Provenance at the Token Level: How Claude, Gemini and GPT Mark Generated Text

As of 2 August 2026 the EU requires providers of generative AI systems to mark their output in a machine-readable format. Google has been watermarking Gemini text since 2024. Anthropic began watermarking Claude text in August 2026. OpenAI watermarks images and audio and has never shipped a text watermark. xAI did not sign the Code of Practice at all.

This is the engineering brief on what those marks actually are, what the detection statistics can and cannot support, and what any of it proves. It is dense on purpose. Every section is meant to be implemented or acted on, not admired.

01 — The marking mandate and what actually shipped

Three regulatory regimes now require synthetic-content marking, and they do not require the same thing.

The EU. Article 50(2) of Regulation (EU) 2024/1689 requires providers of generative AI systems to ensure outputs are “marked in a machine-readable format and detectable as artificially generated or manipulated,” with technical solutions that are “effective, interoperable, robust and reliable as far as this is technically feasible.” The obligation applies from 2 August 2026. The Commission published the Code of Practice on Transparency of AI-Generated Content on 10 June 2026 and the implementing guidelines on 20 July 2026. Roughly 190 organisations signed by end-July; fewer than 100 signed Section 1, the provider-side marking commitments that actually bind a model vendor.

Two details in the Code matter more than the rest for anyone building text systems:

• The multi-layer rule, and its text carve-out. The Code states outright that no single marking technique currently satisfies all four statutory requirements, so signatories must apply at least two layers — digitally signed metadata plus an imperceptible watermark. Free-form text cannot carry metadata, so for text the watermark is the single layer. There is no fallback.
• The 200-token threshold. Watermarking is required for free-form text above roughly 200 tokens (~150 words). “Very short text” below that is exempt. The Code notes the threshold may fall as the technology improves. This number is not arbitrary and it is not a policy compromise — Section 04 shows it falls directly out of the detection statistics.

Systems placed on the market before 2 August 2026 get a transition period ending 2 December 2026. Non-compliance sits in the Article 99(4) tier: up to €15 million or 3% of total worldwide annual turnover, whichever is higher. (The €35M/7% figure routinely quoted in commentary is Article 99(3) and applies only to the Article 5 prohibited-practice ban, not to transparency.)

China. The Measures for Labelling of AI-Generated Synthetic Content, issued March 2025 by the CAC with MIIT, MPS and NRTA, took effect 1 September 2025 alongside mandatory national standard GB 45438-2025. The architecture is different in a way worth internalising: China requires an explicit label — a visible marker at the start, end or other appropriate position of the text — and an implicit machine-readable label in file metadata carrying the provider name and a content reference number. Distribution platforms must check for the implicit label and add a visible prompt where they detect synthetic origin. A user can request removal of the explicit label only under a logged user agreement; the implicit label stays regardless.

So: the EU mandates a statistical watermark the reader cannot see; China mandates a notice the reader can. These are not substitutes, and a product serving both markets implements both.

The United States has no federal marking requirement. State law is where the action is, and it is fragmented.

The practical consequence of this split is the single most important deployment fact in this article. Anthropic’s stated reason for marking all Claude output worldwide rather than only in the EU is that it has no durable way to scope marking by region at generation time — the model does not know where its output will end up. One jurisdiction’s transparency rule therefore became every user’s default. Expect that pattern to repeat: marking is applied at the model layer, and the model layer has no geography.

02 — The detection equation

Everything downstream — the token threshold, the code carve-out, the attack surface, the admissibility problem — falls out of one framing. Watermark detection is a hypothesis test on a sequence of pseudorandom scores, and its power is bounded by the entropy of the thing being watermarked.

2.1 The general scheme

A generative watermark has three components (Piet et al., arXiv:2312.00273; adopted by the SynthID-Text paper):

1. A random seed generator r_t = f_r(x_<t, k) producing a seed at each step from the preceding context and a secret key k. In practice this is a sliding window: r_t = h(x_{t−H}, …, x_{t−1}, k), with h a pseudorandom function family. SynthID-Text uses H = 4.
2. A sampling algorithm S: ΔV × R → V that draws the next token in a way correlated with r_t.
3. A scoring function that measures that correlation given only the tokenised text and the key — no model weights, no logits, no prompt.

Point 3 is the load-bearing engineering property. Detection is O(T) hash evaluations. It does not require a forward pass, which is why a detector can run at a cost four to six orders of magnitude below generation, and why detection-as-a-service is computationally trivial even though, as Section 09 argues, it is commercially and legally fraught.

2.2 The test

Let s(x_t, r_t) be the per-token score. Define:

H₀ : x was produced without knowledge of k
H₁ : x was produced by the k-keyed sampler

S(x) = Σ_{t=1}^{T} s(x_t, r_t)

Under H₀, the seeds r_t are independent of the realised tokens, so the s(x_t, r_t) are i.i.d. with known mean μ₀ and variance σ₀² — known because the scheme designer chose the g-value distribution. That gives a distribution-free null and a closed-form standardised statistic:

            S(x) − T·μ₀
   z(x)  =  ─────────────
              σ₀ · √T

Reject H₀ when z > z_α, where z_α = Φ⁻¹(1 − α) for target false-positive rate α. This is the whole detector. The p-value is Φ(−z).

The critical structural fact: the null requires no model of human writing. This is what separates watermarking from post-hoc classification (Section 07). A classifier’s false-positive rate is an empirical property of a training distribution and drifts as writing styles drift. A watermark’s false-positive rate is a property of a hash function and is analytically fixed. That is the entire reason watermarking survives model upgrades and classifiers do not.

2.3 The scaling law

Let Δ = μ₁ − μ₀ be the per-token evidence rate — how much the keyed sampler lifts the expected score. Then E[z] = Δ√T / σ₀, and the minimum passage length to reach significance α with power ~50% is:

              z_α² · σ₀²
   T*   ≥    ────────────
                 Δ²

Three consequences, each of which becomes a section of this article:

• T* scales with the square of the FPR’s z-score. Tightening from α=10⁻² to α=10⁻⁶ raises z_α from 2.33 to 4.75 — a 4.2× increase in required tokens. Low false-positive rates are expensive in text length. (§08)
• T* scales with the inverse square of the evidence rate. Halving Δ quadruples the text you need. And Δ is bounded by entropy. (§04)
• σ₀² is a design variable. Reducing the null variance is the only free lunch available, and it is exactly what tournament sampling buys. (§03)

Concretely, for a Kirchenbauer-style green-list scheme with γ = 0.25 (σ₀² = γ(1−γ)), the required length as a function of the per-token green-rate lift ε:

Read the bottom-right cell. A weakly-marked passage — ε = 0.02, which is what you get from heavily factual or heavily edited text — needs over ten thousand tokens to clear a one-in-a-million false-positive bar. That is a 40-page document. This single table explains why every provider’s published limitations section says the same thing about short passages, and why the Code of Practice put its floor at 200 tokens rather than 20.

03 — Tournament sampling: the mechanism in production

SynthID-Text (Dathathri et al., Nature 634, 818–823, 2024) is the only generative text watermark with a published production deployment, and it is the scheme Anthropic adopted. Anthropic states directly that Claude’s text watermark “is a version of the SynthID-Text approach published by Google DeepMind,” belonging to the family that begins with Scott Aaronson’s 2022 proposal. So one algorithm now underwrites text marking at two of the three largest frontier labs. Worth understanding precisely.

3.1 The lineage it replaced

Soft Red List (Kirchenbauer et al., ICML 2023, arXiv:2301.10226). Hash the context to partition the vocabulary into a green list of size γ|V| and a red list. Add a constant δ to green-token logits before sampling. Detect by counting green tokens:

             |s|_G − γT
   z   =   ───────────────
            √(T·γ(1−γ))

Simple, strong, and distortionary: adding δ to a subset of logits changes the output distribution, measurably raising perplexity. You are trading text quality for detectability on an explicit dial.

