | Watermark evidence doesn’t meet court standards once text is paraphrased. |
| 2026 | On Google’s SynthID-Text | arXiv | First theory of SynthID-Text; the plain mean score can be gamed; the weighted score is sturdier. |
| 2026 | TextSeal (Meta) | arXiv | Finds AI-written spans inside mixed documents. |
| 2025 | Robustness of SynthID text watermarking | TrustCom | Paraphrase and back-translation weaken SynthID-Text. |
| 2024 | Watermark under Fire (WaterPark) | EMNLP 2025 | SynthID detection fell from 99.8% to 49.8% under paraphrase and to 23.2% under translation. |
| 2024 | Optimizing Adaptive Attacks | ICML 2025 | Cheap tuned paraphrasers evade every watermark tested. |
| 2024 | Scalable watermarking (SynthID-Text) | Nature | Tournament sampling; no significant quality difference across about 20M Gemini responses. |
| 2024 | Watermark Stealing | ICML | Under $50 of queries lets attackers forge or scrub leading schemes. |
| 2024 | No Free Lunch in LLM Watermarking | NeurIPS | Public detection APIs make attacks easier. |
| 2024 | Can Watermarks Survive Translation? | ACL | Translating through another language drops detection to near chance. |
| 2023 | Watermarks in the Sand | ICML 2024 | Strong watermarking is impossible against a determined rewriter. |
| 2023 | SemStamp | NAACL 2024 | Meaning-level watermark that resists paraphrase. |
| 2023 | On the Reliability of Watermarks | ICLR 2024 | Survives human paraphrase given about 800 tokens. |
| 2023 | Who Wrote this Code? (SWEET) | ACL 2024 | Code is too low-entropy for standard watermarks. |
| 2023 | GPT detectors are biased against non-native writers | Patterns | Style-based detectors flagged 61% of TOEFL essays as AI. |
| 2023 | A Watermark for Large Language Models | ICML | The green/red-list scheme (the orange list above). |
| 2022 | Aaronson lecture | Blog | The keyed-random, distortion-free scheme (the race above). |