AI Text Watermarking in 2026: How OpenAI, Google, and Anthropic Differ
OpenAI built a text watermark and never shipped it. Google shipped SynthID and open-sourced it. Anthropic made Claude's mandatory. What each system does, what it proves, and what it means for your writing.
OpenAI, Google, and Anthropic have all built the same technology: a statistical watermark for AI-generated text. OpenAI has never released its version. Google shipped SynthID inside Gemini and published the method. Anthropic made Claude's watermark mandatory for every user in August 2026. If you write with AI assistance in any form, all three decisions now shape how your documents are judged.
Watermarking moved from a research topic to mainstream news on August 11, 2026, when Anthropic announced that every new Claude model marks its text output. We covered that announcement in detail in our Claude watermark explainer. This guide covers the full picture: what a text watermark is, how each of the three major labs implemented or withheld it, and what each system proves about a piece of writing.
What is an AI text watermark?
An AI text watermark is a statistical pattern hidden in the word choices of generated text, planted at the moment of generation so that a detector holding the right key can later verify the text came from a specific AI system. It is not a visible label, not a hidden character, and not metadata attached to a file. The mark lives in the words themselves.
That distinction matters, because the term "watermark" gets used loosely for three different things:
| What it is | Where it lives | Survives copy-paste? | |
|---|---|---|---|
| Statistical watermark | A bias in which words the model picks | The text itself | Yes |
| File metadata (C2PA) | A signed provenance label | The file container | No, plain-text copy strips it |
| Zero-width characters | Invisible Unicode inserted into text | Between the visible characters | No, trivially stripped |
Statistical watermarking is the only one of the three that survives copying, pasting, retyping into a new document, and format conversion. That is why all three major labs converged on it for text, and why "watermark removers" that strip invisible characters do nothing against it. Our free Claude watermark remover page documents that failure mode with sources.
How does statistical watermarking actually work?
At every step of writing a sentence, a language model chooses between several near-equivalent words, and a watermark quietly loads those dice. The foundational recipe was published by Kirchenbauer and colleagues at the University of Maryland in January 2023, in A Watermark for Large Language Models (ICML 2023). It works like this:
- Before each word is chosen, a secret key derived from the preceding words splits the vocabulary into a preferred set and a neutral set.
- The model nudges its choice toward the preferred set. "Suggest" instead of "indicate." "Across" instead of "among." Each individual choice looks completely natural.
- A detector that holds the key counts how often the text lands in the preferred sets. Human writing hits the expected rate by chance. Watermarked text hits it far too often, and a statistical test flags the discrepancy.
No single word is evidence of anything. The signal only emerges across dozens or hundreds of choices, which is why longer passages are easier to test than short ones, and why detection is always probabilistic rather than a yes/no stamp.
Google DeepMind's production system, published in Nature in October 2024 as Scalable watermarking for identifying large language model outputs, refined this with a technique called tournament sampling, which preserves text quality well enough to run silently inside a consumer product at scale. That paper matters beyond Google: it is the published basis that Anthropic points to for Claude's implementation.
The main weakness was published before most of the deployments. In March 2023, Krishna and colleagues showed in Paraphrasing evades detectors of AI-generated text (NeurIPS 2023) that regenerating the wording of a passage collapses detection across methods, watermarking included. The signal lives in the exact token sequence and nowhere else, so anything that rewrites the sequence, a human editor included, rewrites the evidence away. Every vendor shipping a watermark today states this limitation in its own documentation.
OpenAI: the company that invented it and never shipped it
OpenAI has had a working text watermark for years and has chosen, so far, not to release it. The idea was first described publicly by Scott Aaronson, then working on safety at OpenAI, in a November 2022 lecture: bias the model's choices among near-equivalent words with a secret cryptographic function, so the text itself proves where it came from. That lecture predates every deployed system and is the founding document of the field.
In May 2024, OpenAI described the state of the project in its provenance update, Understanding the source of what we see and hear online. The company said its text watermarking method was accurate and effective on small edits, but that it was holding release while it weighed the trade-offs. Two of the risks OpenAI named matter directly for academic writers:
- Easy circumvention. Paraphrasing or translating the text removes the mark, exactly as the 2023 research predicted. A watermark that mostly catches people who do not know it exists is a weak enforcement tool.
- Disproportionate impact on non-native English speakers. OpenAI stated that watermarking could stigmatize legitimate use of AI as a writing aid for people writing in a second language. Our piece on why AI detectors flag non-native writers covers the same problem from the detector side.
OpenAI's own provenance update: the method works, and the company lists the reasons it has not shipped it.
For images and audio, OpenAI went a different route: C2PA provenance metadata in DALL-E and Sora outputs, which is a file-level label rather than a mark in the content. For text, as of late August 2026, ChatGPT output carries no watermark. The company that proposed the technology remains the only one of the three that has never deployed it.
