TL;DR: On 2 August 2026, Anthropic switched on invisible SynthID-Text watermarks worldwide on every new Claude model to comply with Article 50(2) of the EU AI Act (Anthropic); OpenAI still refuses to watermark ChatGPT text and only marks images and audio (OpenAI). Independent audits show the watermark loses 98.3% of its signal after one paraphrase pass (arXiv 2607.16010) and Anthropic itself concedes it “cannot distinguish ‘Claude wrote this’ from ‘Claude heavily edited this'” (Anthropic). The whole scheme measures the wrong side of the equation — the token stream — while ignoring the only thing that has ever mattered: the prompt, the harness, and the human doing the thinking.
Why is the EU forcing AI labs to watermark text now?
Three forces pushed this into production this month, not one.
First, regulation: Article 50(2) of the EU AI Act requires providers of generative systems to mark synthetic text, audio, images, and video as machine-readable and detectable “where technically feasible,” with the transparency obligations applying from 2 August 2026 (Anthropic, Euronews). Around 190 signatories signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026 (Anthropic).
Second, cost: SynthID-Text imposes a 0.57% latency increase per token on Gemma 7B-IT — cheap enough that shipping it beats the cost of an EU enforcement action (Nature, 2024). Marking is now cheaper than not marking.
Third, incentive: labs face regulatory risk in the EU and reputational risk everywhere else from an internet visibly clogged with synthetic content. Watermarking lets them tell regulators “we tried” and, more quietly, gives them a provider-side auditing tool to catch model-extraction and misuse campaigns (Columbia Stats).
I’ll define the key term with a worked example so we can proceed cleanly.
LLM text watermark is a machine-detectable signal embedded in a language model’s output by biasing which words the model chooses, without changing meaning or readability. Example: when Claude has to describe today’s weather and both “overcast” and “grey” are equally natural, a keyed pseudorandom function decides — using the last few words as input — which one wins. Repeat that hidden coin-flip thousands of times per document and a statistical fingerprint emerges that a detector holding the key can pick out with high confidence — assuming nobody paraphrased the text.
How does Anthropic’s SynthID-Text watermark actually work?
Claude generates one token at a time. At each step it faces a distribution over candidate tokens, and for many of them there are several near-equal choices — “overcast” vs “grey,” “however” vs “but,” “swiftly” vs “quickly.” Ordinary decoding settles ties with a random number. Watermarking replaces that random number with the output of a pseudorandom function keyed by a secret and seeded by the previous H tokens (Nature, 2024, Anthropic).
SynthID-Text goes one step further with an approach Google DeepMind calls Tournament Sampling. Instead of a single biased draw, a set of candidate tokens is paired off in a bracket — round after round — where a pseudorandom scoring function g(x_{t-H..t-1}, k) decides which token advances. The paper commonly reports H=4 context and m=30 layers for its non-distortionary configuration (Nature, 2024, Webis, 2025). Nothing about the individual token looks unusual to a reader — but the winner across many rounds correlates with the key.
Tournament Sampling is a bracket-style selection where candidate tokens fight pairwise using a keyed pseudorandom score, and the winner of the bracket is the token that gets emitted. Example: given candidates {overcast, grey, cloudy, dull}, the algorithm scores each pair against the key + previous four words, advances the higher-scoring token, and after log₂(n) rounds emits a single “watermarked” choice.
The detector does the reverse. Given the text and the key, it recomputes the expected g-scores at every position, aggregates them, and compares the mean (or a Bayesian likelihood) to what you’d expect from unwatermarked text (SRI Lab, ETH Zurich, Webis). If the score is far enough above baseline, the passage is flagged. Anthropic will expose this via a forthcoming detection API and stresses that the mark carries no identifying information — no user, no chat, no org (Anthropic).
Files are marked differently: .png, .jpg, and .svg outputs get signed C2PA provenance metadata — the same standard camera manufacturers use — attached in a cryptographically verifiable header (Anthropic, Techcrunch). That’s a signature on the file wrapper, not a watermark woven into the content.
Where does OpenAI actually stand — and why haven’t they watermarked ChatGPT?