Gumbel / exponential sampling (Aaronson & Kirchner, 2022). Instead of perturbing logits, use the key to generate uniform randoms u_i per vocabulary item and select argmax_i u_i^{1/p_i}. This is exactly the Gumbel-max trick with keyed randomness, and it is distortion-free in expectation: marginalised over the key, the output distribution is unchanged. The cost is determinism — the same prompt and key give the same output, collapsing response diversity.

3.2 What tournament sampling does

SynthID-Text keeps the keyed-seed structure and replaces the sampling rule. Given seed r_t, instantiate m independent pseudorandom watermarking functions g_1, …, g_m, each assigning a g-value to any candidate token. The default g-value distribution is Bernoulli(0.5); formally,

   g_ℓ(x, r) := F_g⁻¹( h(x, ℓ, r) / 2^n_sec )

where h is a pseudorandom hash to n_sec-bit integers and F_g⁻¹ is the inverse CDF of the chosen g-value distribution. Then run a knockout tournament:

1. Draw N^m candidate tokens i.i.d. from p_LM(·|x_<t) (repeats allowed).
2. Layer ℓ = 1..m: group survivors into brackets of N, keep the ones with maximal g_ℓ, break ties uniformly.
3. The final survivor is the emitted token x_t.

With N = 2 competitors per match, tournament sampling is single-token non-distortionary: averaged over the key, the emitted token’s distribution equals p_LM. With N > 2 it becomes distortionary but embeds a stronger mark — the explicit quality/detectability dial, now with a better frontier than Soft Red List at equal perplexity cost.

Detection is the mean g-value across tokens and layers:

                    1    T    m
   Score(x)  =  ─────   Σ    Σ   g_ℓ(x_t, r_t)
                 m·T   t=1  ℓ=1

Under H₀ with Bernoulli(0.5) g-values, E[Score] = 1/2. Watermarked text scores higher because the tournament selected for it.

3.3 Why the layers are the innovation

This is the part most summaries miss. The m layers do not each add an independent copy of the watermark — each layer consumes some of the available entropy, and the marginal strength of layer ℓ falls as ℓ grows. What the layers do is reduce the variance of the score estimator. Returning to §2.3: T* ∝ σ₀²/Δ². Averaging over m layers shrinks the effective null variance by roughly m_eff, so:

   z  ≈  2·√(m_eff · T) · δ        where δ = per-token-per-layer g-lift

(Tokens required to reach FPR 10⁻⁴.)

Multiple layers are what drag a weakly-marked passage from “needs a novel” to “needs a few paragraphs.” The production default is m = 30. The paper also reports that a learned Bayesian scoring function — a small network trained on watermarked and unwatermarked text to output a posterior — beats the mean score, and that is the default used in their experiments. Note what that means for anyone reimplementing: the published closed-form statistic is the floor of the scheme’s performance, not its ceiling.

3.4 Repeated context masking

If the same H-token context window recurs, the same seed recurs, and the same bias gets applied twice — which manifests as degenerate repetition loops. The fix, inherited from Hu et al. (ICLR 2024), is K-sequence repeated context masking: maintain a history of context windows already used to watermark, and when a window repeats, sample from p_LM unwatermarked. K = 1 holds history for a single response; larger K spans responses.

This is a real quality/detectability trade, and it is where the non-distortion hierarchy lives:

• Single-token non-distortion — weakest; per-token marginal preserved.
• K-sequence non-distortion — achieved by masking across K responses; preserves the distribution over sequences.
• Stronger levels cost detectability and compute.

Production SynthID-Text runs single-sequence non-distortionary (K = 1): quality preserved, detectability good, with some reduction in inter-response diversity. If you are implementing this, that masking step is not optional polish — skip it and you ship repetition bugs.

3.5 Serving integration

Two production details that matter to anyone running inference:

Speculative sampling. Watermarking and draft-model speculation interact badly if done naively; accepting a draft token the watermark would not have chosen leaks detectability, and rejecting it kills the acceptance rate. The paper gives two algorithms: high-detectability watermarked speculative sampling, which preserves the mark but may lower acceptance rate and therefore raise latency; and fast watermarked speculative sampling, which preserves the acceptance rate exactly — provably, when paired with a single-token non-distortionary watermark — at some detectability cost, recovered by the learned Bayesian scorer. If you self-host and run speculative decoding, this is the design fork.

Latency. Gemma 7B-IT on 4× v5e TPUs generates at 15.527 ms/token unwatermarked and 15.615 ms/token with 30-layer tournament sampling: +0.57%, or 0.088 ms/token. On a 1,500-token response that is +132 ms. For comparison, Gumbel costs +0.26% and Soft Red List +0.28% on the same setup. And because watermarking touches only the sampling layer, its relative cost shrinks as models grow — the forward pass scales, the tournament does not.

Anthropic’s public statement is consistent: watermarking “has a negligible impact on the speed of models, and because it produces no extra tokens, the model is the same price to serve and use.” Hold onto that. It is the first term in the economics of Section 09.

3.6 Reference detector

The scoring side, implementable from the published scheme. This is the mean-score frequentist detector — the floor, not the Bayesian ceiling.

import hashlib
import math
from dataclasses import dataclass


def _prf(key: bytes, *parts: int, nbits: int = 64) -> int:
    """Pseudorandom function family. Production uses a keyed PRF
    (HMAC/AES); SHA-256 over a canonical encoding is fine for analysis."""
    h = hashlib.sha256()
    h.update(key)
    for p in parts:
        h.update(p.to_bytes(8, "big", signed=False))
    return int.from_bytes(h.digest()[: nbits // 8], "big")


@dataclass(frozen=True)
class WatermarkConfig:
    key: bytes
    context_len: int = 4      # H: sliding-window size
    layers: int = 30          # m: tournament depth
    nbits: int = 64


def seed(cfg: WatermarkConfig, context: tuple[int, ...]) -> int:
    """r_t = h(x_{t-H}..x_{t-1}, k)."""
    return _prf(cfg.key, *context, nbits=cfg.nbits)


def g_value(cfg: WatermarkConfig, token: int, layer: int, r: int) -> int:
    """Bernoulli(0.5) g-value for (token, layer, seed)."""
    return _prf(cfg.key, token, layer, r, nbits=cfg.nbits) & 1


def score_sequence(cfg: WatermarkConfig, tokens: list[int]) -> tuple[float, int]:
    """Mean g-value and the count of scored positions.

    Positions whose context window was already used are MASKED — they were
    generated unwatermarked, so scoring them only adds null noise.
    """
    seen: set[tuple[int, ...]] = set()
    total, scored = 0.0, 0
    for t in range(cfg.context_len, len(tokens)):
        ctx = tuple(tokens[t - cfg.context_len : t])
        if ctx in seen:
            continue
        seen.add(ctx)
        r = seed(cfg, ctx)
        total += sum(g_value(cfg, tokens[t], l, r) for l in range(cfg.layers))
        scored += 1
    if scored == 0:
        return 0.5, 0
    return total / (scored * cfg.layers), scored


def detect(cfg: WatermarkConfig, tokens: list[int],
           m_eff: float = 8.0) -> dict:
    """Return the standardized statistic and a p-value.

    m_eff < layers because tournament layers are NOT independent: each
    consumes entropy, so deeper layers contribute less. Calibrate m_eff
    empirically on held-out unwatermarked text — do not assume m_eff = m.
    """
    mean_g, n = score_sequence(cfg, tokens)
    if n == 0:
        return {"z": 0.0, "p_value": 1.0, "scored_tokens": 0,
                "verdict": "indeterminate"}
    z = 2.0 * math.sqrt(m_eff * n) * (mean_g - 0.5)
    p = 0.5 * math.erfc(z / math.sqrt(2))
    return {
        "z": z,
        "p_value": p,
        "mean_g": mean_g,
        "scored_tokens": n,
        "verdict": _verdict(p, n),
    }


def _verdict(p: float, n: int, min_tokens: int = 200) -> str:
    """Three states, never two. An under-length passage is not 'clean' —
    it is unmeasured, and reporting it as negative is the single most
    common integration bug."""
    if n < min_tokens:
        return "indeterminate_insufficient_length"
    if p < 1e-6:
        return "watermark_detected"
    if p < 1e-3:
        return "watermark_likely"
    return "no_watermark_detected"

Three integration notes that cost people real money:

1. m_eff is not m. Tournament layers share entropy; treating 30 layers as 30 independent observations inflates z and silently raises your real false-positive rate by orders of magnitude. Calibrate against held-out human text.
2. Mask repeated contexts at detection time, not just generation time. Those positions were emitted unwatermarked. Scoring them dilutes the signal with pure null noise.
3. Return three states. Watermarked / not-watermarked / indeterminate. Google’s SynthID Detector returns exactly these three for text, and the reason is in the next section.

