Skip to content

Can AI-Generated Text Be Watermarked? (Part 1 of 3)

Can you tell whether a paragraph was written by ChatGPT, Claude, Gemini, or a person? Looking at its style is not a reliable way to know. One possible answer is a text watermark: a hidden signal built into an AI's normal word choices.

This first post explains how that signal can work and what a matching detector can actually establish. Part 2 looks at code, strict formats, and editing; Part 3 moves to images, audio, and video.

Part 1 of 3 - Explore the complete series
Navigate this post 
---
title: "A Text Watermark Can Travel with Copied Text"
---
flowchart LR
    accTitle: A text watermark can travel with copied text
    accDescr: Text generated by an AI can be copied into another app while an embedded watermark remains part of the text for a matching detector to examine.
    A["ChatGPT, Claude, or Gemini generates text"] --> B["Text is copied or pasted"]
    B --> C["The visible app label no longer travels with it"]
    C --> D["A matching detector can look for an embedded signal"]

We are used to looking at watermarks in images. A photographer's logo or a banknote's pattern is visible. A text watermark is different. It is designed to be invisible to ordinary readers but still detectable by a machine.

To understand how a text watermark works, we need to first understand two underlying concepts:

  1. how a mark can be added to text; and
  2. how AI text generation works

How a text watermark is formed

Suppose you make a document and add your name at the bottom:

Text Only
Original document             Document with a mark

Meeting at 10                 Meeting at 10
                              [made by Kunal]

The name is a mark. It is extra information about the document, not part of the meeting message.

Some marks are easy to see, like a signature on a page. Other marks are invisible to human eyes. People do not notice them, but a computer can still read them.

Adding a mark and checking a mark are separate jobs:

---
title: "Adding and Checking a Mark Are Separate Jobs"
---
flowchart LR
    accTitle: Adding and checking a mark are separate jobs
    accDescr: A system adds a mark to original content, and a matching detector later checks the marked content and reports a scoped result.
    A["Original content"] --> B["System adds a mark"]
    B --> C["Marked content"]
    C --> D["Matching detector checks this content"]
    D --> E["Detector says: mark found, uncertain, or not found"]

A detector is a specialised checker. It searches for a particular pattern it knows how to recognise.

Lets understand this with an example. Imagine a checker that searches for the exact letters ABC123:

Text Only
Checker knows to search for: ABC123

Document 1: Welcome ABC123      → found
Document 2: Welcome XYZ789      → not found

“Not found” tells us that the checker did not see ABC123. It does not tell us who wrote Document 2.

SynthID-Text does not add a visible code. Instead, the AI model slightly adjusts its word choices as it writes. To verify the text, a checker scans those word choices for a hidden pattern.

Two rules stay the same:

  • Finding no mark does not mean a human wrote the text.
  • Watermarks show origin, not truth. An AI message can be accurate, while a human message can be wrong.

An AI writes one small piece at a time

A text-generating AI does not write a complete answer behind the scenes and then reveal it. Instead, it builds the answer step by step, picking one word at a time. At each step, the AI looks at what it has already written and chooses the next word from a list of options.

Consider this unfinished sentence:

Text Only
Please close the ____

Several endings could make sense:

Text Only
Please close the door.
Please close the window.
Please close the application.

The earlier words affect which ending fits. After choosing one piece, the AI adds it to the text and repeats the process.

The small pieces are called tokens. A token is not always a complete word:

Text Only
helpful       might be one token
unhelpful     might be: un + help + ful
punctuation   such as , or . can also be a token

For this explanation, it is safe to think of a token as a small piece of text.

At each step, the AI gives each possible next token a score. A higher score means the piece appears to fit better. This is where probability enters the process: the AI treats some next pieces as more likely (more probable) than others.

Earlier text Possible next piece Rough fit
Please close the ... door strong
Please close the ... window strong
Please close the ... application possible
Please close the ... banana weak

You do not need to worry about the underlying math. The key takeaway is simple: the AI usually has more than one good option for its next word. Having multiple good choices is what allows a watermark to be built into the text.

The watermark uses choices the AI already has

Now we can combine these two main ideas:

Term Meaning
Watermark Information deliberately added to content.
Text generation The AI picks words one after another.
How it connects The watermark is hidden within those repeated word choices.

