AI Text Watermark Detector

A genuine text watermark detector isn't scanning for a mark. It's running a statistical test on the sequence of words a model chose, asking whether that sequence matches a pattern only someone holding the right key could have produced.

The foundational version is Kirchenbauer and colleagues' 2023 green-list/red-list scheme. It splits the vocabulary into two pseudorandom groups before every token, reseeded from whatever came before, then nudges sampling toward the green group.

Detection is a one-proportion z-test: count how often green tokens actually got picked, then check whether that rate could plausibly have happened by chance. The output is an interpretable p-value, not a vague AI-like score.

SynthID Text builds on the same basic idea with something more elaborate, tournament sampling, where candidate tokens compete across sampling rounds before one is picked. Google describes two scoring approaches its own reference detector can use, a mean score and a Bayesian score.

Google also documents three ways a detector could be deployed:

• Fully private, where only the provider can check anything
• A semi-private API with limited third-party access
• Fully public

Its documentation doesn't say which of the three, if any, Google actually runs for Gemini in production.

Anthropic's support article states that compatible Claude models have woven an imperceptible watermark into generated text since August 2, 2026, worldwide. That covers the API, Claude, Claude Code, Claude Cowork, Claude Tag, and Claude models accessed through AWS, Google Cloud, or Microsoft Foundry, because, in Anthropic's own words, watermarking is applied at the model level and is present no matter which Claude product or surface the text comes from.

The same article commits Anthropic to letting users and third parties detect that mark. The technical explanation arrived on August 14, 2026: an Anthropic post describing the mechanism as "a version of the SynthID-Text approach published by Google DeepMind" and stating "We will soon be offering a watermark detection API." It shipped on September 1, 2026, in private preview for eligible organizations under EU law rather than to the public, so no detector a general reader can run exists.

What Anthropic has confirmed is narrower than a working tool. A detected mark would only indicate content may have been processed by Claude, not proof that it was.

Anthropic also lists the conditions where marks may not be recoverable at all:

• Models released before the rollout
• Heavily edited or translated text
• Very short passages
• Files whose metadata was stripped by re-saving, format conversion, or a screenshot

Google's documentation of SynthID Text is, if anything, more technically detailed than Anthropic's. The method is open-sourced, with a production-grade reference implementation shipping in Hugging Face Transformers since version 4.46, including a Bayesian detector that reports watermarked, not watermarked, or uncertain.

That's real, usable software anyone can run today. What's contested is whether it's checking anything when pointed at ordinary Gemini API output.

Google DeepMind's own SynthID page says the Gemini app and web experience carry the watermark. A Google-affiliated account on the Google AI Developer Forum, replying on August 5, 2026 to a question about EU AI Act Article 50(2) compliance for two named Gemini models, wrote that API text is "NOT SynthID-watermarked" and that native text watermarking "is not planned at the moment." That reply was retracted by its own author on August 19, 2026, in favour of the opposite claim, and DeepMind's page has not changed to match.

Nothing published reconciles the two. So a clean result on Gemini API output could mean the text was never watermarked in the first place, not that detection failed.

Google's own hosted checker doesn't settle it either. The SynthID Detector portal launched at I/O on May 20, 2025 with only image detection live and text detection promised in the coming weeks.

Access has stayed waitlist-gated for journalists, media, and researchers, with no public API. An independent check in November 2025 found it still waitlist-only.

The statistics behind these detectors are well studied, and so are the ways around them. A 2024 follow-up to the original green-list/red-list scheme found the signal stayed detectable after strong human paraphrasing once a detector had around 800 tokens to analyze, at a false-positive rate of roughly 1 in 100,000.

Shorter passages carry a much weaker signal. That's part of why Google separately notes watermarking is less effective on short, factual responses: there's less room to nudge word choice without hurting accuracy.

The more unsettling finding is that a secret key isn't necessarily safe just because it's secret. ETH Zurich researchers showed in 2024 that a provider's green-list/red-list rule can be approximated from public API queries for under $50.

They then used that approximation two ways: forging a convincing watermark onto text the provider never generated, with over 80% spoofing success in their tests, and scrubbing a genuine watermark out, pushing removal success from near 0% to over 85% in settings assumed safe beforehand.

A 2025 follow-up from the same lab found a statistical way to catch that specific kind of forged text. So this is an active arms race, not a settled failure, and both a clean result and a confirmed match deserve some skepticism.

Most of the detectors people actually reach for don't check any of the above:

• GPTZero describes its own tool as scoring seven components covering perplexity and burstiness, how predictable and varied the writing is, plus other style signals, with no mention of SynthID, C2PA, or any provider watermark.
• Originality.ai describes its detector as "a modified version of the BERT model," a statistical classifier.
• ZeroGPT calls its method "DeepAnalyse."

All three are confirmed, from their own published descriptions, to be inferring style rather than verifying an embedded signal.

That's a meaningfully weaker kind of evidence. A style-based score can be wrong in either direction for reasons that have nothing to do with who wrote the text, and OpenAI has pointed to exactly this as a reason these tools disproportionately misjudge non-native English writers.

A real watermark detector, even an imperfect one, is at least checking for something a provider deliberately put there. A style detector is checking for a vibe.