04 — The entropy ceiling

Here is the hard limit, and it is not an implementation detail — it is the thing that determines which text can be marked at all.

4.1 The bound

A watermark is encoded in which token the sampler chose among tokens it was willing to choose. If the model’s next-token distribution is a point mass, there is no choice to make, and nothing to encode. The per-token evidence rate Δ is therefore bounded above by a function of the sampling entropy at that step:

where ψ is increasing and ψ(0) = 0. Kirchenbauer et al. formalise this with spike entropy, a softened entropy that is the right functional for green-list schemes:

                     p_k
   S(p, m)  =   Σ  ─────────
                k   1 + m·p_k

Combining with §2.3: the required passage length scales as T* ≳ z_α²σ₀² / (κ²·ψ(H̄)²) where H̄ is the mean sampling entropy over the passage. Detectability is not a property of the text’s length alone. It is a property of length × entropy. Two 500-token passages can differ by an order of magnitude in detectability.

4.2 What this predicts, and what the providers confirm

This single bound predicts every published carve-out. Working through them:

Code is weakly marked or unmarked. Identifiers must match declarations; syntax is forced; a different token is not an equally good token, it is a bug. Entropy near zero across most positions. Anthropic states this directly: code “has generally less watermarking than some other forms of text,” with the mark living in genuinely free choices like comments — “by definition, it will have a negligible effect on the actual code produced.” For anyone building on top of a code model, treat code output as unmarked by default.

Factual and quoted text is weakly marked. Anthropic’s example is exact: after “Isaac Newton’s most famous work was called Principia…” the next token has one right answer. The watermark has nothing to act on. The same holds for citations, quantities, names, and structured output. A JSON response conforming to a schema is nearly entropy-free in its keys.

Proofreading leaves almost nothing. When Claude edits a human’s grammar, nearly all tokens are the human’s. The mark can only attach to the handful of changed tokens. Anthropic: those changes “might not be enough to make Claude’s involvement detectable.”

Translation is fully marked. Every output token is chosen by the model, so entropy is high throughout. Anthropic confirms translations carry the watermark. This produces the sharpest equity problem in the whole system, and Section 08 returns to it.

Stronger models are harder to watermark. This one is counterintuitive and under-discussed. RLHF-tuned and larger models are lower entropy — mode collapse is well documented — so the same scheme embeds a weaker mark in a better model. Decoding settings compound it: low temperature, tight top-p and small top-k all cut entropy. A platform serving temperature=0.2 for determinism is substantially reducing the detectability of its own output. SynthID-Text is compatible with top-k for all k ≥ 2, top-p for p ∈ (0,1] and any τ > 0 — but compatible is not the same as effective.

Therefore the 200-token threshold is a statistical artefact, not a legal compromise. At typical mixed-prose entropy, 200 tokens is roughly where a well-designed multi-layer scheme clears a defensible false-positive bar. The Code’s note that the threshold may fall as technology improves is the same statement as “σ₀²/Δ² may improve.”

4.3 Budgeting detectability before you ship

If you operate a model or a platform, you can estimate marking coverage ahead of time instead of discovering it in a compliance audit. You have the logits; the regulator does not.

import math
from dataclasses import dataclass, field


def spike_entropy(probs: list[float], modulus: float = 1.0) -> float:
    """Kirchenbauer et al. spike entropy: S(p,m) = Σ p_k/(1+m·p_k).
    Bounded in (0,1]; low values mean a peaked, unmarkable distribution."""
    return sum(p / (1.0 + modulus * p) for p in probs)


@dataclass
class DetectabilityBudget:
    """Accumulates expected watermark evidence across a generation.

    Run this against sampled logits in staging to learn which of YOUR
    output classes are actually markable, before a regulator asks.
    """
    layers: int = 30
    m_eff: float = 8.0
    kappa: float = 0.22          # scheme constant; fit empirically
    _entropies: list[float] = field(default_factory=list)

    def observe(self, probs: list[float], masked: bool = False) -> None:
        """Call per decoding step. `masked=True` for repeated-context
        positions, which carry no watermark and must not be counted."""
        self._entropies.append(0.0 if masked else spike_entropy(probs))

    @property
    def scored_tokens(self) -> int:
        return sum(1 for h in self._entropies if h > 0.0)

    def expected_z(self) -> float:
        """E[z] ≈ 2·√(m_eff)·Σ_t κ·ψ(H_t) / √T  — evidence accumulates
        linearly in per-token lift, noise only as √T."""
        n = self.scored_tokens
        if n == 0:
            return 0.0
        lift = sum(self.kappa * h for h in self._entropies if h > 0.0)
        return 2.0 * math.sqrt(self.m_eff) * lift / math.sqrt(n)

    def p_value(self) -> float:
        return 0.5 * math.erfc(self.expected_z() / math.sqrt(2))

    def tokens_needed(self, target_fpr: float = 1e-6) -> float:
        """How much MORE text at the observed mean entropy is required."""
        n = self.scored_tokens
        if n == 0:
            return float("inf")
        mean_lift = (
            sum(self.kappa * h for h in self._entropies if h > 0.0) / n
        )
        if mean_lift <= 0:
            return float("inf")
        z_target = _z_for_fpr(target_fpr)
        return (z_target / (2.0 * math.sqrt(self.m_eff) * mean_lift)) ** 2

    def report(self) -> dict:
        n = self.scored_tokens
        return {
            "scored_tokens": n,
            "masked_tokens": len(self._entropies) - n,
            "mean_spike_entropy": (
                sum(self._entropies) / n if n else 0.0
            ),
            "expected_z": self.expected_z(),
            "expected_p": self.p_value(),
            "tokens_for_1e-6": self.tokens_needed(1e-6),
        }


def _z_for_fpr(alpha: float, lo: float = -10.0, hi: float = 10.0) -> float:
    for _ in range(200):
        mid = (lo + hi) / 2.0
        if 0.5 * math.erfc(mid / math.sqrt(2)) > alpha:
            lo = mid
        else:
            hi = mid
    return (lo + hi) / 2.0

Run this across your traffic mix segmented by output class — prose, code, JSON, summaries, translations, proofreads — and you will find the distribution is bimodal, not normal. Prose and translation clear easily. Code, structured output and light edits never clear. That bimodality, not the average, is what your compliance posture actually is.

05 — The capability matrix: who marks what, verified

Reporting on this is noisy and several widely-circulated summaries are wrong. What follows is sourced to primary provider documentation.