You will not see a visible stamp like [made by AI] in the text. The watermark is simply a pattern made by normal writing choices.

Let us understand this with an example below.

First imagine ordinary generation

Imagine the AI has written the first half of a sentence:

"The task is complete, ..."

Next, it considers several good ways to finish it:

  1. "so we can stop."
  2. "and we can stop."
  3. "which means we can stop."

Without a watermark, the AI picks a finish using its normal writing process. No hidden pattern is added yet.

Now add a small private preference

Now, give the AI a piece of private data that controls the watermark. We will call this the secret recipe (researchers call it a "key").

For a specific spot in the sentence, the recipe gives a slight bonus to one word, like so:

Possible Word Secret Bonus?
so Yes
and No
which means No

However, the AI must still make sense. A secret preference cannot force the AI to pick a word that makes no sense.

For example, look at this sentence:

"Please place the book on the ..."

Both table and shelf make sense. cloud does not. Even if the recipe favors cloud, the AI will ignore it. The watermark only chooses between words that already fit the sentence.

Here is how the watermark treats different word choices:

Word Option How the Watermark Affects It
Makes sense and has secret bonus Slightly more likely to be picked
Makes sense, but no secret bonus Still possible to pick
Makes no sense in this context Will not be picked

The watermark gently guides the AI's choices. It never replaces the main goal of writing clear, sensible text.

The preference changes with the surrounding text

The recipe does not favor the same word every time. Its preference changes based on two things:

  1. The secret recipe itself
  2. The text written just before the new word

Here is a simplified example of how this works step by step:

Step Text Written So Far Good Next Words Preferred by Recipe? Selected Word
1 The task is complete, so / and so so
2 so we can stop / finish finish finish
3 finish for today / now now today
4 today. Please send / share share share
5 share the result / answer result result

Notice two important details:

  • The preferred word changes at every step.
  • The AI does not have to pick the preferred word every time. At step 3, it chose today instead of the preferred word now.
flowchart TD
    A["Read the text written so far"] --> B["Find good next words"]
    B --> C["Check secret recipe for a preferred word"]
    C --> D["Pick a word that still makes sense"]
    D --> E["Add the word to the text"]
    E --> A

Because context matters, the same word can carry a watermark in one sentence but not another. Consider the word and in these two examples:

"The meeting ended, and we left." "I bought bread and milk."

The secret recipe might prefer and after "The meeting ended," but not after "I bought bread". A detector does not just count how many times the word and appears. It checks the surrounding text to recalculate the secret preference for each position.

Why context and choice matter

A single matching word proves almost nothing. A human writer or an unmarked AI can pick that same word purely by coincidence.

Instead, evidence builds up over an entire passage:

  • One matching choice → Weak evidence
  • A few matching choices → Still uncertain
  • Many matching choices → Strong evidence of a hidden pattern

Think of it like this, where ✓ means a word matched the secret preference and · means it did not:

Text Only
Single choice:     ✓                  Tells us very little
Repeated pattern:  ✓ ✓ · ✓ ✓ ✓ · ✓   Shows a clear, unusual pattern

Real detectors responsible for detecting in text, use math rules rather than counting checkmarks, but the main lesson is clear: a detector needs a full passage to make a decision, not just one word.

Both of these paragraphs read naturally to a human:

Paragraph 1: The work is complete, so we can finish for today. Please share the result. Paragraph 2: The work is done, and we can stop now. Please send the answer.

A human reader and a detector look for completely different things:

Who is reading? What question are they asking?
Human Reader "Does this paragraph make sense?"
Watermark Detector "Do these word choices match my secret pattern?"

Here is how the detector works step by step:

flowchart LR
    A["Finished text"] --> B["Examine word choices across the text"]
    B --> C["Recreate secret preference for each position"]
    C --> D["Compare preference with actual word used"]
    D --> E["Combine all observations"]
    E --> F["Report strength of the watermark pattern"]

The SynthID-Text research paper covers the full math in detail. But the main takeaway is simple:

SynthID-Text turns many ordinary word choices into a hidden pattern. The detector checks the whole pattern, not a single word.

There is no list of "SynthID words"

Previous sections might have given the impression that a watermark is made of specific words. That is not true. A watermark is a pattern across many words, not a list of words.

