AI text watermarking: what it can prove, and what it can't
Copy a paragraph from an AI assistant into a plain text document. Remove the formatting. Change the font. You may still have copied a watermark.
Some AI text watermarks live in the pattern of words the model chooses. There is no badge to crop out or hidden character to delete. Preserving the words can preserve the signal.
That helps explain the reaction in a recent Reddit discussion about OpenAI's Astra models and a Hacker News thread about text watermarking. People are debating transparency, privacy and whether using AI should affect how their work is judged. Those questions deserve better answers than a detector score.
How a watermark gets into ordinary words
A language model produces text in small pieces called tokens. A token can be a word or part of one. At each step, several possible continuations may fit.
Imagine the unfinished sentence: "The meeting was surprisingly..." Depending on the context, "useful", "brief" or "productive" might all be reasonable. A watermarking system can use these choices to leave a statistical pattern across a passage.
One early approach, described by Kirchenbauer and colleagues, selects a changing group of candidate tokens and slightly increases their chances of being chosen. The researchers call these "green" tokens. Nothing appears green on the page; it is a label used by the algorithm. A detector checks whether the finished text contains more of these selections than chance would normally explain.
Google's SynthID-Text uses a different sampling method. The shared idea is to introduce a detectable pattern during generation. This differs from an AI classifier that examines existing text and guesses its origin from learned characteristics. Google's technical explanation covers both approaches.
An em dash or an overused phrase is not, by itself, evidence of a watermark. The signal depends on patterns across token choices, rather than a list of suspicious words.
What has actually been announced?
Anthropic's August 2026 announcement describes a version of SynthID-Text for new Claude models, with older models to follow. It says the watermark contains no information identifying a user, organisation or conversation. Its September update describes a detection API in private preview for eligible organisations. Detection access is therefore separate from access to the model itself. Anthropic's announcement sets out the scope and limitations.
OpenAI's position needs more careful wording than the Reddit speculation. Its current provenance documentation lists support for images and audio, and says it intends to extend provenance signals to text. That page does not establish that every Astra text response is watermarked. An intention to support text is insufficient evidence of a particular model's rollout.
The same documentation distinguishes embedded watermarks from C2PA Content Credentials. C2PA records origin and history in file metadata, which can be removed during processing. An embedded watermark travels within the content and may survive some transformations. Neither establishes that a claim in the content is true.
Why detection has limits
Watermarks need enough choices to form a recognisable pattern. A long, varied passage gives a detector more evidence than a short factual answer. Google reports that SynthID can survive some light edits, while extensive rewriting or translation can substantially reduce detection confidence. Its explanation of these limitations also notes that tightly constrained answers provide fewer opportunities to embed a signal.
This creates an uneven picture. Some AI-assisted work will produce a detectable result, while other work will not. A negative result cannot establish human authorship, especially when the detector only recognises certain systems.
There is also a statistical distinction worth keeping. A low false-positive rate measures how often a test incorrectly flags material under specified conditions. It is not automatically the probability that a particular person used AI. That judgement depends on the test, the material being checked and the other evidence available.
For an employer or publisher, a result should prompt a review of the work and its history. Turning a score directly into an accusation skips the part where someone establishes what happened.
AI involvement covers very different kinds of work
Consider a technical specialist who writes an article in Thai, then uses AI to translate it into English. Compare that with someone who asks an assistant to invent an article on a subject they do not understand.
The final English text could carry a watermark in either case. The contribution behind it is very different.
Anthropic explicitly says its watermark applies to translations and cannot distinguish generation from substantial editing. Light proofreading may leave too few changes to detect. A result can indicate Claude's involvement without measuring the human contribution. Its explanation makes that distinction clear.
A policy that treats both examples identically discards useful information. The relevant questions include who supplied the ideas, whether the claims were checked, and whether the person publishing the work can explain and defend it.
Disclosure can preserve that context. "Translated with AI and reviewed by the author" tells a reader much more than a generic AI label. It also gives the author a specific claim to stand behind.
What the EU rules actually say
The legal discussion often merges two separate obligations.
Article 50(2) of the EU AI Act addresses providers of systems generating synthetic content, including text. It requires machine-readable marking and detectability, with qualifications about technical feasibility and exceptions covering standard editing assistance or changes that do not substantially alter the input or its meaning. The provision does not prescribe Google's SynthID as the required technology.
Article 50(4) separately addresses disclosure by those publishing AI-generated or manipulated text to inform the public on matters of public interest. It includes an exception where human review or editorial control takes place and someone holds editorial responsibility for publication. Both provisions appear in the official text of Article 50.
Human review is therefore not a blanket exemption from the provider's marking obligation. Equally, those provisions should not be compressed into a claim that every AI-assisted sentence needs a visible warning.
How businesses should respond
There is a useful role for evidence about where content came from. It can help investigate disputed material and support disclosure. Its value depends on how carefully people interpret it.
For a team using AI, start by defining acceptable use for the actual task. Translation, drafting a customer response and producing a research report may need different review requirements. Make those requirements understandable before using detection to enforce them.
Keep the evidence that lets someone assess the finished work: source references, meaningful revisions and the name of the person who approved publication. If a watermark result raises a concern, examine that record and give the author a chance to explain their process.
Providers also need to publish clear information about which outputs are marked, who can verify them and how often detection goes wrong. Without that, organisations are being asked to make decisions using a signal they cannot properly evaluate.
A customer reading a technical recommendation needs someone to take responsibility for its accuracy. A watermark may help explain how the words were produced. The person delivering the recommendation still has to check it.