5.1 Anthropic / Claude

Anthropic signed the Article 50(2) Code of Practice and published both a support article and a technical explainer (14 August 2026, updated 1 and 9 September). The commitments:

• Claude models launched on or after 2 August 2026 support marking at launch; earlier models are being retrofitted during the transition period ending 2 December.
• Text carries an embedded watermark; generated files carry C2PA Content Credentials.
• Marking is applied at the model level, so it is present regardless of surface — Claude apps, Claude Platform (API), Claude Code, Claude Cowork, Claude Tag — and through AWS, Google Cloud and Microsoft Foundry.
• Applied worldwide, not scoped to the EU.

The per-model support matrix, from Anthropic’s support documentation, is the part most coverage omits and the part that matters operationally:

* Anthropic notes rollout on Amazon Bedrock completing by 12 October 2026.

Marking support is a versioned model capability, not a provider-wide boolean. Any system that reasons about “is this from Claude” must condition on model ID. Note Mythos 5 carries C2PA but not the text watermark while Mythos 5.1 carries both — adjacent point releases differ.

Detection is the critical gap: the watermark detection API is in private preview, restricted to organisations with a legal need under EU law (regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations, EU civil society) plus enterprises with their own Article 50 obligations. A free Claude Content Checker exists at claude.com/check-content, but it verifies C2PA credentials on files — it is not a text detector.

Anthropic’s stated limitations are unusually candid and should be quoted into any policy that relies on this:

• A detected mark means content “may have been processed by Claude,” not that Claude authored it. Proofreading, translation, summarisation and format conversion all produce marked output from human-origin ideas.
• A missing mark proves nothing — unsupported model, heavy editing, paraphrase, translation, short passage, or an unsupported surface.
• The mark carries no identifying information and cannot be traced to a user, organisation or conversation.

5.2 Google / Gemini

SynthID-Text has watermarked Gemini output since 2024 — the first production text watermark at scale. The live experiment behind the Nature paper covered ~20 million responses split between watermarked and unwatermarked models; the thumbs-up rate differed by 0.01% (watermarked higher), thumbs-down by 0.02% (watermarked lower), both statistically insignificant and inside 95% CIs. A controlled side-by-side on 3,000 ELI5 prompts found no significant rater preference across grammaticality, relevance, correctness, helpfulness or overall quality.

Google also open-sourced a reference implementation (google-deepmind/synthid-text), which is why a second lab could adopt the scheme at all. SynthID now spans text, image, audio and video; by Google I/O in May 2026 the reported cumulative scale was over 100 billion images and videos plus roughly 60,000 years of audio, up from ~10 billion items at I/O 2025. Adopters announced alongside include OpenAI, NVIDIA, ElevenLabs and Kakao. A SynthID Detector portal exists, in early access for journalists and media professionals; for text it returns three states — watermarked, not watermarked, uncertain.

5.3 OpenAI

The most instructive case, because OpenAI built the thing first and did not ship it.

Scott Aaronson developed the scheme that seeded this entire literature while at OpenAI in 2022. OpenAI has confirmed it built a working text watermarking method and declined to deploy it, citing weak robustness against translation and rewording and the risk of disproportionately flagging non-native English speakers. It also retired its own AI-text classifier in July 2023 for low accuracy and has not replaced it.

What OpenAI does ship, per its 19 May 2026 provenance post (updated 31 July 2026):

• C2PA Content Credentials on generated images since DALL·E 3, extended to ImageGen and Sora; OpenAI is now a C2PA Conforming Generator Product and sits on the C2PA steering committee.
• SynthID watermarking on images (ChatGPT, Codex, API) via partnership with Google — explicitly a multi-layer strategy, because “metadata is not foolproof. It can be stripped, lost through uploads and downloads, or broken by transformations.”
• SynthID on supported audio since 31 July 2026.
• A public verification tool for images and audio, plus a verification API for developers.

Text is absent from all of it. OpenAI signed the Code of Practice and has stated its goal is to expand provenance signals to all modalities including text, but as of this writing no text watermark is deployed. The lab that invented the technique is the last major Western signatory without it in production.

5.4 xAI, and the rest

xAI did not sign the Code of Practice — the only major Western lab to abstain. That is not an exemption. Article 50 binds every provider placing a generative system on the EU market regardless of signature; the Code is merely the pre-approved compliance pathway. xAI must demonstrate compliance on its own terms to national market-surveillance authorities, without the presumption of adequacy the Code confers. Reporting on Meta’s signatory status conflicts across outlets and we are not able to resolve it from primary sources; treat it as unverified.

Open-weight models are the structural hole. A watermark requires the operator to run the keyed sampler. Anyone serving Llama, Qwen, DeepSeek or Mistral weights on their own hardware simply does not, and no technical mechanism compels them. Every marking regime described in this article covers hosted frontier APIs and nothing else. If your threat model is a motivated adversary rather than a careless user, assume unmarked generation is freely available at near-zero cost, because it is.

5.5 The summary table

Read the fourth column. Text marking has been deployed at the scale of hundreds of millions of users, and essentially no one outside a regulator can check it. That asymmetry is the subject of Section 09.

06 — The adversarial layer: scrub, spoof, steal

Three attack objectives, and they are not equally important.

• Scrubbing — remove the mark from marked text. Evades attribution.
• Spoofing — imprint a provider’s mark on text they did not generate. Creates false attribution.
• Stealing — reverse-engineer the keyed rules well enough to do either at will.

Public discussion fixates on scrubbing. Spoofing is the more serious failure, and the one that explains every provider’s detection posture.

6.1 The impossibility result, and its honest rebuttal

Zhang et al. (ICML 2024, arXiv:2311.04378), Watermarks in the Sand, prove that strong watermarking is impossible under two assumptions: the attacker has a quality oracle that evaluates whether a candidate output is a good response, and a perturbation oracle that modifies an output while preserving quality with non-trivial probability, inducing an efficiently mixing random walk on the set of high-quality outputs.

The geometry is clean. Watermarked outputs are a small subset of high-quality outputs — necessarily small, because the scheme has a low false-positive rate. Random-walk through high-quality space, rejecting low-quality candidates with the quality oracle, and you exit the watermarked region while staying in the quality region. No key access required. The bound holds for secret-key schemes.

The assumption that carries the weight is that verifying quality is at least as easy as generating it — and as models improve, the attacker’s oracles improve at least as fast as the defender’s watermark. That is why this result does not expire.

But the honest engineering reading is more nuanced than the headline, and Sandcastles in the Storm (arXiv:2505.06827) supplies it: in practice the automated random-walk attack removes watermarks only 26% of the time, dropping to 10% under human quality review, because real quality oracles are not the idealised oracle of the theorem and real perturbation does not mix as fast as assumed. The impossibility result is correct and the practical attack underperforms it substantially. Weak watermarking survives; strong watermarking does not. Design and policy accordingly — a watermark is a deterrent and a triage signal, not a seal.

6.2 Stealing, and the $50 number

Jovanović, Staab and Vechev (ICML 2024, arXiv:2402.19361) is the result that most changed deployment practice. An attacker with only API access, issuing benign queries, can build an approximate model of the secret watermarking rules by token-frequency analysis of watermarked output:

• One-time cost: under $50 in API spend.
• Spoofing success: over 80%, including the first demonstrated attack on KGW2-SelfHash.
• Scrubbing boost: from ~1% to over 80% for a standard paraphraser (DIPPER), with no additional queries after the one-time theft.

Once paid, the cost amortises to zero across unlimited attacks. And there is a structural trade with no good resolution: the context window size h governs it. Small h localises the mark and resists scrubbing, but makes the rules easy to reverse-engineer from frequency statistics. Large h resists stealing but delocalises the mark, making scrubbing easier. You cannot maximise both. SynthID-Text’s H = 4 sits deliberately in the middle of that trade.

The Nature paper lists stealing, spoofing and scrubbing as open vulnerabilities and “an area of ongoing research.” It does not claim to have solved them.

