How AI watermarking works
Updated September 1, 2026 · first published September 1, 2026
There is an invisible signal in text generated by supported Claude models. You cannot see it. Your users cannot see it. It does not change the meaning, the quality, or the reading experience, and it does not appear on your invoice. It is there anyway, and it is worth ten minutes of your understanding, because the things that break it are things your own pipeline does every day.
How the text watermark works
A language model does not pick the single most likely next token. It samples from a probability distribution, and that sampling uses randomness. The watermarking technique — following Google DeepMind's SynthID-Text approach — biases that randomness. Certain tokens become very slightly more likely than they otherwise would have been, according to a pattern only the detector knows.
Any single word choice is unremarkable; a plausible alternative was always available, and the model picked one of them. Across a few hundred tokens, though, the pattern accumulates into a statistical signal that a detector can measure and a reader cannot perceive. That is the whole trick: the watermark hides in a decision the model was already making at random.
Two consequences follow immediately, and both matter more than the mechanism. First, it is statistical, not a stamp — there is no field to read, only a confidence level to compute. Second, it needs length. A tweet-sized output carries far less signal than a full page.
How image provenance works, and why it is different
Images and files take the opposite approach. Generated .svg, .png and .jpg files carry C2PA metadata: a cryptographically signed manifest recording what produced the file. That is not statistical and not hidden — it is a discrete block of data attached to the file, verifiable exactly rather than probabilistically.
The trade-off is exactly what you would expect. Signed metadata gives you certainty, and it can be deleted in one command. A statistical text watermark cannot be deleted cleanly, but it degrades as the text is edited, paraphrased or translated. Neither is a lock; both are evidence.
Who can check
Detection is gated. On 1 September 2026 an API opened to eligible organisations: regulators, law enforcement, media, fact-checkers, independent researchers, educational institutions, EU civil society groups, and enterprises with their own verification obligations. Access widens over time. If you are not eligible, you cannot verify your own output through the API, and your evidence has to come from your own logs.
Why it exists
Article 50 of the EU AI Act took effect on 2 August 2026, and it requires machine-readable marking of AI-generated content. Marking is applied worldwide rather than EU-only, which is the simpler engineering choice and means it is already in output you shipped months ago.
What this means for your systems
Three practical facts. Short outputs carry weak signal, so a classifier or extraction service returning single words is effectively unmarked. Heavy post-processing — paraphrasing, summarising, translating, or passing text through a second model — erodes the signal, so a chain of models attributes to the last one at best. And your image pipeline can destroy C2PA metadata by accident, which is the most common way provenance goes missing in production.
None of that is a reason to change what you build. It is a reason to know which of your outputs still carries provenance and which does not, before someone asks you to prove it.
Related
Related
Want this applied to your own LLM spend? FinOps LLM runs a free audit of your AI costs and shows where the savings are. Book free audit →