AI Text Watermarking by Model: Who Actually Does It

The assumption that every major model quietly watermarks its output is wrong, but the picture changed in 2026. Google has run a production text watermark for some time, and Anthropic has now announced model-level text watermarking for Claude. Neither can currently be verified by a third party, because neither detector is publicly available.

This page is deliberately factual and dated, because it is a moving target. Where a provider has made no public commitment, we say so rather than guessing.

Google — Gemini: deployed

Google DeepMind's SynthID-Text is live in Gemini and is the first production text watermark deployed at this scale. Instead of the simple green-list bonus, it uses an approach DeepMind calls tournament sampling: candidate tokens are run through a bracket of pairwise comparisons scored by a keyed pseudo-random function, and the winner is emitted. The effect is similar — the output is biased toward tokens the key prefers — with better quality preservation.

Google reported no significant difference in user thumbs-up or thumbs-down rates across nearly 20 million Gemini responses between watermarked and unwatermarked output, which is the strongest public evidence that watermarking need not degrade quality.

Two limitations matter, and DeepMind states both:

• It weakens under paraphrasing, translation and heavy editing.
• The open-sourced implementation lets developers watermark their own models with their own keys. It does not let anyone verify Google's production Gemini output — that requires Google's key.

OpenAI — ChatGPT: built, never shipped

OpenAI developed a text watermarking prototype and did not deploy it. Reporting on the decision pointed to concerns about disadvantaging non-native English users, the ease of defeating it, and the effect on users who rely on the product.

Separately, OpenAI withdrew its AI Text Classifier — a detector, not a watermark — in 2023, citing low accuracy.

Practical position: assume ChatGPT output carries no watermark, while noting that this is a product decision that could change.

Anthropic — Claude: announced, detector not yet public

Anthropic has announced model-level text watermarking for Claude, described as part of its work toward EU AI Act obligations. The mechanism is statistical and operates on word and token selection: where several continuations are equally good, the choice is driven by a keyed source of randomness, so a party holding the key can test whether a sequence is consistent with the choices Claude would have made. Anthropic states that nothing is added to the text and that there are no hidden characters, and that a watermarked response is indistinguishable from an unwatermarked one to a reader.

The part that matters for every third-party tool: the detector is not public yet. Anthropic says it will soon offer a watermark detection API and that the implementation details are still being worked out. Until that API ships with documentation and access rules, no independent website can verify Claude's watermark — the key is Anthropic's, and reproducing the mathematics without it is not the same test.

We are explicit about this because it is the most common misconception we see, and because tools advertising that they already "detect" or "remove Anthropic watermarks" are describing a capability nobody outside Anthropic currently has. Our own site keeps its position visible on the API status page: today's score is a local research estimate, and enabling real API verification is a single configuration change once the endpoint exists and its terms allow this use.

Meta — Llama: no text watermark

Meta has published watermarking work for images and audio, and has released open-weight Llama models. Open weights make output watermarking largely unenforceable: anyone running the model locally controls the sampling loop and can simply omit it.

Open-weight models generally: structurally unwatermarkable

This is the point most coverage misses. Generation-time watermarking requires control of the sampling step. If you can download the weights and run them yourself, you own that step — so any watermark is opt-in for whoever operates the model. This is not a gap that will be closed; it follows from what open weights are.

Status at a glance

What follows from this

Most AI text already in circulation is not watermarked. Watermarking applies to output produced by a model that was watermarking at the time of generation, so ChatGPT text carries no watermark, and Claude text produced before the feature rolls out does not either.

An announced watermark is not a usable detector. Anthropic's watermark exists in the model, not in a tool anyone else can run. Until the detection API is published, "we checked your text against Anthropic's watermark" is a claim no third party can honestly make.

Accusations therefore almost never come from watermarks. They come from perplexity classifiers, which are far less reliable and carry a documented bias against non-native English writers. If you are contesting a flag, that distinction is your strongest argument.

A "no watermark detected" result proves very little. Absence of a signal is expected for most models. It is not evidence of human authorship.

Adoption could widen. Regulation such as the EU AI Act pushes toward machine-readable marking of synthetic content. If more providers deploy, this page will need revising — it reflects August 2026.

Sources

• Google DeepMind, SynthID and Watermarking AI-generated text and video with SynthID.
• Anthropic, Watermarking Claude's text output — the announcement, the statistical word-selection mechanism, and the statement that a detection API is still to come.
• Liang et al., GPT Detectors Are Biased Against Non-Native English Writers (2023).