What is an AI text watermark?
A language model writes one word at a time, counting tokens that can be whole words or pieces of words. At most steps, several possible next words fit about equally well, and a random number normally settles which one the model uses. A watermarked model swaps that random number for one computed from a secret key and the last few words. As Anthropic says in its explanation of Claude's watermark, "watermarking uses the key and a few words that come before to settle what word the model should pick."
The text reads the same, with no hidden characters or added text. What changes is the pattern of word choices, which now leans in a way only someone holding the key can recompute. You can't spot that lean in a single word, just as one coin flip can't tell you whether a coin is weighted. Over a few hundred words, the lean adds up, and the key holder can calculate a likelihood that their model was involved, though the result can't prove it.
What is a hash function?
Computers store each character as a row of eight bits, which you can picture as switches that are either on or off. The letter A, for example, is 01000001.
A hash function takes any input, turns it into bits, and mixes them using a fixed recipe to produce a number of fixed length that looks like noise. The recipe doesn't make random choices as it works through the bits, so whenever you start with the same input, you get the same output, and anyone else who runs it gets that same output too. Even if you have the number that comes out, nobody can run the recipe backward from that output to recover the input that went in. Google's watermark code uses add, rotate, and XOR (short for exclusive or) as its three moves.
XOR compares two rows of switches, one position at a time. Where the switches differ, its output switch is on (1), and where they match, it's off (0). Flip any input switch, and the output switch under it flips too, which is why mixing recipes lean on XOR.
Rotate slides every switch along by a set number of places. A switch pushed off one end comes back on the other, so none are lost. Add works like ordinary addition on 32-switch numbers. Once the count passes the largest such number, 4,294,967,295, it wraps back to zero like a car odometer.
How does a hash mix its input?
A hash mixes its input by repeating a short recipe in rounds. Google published the code for Threefry, the hash its SynthID watermark code uses, on October 23, 2026. In that code, one round takes three lines to add values, rotate them, and combine them using XOR. Threefry repeats the process for 20 rounds in all, mixing the secret key back in after every fourth round.
Think of scrambling a Rubik's cube with a short list of simple moves. You make those moves in a fixed order. Start with the same cube and follow that recipe, and you'll get the same scrambled cube every time. A cube only moves stickers around, but a hash also adds and XORs values together, so a small change spreads.
In our run of Google's function, the two inputs started with just one switch differing between them. After the first round, they differed in 4 of 64 switches, and after the next three rounds, that count reached 13, then 17, then 40. After round 20, the two outputs differed in 32 of 64 switches. That last count is half the switches, which is as different as two unrelated random numbers get.
Why does one letter change half the output?
SHA-256 is the standard hash behind file fingerprints and password storage. SHA stands for Secure Hash Algorithm, and 256 is the number of bits it puts out. To see what happens when the input changes, compare the SHA-256 output for "The crew arrived early" with the output for "The crow arrived early." Although the inputs differ by just one letter, 137 of the hash's 256 output switches flip when you compare the two results. Those 137 switches amount to about half of the output, the kind of difference you'd expect if you compared two unrelated random numbers.
Cryptographers call this the avalanche effect because a small change at the top of the input sets off changes all the way down. You can't nudge a hash output by making small edits to the input. That same property makes a watermark's coin flips look like noise to anyone without the key.
Where do hashes already show up?
A site keeps a hash of your password, never the password itself, then hashes what you type at login and compares the two. Careful sites add a salt, random characters mixed into each password before hashing, and use slow hashes such as bcrypt to make guessing take longer. Git names each file and commit by a hash of its contents. It uses SHA-1 by default and supports SHA-256 repositories since Git 2.29 in 2020, according to Git's hash transition notes. Editing old history changes every later commit ID. Bitcoin gets block IDs by running SHA-256 twice, and miners hunt for a block whose hash starts with a long run of zeros.