6.3 Images: the same story, further along

Image watermarking has a longer attack literature because the signal is continuous. MarkNull (Cao et al., USENIX Security 2026, arXiv:2608.10166) is the current high-water mark: a model-agnostic, no-box removal attack operating by on-manifold latent manipulation, exploiting the statistical dependency between a watermarked image’s latent representation and its embedded initial noise. Reported results against Google’s SynthID-Image: 100% attack success rate while maintaining better perceptual quality than any other tested attack. The amortised variant MarkNull-A distils the attack into a single forward pass at 0.50 s/image on 6.3 GB of VRAM — roughly 170,000 images per day on one consumer GPU — and transfers to video watermarking schemes.

This matters for text teams for one reason: it is the preview. Text watermarks are harder to attack than image watermarks today because text is discrete and low-bandwidth, not because anyone has solved the underlying problem.

6.4 Paraphrase: the boring attack that works

No stealing required. Krishna et al. (NeurIPS 2023) established with DIPPER that paraphrasing evades detectors, and that retrieval over a log of generated outputs is the effective defence — at the cost of storing and searching every interaction, with the privacy exposure that implies. The Nature authors evaluate SynthID-Text under edits and paraphrase and acknowledge it is weakened, noting only that such attacks “usually change the text significantly.”

Anthropic’s position is the clearest statement anyone has published: “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will. In the latter case, of course, it’s arguable whether the text can any longer be described as AI-generated.”

That last clause is the right frame and deserves to be taken seriously rather than read as a dodge. A watermark does not measure “was a model involved.” It measures how many of these token choices were made by the keyed sampler. If an adversary replaces every choice, the thing being measured is genuinely gone — but so is the model’s authorship, in any sense a court or an editor should care about. The definition and the measurement coincide. The failure mode is not at the extremes; it is in the middle, where partial rewriting produces partial evidence that no one has a principled threshold for.

6.5 Why detection is gated

Now the posture makes sense. A public, unlimited, high-throughput detection oracle is an attacker’s calibration instrument. It converts blind scrubbing into hill-climbing: perturb, query, keep what lowers the score, repeat. The same oracle lets a spoofer verify a forged mark before deploying it.

So every provider faces a genuine trilemma, and there is no configuration that satisfies all three:

1. Regulatory duty — the Code requires providers to make a detection solution available.
2. Security — an open detector accelerates both scrubbing and spoofing.
3. Utility — a detector only regulators can reach does not help the teacher, editor or platform integrity team who encounters the content.

Anthropic resolved it toward (1) and (2): private preview for legally-eligible organisations, expanding over time. Google resolved it similarly: a portal in early access for journalists and researchers. Nobody has resolved it toward (3). The result is a system where a billion people’s text is marked and almost none of them, nor the institutions making decisions about them, can check it.

07 — Post-hoc classifiers: the other half of the stack

Watermarking covers marked models. Post-hoc detection is what remains for everything else — open weights, unmarked providers, pre-2026 content. The two are complementary and are routinely confused, including in institutional policy.

7.1 The methods

Zero-shot statistical. DetectGPT (Mitchell et al., ICML 2023) exploits the observation that model-generated text occupies local maxima of the model’s log-probability curvature: perturb the text and log-probability falls more sharply than for human text. Needs access to a scoring model. Binoculars (Hans et al., ICML 2024) contrasts the perplexity of one model against the cross-perplexity of a pair, achieving strong zero-shot detection without per-generator training.

Trained classifiers. Pangram, GPTZero, Turnitin, Copyleaks. Supervised discriminators on labelled corpora.

The structural weakness is in the null. As established in §2.2, a watermark’s FPR is a property of a hash function. A classifier’s FPR is a property of a training distribution — and that distribution is non-stationary in the worst possible way. As models improve, machine text converges on human text; as humans read more model output, human text converges on machine text. Both arms of the discriminant move. This requires permanent retraining and recalibration, and it is why the Nature authors list post-hoc detection as complementary to, not competitive with, watermarking.

7.2 The claims, and the field data

Vendor benchmarks are strong. Pangram reports 99.98% accuracy and a false-positive rate near 1 in 10,000; GPTZero reports 99.76% average accuracy at 0.08% FPR on a vendor benchmark. A University of Chicago Booth working paper independently found Pangram achieving essentially zero false positives on medium and long passages, and being the only detector meeting a strict 0.5% FPR policy cap without losing detection power. Those findings appear to be real within their evaluation design.

Then there is the field data, and it is a different picture.

Karr et al. (Why AI Detection Fails for Academic Integrity, AILS ‘26, arXiv:2608.11256) scored 642 published English abstracts across chemistry, computer science, political science and theology, in two windows (2013–15 as a pre-LLM reference, 2023–25 as current), with Pangram 3.2 and GPTZero, before and after commercial humanisation. At τ = 0.50:

Four findings worth carrying into any deployment decision:

1. The vendor numbers reproduce on pre-LLM text and not on current text. Zero false positives on 2013–15 abstracts. On 2023–25 abstracts, 14.9% and 8.9% flag rates. The authors are careful — these are flag rates, not confirmed false positives, because real AI assistance in recent published work is unobserved. But the direction is unambiguous and the gap against sub-1% marketing claims is two orders of magnitude.

2. The errors are structured, not random. Detector scores correlate with Academic Word List density (Spearman ρ = 0.346 Pangram, 0.320 GPTZero) and long-token ratio (0.336 / 0.304), and negatively with numeric and non-alphabetic token ratios. Domain-centred, the associations strengthen (r > 0.41). The practical consequence is a flag-rate spread by field at identical threshold:

Non-STEM versus STEM: 25.3% vs 5.6% for Pangram, p = 0.0002. These detectors are substantially measuring register, not authorship. Formal, Latinate, low-numeric prose scores as AI. That is a disparate-impact finding sitting inside a tool used for misconduct adjudication, and it rhymes directly with Liang et al. (Patterns, 2023), who showed GPT detectors are biased against non-native English writers — the same surface features, the same direction.

3. Humanisers defeat them almost completely. After one commercial humanisation pass, false-negative rates exceed 96% for both detectors; fewer than 4% of AI-labelled rewrites remain flagged. The mechanism is measurable and mundane: humanisers suppress exactly the cues the detectors use — long-token ratio down 0.184→0.138, AWL density 0.157→0.121, type-token ratio 0.700→0.605, all p < 0.001 across 2,568 pairs. The humaniser is not fooling a model of authorship. It is sanding down the surface statistics the classifier learned.

4. The asymmetry is the finding. Guideline-compliant light editing — a human’s ideas, a model’s polish — is flagged at 64–80% by Pangram and 38–49% by GPTZero. Full synthesis followed by humanisation evades at >96%. The authors name it precisely: honest AI-assisted editing currently carries higher sanction risk than humaniser-assisted evasion. No threshold fixes it. Across τ ∈ 0.6 Pangram holds ~15% original flags and ~80% light-edit flags; raising τ slightly increases FNR on AI text without making honest editing safe.

One more number with direct operational meaning: inter-detector agreement (Cohen’s κ) falls from 0.539 pre-humanisation to 0.221 post. A second detector is not an independent check once evasion is in play. Requiring two flags does not buy the corroboration people assume it does.

7.3 How to hold both findings at once

The vendor benchmarks and the field study are not actually contradictory, and getting this right matters.

Benchmark evaluations measure fully-generated versus never-touched text, where separation is nearly perfect and sub-1% FPRs are achievable. Field conditions present a continuum: human-drafted-and-polished, AI-drafted-and-rewritten, translated, co-written, humanised. Detectors emit one scalar. A scalar cannot encode position on that continuum, and the pooled benchmark metric is dominated by the easy extreme — the Notre Dame authors note pooled AUC-PR stays ≈0.96 precisely because full-synthesis rewrites saturate the score scale, which is why they refuse to report it.

The number quoted in procurement is from the easy distribution. The number you will experience is from the hard one. Both are honestly measured. Only one describes your deployment.

