AI text doesn’t contain hidden code. Some models can still leave a statistical signature behind. Here’s how watermarking works, why it’s different from AI detection, and what happens when a human rewrites the result.
Paste a response from an AI assistant into a plain-text editor and you won’t find a secret layer hiding underneath it.
There are no invisible characters spelling out “written by AI.” No special metadata survives when you copy a paragraph into Notepad. Nothing is secretly attached between the words.
And yet, some AI-generated text can still carry a watermark.
The strange part is that the watermark can live entirely in the choices the model made while writing.
A language model already has to decide which token comes next. Watermarking can subtly influence those decisions so that, across a long enough passage, they form a statistical pattern. Humans normally won’t notice anything unusual. An algorithm that knows what to look for might.
But there is an important distinction before going any further:
AI detection and AI watermark detection are not the same thing.
That difference changes almost everything about how we should interpret claims that a piece of writing was “detected as AI.”
AI detectors guess. Watermark detectors look for a planted signal.
Most people use AI detector as a catch-all term, but there are at least two very different ideas hiding behind it.
A conventional AI-text detector examines finished writing and tries to classify it. It may look at vocabulary, sentence patterns, predictability, stylistic tendencies, or other statistical signals associated with machine-generated text.
It does not necessarily know which model produced the text. It is making an inference.
A watermark detector works differently.
The model provider deliberately changes the generation process so that the resulting text contains a recognizable statistical signal. A detector that knows how that watermark works can then test for it.
Anthropic makes this distinction explicitly in its description of Claude’s text watermarking. Third-party detectors do not have Anthropic’s watermarking key, so they instead rely on linguistic and statistical characteristics of the prose. Checking those patterns is fundamentally different from verifying a watermark. (Anthropic)
That means a useful mental model is:
An AI detector asks, “Does this look machine-generated?” A watermark detector asks, “Does this text contain the statistical signal our generator was designed to leave behind?”
Those sound similar. Technically, they are very different questions.
The watermark lives in token choices, not hidden characters
Large language models write one token at a time.
A token might be a whole word, part of a word, punctuation, or another small unit of text. At each step, the model assigns probabilities to many possible next tokens.
Imagine the sentence:
“The platform infrastructure is highly…”
The model might consider scalable, flexible, distributed, resilient, and dozens of other possibilities. Each receives a different probability based on the context.
Without watermarking, the sampling process selects from that probability distribution according to the model’s generation settings.
A text watermark changes that process slightly.
One influential early approach, published by researchers including John Kirchenbauer in 2023, dynamically divides possible tokens into randomly generated groups usually described as green and red. The model then gives green tokens a small statistical advantage during sampling. The text remains coherent, but across many tokens the generated passage contains more green-list selections than would normally be expected. (Proceedings of Machine Learning Research)
A detector can recreate those groups and ask a statistical question:
Did this text select preferred tokens much more frequently than chance would predict?
Notice what the system is not doing. There is no dictionary where flexible is permanently an AI word and scalable is permanently a human word.
The groups change with the context.
A word that helps create the signal in one sentence may have no special status in another.
That is why searching for a list of “AI watermark words” misses the point entirely.
A statistical signal is evidence, not a scarlet letter
This probabilistic nature creates an important limitation.
Human writing can occasionally resemble the expected watermark pattern by coincidence. A statistical detection system therefore needs thresholds and false-positive rates rather than simply declaring that a document is metaphysically “AI” or “human.”
This is one reason I would be very skeptical of statements such as:
“This paragraph is 43% AI.”
That number may belong to the scoring system of a particular detector, but it should not automatically be interpreted as “43% of these sentences were written by a machine.”
Different detection systems measure different things.
In the case of statistical watermarking, the more useful question is whether the observed token pattern is sufficiently unlikely under the assumption that the text was not watermarked.
The difference sounds academic, but it matters.
You could theoretically test an old novel against a statistical pattern and observe coincidences. That does not retroactively turn Cervantes into an early adopter of generative AI. Good detection systems account for this possibility through statistical thresholds and measured false-positive rates rather than treating every unusual pattern as proof.
SynthID takes the idea much further
Google DeepMind introduced a more sophisticated technique called SynthID-Text, described in a 2024 Nature paper.
Google has since deployed SynthID watermarking in text generated through Gemini experiences. (Google DeepMind)
The central idea remains familiar: influence which tokens are selected so the finished text contains a detectable signal.
But SynthID does not simply maintain one permanent list of “preferred words.”
Its approach uses something called Tournament Sampling.
Imagine the model is ready to generate its next token. Instead of choosing one candidate immediately, the simplified process looks roughly like this:
- The model samples several plausible candidate tokens from its normal probability distribution. In the example shown in the SynthID paper, eight candidates enter the tournament.
- Those candidates are placed into pairs. Pseudorandom scoring functions, determined partly by the recent context and a watermarking key, decide which candidates advance.
- Winners continue through additional rounds until one token remains.
- That winning token becomes the model’s next output, and the process repeats for subsequent tokens.
