The digital world has long struggled with the invisibility of AI-generated text. Unlike an image, where a hidden pixel pattern can signal a synthetic origin, or an audio file, where frequency anomalies betray a deepfake, text is fundamentally fragile. The moment a user copies a paragraph from a chat interface and pastes it into a document, all metadata vanishes. For years, the industry relied on AI detectors that guessed the origin of a text based on perplexity or burstiness—essentially trying to spot a specific kind of robotic cadence. But these tools were notoriously unreliable, often flagging non-native English speakers as AI. The industry is now moving away from guessing and toward a system of intentional, embedded signatures.

The Mechanics of Probability Biasing

Google and Anthropic have pivoted to a method that embeds identification not in the characters themselves, but in the very process of how the model chooses its words. Google began deploying this technology across Gemini apps and web experiences in 2024 through a system called SynthID. Anthropic has announced a similar trajectory for Claude, with model-level watermarking slated for new models starting in August 2026, with a planned rollout to existing models thereafter.

The technical core of this approach lies in the probability distribution of the next-token prediction. When a Large Language Model (LLM) generates text, it does not simply pick the single most likely word; it samples from a distribution of candidates. The watermarking system intervenes here by using a secret key to randomly partition the available vocabulary into two groups: green lists and red lists. The model then subtly increases the probability of selecting tokens from the green list.

To a human reader, the resulting sentence remains natural and grammatically correct because the bias is minute. However, a validator possessing the secret key can analyze the text and determine if the frequency of green-list tokens is statistically higher than what would occur by chance. While Google's SynthID employs a sophisticated tournament-style selection process, other industry approaches, such as the method proposed by Scott Aaronson and adopted in some OpenAI contexts, derive the random seed for the selection process directly from the key. In both cases, the watermark is not a piece of data added to the text, but a pattern of choices made by the model.

From External Detection to Internal Adoption

This shift represents a fundamental change in the philosophy of AI provenance. We are moving from a world of external detection—where third-party tools analyze a finished product—to a world of internal adoption, where the signal is baked into the model's architecture. This makes the identification far more resilient than previous methods. Simple formatting changes, font swaps, or basic copy-pasting cannot erase the statistical bias embedded in the word choices.

There is currently a quiet arms race regarding the stealth and robustness of these schemes. The goal is to maintain the original intended probability of each word as closely as possible to avoid degrading the quality of the output while still leaving a detectable trace. Anthropic has taken a notably guarded approach, keeping the specific details of its production scheme confidential to prevent adversarial actors from reverse-engineering the key or developing automated tools to scrub the watermarks.

This movement is largely a response to mounting regulatory pressure to ensure transparency and accountability for AI-generated content. However, a notable gap exists in the implementation. Google, for instance, currently excludes its API services from these requirements in its documentation, creating a divide between the watermarked experience provided to general consumers and the raw tools provided to developers.

Despite the sophistication of these systems, they are not infallible. The survival of a watermark depends entirely on the continuity of the original token sequence. Because the color of the next word is determined by the flow of previous words, any significant disruption to the text can dilute the signal. Experimental data suggests that light editing or simple typo corrections are insufficient to hide the origin; even when a human paraphrases the text, the watermark often remains detectable if the sample size is at least 800 tokens (roughly 600 words).

The true vulnerability lies in the full rewrite. When a user takes the core meaning of a passage and regenerates it from scratch—essentially moving the content into a different meaning-space—the original sequence of token choices is destroyed. In these cases, the validator can no longer calculate the frequency of green tokens, and the detection accuracy plummets to roughly 50%, which is no better than a coin flip. Furthermore, the reliability of the detection is tied directly to text length. Short snippets lack the statistical significance required for a confident match. For certain models, a document may need to reach 1,500 words before a green-token ratio of just 55% is enough to confirm AI origin with high confidence.

This creates a new reality for enterprises and developers implementing AI detection. The utility of a watermark is not binary; it is a sliding scale of confidence based on length and the degree of human intervention.