Table of Contents
How AI Text Watermarking Works: The Statistics, Explained
How AI text watermarking works, from green-list token biasing to a coin-flip demo you can run at the kitchen table, plus what actually survives an edit.
Flip a fair coin 100 times and you expect about 50 heads. Get 70 and something is going on. That gap between “what chance would give you” and “what you actually see” is the entire mechanism behind how AI text watermarking works, and a ten-year-old can follow it with a real coin and a piece of paper.
The clever part is not the statistics. It is that the pattern hides in choices the reader was never going to notice: “overcast” instead of “grey,” “began” instead of “started.”
Key Takeaways
- The foundational method, Kirchenbauer et al. (ICML 2023), splits the vocabulary into a pseudorandom “green list” and “red list” before each word and softly favors green-list words; a detector counts green words and computes a z-score.
- Which words are green is determined by a hash of the preceding token plus a secret key, so the split changes at every position and the text stays fluent.
- Google DeepMind’s SynthID-Text (Nature, 2024) used tournament sampling and was tested on nearly 20 million Gemini responses with no statistically significant quality difference.
- Anthropic’s Claude watermark, announced August 11, 2026, is derived from SynthID-Text and works by replacing the model’s randomness source with one derived from the key and preceding words.
- Detection needs volume. Kirchenbauer et al. (ICLR 2024) found that after aggressive human paraphrasing, roughly 800 tokens were needed on average for reliable detection at a strict false-positive rate.
How AI text watermarking works, step by step
Start with the thing being watermarked. A language model does not write a sentence; it repeatedly picks the next token from a probability distribution over its whole vocabulary. At many positions, several candidates are nearly tied: after “the sky was,” the model might rate “grey,” “overcast,” “cloudy,” and “dark” as similarly good. That near-tie is the space where a watermark lives.
The Kirchenbauer et al. method, published at ICML 2023 by researchers at the University of Maryland, does this. Before generating each token, take a hash of the previous token, combine it with a secret key, and use that to pseudorandomly split the vocabulary into a “green list” and a “red list.” Then add a small bonus to the green-list words’ scores. The model still picks something sensible, because plenty of good options are green. But across hundreds of tokens, green words show up far more often than chance would predict.
Detection is then pure counting. Anyone with the key can recompute which words should have been green at each position, count how many actually are, and calculate a z-score: how many standard deviations above the expected rate. High z-score, watermark present, with an interpretable p-value. The original paper describes the watermark as “invisible to humans but algorithmically detectable from a short span of tokens,” using an efficient open-source algorithm without access to the model itself.
Two refinements matter. Google DeepMind’s SynthID-Text, published in Nature in October 2024 by Dathathri and colleagues, uses tournament sampling instead of a simple bonus and was the first production-scale deployment; feedback across nearly 20 million Gemini responses showed no statistically significant difference in quality between watermarked and unwatermarked text. And Anthropic’s Claude watermark, announced August 11, 2026 with details on August 15, is derived from SynthID-Text: instead of an arbitrary random number generator, the model “uses the key and a few words that come before to settle what word the model should pick.”
How to Teach Your Kid About Watermarking
Ages 5–8: The secret-color game
Write ten simple words on cards and secretly color the backs of four of them green. Ask your child to pick words to build a silly sentence, but quietly encourage the green-backed ones (“what about this one?”). Then flip the cards over. Four green words in a row looks suspicious; one looks like luck. Explain that computers can hide a secret in which words get chosen, not in the words themselves.
Ages 9–12: The rigged coin
Flip a real coin 20 times and record heads and tails. You will land near 10-10. Now do 20 more but cheat slightly: whenever it is tails, sometimes flip again. Count. The kid can see that a nudge shows up in the tally without any single flip looking wrong. Now do the math version: for 100 fair flips, the standard deviation is 5, so 60 heads is two standard deviations out, which happens by chance about 2.3% of the time. That is a z-score, and that is literally what a watermark detector computes.
Ages 13+: Build a toy watermark in ten lines
Take any paragraph. Split the alphabet in half: A through M is “green,” N through Z is “red.” Now rewrite the paragraph so that as many words as possible start with green letters, without changing the meaning. Count the green fraction before and after. Then have them explain the two things a real system does better: the split changes at every word (so the bias is undetectable by eye) and it depends on a secret key (so nobody can fake it). Ask what happens to their green fraction if someone paraphrases half the sentences.
The question to ask: “If a detector is measuring how unlikely the word choices were, what could a person do to make a marked text look unmarked, and what would they lose by doing it?”
Three watermarking methods compared
| Method | How the bias is applied | Detection | Published | Notable property |
|---|---|---|---|---|
| Green-list / red-list (Kirchenbauer et al.) | Small score bonus to a pseudorandom half of the vocabulary, reseeded from the previous token | Count green tokens, compute z-score and p-value | ICML 2023 | Open-source detector; needs no model access |
| SynthID-Text (Google DeepMind) | Tournament sampling over candidate tokens | Compare against expected watermarked and unwatermarked signatures | Nature, October 2024 | First production deployment; no quality difference across ~20M responses |
| Claude text watermark (Anthropic) | Randomness substitution: key plus preceding words determines the pick | Detector API, private preview for eligible organizations | August 2026 | Adds no tokens or hidden characters; no user identity encoded |
| C2PA Content Credentials | Not a text method: signed metadata attached to a file | Verify the signature | Industry standard | Survives file copying; destroyed by screenshots |
The bottom row is in the table on purpose. Parents often conflate the two, and they behave completely differently. Text watermarks live in the words and travel through copy-paste; file metadata lives outside the content and dies the moment someone takes a screenshot.
Where the mechanism breaks down, honestly
Every property of this design has a cost, and the costs are documented in the same literature that established the method.