Under the HTTPS padlock, TLS 1.3 (Transport Layer Security, the protocol behind the padlock) derives session keys with HKDF (HMAC-based key derivation function), which is built on HMAC (hash-based message authentication code). HMAC is a hash with a secret key mixed in. A webhook is an automatic message one service sends another when something happens, such as Stripe telling a store a payment went through. Stripe signs each webhook with HMAC-SHA256 and a secret only Stripe and the merchant hold, and Shopify and GitHub do the same. The merchant's server recomputes the HMAC with that shared secret, so a match proves the message came from Stripe and wasn't changed.
The watermark uses almost the same mechanism. It puts a secret key and a message into a hash, and the checker recomputes the hash with the same key. HMAC attaches one signature beside the message and checks for an exact match, while the watermark attaches nothing and spreads its signal across word choices, which the checker tests by counting.
Why are fingerprints 256 bits long?
Think of each bit as a switch. Every switch you add doubles the number of possible outputs because each arrangement you already had can now use either position of the new switch. With 64 switches, there are 18,446,744,073,709,551,616 possible outputs. With 256 switches, the number of possible outputs is 78 digits long.
The birthday problem shows how soon a match can turn up, since a room of 23 people has a 50.7% chance that two share a birthday. Hash outputs can collide the same way. A fingerprint gets 256 bits because it must never repeat. Finding any repeat by chance takes about 2 to the 128th power tries. The watermark needs only fast coin flips computed for every candidate word at every step, and Google's hash produces 64 bits each time it's used.
How does a watermark use a hash?
At each step, the model has a short list of words it could write next, each with its own odds. As an illustration, after "The crew arrived," that list might include "early" at 30%, "promptly" at 22%, "late" at 14%, and "today" at 11%. For each candidate, a hash takes the secret key, the words just before it, and the candidate itself, then returns coin flips. Google's code reads 30 flips per candidate, one for each round of a tournament, and 30 rounds is its published default.
The secret key goes into every hash calculation, so a different key changes every flip. Run the same sentence under a different key, and you get an unrelated pattern of heads and tails.
In ETH Zurich's probe of Gemini, researchers found that "the context size of the watermark is 4 tokens for all models." Tokens are pieces of text, and the window moves as the model writes, so the same word in a different spot gets different coins. There's no list of suspicious words to steer around. The probe also found that nine Gemini models share one key, while Gemini 4 Argon uses a different way to split text into pieces and doesn't share that key.
The candidates the model already rates as good meet in a knockout bracket. Heads beats tails in each round, and the last candidate standing gets written into the sentence, where it reads like any ordinary pick. Anthropic says "the watermark only changes the source of the randomness used to pick among words." Google's live test of this approach, reported in Google DeepMind's paper in Nature, covered about 20 million Gemini responses, and users rated watermarked and unwatermarked answers the same.
How does a detector find the mark?
The detector starts with the finished text and the key, moves forward through the text in order, and recalculates each word's coin flip from the words before it, which are sitting right there in the finished text. Nothing runs backward, and nothing has to be stored anywhere, because the key and the finished text give the detector what it needs to do the calculation again. The detector then counts how many of those recalculated coins come up heads. Human writing lands near 50% heads, while marked writing drifts higher, so the gap becomes clearer as the passage gets longer.
At a 1% false-alarm rate, OpenAI's figures for its own watermark show that it catches about 80% of 200-token passages and about 95% of 400-token passages. A token is a word or a piece of a word, so 400 tokens is roughly 300 words. The result gives a likelihood, and Anthropic's help center says, "A detected mark provides a signal that content was processed by Claude, but is not fully conclusive." A hit can mean Claude only proofread or translated the text, while a miss proves nothing about who wrote it.
What weakens a watermark?
Changing one word breaks its own coins and the coins of the four words after it, which used that word as context. Anthropic says light editing probably won't remove the mark completely, but rewriting every word will. In OpenAI's test of its own mark on 400-token passages, where tokens are words or pieces of words, swapping 10% of words for synonyms cut detection from about 92% to 66%, and swapping 25% cut it to 17%. Researchers built a detector that finds 100 to 400 marked tokens hidden in a 10,000-token text, so mixing marked passages into other writing doesn't necessarily hide them.