08 — The Bayes problem: what a flag actually proves

Every published accuracy number is a likelihood. Every decision anyone makes is a posterior. The gap between them is where the harm lives, and almost no deployed interface closes it.

where π is the base rate of AI-generated text in the population being screened. Base rate dominates. Here is the same detector at four base rates:

Turnitin-class (TPR 0.95, FPR 0.51%):

Pangram vendor-claimed (TPR 0.998, FPR 0.01%):

Notre Dame field conditions (TPR 0.865, flag rate 14.9%):

Same technology. The bottom-right cell says that under field conditions, screening a population where 1 in 100 submissions is AI-generated, a flag is wrong 19 times out of 20. The top-right cell says that under vendor-benchmark conditions it is right 99 times out of 100. The decision-relevant quantity moved by a factor of eighteen and the “accuracy” in the marketing did not move at all.

At institutional scale the absolute counts are what reach a disciplinary committee:

8.1 The same arithmetic for watermarks

A watermark’s FPR is analytically controlled, so you can simply choose it — and at p < 10⁻⁶ the posterior is dominated by the prior only in genuinely extreme regimes. This is watermarking’s real advantage over classification and it is not small.

But the likelihood structure is different, and it is weaker than people assume. A watermark hit does not test “AI-generated.” It tests “tokens chosen by this specific keyed sampler.” The hypothesis actually supported is narrow:

• ✅ Supported: these token choices are consistent with Claude’s keyed sampler.
• ❌ Not supported: a human did not write the underlying ideas. Translation, summarisation and proofreading all produce marked text from human-origin content.
• ❌ Not supported: the content is unedited. Marked text may have been modified, excerpted or combined afterwards.
• ❌ Not supported: no AI was involved when the mark is absent. Unmarked model, short passage, heavy edit, paraphrase, stripped metadata, unsupported surface.
• ❌ Not supported: who generated it. The mark carries no user, organisation or session identity by design.

A reference implementation with the abstention logic that belongs in any production path:

import math
from dataclasses import dataclass
from typing import Literal

Evidence = Literal["watermark", "classifier", "c2pa"]


@dataclass(frozen=True)
class Signal:
    kind: Evidence
    flagged: bool
    tpr: float          # P(flag | AI)
    fpr: float          # P(flag | human)
    scored_tokens: int = 0


def posterior(prior: float, signals: list[Signal]) -> float:
    """Sequential Bayes over provenance signals.

    WARNING: this multiplies likelihood ratios, which assumes conditional
    independence. A watermark and a classifier are close to independent —
    different mechanisms, different nulls. TWO CLASSIFIERS ARE NOT: the
    Notre Dame study measured their agreement collapsing to κ=0.221 under
    evasion, i.e. correlated in exactly the regime where you need them
    independent. Never stack two classifiers here.
    """
    odds = prior / (1.0 - prior)
    for s in signals:
        lr = (s.tpr / s.fpr) if s.flagged else ((1 - s.tpr) / (1 - s.fpr))
        odds *= lr
    return odds / (1.0 + odds)


def adjudicate(
    prior: float,
    signals: list[Signal],
    act_above: float = 0.99,
    clear_below: float = 0.50,
    min_tokens: int = 200,
) -> dict:
    """Three-way output with an explicit abstention band.

    The abstention band is not indecision — it is the honest range where
    the evidence cannot carry a consequential decision. The SynthID text
    detector returns three states for the same reason.
    """
    usable = [s for s in signals
              if s.kind != "watermark" or s.scored_tokens >= min_tokens]
    dropped = len(signals) - len(usable)

    if not usable:
        return {"verdict": "abstain_no_usable_evidence",
                "posterior": prior, "dropped_signals": dropped}

    p = posterior(prior, usable)
    if p >= act_above:
        verdict = "strong_evidence_of_model_involvement"
    elif p <= clear_below:
        verdict = "no_meaningful_evidence"
    else:
        verdict = "abstain_insufficient_evidence"

    return {
        "verdict": verdict,
        "posterior": round(p, 6),
        "prior": prior,
        "dropped_signals": dropped,
        "caveat": (
            "Supports model INVOLVEMENT only. Does not distinguish "
            "authorship from translation, summarisation or editing, and "
            "carries no user identity."
        ),
    }

Two design notes. First, prior is a required argument with no default, deliberately: if the operator cannot state a base rate for the population being screened, they are not in a position to interpret the output, and a default would let them skip the question. Second, the abstention band is the product. The Nature authors built a selective-prediction mechanism for exactly this reason, trading coverage for error rate — abstaining where the scoring function is uncertain in order to hold TPR 95% / FPR 1% on the rest. A detector that always answers is a detector that is wrong in the middle of its range.

09 — Economics: the cost asymmetry that explains every decision

Every deployment choice in this article is legible once you price the four operations.

9.1 Marking is free. This is the whole reason it shipped.

• Compute: +0.57% per-token latency for 30-layer tournament sampling on Gemma 7B-IT / 4× v5e. Gumbel +0.26%, Soft Red List +0.28%.
• Tokens: zero. The mark is which token is chosen, not an added token. Anthropic: “because it produces no extra tokens, the model is the same price to serve and use.”
• Quality: no measurable loss at ~20 million production responses, and the scheme is provably non-distortionary at the configured level.
• Scaling: watermarking cost is constant in model size while the forward pass is not, so relative cost falls by orders of magnitude as models grow.

Put a number on it. At $3/MTok input and $15/MTok output, a 1,500-token response costs ~$0.0225 in output. The watermark adds 0.088 ms/token — 132 ms on that response and $0.00 in token cost. Against an Article 99(4) exposure of €15 million or 3% of worldwide turnover, whichever is higher, this is the cheapest regulatory compliance available to a frontier lab in any domain. For a company at $5B revenue, the 3% ceiling is $150M. The expected-value calculation is not close, and it explains why three labs shipped within months of the deadline and why one of them shipped globally rather than build regional routing.

9.2 Detection is cheap to compute and expensive to offer

Detection needs no forward pass — O(T) hashes, microseconds per passage, a rounding error against generation. The cost is not computational. It is:

• Security: an open oracle is an attacker’s gradient (§6.5).
• Liability: operating the authority that says “this person’s work is machine-written” is a product decision with litigation attached, in a domain where the provider’s own documentation says the signal is not conclusive.
• Spoofing exposure: a public detector that can be made to fire on text the provider did not generate is a reputational attack surface with no clean remedy.

So the market clears at: marking universal, detection rationed. Anthropic’s detection API is private preview for legally-eligible organisations. Google’s portal is early-access for journalists and researchers. Both satisfy the Code’s Commitment 2 while declining to become the world’s authorship authority.

The second-order effect is the one to watch. Detection access is becoming a licensed capability, and the licence is tied to institutional category rather than need. A university adjudicating a student’s degree is in-scope under “educational organisations.” A freelance editor, a hiring manager, a small publisher and the accused student are not. That is a durable asymmetry of epistemic power, created by regulation, and nothing in the current trajectory closes it.

9.3 Attacking is cheap, and amortises

The stealing cost is the one that should alarm anyone building policy on this. Fifty dollars, once. After that the marginal cost of each spoofed or scrubbed passage is approximately zero, with no manual effort. Against an institution spending six figures annually on detection licensing, the attacker’s budget is a rounding error on a single seat.

And the evasion market is not fringe. One humaniser vendor reports 22 million users as of March 2026 and offers a money-back guarantee if output is flagged as non-human — a vendor confident enough in evasion to underwrite it contractually.

9.4 Sizing the stakes, carefully

Detection-market forecasts in this space are unusable and should be named as such. For roughly the same object in roughly the same year, published 2025–26 estimates include ~$636M, ~$700M, ~$823M and $15.7B — a 20× spread driven entirely by scope definition. Do not plan against any of them.

