AI Watermarks Can't Prove Who Wrote Anything — and That's the Point Everyone Misses

Aleksei Grebenkin — Thu, 13 Aug 2026 06:34:22 +0000

Within 48 hours at the turn of August, both major AI labs switched on watermarking. On July 31, OpenAI embedded SynthID marks into all GPT-Live voice output — one day before Article 50 of the EU AI Act came into force. From August 2, Anthropic began weaving an imperceptible watermark into everything Claude writes.

My first thought was that this is very hard to do in a way that actually holds. Text has no pixel layer to hide anything in. So I read how Anthropic plans to do it — and dug into how text watermarks work in general. The honest answer: it works, and it also breaks in a lot of ordinary situations.

How do you even hide a mark in plain text?

There are three generations of this idea. (A good breakdown of the mechanics went viral this week in a thread by ML engineer Daria Berezhnaia — I'm borrowing her framing for the first two.)

Zero-width Unicode. The ancient way: invisible characters tucked between words. Paste the text into Notepad and copy it back out — the mark is gone. Nobody serious uses this anymore.

Token-level (statistical) watermarking. When the model generates text, many word choices are near coin-flips: "the cat sits" vs "the cat lies" might both be ~50% likely. A secret key decides which of the equally-probable options the model picks, again and again across the text. Where the model is confident — 90% one option — the choice is left alone, so quality barely suffers. A detector with the key checks whether word choices are "skewed" in the right pattern. This is the academic classic (green/red token lists), and Anthropic's "embedded in the text itself" wording points this way.

Embedding-space watermarking. The subtler one. Inside the model, every step produces hidden states — vectors that trace how the model "thought". You can nudge those vectors slightly in a secret direction; word choices shift almost imperceptibly, nothing visible at the text level, but the statistical fingerprint is there. Research is now pushing this toward semantic clusters, precisely so that paraphrasing won't wash the mark out.

Where it stops working

Taken mostly from Anthropic's own documentation, plus what follows from the mechanics:

Short text. Their wording: a very short passage leaves "too little text for a reliable signal". A mark spread across word choices needs volume, so a headline, a chat reply or a commit message is out of reach.
Editing. Heavy editing, paraphrasing, translating, or mixing the output into your own writing all thin the signal out until it is gone.
Older models, until the transition period for pre-August releases finishes.
Screenshots and format conversion, which strip file metadata completely.
Only the vendor can check. The key is secret, so there is no independent verification: Anthropic tells you whether Claude touched a text; you cannot audit the claim, and false positives on short "skewed-looking" text are a real statistical possibility. The detection tooling and its documentation haven't even shipped yet.

The part I did not expect

A detected mark says Claude processed the text, not that Claude wrote it. Anthropic states this plainly. Proofreading, translating and summarising leave the same mark as generating from scratch. I dictate my posts and run them through a model to fix grammar, so the thinking is mine and the mark would be there anyway.

Read it the other way and it is no stronger. No mark found proves nothing.

So the people this catches reliably are the ones who paste raw output and change nothing. Anyone who edits carefully, translates, or runs the text through a second model comes out clean — today there is no second embedding-space mark to replace the first one, and even when every lab ships one, each key stays locked in its own vault.

The voice side has the same hole — plus one more

OpenAI's audio watermarking repeats the pattern: their Verify tool answers one question — whether audio was "made by OpenAI" — not who authored the words. And voice adds its own escape hatch: the moment marked audio is transcribed to text, the audio watermark is gone. Speech-to-text is the analog hole of voice provenance.

So is it pointless?

I do not think so. A weak provenance signal beats no signal, someone had to move first, and Anthropic published the limitations instead of burying them. It just cannot carry the weight people will want to put on it, which is proof of who wrote something.

Would you want your own writing marked because you asked a model to fix your commas?

Sources: Anthropic — How Claude marks AI-generated content · thread on watermark mechanics by @dariadsss · OpenAI adds SynthID to GPT-Live voice · token-level watermarking: Kirchenbauer et al., "A Watermark for Large Language Models" · embedding-space: PASA, SimMark