Phone numbers, prices, quotes, and code have one right answer, so the coins have nothing to settle. Anthropic says marks are sparser on factual passages. Very short passages also give too few coin flips to judge.
A translation Claude writes still carries the mark because Claude picked every word. Find-and-replace and stripping invisible characters do nothing because the mark adds no characters. OpenAI marks text it sends to developers' own software only when the developer opts in, and it's off by default. Text another model writes from notes never gets Claude's mark, and at Complete SEO, Claude handles the research and notes while GPT-6 Sol, which we rate the better writer, writes every published sentence.
Who marks AI text today?
Claude marks text using a version of Google DeepMind's SynthID-Text, which was published in Nature in 2024. As of October 28, 2026, nine Claude models mark text: Fable 5.1, Fable 5, Mythos 5.1, Opus 5.5, Opus 5, Opus 4.8, Sonnet 5.5, Sonnet 5, and Haiku 5.5. Older models remain unmarked, and Anthropic's help center says of them, "Anthropic is adding watermarks to outputs from models released before August 2, 2026." Claude's marks apply in every region and everywhere Claude runs, including the API (application programming interface, the connection developers use to build Claude into their own software) and cloud partners.
OpenAI's announcement on October 5, 2026, introduced its own text watermark, textGrain, for ChatGPT and Codex in the EU, with a rollout over the following weeks. API customers can opt in, but the watermark is off by default for them, and OpenAI plans to make its code publicly available. Google marks Gemini text with SynthID.
The approach goes back to a proposal Scott Aaronson made in 2022. The EU drove the push in 2026 because, as of August 2, it requires AI providers serving its market to mark AI-generated content. Around 190 signatories signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026.
Can anyone check your content for a watermark?
Anthropic gives access to its detector through a private preview for regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, EU civil society groups, and companies with their own EU compliance duties, according to Anthropic's watermark post. OpenAI accepts applications for its detector from researchers and expert organizations, then approves access case by case, according to OpenAI's watermark announcement. Google's SynthID Detector has been open to anyone since October 2026 for checking images, video, and audio, including files from partners OpenAI, NVIDIA, and Kakao, with Apple coming. It doesn't check text. There's no public text watermark detector from any AI company yet.
Search engines aren't on either access list, and Google's Search Central documentation didn't mention watermarks when we checked it in September 2026. The AI detectors people run, such as Pangram and GPTZero, judge writing style. On Pangram's page on watermarks, the company says, "Pangram does not currently support AI watermarking detection." Anthropic explains the difference: "AI detection software uses a different method, because the companies that provide it don't have our key."
Why can't one detector read every watermark?
Each company's text watermark uses its own key, which is why Anthropic says of another AI's text that "even if that other AI uses watermarking, it would have a different key." OpenAI's textGrain uses a different method altogether, and for text, Google's detector reads only Gemini's marks. For images, video, and audio, files from OpenAI, NVIDIA, and Kakao carry SynthID marks that Google's public detector reads. Each text detector can only tell you whether its own model wrote the text.
The key has to stay private because whoever holds it can check a mark, forge one, or keep editing text until the mark disappears. Stripe has to keep a merchant's webhook secret private for the same reason. Pangram's page says checking text for a watermark "requires that the company give access to the private key they used to generate the watermark."
Images and other files work another way through C2PA (Coalition for Content Provenance and Authenticity), an industry standard that attaches a label signed with a private key to a file so anyone can check the label with a public key. Anthropic's free Claude Content Checker reads the C2PA labels on files Claude makes. Fairoze and colleagues presented a public-key text watermark in 2023, described in the public-key watermark paper. No AI company ships one, and a September 2026 paper by Nemecek, Chaudhary, and Ayday, Watermarks Without Verification, lists detection that works across companies among the missing pieces.
