How AI Text Watermarks Work

Unicode contains many code points that affect layout, direction, joining or line-breaking without drawing a visible glyph. A system could insert a chosen pattern of them as a signature, and copy-and-paste pipelines insert them accidentally all the time.

Because these are literal characters, they can be enumerated, counted and removed exactly. The catch is that presence proves nothing about origin: the same characters arrive from web page layout, editors, PDF exports and chat clients. A conservative cleaner also has to leave joiners alone, since deleting them corrupts emoji sequences and several writing systems.

At each step a language model has several acceptable next words. A statistical watermark uses a secret key to nudge that choice, consistently, in a way a reader cannot perceive. Google describes SynthID Text as a logits processor that augments the model's logits with a pseudorandom g-function; Anthropic describes using the key plus the preceding words to settle which word gets picked.

Detection then measures whether a passage's choices align with the key more often than chance allows. This is why the signal is cumulative: more text means more evidence. It is also why nothing is hidden in the characters — Anthropic states plainly that nothing is added to the text and there are no hidden characters.

The providers document this themselves, and their answers agree. Rewriting is the lever that matters, and the more of the original wording that survives, the more of the signal survives with it.

• Thorough rewriting: Google says detector confidence can be greatly reduced; Anthropic says a complete rewrite in which every word is replaced will remove the mark, while light editing probably will not.
• Translation into another language.
• Density of free choices: factual passages, code and quotations carry less watermark, because the model had fewer acceptable alternatives to encode into.
• Length: short samples carry little evidence, and Anthropic notes detection does not work well on small samples.

Detection is statistical, keys and methods are not static, and for most providers there is no public detector to test against. Anyone promising that text is now permanently undetectable is describing a measurement they cannot make.

The honest framing is a large reduction in a signal, stated alongside its limits. It is also worth separating the mechanical question from the ethical one: a watermark indicates a model was involved, not who holds authorship, and Anthropic says explicitly that its mark cannot distinguish text Claude wrote from text Claude heavily edited.