You can stamp a photograph. A banknote hides a drawing inside its paper. But a piece of text? There is nothing but words, and anyone can retype them by hand. And yet, since this month, European law requires AI-written text to be recognisable by a machine. The solution exists. It is far cleverer than a stamp.
First: how an AI writes
One false image has to go. A language model does not think through its sentence before writing it, and it does not look up a ready-made answer in some library. It does one thing, thousands of times in a row: it guesses the next word.
It is the keyboard on your phone offering “much” after “very”. Only incomparably better: the model has read enough text to know that after “the client signed the” comes probably “contract”, sometimes “quote”, almost never “truck”.
So at every position it scores every word it knows, each with its own probability. Then it draws one at random. Not always the top-ranked one, or the text would come out flat and repetitive.
That draw explains something you have noticed: ask the same question twice and you get two different answers. The model leaves room for chance. And that room for chance is exactly where the watermark hides.
For readers who want the mechanics
The draw has a name, sampling, and two dials govern it. Temperature flattens or sharpens the gaps between candidates: at its lowest, the model always takes the top-ranked word and becomes deterministic. Nucleus sampling, or top-p, cuts the tail of the distribution to keep absurd words out. A watermark needs that randomness to exist: at temperature zero there is nothing left to steer, and the mark disappears.
The idea: rig the draw, very slightly
Since there is a draw at every word, you may as well load it. The recipe fits in three sentences.
Just before writing a word, cut the dictionary in two at random. One half becomes the green list, the other is set aside. Then nudge towards green.
Nothing is forced, it is favoured. If “contract” is green, it goes from a 52 % chance of being drawn to 60 %. If it is not, it loses as much. The model keeps its choice, the sentence stays natural, and nobody sees a thing.
15 of 28 words are on the green list. Change the key or the previous word: the split is redrawn from scratch.
The important part is elsewhere: the split is redrawn at every word, and it is not drawn just any way. It is computed from the previous word and from a secret key held by whoever provides the model.
Hence the two properties that make the whole thing work. Without the key, the list is unpredictable: you can neither guess it nor tell whether a text is marked. So the watermark really is invisible. With the key, you redo exactly the same computation, word after word, and recover the lists. The mark is written nowhere. It is recomputed.
For readers who want the mechanics
The split comes from a cryptographic hash seeded by the key and by a context window, often just the single preceding word. A short window survives edits better but is easier to recover by cross-referencing. A long window does the opposite.
The Maryland method adds a constant to the scores of green words before the draw, which distorts the distribution slightly. SynthID takes another route: a tournament between candidates drawn from the original distribution, which preserves that distribution on average. This is what is meant by a distortion-free watermark, and it is what made deployment possible without degrading answers.
Why it shows up
Take a text and check every word: does it fall on the green list for its position?
A person writing has no idea these lists exist. Their words land on them by pure chance, about half the time, like a coin toss. Text produced by a watermarked model, on the other hand, was nudged towards green at every position. It lands there nearly always.
So the detector does not read the text. It does not judge style or hunt for suspicious phrasing. It counts. And it asks one question: what are the odds of getting 88 heads in 100 tosses? None. It is a calculation, not a hunch, and it requires neither knowledge of the model nor access to its settings. Only the key.
Length, though, decides everything. In a ten-word sentence, seven green words prove nothing: a coin does that too. It takes a paragraph before the gap stops being an acceptable coincidence. A text message cannot usefully be watermarked. A report can.
For readers who want the mechanics
Formally, the detector tests the hypothesis “this text was written without knowledge of the green list”. It counts green words, computes a z-score, and derives the probability of such a gap arising by chance. That probability is the false-positive rate: you pick a threshold, say one in a billion, and accuse beyond it.
The real limit is not length but entropy, meaning how much freedom the model actually had. A hundred words of constrained administrative prose carry less mark than twenty free ones. That is why a short factual answer, a settled legal formula or source code all watermark poorly.
Who invented this
There is no single inventor, there is a chain. And it is instructive: you watch an idea sit in a drawer for four years until the law pulls it out.
- November 2022OpenAI
The idea is presented in public
Scott Aaronson
On leave from the University of Texas and working at OpenAI, this theoretical computer scientist describes a statistical mark that costs the text nothing in quality. OpenAI never shipped it: the company feared pushing its users towards a competitor that asked fewer questions.
