AI Chatbots Are Starting to Watermark Their Text. Here's What That Actually Means

Key points

• Anthropic announced on 11 August that all future Claude models will embed invisible watermarks in their text output.
• Google already applies SynthID-Text watermarks to its Gemini models, and Anthropic's approach is based on that system.
• OpenAI has not yet deployed a text watermark but has publicly stated it plans to do so.
• The European Union's AI Act requires watermarks on AI-generated content for models released after 2 August 2026.
• Google's study of 20 million responses found no measurable quality drop from watermarking, though researchers say short replies are a genuine weak spot.

When you ask an AI chatbot a question, the words you get back may carry a hidden fingerprint. You won't see it, and you almost certainly won't sense anything off. But software with the right key could look at that response and confirm a machine wrote it.

That fingerprint is a text watermark, and it's coming to the AI tools millions of people use daily.

How does an AI text watermark actually work?

It is not a hidden label or invisible ink. The watermark lives inside the word choices themselves.

To understand why, it helps to know how a large language model (the technology behind chatbots like Claude and Gemini) generates text. At every step, the model calculates a probability score for every possible next word. A likely word might score 40 percent; a plausible alternative might score 10 percent. The model then picks a word at random, weighted by those scores.

A watermarking system nudges those choices in a specific, trackable direction. John Kirchenbauer, a postdoctoral fellow at the Vector Institute and co-author of a widely cited 2023 paper on text watermarking, describes dividing words into two groups: a "red list" the model treats normally, and a "green list" whose words get a small probability boost. Over many words, the model ends up picking green-list words more often than it otherwise would. That pattern is the watermark.

No single word gives it away. Across a paragraph, though, the pattern is statistically detectable by software holding the right key. Kirchenbauer's team reported a 98.4 percent detection rate and zero false positives in responses of around 200 words.

Simple paraphrasing won't erase it either. The 2023 paper found that stripping the watermark from a long response requires changing roughly a quarter of its words.

Does watermarking make AI responses worse?

Experts disagree, and the answer may depend on what you're asking.

The strongest case that quality is unaffected comes from Google's 2024 paper introducing SynthID-Text, the watermarking system Anthropic adapted for Claude. Google randomly sent user queries to watermarked and non-watermarked versions of its models, then compared feedback across 20 million responses. No significant difference emerged.

But Vinu Sankar Sadasivan, an AI research scientist at Meta, points to a real limitation. Short responses are a problem. In a tweet-length reply of 20 words, a watermark may need to skew 50 to 60 percent of word choices toward the green list to be reliably detectable, and that pressure could visibly distort the output. Google's own detection-rate chart shows accuracy falling below 50 percent for short replies. Code is another tricky case: a short Python function has very few valid word choices, so a watermark has little room to hide.

"This is where I have a disagreement with some of the PR posts from Anthropic, where they say it has no quality change," Sadasivan says. He adds that watermark strength can be adjusted dynamically to preserve quality, but doing so can weaken the fingerprint itself.

Technology writer John Gruber, who co-created the Markdown formatting language, calls text watermarking a "perversion of writing" and argues that any change to word selection changes what the text actually is. Kirchenbauer's counter is direct: "A watermark wouldn't be detectable if there wasn't a change. The question is, do you care if it's not the exact original distribution if, for all intents and purposes, it doesn't change the utility to you?"

Why is this happening now?

Regulation is part of the answer. The EU's AI Act requires watermarks on AI-generated text, images and video for models released after 2 August 2026. Image and video watermarks from companies including Google and Meta have existed for years and can reach detection rates above 99 percent. Text watermarking is newer and less settled. We've tracked the SynthID-Text story since our first report on 17 August, and the debate over its real-world limits hasn't quieted.

Anthropid declined to share technical details about how its version of the watermark works or how it balances quality against detection strength.

What should readers watch for?

For most people, reading an AI response will feel identical. The watermark isn't meant for human eyes; it's meant for detection software that can flag AI-generated content in academic papers or legal documents.

Watermarks are not foolproof. Short answers, code snippets, and responses that get heavily edited afterward may carry weak or undetectable fingerprints. A watermark is a signal, not a guarantee, and anyone treating it as proof of origin is relying on a system its own creators admit struggles at the edges.