Low-entropy text barely marks. If there is only one right answer, there are no near-ties to exploit. Ask for the capital of France and the model must say Paris. Google’s own SynthID documentation notes reduced effectiveness on short text and content with limited word alternatives. Anthropic notes the same for code: watermarks appear minimally because the model has little flexibility except in comments.
Paraphrasing degrades the signal. Kirchenbauer et al. (ICLR 2024) studied this directly and found watermarks remain detectable after human and machine paraphrasing, but weakened: after aggressive human paraphrasing at a strict false-positive rate, roughly 800 tokens were needed on average for reliable detection. Detectable, but only with volume.
Determined removal works. Sadasivan et al. (2023), published in Transactions on Machine Learning Research, demonstrated a recursive paraphrasing attack that significantly reduces detection rates across watermarking schemes, neural classifiers, zero-shot detectors, and retrieval systems, and also demonstrated spoofing: inferring the hidden signature well enough to make human text look AI-generated. They connected detector performance to the total variation distance between human and AI text distributions, an argument that reliable detection gets harder as models improve.
Only the issuing lab can detect its own mark. A Claude watermark says nothing about Gemini text, and neither says anything about a self-hosted open model. As of August 2026, publicly confirmed text watermarking existed for Claude and for Gemini via SynthID; OpenAI built a system in 2024 and declined to deploy it, citing concern about false accusations against non-native English writers and competitive risk.
Put together: a watermark is strong evidence of involvement when present in a long passage, weak evidence in a short one, and no evidence at all when absent. That is why it is a provenance tool and not a cheating detector, a point we develop in why a watermark is not proof of cheating.
What to actually do at home
Run the coin demo once
Fifteen minutes with a real coin teaches the concept better than any explanation. The moment a kid computes a z-score for a rigged coin, they understand watermark detection.
Connect it to a school conversation, carefully
A kid who understands that detection needs volume and fails on short text will not assume a one-paragraph answer is traceable. A kid who understands that the mark proves involvement and not authorship will not panic. Both halves matter. Our guide to watermarks versus AI detectors has the school-facing version.
Point out where the analogy fails
Coins are independent; word choices are not, which is why the real math is messier than 50-50. Saying that out loud teaches more than a clean analogy would.
Let them try to break it
Ask your teen how they would defeat a watermark, then read the Sadasivan findings together. Recursive paraphrasing works, and it also degrades the writing. That trade-off is the honest conclusion, not a loophole to exploit.
What to Watch For Over the Next 3 Months
- Week 4: Have your kid explain a z-score in one sentence. If they can, the statistics landed.
- Month 2 red flags: Believing watermarks are magic and infallible, or believing they are useless; both are wrong in the same way.
- Month 3 self-check: Anthropic’s retrofit of pre-August models targets December 2, 2026, and detection access is expanding. Watch for the first published false-positive or false-negative rates, which nobody has released yet.
Frequently Asked Questions
How does AI text watermarking work in one sentence?
The model secretly biases its choice among near-equally-good next words using a hidden key, so the text reads normally but contains statistically unlikely word patterns that a detector holding the key can measure.
Can a human see the watermark?
No. The bias applies only where several candidates are nearly tied in quality, so the output reads naturally. SynthID-Text’s live test across nearly 20 million Gemini responses showed no statistically significant quality difference between watermarked and unwatermarked text.
What is a green list?
In the original Kirchenbauer et al. method, the vocabulary is pseudorandomly split at each position into a green list and a red list using a hash of the previous token plus a secret key. Green-list words get a small score bonus, and detection counts how many green words appear.
How much text is needed to detect a watermark?
Enough to accumulate signal. Kirchenbauer et al. (ICLR 2024) found roughly 800 tokens on average were needed for reliable detection after aggressive human paraphrasing at a strict false-positive rate. Unedited text detects with much less; very short text may not detect at all.
Does paraphrasing remove it?
Light editing usually does not. Recursive paraphrasing, studied by Sadasivan et al. (2023), significantly reduces detection rates across watermarking and detection methods. Translation also strips a mark, while a translation produced by the AI carries a strong one.
Do all AI companies watermark text?
No. As of August 2026, publicly confirmed text watermarking existed for Anthropic’s Claude and Google’s Gemini via SynthID. OpenAI built a system in 2024 but did not deploy it, citing concern about false accusations against non-native English writers. Self-hosted open models generally do not mark at all.
About the author
Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.
Sources
- Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., & Goldstein, T. (2023). “A Watermark for Large Language Models.” ICML 2023. https://arxiv.org/abs/2301.10226
- Kirchenbauer, J., Geiping, J., Wen, Y., et al. (2024). “On the Reliability of Watermarks for Large Language Models.” ICLR 2024. https://arxiv.org/abs/2306.15666
- Dathathri, S., Kohli, P., et al. (2024). “Scalable watermarking for identifying large language model outputs.” Nature. https://deepmind.google/technologies/synthid/
- Anthropic. (2026, August 14). “How Claude’s text watermark works.” https://www.anthropic.com/news/claude-text-watermark
- Anthropic. (2026). “How Claude marks AI-generated content.” Claude Support. https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content
- Sadasivan, V. S., Kumar, A., Balasubramanian, S., Wang, W., & Feizi, S. (2023). “Can AI-Generated Text be Reliably Detected?” Transactions on Machine Learning Research. https://arxiv.org/abs/2303.11156
- Wikipedia. (2026). “Text watermarking.” https://en.wikipedia.org/wiki/Text_watermarking
- TechCrunch. (2026, August 15). “Anthropic shares more details about how Claude’s new watermarks will work.” https://techcrunch.com/2026/08/15/anthropic-shares-more-details-about-how-claudes-new-watermarks-will-work/
