AI 101 — What is AI watermarking?

AI watermarking is a hidden, machine-readable signature embedded in AI-generated content — text, images, audio, or video — that lets a detector verify which model produced it. You can't see it, and neither can most people who copy or edit the content; it's a pattern woven into the output itself.

The concept just moved from research papers to the front page. Anthropic has started stamping every piece of text its Claude models generate with an invisible watermark, everywhere on Earth — not just in the EU that required it. The company signed the EU AI Act's transparency code of practice, and rather than mark only European traffic, it made machine-readable provenance the default for every Claude user, in every product, on every cloud partner. Generated images and SVG files get signed metadata following the C2PA standard, the same provenance system cameras and news agencies use. We covered the news in our deep dive; this is the concept behind it.

Why it matters right now

Text watermarking is the first realistic answer to a question the internet has been asking since ChatGPT launched: how do we know whether a human wrote this? The EU AI Act's Article 50 makes machine-readable marks mandatory for AI-generated content, with fines up to €15 million or 3 percent of worldwide turnover for non-compliance. Anthropic's global rollout — the most sweeping text-watermarking deployment any frontier lab has attempted — makes the mark the default for every Claude output, and whether the other labs follow will shape what "AI-generated" means on the open web.

The mental model

A language model builds text one token at a time, picking each next word from a vocabulary of possibilities. A text watermark works by quietly biasing those picks according to a secret pattern — the classic scheme, from a 2023 paper by researchers at the University of Maryland, splits the vocabulary into two groups and nudges the model toward one of them. No single word looks wrong, but across a paragraph the choices leave a statistical fingerprint. A detector that knows the secret can score any text for that fingerprint: match above a threshold, and the text carries the mark. Because the signal lives in which words were chosen, not in a file header, it survives copy-paste — copy the text and you copy the pattern. That's the property that makes it useful against AI slop, and the same property makes it fragile: paraphrase heavily enough, and you replace the telltale words.

An everyday analogy

Imagine a kitchen where every dish carries a pinch of a secret spice blend. Diners can't taste it, and no single dish reveals it — but a food lab that knows the recipe can test any plate and say with confidence whether it came from that kitchen. Reheat the dish, rearrange the garnish, serve it on new plates: the spice is still there. Boil it into stock, though, and the trace is gone. Text watermarking is the same idea: the "spice" is the statistical pattern in word choice, and the "food lab" is the detector. Light edits survive; thorough rewrites destroy the signal.

Common misconceptions

"A watermark proves AI wrote this." It proves the model touched the text — people use Claude to proofread, translate, and summarize human writing every day, and all of that leaves the mark. Anthropic is explicit that a detected mark is not conclusive proof of machine authorship.

"No watermark means a human wrote it." Absence proves nothing. Paraphrased or translated AI output can lose the mark, and models without watermarking — including most open-weight models run locally — never carry one in the first place.

"Watermarking is useless because it can be stripped." It survives exactly the population that matters most: casual copy-paste and light editing, which is how most AI slop actually spreads. A determined adversary can defeat it — that's the cat-and-mouse — which is why detectors are treated as one tool, not a silver bullet.

"Watermarking degrades quality." The bias is tiny and statistical — a nudge among equally plausible words, imperceptible by design. The harder trade-off isn't quality but openness: if the scheme is public, attackers can engineer around it; if it's secret, nobody can independently verify it.

Where to learn more

Hugging Face's explainer, "AI Watermarking 101," is a clear tour of the techniques across text, images, and audio. The 2023 University of Maryland paper that kicked off modern text watermarking is surprisingly readable for a research paper. Google DeepMind open-sourced its SynthID system — the watermark built into Gemini — with a reference implementation on GitHub. And Anthropic's support document is refreshingly candid about exactly what its marks can and cannot prove.

Ever wondered whether the paragraph you just read was written by a human? Tell us in the comments.

Sources: AI Midday — Anthropic's invisible ink · Anthropic — How Claude marks AI-generated content · Hugging Face — AI Watermarking 101 · Kirchenbauer et al. — A Watermark for Large Language Models · Google DeepMind — SynthID Text (GitHub) · European Commission — Transparency guidelines