Google: first to ship, then gave the recipe away
Google DeepMind shipped first, published fully, then opened the method up. Its system, SynthID, started as an image watermark in 2023 and expanded to text in 2024. By the time the Nature paper appeared in October 2024, SynthID-Text was already running inside Gemini in production, which made it the first statistical text watermark deployed at consumer scale.
SynthID covers text, images, audio, and video, and has been live in Gemini text output since October 2024.
Google then published the implementation as open source on Hugging Face, letting any developer apply the same watermarking scheme to their own models. In May 2025 it announced the SynthID Detector, a verification portal where content can be checked for SynthID marks across text, images, audio, and video.
One scope limitation matters: SynthID only marks and only detects content from Google's own models. It says nothing about ChatGPT or Claude output, and a clean SynthID scan does not mean a text is human-written. It means Google's models did not write it, which is a much narrower claim.
Anthropic: last to move, strictest policy
Anthropic deployed latest, with the widest mandatory coverage. Every Claude model launched on or after August 2, 2026 embeds a statistical watermark in its text output, worldwide, on every plan, with no opt-out. The company describes the mechanism in its explainer, How Claude's text watermark works, and the policy scope in its help-center article, How Claude marks AI-generated content: the Claude API, claude.ai, Claude Code, Claude Cowork, and Claude Tag are all covered. Models launched before the cutoff are in a transition period, and Anthropic says it is adding marking support to those as well. Alongside the statistical mark, Claude-generated files also carry C2PA metadata, a second, separate system that plain-text copying strips.
The policy in Anthropic's own words: every new model, every platform, worldwide, with older models being added.
Anthropic's documentation states the limits directly. Detection is probabilistic. The mark cannot distinguish a document Claude wrote from a document a human wrote and Claude lightly edited. A complete rewrite removes it. We walked through all of this, including what a positive detection actually proves and what to do if your own writing gets marked, in the dedicated Claude watermark guide.
The timing follows the regulation. Anthropic has signed the Article 50(2) Code of Practice on Transparency of AI-Generated Content under the EU AI Act, which requires providers of generative AI systems to ensure outputs are "marked in a machine-readable format and detectable as artificially generated." Those transparency obligations became applicable on August 2, 2026: the exact cutoff date in Anthropic's model policy, nine days before the public announcement. Anthropic chose to comply globally rather than maintain separate behavior for EU traffic. Google was already compliant by design. OpenAI's unmarked text output is the open compliance question for 2027.
The three approaches, side by side
| OpenAI | Google DeepMind | Anthropic | |
|---|---|---|---|
| Text watermark deployed? | No | Yes (Gemini, since Oct 2024) | Yes (Claude models from Aug 2, 2026) |
| Technique | Cryptographic sampling bias (built, unreleased) | SynthID-Text tournament sampling | Statistical sampling mark, SynthID-style |
| Coverage | None for text | Google models only | All new Claude models; older models in transition |
| Opt-out | Not applicable | No | No |
| Public detector | No | SynthID Detector portal (2025) | Planned, not yet released |
| Scheme published? | Concept lectures only | Nature paper + open source | Explainer, based on published work |
| File metadata (C2PA) | Yes, images and audio | Yes, across media | Yes, on generated files |
| Stated limitations | Circumvention, ESL stigma | Scope limited to own models | Probabilistic, edits blur authorship |
The pattern across the columns: OpenAI treats text watermarking as an unresolved policy problem, Google treats it as infrastructure to standardize, and Anthropic treats it as a compliance obligation to implement in full.
What this means for researchers and academic writers
The practical consequences depend on which tools touch your text. If you draft with ChatGPT, your text carries no watermark today. If you draft with Gemini, it carries a SynthID mark that only Google's detector can read. If you draft or edit with a current Claude model, it carries Anthropic's mark, and there is no setting that turns that off.
Three things academic writers should know:
A watermark identifies a tool, not an author. Every vendor states this in its own documentation, and it is worth repeating because institutional policies do not always make the distinction. Text can be marked because an AI drafted it, because an AI copy-edited two sentences of it, or because a marked paragraph was quoted. If your institution runs watermark checks, what the check proves is that a specific model touched the text at some point, nothing more. Our guide on appealing a false AI detection flag covers how to make that argument when it matters.
Watermarks and AI detectors are different technologies with different failure modes. Detectors like Turnitin or GPTZero guess from statistical style, with the accuracy problems we have documented. Watermark detection is a key-based test with a very low false-positive rate on unmarked human text. The asymmetry flips for false negatives: a watermark check misses any AI text from a non-watermarking model, which today includes all of ChatGPT.