The real implementation is optimized and more sophisticated than physically running a miniature bracket billions of times, but the tournament metaphor captures the mechanism surprisingly well. The original paper’s Figure 2 is particularly useful for visualizing it. (PubMed Central (PMC))
https://www.nature.com/articles/s41586-024-08025-4/figures/2
The interesting part is that every candidate originally came from the language model’s own distribution.
The system is not inserting strange words simply to leave evidence behind. It is changing how the final choice is made among plausible alternatives.
Google tested the production system across roughly 20 million watermarked and unwatermarked Gemini responses. In that experiment, user feedback showed no meaningful quality degradation attributable to watermarking, supporting the idea that the signal can operate without making the prose obviously different to readers. (Nature)
That is the cleverness of the approach.
You aren’t supposed to see the watermark.
The detector sees it statistically.
But watermarking still has limits
This is where the idea gets more interesting.
Language isn’t static.
People edit sentences. They delete paragraphs. They translate documents, reorder ideas, summarize them, combine multiple sources, and sometimes rewrite the entire argument.
Each transformation changes the token sequence that originally carried the signal.
Anthropic, which announced text watermarking for Claude models in 2026, describes the limitation quite plainly: light editing probably will not completely remove the watermark, while a complete rewrite can. Anthropic also points out that, after such a substantial rewrite, the distinction between “AI-written” and “human-written” becomes conceptually less straightforward anyway. (Anthropic)
That last point is more important than it first appears.
Suppose an AI produces 800 words.
You then disagree with the argument, remove two sections, research three sources yourself, replace the examples, rewrite the opening, reorganize the explanation and write a new conclusion based on your experience.
Was the final article “written by AI”?
The answer is no longer captured very well by a binary checkbox.
The watermark might answer a narrower question:
Was this model probably involved somewhere in the text’s history?
Anthropic explicitly says its watermark cannot distinguish between “Claude wrote this” and “Claude heavily edited this.” (Anthropic)
Authorship is a much larger question than provenance.
C2PA solves a different problem
The situation changes again when we move away from plain text.
Images, video, audio and other digital files have structures capable of carrying additional information. That allows systems to use approaches such as C2PA Content Credentials.
C2PA is not simply a text watermark with a different name.
It is a provenance system.
A Content Credential can contain cryptographically signed assertions about an asset’s history: how it was created, what tools were involved, whether AI played a role, and what modifications occurred afterward. The credential can be embedded in the asset or stored externally while remaining cryptographically bound to it. (C2PA)
That gives us another useful distinction:
A text watermark modifies generation so the content itself contains a statistical signal.
C2PA records tamper-evident claims about the provenance of a digital asset.
Those systems can complement each other, but they are solving different technical problems.
Anthropic, for example, says supported files produced by Claude, such as PNG, JPG and SVG files, receive C2PA Content Credentials indicating that Claude was involved in producing or processing them. (Anthropic)
There is also an important nuance here: C2PA does not magically establish that every statement associated with a file is objectively true.
It lets software verify the integrity and signer of provenance claims. Trust still depends on who created those claims and what information they chose to include.
Think of it less as a supernatural authenticity detector and more as a digitally signed chain of provenance.
What human editing actually changes
This was the part of the subject I initially found most interesting.
If an AI-generated draft contains a statistical pattern, then changing the text necessarily changes some portion of that pattern.
But I don’t think the useful lesson is:
“Replace enough synonyms and you can beat the detector.”
That’s probably the least interesting conclusion available.
The better lesson is that genuine editing alters much more than vocabulary.
When I edit an AI-assisted draft seriously, I may change what I believe the argument actually is. I might remove an example because it doesn’t support the claim, replace a generic explanation with something I’ve seen in real projects, add an objection the model overlooked, verify a source, or decide that an entire section is unnecessary.
Sentence structure changes as a consequence.
Word choice changes too.
But those changes happen because the thinking changed first.
This is also why replacing a few suspicious-looking words is not a particularly meaningful definition of authorship. A lightly polished AI response can still preserve almost all of the model’s reasoning and structure. A heavily rewritten draft can become something substantially different even if an AI helped create the starting point.
The distinction I find more useful is therefore not: AI versus human.
It is: Did a person actually take responsibility for the final thinking?
AI can accelerate the draft. It can’t supply your experience.
I used AI tools while working on this article.
That feels particularly appropriate given the subject.
But I also had to investigate the difference between detection and watermarking, read about SynthID, correct assumptions I originally had about C2PA, and reconsider what “removing” a watermark actually tells us about authorship.
That process changed the article itself.
And that, to me, is where AI-assisted writing becomes interesting.
Copying an LLM response and publishing it unchanged gives the reader access to something they could probably have generated themselves.
The value appears when the writer does something the model cannot do on its own: choose what deserves skepticism, connect the research to experience, decide which claims are too strong, introduce information the model did not have, or simply say, I don’t think the first explanation was good enough.
Statistical watermarking may become increasingly useful for provenance and transparency. It may also remain imperfect, because natural language is editable, remixable and inherently probabilistic.
But perhaps that imperfection exposes something we should have cared about anyway.
The best way to make AI-assisted writing genuinely yours isn’t to hunt for the statistical fingerprint.
It’s to give the text something that wasn’t there before you touched it.
Your judgment.