The loss figures are better grounded because they derive from incident records rather than TAM models, though they still measure different things:

• FBI IC3: >22,000 AI-related fraud complaints and $893M in audited AI-fraud losses in 2025.
• Surfshark, from public incident databases: ≥$3.7B cumulative documented deepfake-enabled fraud losses, January 2020 – June 2026, with ~89% of it recorded in 2025 and H1 2026.
• Deloitte projection: US GenAI-enabled fraud losses reaching $40B by 2027, from $12.3B in 2023 at ~32% CAGR.

Note what the audited figure and the projection have in common: they are almost entirely about images, audio and video — voice-cloned executives, synthetic identity documents, fabricated video calls. Text watermarking addresses essentially none of it. The modality with a mandated statistical watermark is not the modality driving the losses, and the modalities driving the losses are protected by C2PA metadata that strips on re-save and a watermark that MarkNull removes at 0.5 s/image.

The regulatory marking regime and the fraud loss distribution are close to orthogonal. That is the central economic observation of this article, and it is why “we comply with Article 50” and “we are protected against synthetic-media fraud” are unrelated statements.

9.5 The build-vs-buy line for platforms

If you deploy a model in your own product, Article 50 may reach you independently as a deployer — Article 50(4) covers deepfakes and AI-generated text published to inform the public on matters of public interest, and the Code’s Section 2 covers the labelling duties. Anthropic states this plainly: “If you deploy Claude in your own product, you should independently assess what Article 50 requires of your products and services.”

The upstream provider marking its output does not discharge your duty. You may still owe a visible disclosure, a deepfake label, an editorial process, or your own provenance record. Budget accordingly: the provider’s watermark is an input to your compliance, not a substitute for it.

10 — Engineering: what to build if you ship text

Ordered by leverage-per-effort. These are weeks for one engineer on an existing platform.

Step 1 — Record provenance at generation (do first, ~2 days)

The highest-value artefact in this entire domain is not a detector. It is a log written at the moment of generation, by the party who knows the answer with certainty. Detection is an attempt to recover, probabilistically and after the fact, information that was free at creation time.

import hashlib
import json
from dataclasses import dataclass, asdict, field
from datetime import datetime, timezone


def sha256_text(s: str) -> str:
    return hashlib.sha256(s.encode("utf-8")).hexdigest()


@dataclass
class ProvenanceRecord:
    """Written at generation. Immutable. The ground truth no detector has."""
    record_id: str
    created_at: str
    provider: str                  # "anthropic" | "google" | "openai" | ...
    model_id: str                  # EXACT version: marking is per-model
    surface: str                   # api | app | code | cowork | bedrock | ...
    operation: str                 # generate | translate | summarize |
                                   # proofread | convert
    human_input_hash: str | None   # hash of user-supplied source text
    output_hash: str               # hash of the raw model output
    output_tokens: int
    marking_expected: bool         # from the provider's support matrix
    decode_params: dict = field(default_factory=dict)
    downstream_hashes: list[str] = field(default_factory=list)

    def to_json(self) -> str:
        return json.dumps(asdict(self), sort_keys=True)


def record(model_id: str, output: str, *, surface: str, operation: str,
           source: str | None, marking_matrix: dict[str, bool],
           **decode) -> ProvenanceRecord:
    out_hash = sha256_text(output)
    return ProvenanceRecord(
        record_id=sha256_text(out_hash + model_id)[:32],
        created_at=datetime.now(timezone.utc).isoformat(),
        provider=model_id.split("-")[0],
        model_id=model_id,
        surface=surface,
        operation=operation,
        human_input_hash=sha256_text(source) if source else None,
        output_hash=out_hash,
        output_tokens=len(output.split()),   # replace with real tokenizer
        # Marking is a VERSIONED capability. Never hardcode per provider.
        marking_expected=marking_matrix.get(model_id, False),
        decode_params=decode,
    )

Three fields earn their place and are routinely omitted:

• operation distinguishes generate from proofread and translate. The watermark cannot make that distinction — it is the single most important thing a downstream reader needs, and you have it for free.
• human_input_hash establishes that human source text existed and what it was. This is the only artefact that defends a user against a false attribution.
• marking_expected keyed on exact model ID. Mythos 5 and Mythos 5.1 differ. Sonnet 4.6 and Sonnet 5 differ.

Step 2 — Preserve C2PA through your pipeline (~1 week)

C2PA Content Credentials are signed metadata, and metadata is destroyed by ordinary handling: format conversion, re-saving, resizing, screenshots, most social upload paths. OpenAI’s own framing is that metadata “can be stripped, lost through uploads and downloads, or broken by transformations” — which is why they pair it with a pixel watermark.

Audit every stage of your media pipeline for credential survival. Thumbnail generation, CDN transcoding and image optimisers are the usual offenders. The Code also requires signatories to add terms prohibiting users from intentionally stripping metadata, so if you are a signatory this is a contractual obligation and not only an engineering one.

Note the division of labour for Claude specifically: C2PA attaches where Claude creates a file — Claude apps and Claude Platform including AWS and Microsoft Foundry — while the text watermark rides on the model everywhere. These have different coverage. Do not conflate them.

Step 3 — Never present a detector score as a verdict (~3 days)

If you surface detection to users, the Section 08 machinery is the minimum bar:

• Require an explicit base rate for the screened population.
• Return three states, with an abstention band.
• Enforce the length floor; report short passages as unmeasured, not clean.
• Pair every flag with process evidence — drafting history, your own provenance records — exactly as the Notre Dame authors recommend: detector output is weak evidence, never standalone misconduct evidence.
• Do not stack two classifiers for corroboration (κ = 0.221 under evasion).
• Expect domain skew. If you screen mixed disciplines, a single threshold imposes a 5× flag-rate differential between STEM and humanities prose.

Step 4 — Budget detectability for your own output mix (~1 week)

Run §4.3’s instrumentation across your traffic. You will find prose and translation clear comfortably while code, structured output and light edits never do. Know which of your output classes are effectively unmarked before a regulator or a customer asks, and say so in your documentation rather than implying uniform coverage.

Step 5 — Treat marking as a versioned capability in your abstractions (~2 days)

Model-routing layers break this constantly. If a request can be served by two models with different marking support, your product’s compliance posture varies by routing decision. Surface marking support in the model registry alongside context window and price, and let routing policy read it.

What not to build

• Do not build a watermark detector for another provider’s key. You do not have the key. Everything claiming to “detect the Claude watermark” without the key is a classifier wearing a costume.
• Do not treat absence of a mark as evidence of human authorship. It is the single most common error, and every provider’s documentation warns against it explicitly.
• Do not build removal tooling into your product “for user privacy.” The Code requires signatories to prohibit intentional metadata stripping, and in the EU you are engineering against a transparency obligation your upstream provider is contractually bound to.

11 — Open problems and the 2027+ direction

Public verifiability. Every deployed scheme is symmetric-key: detection requires the secret, so the provider is both marker and sole arbiter. Publicly-verifiable watermarking via cryptographic signatures and rejection sampling (Fairoze et al., 2025) is the research direction that would dissolve §9.2’s trilemma — anyone could verify, no one could forge, and the provider would stop being an authority. The cost is detectability during low-entropy stretches, which error-correction partially addresses. This is the single most consequential open problem in the field.

Cross-provider interoperability. Today each key is a silo. Claude’s detector sees Claude. SynthID sees SynthID. There is no “was this AI-generated” query, only n separate “was this generated by provider i” queries, each gated separately. The Code demands interoperability; nothing in deployment delivers it for text.

The open-weight hole does not close. No technical mechanism compels a self-hoster to run a keyed sampler. Every marking regime covers hosted APIs. As open-weight quality converges on frontier quality, the fraction of synthetic text that is markable in principle falls. The regime’s coverage is a function of market structure, not technology.