You might be tempted to look for specific words like however, therefore, or delve. But searching for overused words will not reveal this kind of watermark.

In one spot, the secret recipe might favor the word however. In another spot, that same word might not match the pattern at all. A different secret recipe would create entirely different preferences.

This leads to four key facts:

  • Specific words like however are not permanently marked.
  • Formal words or filler words are not automatically part of a watermark.
  • The same word can be part of the watermark in one sentence, but not in another.
  • Individual words provide very weak evidence on their own.

A detector needs to analyze the full pattern across the whole passage. That pattern shifts constantly based on the words that come before each choice.

Some requests leave little room for a pattern

The watermark needs real choices to form, and some prompts offer far more choices than others. Compare these two examples:

Request A: "What is 2 + 2?" Only reasonable answer: 4

Request B: "Write a friendly sentence saying that the work is finished." Possible answers:

  • "The work is finished."
  • "We have completed the work."
  • "Everything is now done."

Request A leaves almost no room for word choices. Request B leaves plenty of room.

Because of this, Google DeepMind notes that SynthID-Text works best on longer, varied writing. It is less effective on short factual answers because there are fewer word choices for the AI to use and fewer results for the detector to check.

Coding presents a mixed situation. Strict commands and punctuation leave little room for choice. However, comments, explanations, variable names, and alternative solutions provide plenty of flexibility.

Part 2 explores how code, strict prompts, and later edits change the room a text watermark has to form.

What a watermark detector can and cannot tell you

A watermark detector is only one type of tool, and people often confuse it with an AI style checker. These two tools ask very different questions:

Tool Question Asked Type of Result
Watermark Detector "Can I find my specific hidden pattern in this text?" Proof of a deliberately hidden watermark
AI Style Checker "Does this writing look like typical AI writing?" A guess based on writing style and examples

Both tools have clear limits. An AI style checker can incorrectly flag human writing or miss AI text entirely. Meanwhile, a watermark detector only looks for its own pattern - it will find no mark if a different AI system wrote the text.

One provider does not automatically recognise another provider's text

Imagine a detector set up only to find Gemini's watermark. If you test text copied from a different system, the detector will report no Gemini mark found:

---
title: "A Provider-Specific Detector Has a Narrow Scope"
---
flowchart LR
    accTitle: A provider-specific detector has a narrow scope
    accDescr: Text from a human or another AI is checked by a Gemini-specific detector. A missing Gemini mark cannot identify the real source.
    A["Text from a human or another AI"] --> B["Gemini-specific detector"]
    B --> C{"Gemini mark found?"}
    C -->|"No"| D["The text might still be human or AI-generated"]
    C -->|"Yes"| E["The detector found its matching signal"]

This result only proves one thing: Gemini's specific watermark is missing. A human, ChatGPT, Claude, or a different AI could have written the text.

AI providers can choose to work together on compatible watermarks. However, sharing a watermark system requires shared rules, matching secret keys, and a detector built to support those specific models. Hugging Face's implementation guide shows how compatible models can use the same watermark rules under specific conditions.

We already see these boundaries in image tools today:

That is why a headline about any one provider's watermarking claim needs careful reading. "Text watermark" is a general category, while "SynthID-Text" is one specific method.

Read the standalone guide on how to interpret Anthropic's announcement about watermarking.

Read every result within its narrow scope

When you combine tool limits with provider limits, here is how you should read any detector result:

Detector Result What it Means Key Limits
Watermark Found The text contains a pattern from that specific watermarking system. Does not guarantee factual accuracy, full AI authorship, or zero human editing.
Uncertain The detector does not have enough text to give a clear result. Does not tell you what percentage of the text was written by AI.
No Watermark Found The detector did not find its specific pattern in the text. Does not prove a human wrote it, nor does it rule out a different AI system.

Conclusion

Text watermarks do not let someone read a single sentence and prove that ChatGPT, Claude, or Gemini wrote it. They give a matching provider detector a way to look for a statistical pattern across enough text.

That can be useful origin evidence, but it is not a universal AI detector and it says nothing by itself about truthfulness or complete authorship. Part 2 - What Happens to Watermarks in AI-Generated Code? takes the next step: what changes when the output has to follow exact rules, or when someone edits it afterwards?

References and further reading

Open the complete reference catalog

Primary Sources