Here’s the part every headline conflates. OpenAI has not deployed text watermarking on ChatGPT. They built it. The Wall Street Journal reported in August 2024 that OpenAI had a text-watermarking system ready for roughly a year and rated internally as ~99.9% effective — and shelved it (The Verge, 2024, Tom’s Hardware, 2024). What OpenAI actually shipped, in 2026, was C2PA metadata plus SynthID watermarks on images (19 May 2026) and audio (31 July 2026) plus a public verification tool (OpenAI). On text, OpenAI’s own support page — quietly updated on 2 August 2026 — says its goal is to “expand provenance signals to text models,” in the future tense (Business Insider).
So the state of play, on the day I’m writing this:
| Provider | Text watermark | Image / audio provenance | Verification tool |
|---|---|---|---|
| Anthropic (Claude) | Live worldwide, from 2 Aug 2026 — SynthID-Text (Anthropic) | C2PA signed metadata on .png, .jpg, .svg (Anthropic) | Detection API “forthcoming” (Anthropic) |
| OpenAI (ChatGPT) | Not deployed — described as a future goal (Business Insider) | C2PA + SynthID on images (May 2026) and audio (Jul 2026) (OpenAI) | Public image + audio verification tool live (OpenAI) |
| Google (Gemini) | SynthID-Text in production (Nature, 2024) | SynthID on images, audio, video | No public text detector |
OpenAI’s stated reason for not shipping text watermarking is instructive. They cited concerns about robustness, fairness — non-native English speakers being disproportionately caught — and the political risk of a “cheat-detection tool” that punishes their own paying users (The Verge, 2024). Read closely: they’re not saying it doesn’t work; they’re saying it works well enough to hurt the wrong people.
What’s really going on here — the intent investigation
The stated reason is transparency: help readers know when AI touched the content. Let’s test it against the evidence.
Stated reason: “Watermarking helps identify AI-generated content and combat misinformation.”
Does it hold? Only weakly. Anthropic states plainly that a detected mark “provides a signal that content was processed by Claude, but is not fully conclusive” and that the watermark cannot distinguish between Claude writing an essay from scratch and Claude polishing the grammar of a human-written one (Anthropic, Columbia Stats). Anthropic itself frames it: “This is not a cheating detector.” (Columbia Stats).
Real reason: regulatory arithmetic. Article 50(2) of the EU AI Act made text marking legally required for anyone serving the EU market as of 2 August 2026 (Anthropic). Anthropic doesn’t yet have a durable way to scope the mark by region, so it turned it on globally. The transparency framing is a nice cover story for what is, mechanically, an EU compliance ship-list.
Second-order effect: the market will bifurcate. Marked frontier models (Claude, Gemini) will be avoided by anyone who cares about detectability — students, ghostwriters, marketing agencies, propaganda operations. They will migrate to unmarked open-weight models (Llama, Mistral, DeepSeek, Qwen) or to OpenAI’s still-unmarked text output. Watermarking pushes serious misuse toward exactly the models where nobody holds a key.
Real solution: stop trying to detect AI at the output layer at all. Score the work — the reasoning, the evidence, the prompt design, the verification loop — not the token stream. More on that below, because this is where the edge is.
Applying inversion: how would I guarantee this watermark scheme fails?
The fastest inversion of “does the watermark identify AI-written text?” is to ask: how would I guarantee it doesn’t? Two token-level attacks come out of the literature immediately.
Independent teams have already published the answers. On clean, unaltered watermarked text, SynthID-Text hits an F1 of 1.0 with a false-positive rate of 0.0 (arXiv 2508.20228) — genuinely excellent. But apply one pass of the DIPPER paraphraser and the wheels come off:
- 98.3% of initially-detected texts lose their watermark signal after a single DIPPER paraphrase pass, alongside a 5.4% false-positive rate on paraphrased human writing (arXiv 2607.16010, aiwatermarkremoval).
- On watermarked Gemma-2B-IT, TPR at 5% FPR drops from 87.6% to 5.4% after DIPPER paraphrase — worse than a coin flip, once you set even a modest false-positive tolerance (arXiv 2501.03437).