Entropy is falling. Models get more confident; RLHF reduces entropy; agentic pipelines favour low-temperature determinism; structured output is growing as a share of generation. Every one of these trends reduces Δ and raises T*. The watermark gets weaker as the ecosystem matures, and nothing in the current design arrests that.

Assistance versus authorship remains unmeasured. The whole stack emits one scalar for a question that is not scalar. “Claude wrote this” and “Claude translated this” and “Claude fixed the commas” produce the same kind of evidence in different quantities, and no deployed system distinguishes them. The Notre Dame catch-22 is a direct consequence, and it will not be solved by better detectors — only by provenance recorded at generation (§10, Step 1).

Adversarial research is accelerating faster than defensive. $50 stealing, 0.5 s/image removal, 22-million-user humanisers with refund guarantees. The defender ships on regulatory timelines; the attacker ships continuously.

The likely 2027 shape: marking becomes undifferentiated infrastructure, present everywhere and argued about nowhere; detection stays licensed and stratified; and the decision-relevant signal migrates from post-hoc detection to provenance recorded at creation — C2PA-style credentials, signed generation logs, and editor-side process evidence. The detectors will still exist. They will just stop being the thing anyone sensible relies on.

References

Watermarking schemes

1. Dathathri, S., See, A., Ghaisas, S., Huang, P.-S., McAdam, R., et al. (2024). Scalable watermarking for identifying large language model outputs. Nature 634, 818–823. doi:10.1038/s41586-024-08025-4. [SynthID-Text; tournament sampling; ~20M-response live Gemini experiment]
2. Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., Goldstein, T. (2023). A Watermark for Large Language Models. ICML 2023, PMLR 202:17061–17084. arXiv:2301.10226. [Soft Red List; z-statistic; spike entropy]
3. Aaronson, S. & Kirchner, H. (2022). Watermarking of large language models. [Gumbel/exponential scheme; the origin of the family]
4. Kuditipudi, R., Thickstun, J., Hashimoto, T., Liang, P. (2024). Robust distortion-free watermarks for language models. TMLR.
5. Christ, M., Gunn, S., Zamir, O. (2024). Undetectable watermarks for language models. COLT 2024, PMLR 1125–1139.
6. Hu, Z., et al. (2024). Unbiased watermark for large language models. ICLR 2024. [Repeated context masking]
7. Piet, J., Sitawarin, C., Fang, V., Mu, N., Wagner, D. (2023). Mark My Words: Analyzing and Evaluating Language Model Watermarks. arXiv:2312.00273.
8. Gowal, S., Bunel, R., Stimberg, F., Stutz, D., et al. (2025). SynthID-Image: Image watermarking at internet scale. arXiv:2510.09263.
9. Google DeepMind (2024). synthid-text reference implementation. github.com/google-deepmind/synthid-text

Attacks and limits

10. Zhang, H., Edelman, B. L., Francati, D., Venturi, D., Ateniese, G., Barak, B. (2024). Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models. ICML 2024, PMLR 235:58851–58880. arXiv:2311.04378.
11. Sandcastles in the Storm: Revisiting the (Im)possibility of Strong Watermarking. (2025). arXiv:2505.06827. [Automated walks succeed 26%; 10% under human quality review]
12. Jovanović, N., Staab, R., Vechev, M. (2024). Watermark Stealing in Large Language Models. ICML 2024, PMLR 235:22570–22593. arXiv:2402.19361. [<$50; >80% spoof; scrubbing 1%→>80%]
13. Cao, J., Li, Q., Zhang, Z., Wu, X., Liu, L., Li, X., Ni, J. (2026). MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation. USENIX Security 2026. arXiv:2608.10166.
14. Krishna, K., Song, Y., Karpinska, M., Wieting, J. F., Iyyer, M. (2023). Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense. NeurIPS 2023.
15. B⁴: A Black-Box Scrubbing Attack on LLM Watermarks. (2024). arXiv:2411.01222.
16. Discovering Spoofing Attempts on Language Model Watermarks. (2024). arXiv:2410.02693.

Post-hoc detection

17. Mitchell, E., Lee, Y., Khazatsky, A., Manning, C. D., Finn, C. (2023). DetectGPT: Zero-shot machine-generated text detection using probability curvature. ICML 2023.
18. Hans, A., et al. (2024). Spotting LLMs with Binoculars: Zero-shot detection of machine-generated text. ICML 2024, PMLR 17519–17537.
19. Verma, V., Fleisig, E., Tomlin, N., Klein, D. (2024). Ghostbuster: Detecting text ghostwritten by large language models. NAACL 2024.
20. Karr, J. A. Jr., Khvatskii, G., Hua, T., Chawla, N. V. (2026). Why AI Detection Fails for Academic Integrity. AILS ‘26. arXiv:2608.11256. [The catch-22; domain skew; >96% post-humanisation FNR]
21. Liang, W., Yuksekgonul, M., Mao, Y., Wu, E., Zou, J. (2023). GPT detectors are biased against non-native English writers. Patterns 4, 100779.
22. Emi, B. & Spero, M. (2024). Technical report on the Pangram AI-generated text classifier. arXiv:2402.14873.
23. Elkhatat, A. M., Elsaid, K., Almeer, S. (2023). Evaluating the efficacy of AI content detection tools. Int. J. Educ. Integrity 19, 17.

Provider documentation (primary)

24. Anthropic (2026). How Claude’s text watermark works. anthropic.com/news/claude-text-watermark (14 Aug 2026; updated 1 Sep 2026).
25. Anthropic (2026). How Claude marks AI-generated content. support.claude.com/en/articles/16266773 [Per-model support matrix; limitations; detection access]
26. OpenAI (2026). Advancing content provenance for a safer, more transparent AI ecosystem. openai.com/index/advancing-content-provenance/ (19 May 2026; updated 31 Jul 2026).
27. Google DeepMind. Watermarking AI-generated text and video with SynthID.

Regulation

28. Regulation (EU) 2024/1689 (AI Act), Article 50 (transparency) and Article 99 (penalties).
29. European Commission (2026). Code of Practice on Transparency of AI-Generated Content. Published 10 June 2026; guidelines 20 July 2026; applicable 2 August 2026. [Multi-layer marking; 200-token threshold; detection commitment]
30. European Commission (2026). Strong backing for the Code of Practice on Transparency of AI-generated Content. 31 July 2026. [~190 signatories]
31. Cyberspace Administration of China, MIIT, MPS, NRTA (2025). Measures for Labelling of AI-Generated Synthetic Content (人工智能生成合成内容标识办法), with mandatory national standard GB 45438-2025. Effective 1 September 2025.
32. C2PA Technical Specification, Coalition for Content Provenance and Authenticity. c2pa.org

@article{fp4-2610001,
  title   = {Provenance at the Token Level: How Claude, Gemini and GPT
             Mark Generated Text},
  author  = {fp4 editorial desk},
  year    = {2026},
  url     = {https://fp4.dev/algorithm/text-watermarking-provenance/},
  journal = {fp4}
}

Figures referenced in the published version: Fig. 1 generative watermarking pipeline; Fig. 2 required tokens vs. per-token lift at three FPR targets; Fig. 3 tournament sampling bracket; Fig. 4 entropy ceiling by output class; Fig. 5 provider capability matrix; Fig. 6 attacker cost table; Fig. 7 posterior vs. base rate for three detector regimes; Fig. 8 provenance-at-generation architecture.

@article{fp4-2610001,
  title   = {Provenance at the Token Level: How Claude, Gemini and GPT Mark Generated Text},
  author  = {fp4 editorial desk},
  year    = {2026},
  url     = {https://fp4.dev/algorithm/provenance-at-the-token-level-how-claude-gemini-and-gpt-mark-generated-text/},
  journal = {fp4}
}