How AI watermarking works and why detectors miss it

You probably check your own writing against an AI detector before you send it. GPTZero, Turnitin, Originality: you paste the text in, watch the number, and edit until it drops. But there is a second kind of flagging arriving in 2026 that works completely differently, and it is built into the models themselves.

This guide covers that other system. Not the statistical detectors that guess from word patterns, but the machine-readable watermark a model can embed at the moment it writes, and the signed provenance metadata companies attach to generated files. They are not the same thing, and conflating them is why so much coverage leaves readers confused.

The three systems that label AI content

There are three distinct mechanisms, and they answer three different questions. A detector asks could this be AI? A watermark asks did this pass through a specific model? Provenance asks where did this file come from?

• Heuristic detectors: GPTZero, Turnitin, Originality. These measure style statistics like perplexity and burstiness and return a probability. They can be fooled, and they flag real human writing all the time.
• Watermarks: a signal the model embeds as it generates. Invisible to you, readable by a detector that holds the key. It travels with the text when you copy it.
• Provenance metadata: a signed record of a file's origin, following the C2PA standard. It lives in the file, not the pixels, so it is easy to strip.

The confusion is understandable. All three get called AI detection. But the mechanics, the accuracy, and what you can actually do about each one are different. If you want the deeper walkthrough of the statistical detectors, start with this explainer on how AI detection works, which covers perplexity and burstiness in plain english.

What an AI watermark actually is

A watermark is a hidden signal embedded inside generated output so a machine can tell the content was processed by an AI model. A reader cannot see it, and it does not change what the text says. A tool built to look for that signature can.

The analogy people reach for is a banknote's security thread or an invisible stamp. The text still reads normally. But a detector that knows the pattern can spot the stamp and say the content likely passed through a model. It is a signal about provenance, not a judgment of quality.

How text watermarking works at generation time

The trick happens during sampling, the moment the model picks the next word. At most steps a language model has several near-equal options that all fit. A watermark nudges the model toward a specific hidden subset of those options, following a rule the detector later knows.

Across a long passage, that nudge becomes a measurable statistical pattern. It is tiny, so you never notice it, but it is consistent. Because the signal lives in the choice of words, it survives copy-paste. Anthropic's own documentation describes exactly this for Claude: a watermark woven into the text itself, present no matter which product the text comes from.

Claude models launched on or after August 2, 2026 embed this mark. The two current examples, Fable 5.1 and Mythos 5.1, apply it everywhere Claude generates, and the mark travels when text is copied and pasted.

The same idea applies to images and audio. Google's SynthID shifts pixel values after an image is generated, and the signal is spread across the whole image, so cropping or blurring does not remove it. For text, the constraints are tighter, because there is less room for the model to vary and still sound natural.

C2PA provenance: the watermark's fragile sibling

Watermarking and provenance are complementary, not the same. Provenance uses the C2PA standard, an open format for recording a file's origin and edits. Claude attaches signed provenance metadata to generated files such as SVG, PNG, and JPG.

Here is the practical difference. A watermark lives inside the content, so it survives a screenshot. Provenance metadata lives in the file container, in the XMP header. Take a screenshot of a provenance-tagged image and the metadata vanishes. The watermark is still there.

That is why researchers treat them as two legs of one approach. One is robust but passive. The other is precise but fragile. Well built frameworks use both, so a watermark catches content that is re-encoded, while provenance keeps a trustworthy record of who made it and when.

Why watermarks stay invisible to generic detectors

This is the part most people get wrong. A generic detector and a watermark detector are built for different signals. GPTZero and Turnitin measure writing statistics. They have no idea what a specific model's watermark pattern looks like.

So a piece of text can be watermarked and score clean on GPTZero, or be completely human-written and score as AI. The two systems do not talk to each other. Industry explainers state it plainly: a watermark cannot be read by generic detectors like GPTZero or Turnitin.

If you want to understand what those generic detectors are actually measuring, this practical guide to detecting AI generated text walks through the same signals from the writer's side.

How accurate watermarks are, and where they break

On long, unedited text, watermark detection is strong. Across the major approaches it exceeds 99% for an intact passage. Accuracy falls the shorter and the more edited the content gets, because the pattern needs enough text to show up.

The biggest threat is paraphrase. If you paste watermarked text into another model and ask it to rewrite the passage, the new model re-rolls the word choices and breaks the original statistical pattern. Brookings finds watermarking more robust than heuristic detection, but it is not foolproof: a motivated person can degrade it.

For the writer, the practical reading is simple. A watermark is a hint, not proof. A positive read suggests AI involvement, but it is not irrefutable evidence, and a human can still write something that scans as AI. The same is true in reverse, and it is worth reading before you trust a single score from a detector.

Are AI detectors reliable is the fuller question, and the answer shapes how much weight you give any single result.

Why this is happening now

The driver is regulation. The EU AI Act's Article 50 requires providers of generative AI to mark synthetic output in a machine-readable way, and that transparency requirement hit new models in 2026. That pushed model makers to ship actual watermarks rather than just promise them.

Anthropic says the law includes a transition period for models released before the cutoff, and marking is being added to those too. For now the remaining lever is access: watermark detection is in private preview, gated to regulators, researchers, fact-checkers, and enterprises with a legal obligation.

What this means for your writing

If you draft, edit, or translate with a model that marks output, that output can carry a signal even after you rewrite chunks of it. The watermark survives copy-paste and some editing. Provenance metadata, if the model attached it to a file, is stripped by re-saving or screenshotting.

So secrecy becomes a worse strategy in 2026. If you depend on running marked text through a humanizer and hoping it clears, you are fighting a signal you cannot see. A better plan is to stop trying to erase provenance and compete on the work itself.

Three steps that actually help:

• Write the hard parts yourself. The more original decisions in the text, the less it depends on a model's default patterns.
• Edit with a clear purpose. Cut filler, tighten rhythm, and add the specific detail a model would not invent. That improves the writing and shifts the measurable signal.
• Disclose where you are required to. Policy and client trust beat an arms race with a detector you cannot see.

Much of the stress around AI detection comes from the heuristic side, and it lands hardest on people who are already writing in a second language. If that is your situation, this explainer on AI detection false positives is worth a read before you change your writing to chase a score.

The tightening question is about editing, not detection. If you want to cut AI tells without letting a model flatten your sentences, this workflow on editing AI writing to sound human keeps the cuts in your hands.

Watermarking is not going away, and it is not the enemy of good writing. It just means the question has shifted from can I get away with this to does this sound like me. That second question is the one worth answering, and it is a craft problem, not a detection problem.

Frequently asked questions