LLM Watermarking: Claude vs Gemini vs ChatGPT vs Llama

Provider status for ordinary generated text is not converging. It's diverging, and the gaps are documented in the providers' own words.

• Claude: confirmed, explained, and now partly checkable. Anthropic's support documentation says models launched on or after August 2, 2026 support machine-readable marking at launch, and its per-model table, re-read 2026-09-25, marks Fable 5.1, Mythos 5.1, Opus 5.5 and Opus 5, with every model released before that date to be covered by December 2, 2026. Anthropic's 2026-09-25 email to Claude Platform customers dates Opus 5 from September 14, where its 2026-09-04 notice to administrators had said September 9, and schedules Fable 5, Sonnet 5 and Opus 4.8 from September 30, 2026. Its August 14 explainer describes the mechanism as a version of Google DeepMind's SynthID-Text approach, keyed word selection with nothing added to the text. The detection API shipped on September 1 in private preview for regulators, media, fact-checkers, researchers and similar bodies, which makes Claude the only provider on this page whose text watermark anyone outside the company can verify, and only if they qualify.
• Gemini: confirmed for the app and web experience on Google's own SynthID page, unresolved for the API. A Google-affiliated developer-forum reply of August 5, 2026 said API text was not SynthID-watermarked; the same account said the opposite on August 19 and called its first answer incorrect. Google's documentation still covers neither claim.
• ChatGPT: nothing confirmed for ordinary text. The reasons are the most documented refusal story in the industry, and they get their own section below.
• Grok: xAI's Acceptable Use Policy prohibits stripping or circumventing "embedded provenance metadata or watermarks" in Grok output. That's the first confirmed sign Grok outputs carry some embedded signal, but xAI has never disclosed which mechanism or which output types it covers, and it sits outside the C2PA steering committee.
• Llama: a full fetch of Meta's own Llama 3.1 and Llama 4 model cards found zero mentions of watermarking. Meta confirms watermarking elsewhere, Content Seal for Muse-generated images and a Llama Audio Watermark Detector for voice fraud, just nothing for chat text.
• DeepSeek: a visible, human-readable label rather than an invisible statistical watermark, driven by China's Artificial Intelligence Generated and Synthetic Content Labeling Measures, effective September 2025. That's a different category of signal entirely, and easy to remove by deleting the label text.

Open-weight deployments add another layer of variance on top of all this. Whoever runs the actual model controls the sampler, so the same base model can be watermarked by one deployment and not another.

A 2024 paper by Christ, Gunn, Malkin, and Raykova proposes closing that gap by embedding the watermark in a model's parameters instead of relying on the deployer's sampling code. They argue it's provably resistant to token-substitution attacks unless output quality gets destroyed. That's a research proposal, not something any provider has shipped.

Most statistical LLM text watermarking, including SynthID Text and the academic green-list schemes that came before it, happens during generation. As the model builds a probability distribution over its next possible word, a watermarking layer nudges which word gets picked, using a keyed pseudo-random signal seeded by the tokens that came just before.

The output still reads naturally, since the model keeps choosing among words it would plausibly pick anyway. It's just tilted toward some over others. A matching detector can later recover the statistical pattern from the sequence of choices.

Three unrelated things get called a text watermark, and they fail in completely different ways:

• Statistical watermarking: baked into how the text was produced, so it can't be retrofitted onto text a differently configured model already generated.
• Provenance metadata such as C2PA: a signed record attached to a file after the fact, routinely stripped by uploads, screenshots, and format conversion.
• Hidden Unicode characters: inserted into finished text, and removable by any tool that normalizes characters.

Only the first survives a paste into a plain text box. That's also why no character-stripping tool touches it.

Per Wall Street Journal reporting on leaked internal documents, relayed by Tom's Hardware, OpenAI built a text-watermarking method roughly 99.9% effective at flagging ChatGPT-written text. It was working years before any competitor shipped anything comparable.

It never went out the door. The internal case against release came down to four things:

• Real risk of false positives against innocent human writers.
• A documented, disproportionate impact on non-native English speakers, whose phrasing patterns can resemble a watermark's statistical signature.
• Straightforward circumvention once the method became public.
• Survey data suggesting close to 30% of users would use ChatGPT less if the feature shipped.

Nothing in 2025 or 2026 sourcing supersedes this. OpenAI's public statements still describe text provenance as an unmet future goal.

That's despite the company shipping watermarking for images (SynthID plus C2PA, since May 2026) and for audio (since July 2026). The absence of a ChatGPT text watermark is a considered tradeoff, not a technical gap.

EU AI Act Article 50(2) requires providers of systems generating synthetic text to make outputs machine-readable and detectable as artificially generated, as far as technically feasible. That rule took effect August 2, 2026, backed by fines up to €15M or 3% of global annual turnover.

Roughly 190 organizations, including Anthropic, Google, Meta, Microsoft, and OpenAI, had signed the EU's Code of Practice on transparency by the end of July 2026.

But the rule and its Code of Practice are both explicitly technology-neutral. Neither names a required scheme, and Article 50(2) carves out real exemptions:

• Short sequences of numbers, symbols, or letters
• Source code
• Machine-to-machine outputs a human never sees
• Standard editing-assistive functions

So provider responses are likely to keep diverging rather than converge on one shared standard. And a law that exempts source code from marking requirements leaves the code-safety question about token-nudging watermarks just as open as it was before.