Disclosure remains your strongest position. Watermarking makes silent AI use riskier and disclosed AI use safer, because a disclosed workflow has nothing to fear from a positive mark. Most journals and universities now have explicit AI-use policies; our AI use policy explains how we draw those lines across our own tools, and it is a reasonable template for what transparent use looks like.
What removes a text watermark, and what does not
Rewriting removes it; reformatting does not. Copying, pasting, changing fonts, converting between file formats, and stripping invisible characters all leave a statistical watermark fully intact, because the mark is in the word choices. What removes it is anything that regenerates the wording: a deep human edit, a translation, or a genuine paraphrase, as the NeurIPS 2023 robustness work established before any of these systems shipped.
Both directions matter here. The mark disappearing does not make text yours, and the mark surviving does not make text not yours. A rewritten AI draft is still an AI-assisted document that your institution's disclosure rules apply to. Our AI text humanizer rewrites AI-assisted drafts into a natural academic register, and because that process regenerates the token sequence, statistical marks do not survive it. For Claude text specifically, the free Claude watermark remover re-expresses every sentence in fresh wording while keeping facts, numbers, and citations unchanged. What no tool can change is what you owe your reader: transparency about how the document was made.
Rewriting is the one operation that removes a statistical mark, and it is what this tool does, sentence by sentence.
Where this goes next
Watch three things through 2027. First, whether OpenAI ships: EU enforcement of Article 50 makes "built but unreleased" an increasingly expensive position for text. Second, whether detectors converge: a world where every major lab watermarks with a published scheme is a world where universities check keys instead of guessing from style, which would be a real improvement over today's false-positive-prone detection. Third, whether interoperability arrives: today, three labs means three incompatible marks and no universal check. C2PA fills that gap for files; nothing yet fills it for raw text.
Does ChatGPT watermark its text?
No. As of August 2026, OpenAI has built a text watermarking method but has not deployed it, a position the company explained in its May 2024 provenance update. ChatGPT text output carries no statistical watermark and no hidden characters. OpenAI does apply C2PA provenance metadata to DALL-E and Sora media files, which is a separate, file-level system.
Does Google Gemini watermark its text?
Yes. Gemini output has carried Google DeepMind's SynthID-Text watermark since October 2024. It is a statistical mark in the word choices, invisible to readers, and checkable through Google's SynthID Detector. It only applies to Google's own models, so a negative SynthID result says nothing about text from other AI systems.
Does Claude watermark its text?
Yes. Every Claude model launched on or after August 2, 2026 embeds a statistical watermark in its text output, on every platform and plan, with no opt-out, and Claude-generated files additionally carry C2PA metadata. Models launched before that date do not yet mark their output; Anthropic says it is adding marking support to them during a transition period. The full details are in our Claude watermark explainer.
Can universities detect AI watermarks?
Only with the vendor's cooperation, because detection requires the vendor's key. Google offers a public detector portal for SynthID content. Anthropic says detection support for users and third parties is planned but has not yet released a public detector. No mainstream plagiarism suite can currently verify statistical watermarks from any lab, so institutional "AI detection" today still means style-based guessing, not watermark verification.
Is AI watermarking required by law?
In the EU, yes in effect. Article 50(2) of the EU AI Act requires generative AI providers to ensure outputs are marked in a machine-readable format and detectable as artificially generated, with transparency obligations applicable from August 2, 2026. Anthropic signed the related Code of Practice and chose worldwide compliance. How regulators treat OpenAI's unreleased text watermark is the question to watch in 2027.
Do AI watermarks survive translation?
No. A statistical watermark lives in the exact sequence of words the model chose, and translation replaces every word. The same is true of deep paraphrasing and heavy human editing. This limitation is documented in the peer-reviewed literature and acknowledged by every vendor that ships a watermark.
Sources
- Anthropic, How Claude's text watermark works, August 2026
- Anthropic Help Center, How Claude marks AI-generated content, 2026
- OpenAI, Understanding the source of what we see and hear online, May 2024
- Google DeepMind, SynthID
- Dathathri et al., Scalable watermarking for identifying large language model outputs, Nature, October 2024
- Google, SynthID Detector announcement, May 2025
- Hugging Face, Introducing SynthID Text, October 2024
- Kirchenbauer et al., A Watermark for Large Language Models, ICML 2023
- Krishna et al., Paraphrasing evades detectors of AI-generated text, NeurIPS 2023
- Scott Aaronson, My AI Safety Lecture for UT Effective Altruism, November 2022
- European Union, AI Act, Article 50
- C2PA, Coalition for Content Provenance and Authenticity
Dana is a content creator at ProofreaderPro, where she runs the daily blog and writing operations. She writes the articles on how the online editing platform works, and she handles customer messages every day, with a five-star satisfaction score to show for it.