- January 2023University of Maryland
The method is published, detector included
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers and Tom Goldstein
A Watermark for Large Language Models lays out the green list, the detector, and the code to reproduce both. The ICML 2023 committee named it one of six outstanding papers out of 1,865 accepted. It is the paper the whole field has cited ever since.
- October 2024Google DeepMind
The first deployment at scale
Sumanth Dathathri and co-authors
SynthID-Text appears in Nature. Its tournament sampling marks Gemini’s answers for millions of people, with no measured quality loss across some twenty million conversations. The code is published.
- 2 August 2026European Union
Marking becomes a legal obligation
Article 50 of the AI Act
Providers of generative AI must make their outputs machine-detectable. Systems already on the market before that date have until December 2026 to comply.
- 11 August 2026Anthropic
Claude starts marking too, everywhere
Nine days after the law took effect
Every Claude model launched from 2 August 2026 marks its text, using the same approach as SynthID. It does not stop at Europe: it applies worldwide, because the mark lives in the model rather than in a regional variant.
The detail worth pausing on: the reason given for not deploying the watermark at OpenAI was not technical. It was commercial. Marking your text while your competitor does not amounts to handing your customers a reason to leave. That is precisely the kind of deadlock a law breaks, and it is why Article 50 exists.
Nine days after the law took effect, Anthropic did what OpenAI had not: mark, and mark everywhere. So here is where the three assistants your teams opened this morning actually stand.
Gemini
Google DeepMind
SynthID-Text, the first watermark deployed at scale. The method appeared in Nature and the code is public.
Claude
Anthropic
The same approach as SynthID, applied worldwide rather than in Europe alone. A detection interface has been announced.
ChatGPT
OpenAI
The European code of practice is signed, and images and audio already carry provenance. For text, nothing is in service.
Anthropic published a diagram summing up its method in four steps. It is worth a look, because it says the same thing as the figures above, only shorter.
What a watermark does not do
This is the part enthusiastic articles leave out. It is the most useful part, because it will stop you buying the wrong thing.
- A rewrite erases it. Have another model rewrite the text: the words change, the green lists are no longer respected, and detection collapses. A single pass is enough. Machine translation does the same.
- It does not work on constrained text. A watermark needs freedom. If there is only one good way to write something, there is nothing to steer. A short factual answer, a legal formula, source code: the mark is weak there, or absent.
- It is not universal. Each provider keeps its own key, and therefore its own detector. Gemini and Claude use the same family of method but not the same secret: being able to read one tells you nothing about the other. There is no “was this written by an AI” button. There are answers to “did this come from that specific model”.
- It can be forged. Anyone who works out how the green list behaves can craft text that trips the detector. So a model can be accused of writing something it never produced.
- Its absence proves nothing. Unmarked text may come from a model that does not mark, from a model running in house, or from a simple rewrite.
The commercial trap worth knowing
The “AI detectors” sold to schools and companies are not what I have just described. They hold no key: they guess, from the style and regularity of the text. Their error rate is high, and it is particularly unfair to people writing in a language that is not their own, because careful writing looks statistically like machine writing. Never base a sanction, a dismissal or a grade on their verdict.
What this changes for your business
Three concrete things, if you run an organisation that uses or provides generative AI.
A watermark is an indication, never proof. Use it as one. It answers “did this come out of our model”, which is useful for tracing a leak or checking internal work. It does not answer “did my employee cheat”.
If you provide generative AI in Europe, the obligation is yours. Ask your vendor whether its outputs are marked and how to verify it. And if you run a model on your own servers, which is the heart of what I do, then you are the provider: the marking obligation lands on you, with no intermediary to pass it to.
The real risk is upstream, not downstream. Being able to recognise AI-written text protects you far less than knowing what your teams feed into these tools. Your contracts, your client files, your numbers go into public tools every day, with no bad intent and no written rule. That is where it matters.
The playbook, and the AI charter to sign
Seven pages on the real risk, a ten-question self-audit, and the charter ready to adapt for your teams. Free.
Going further
The work cited here is public and readable. The Maryland paper, A Watermark for Large Language Models, is the most approachable of them and contains the original diagrams. DeepMind’s, published in Nature in October 2024, tells the story of scaling it up and releases its code. Article 50 of the European regulation runs to a single page, and it is worth reading for anyone deploying generative AI to the public.
A question about what this means where you are? Write to me, I answer myself.