- A watermark-smoothing attack out of EMNLP 2025 reduces TPR to around 5%, sometimes 0%, on the “distortion-free” SynthID variant — with or without knowledge of which watermark is in use (ACL Anthology, 2025).
- Techtimes reported a headline “four cents strips Claude watermark” — the cost of an API paraphrase call — and Anthropic’s forthcoming detection API doubles as an oracle the attacker can query to confirm removal (Techtimes, 12 Aug 2026).
Even Google’s own documentation concedes the point: “Detector confidence scores can be greatly reduced when an AI-generated text is thoroughly rewritten, or translated to another language” (Google DeepMind).
Base-rate check. Watermarks provably degrade in a specific pattern — Xiang Li et al.’s framework in JRSSSB shows that with 5% of tokens humanly modified, detection power on 400-token text drops from 87.8% to 30.2% under adversarial edits (Oxford JRSSSB, 2025). This is not a bug to be patched. It is what the math says happens when you try to embed a fragile signal in a substrate — natural language — that anyone can rewrite for four cents.
Why the whole scheme measures the wrong thing — the edge angle
Here is the thesis nobody has taken because it’s uncomfortable: watermarking measures the output side of the LLM, but the value in AI-assisted writing has moved entirely to the input side — the prompt, the context, the harness, and the human doing the reasoning.
Apply first principles. An LLM is, mechanically, a stochastic function y = f(prompt, context, tools, sampling). In 2022 the marginal quality of y was dominated by which f you chose — GPT-3.5 vs Claude-1 was a chasm. In 2026, on any nontrivial task, the frontier models are close enough that the marginal quality of y is dominated by the quality of the inputs: how you decomposed the problem, what context you pasted in, which tools you wired up, and how many iteration rounds you were willing to run.
The watermark inspects y. It says nothing about prompt, context, or the human who assembled them.
Anthropic itself admits this — read their own examples carefully (Anthropic, Columbia Stats):
- A person writes 1,500 words and asks Claude to polish grammar → watermark fires.
- A person gives Claude a 30-page report and asks for a 500-word summary → watermark fires.
- A person designs an entire statistical analysis, specifies variables and model, and asks Claude to implement it in code → watermark fires.
In all three, the intellectual work is human. In all three, the watermark cannot tell you that.
Now apply second-order effects. If organisations start treating a positive watermark hit as evidence of low effort, they’ll systematically punish the group of workers who are actually most productive — those who’ve learned to use LLMs as an amplifier. Meanwhile, the group who does the same work by hand, badly, in half the time or twice the time, escapes scrutiny. This is inversion in action: the tool designed to catch low-effort writing catches high-leverage writing instead.
Amplifier framing is the mental model that an LLM multiplies the quality of what you already bring — sharp problem framing, domain judgement, source discipline, iteration stamina. Example: I recently asked Claude to help me stress-test a portfolio-rebalancing rule. The prompt was 900 words specifying the strategy, its known failure modes, three historical regimes to test against, and the exact statistical output I wanted. The response was, at best, 20% of the value; my prompt was 80%. A watermark would only see Claude’s 20%.
Most of my substantial writing now is co-written with LLMs — the way most substantial software is co-written with compilers, IDEs, and Copilot. When someone sends me an argument, I care whether the logic holds, whether the facts check out, and whether the writer engaged their own judgement. Whether Claude helped tighten a sentence is as interesting to me as whether Grammarly helped, which is: not at all. Someone in 2026 handwriting a 3,000-word memo from a blank page while ignoring available tools isn’t showing craft — they’re showing they don’t yet know how to lead their own attention.
What history teaches — the calculator moment, 1975
This isn’t the first time a productivity tool triggered a moral panic about “cheating.” In the mid-1970s, US schools debated banning pocket calculators because students would “no longer learn arithmetic.” The National Council of Teachers of Mathematics eventually issued its 1980 Agenda for Action recommending calculators be integrated into all grades, and by the 1990s that was the norm. Nobody today argues that a physicist using MATLAB is a fraud, or that a lawyer using Westlaw’s search is “not really doing legal research.”
The precedent: when a tool compresses the mechanical part of intellectual work, the profession’s centre of gravity migrates to the parts the tool doesn’t do — problem framing, judgement, verification, taste. The analogy: an LLM watermark is a metal detector at the entrance of a chess tournament. It tells you the player brought a phone. It tells you nothing about whether they can play chess.
The fairness problem watermark advocates don’t want to discuss
Even before watermarks, output-based AI detectors already produce a documented, replicated pattern of discrimination. The Stanford Human-Centered AI group found that seven leading GPT detectors flagged 61.3% of TOEFL essays written by non-native English speakers as AI-generated, while native-English writing was misclassified at near-zero rates (Stanford HAI, 2023, arXiv 2304.02819). A 2026 review of 27 studies confirmed the range at 50.2–61.3% false-positive rates for non-native writers (WisPaper).
Now overlay the SynthID-Text robustness data. On unwatermarked human text from ESL writers, feature-based detectors already smear the border. On watermarked text that’s been paraphrased even once, the watermark itself becomes near-invisible. The net result of shipping watermarking as a governance layer is a system that:
- Catches naïve, honest AI users who paste raw output.
- Misses sophisticated bad actors who paraphrase for four cents.
- Systematically over-flags non-native writers, neurodivergent writers, and anyone with an idiosyncratic style.
That’s not a transparency tool. That’s a class filter.
What I think comes next — three dated predictions
By 31 December 2027:
- At least one Fortune 500 hiring or evaluation policy that treats “positive AI-watermark hit” as evidence against a candidate will lose a public discrimination lawsuit or regulatory finding — most likely tied to the non-native-speaker false-positive data.
- A major research university will publicly abandon watermark-based academic-integrity enforcement, following Vanderbilt’s 2023 disabling of Turnitin’s AI detector (Enago) as the precedent.
- A serious “prompt-signed provenance” standard — the human’s prompt, the model, the tools, the iteration history, cryptographically signed at document creation — will emerge from the C2PA working group as the successor to token-level marking.
The centre of gravity for provenance is going to move from what the model wrote to what the human authored the process. Watermarking is a bridge, not a destination.
FAQ
Does Claude now watermark everything it writes?
Yes, for models launched on or after 2 August 2026, worldwide, across the Claude platform, API, Claude Code, Claude Cowork, Claude Tag, and Claude on AWS/Google Cloud/Microsoft Foundry (Anthropic). Older Claude models are being retrofitted during the EU AI Act transition period.
Does ChatGPT watermark its text output?
No. As of August 2026, OpenAI has not deployed a text watermark in ChatGPT, the API, or Codex. It watermarks images (from 19 May 2026) and audio (from 31 July 2026) with C2PA + SynthID, and describes text watermarking as a future goal (OpenAI, Business Insider).
How reliable is the Claude watermark detector?
Near-perfect (F1=1.0) on unaltered watermarked text, but 98.3% of watermarked passages lose the signal after one DIPPER paraphrase pass, and true-positive rate drops from 87.6% to 5.4% at 5% false-positive rate (arXiv 2607.16010, arXiv 2501.03437). Anthropic itself: “A detected mark provides a signal that content was processed by Claude, but is not fully conclusive” (Anthropic).
Can the watermark identify who wrote a text or which chat produced it?
No. Anthropic states the watermark “carries no identifying information and can’t be traced to a specific person, organization, or chat” (Anthropic).
What removes the watermark?
A complete rewrite (every word replaced), thorough paraphrasing with a competent model, translation, or heavy editing. Anthropic’s own guidance says complete rewriting removes it and that at that point “it is arguable whether the resulting text can still be described as AI-generated” (Anthropic).
Is using AI to write a document actually a problem worth detecting?
That depends on whether the writer engaged their own judgement, brought good evidence, and stands behind the reasoning. A watermark cannot answer any of those questions. Ask about the process — prompt, iteration, verification — not the output.
Jiri Pik is the founder of RocketEdge, an AI fintech company based in Singapore. Follow him on LinkedIn and X for more.
Disclaimer: This reflects my personal views and experience, not legal or financial advice.