Is it no longer possible to hide AI content?
How text watermarking works, what it survives, and why a detected mark is a probability - never a verdict.
Google “Claude watermark remover” and you get pages of services, all kindly offering to humanize AI-generated content. The landing pages claim their tools remove invisible marks from your text. One of them defines the mark as a hidden pattern that OpenAI embeds into ChatGPT - on a page selling removal of Claude’s watermark.
Invisible characters do show up in model output sometimes. But they can be cleaned with find-and-replace, and they have nothing to do with watermarks. The service removes a formatting artifact and calls it watermark removal.
What caught my attention was something else. Do hidden patterns for identifying the origin of a text exist at all, and how reliably can this be measured? Especially since the method Anthropic published on August 14 was making rounds on social media. So I decided to do my own research.
How text watermarking works
The described mechanism answers the question: what is the probability that a text was generated or edited by Claude models. It cannot state with 100% certainty whether a text was generated or not.
A bit of dry theory. LLMs create content by picking the next word in a sentence. The pick is made pseudo-randomly among plausible candidates the model has selected itself. Watermarking swaps out the source of this pseudo-randomness. The initial value (the seed) can, in this context, be called a key.
The preceding context and the key together determine not the word itself, but which of the candidate words draws the short straw. The model provides the list; the key merely skews the pick inside it, at each round of generation. That is why the meaning doesn’t change - every candidate in the list was already a good fit.
Knowing the key, you can measure how well a sequence of words agrees with the skew that key produces. And you don’t need to re-run the model to measure - the text and the key are enough. That is how you get a probability estimate that a text was generated by this model. According to the DeepMind A/B tests Anthropic cites, watermarking does not affect text quality.
The mark survives:
- copy and paste
- reformatting
- conversion to plain text
The mark breaks under:
- substantial paraphrasing
- rewriting
- translation
The mark is weak from the start in:
- short passages, where the model had few free choices
- factual text, which leaves the model one option for a precise answer
- code, which has to be exact to run
The logic behind the first two lists is the same. The recalculation runs over the preceding words. Editing the formatting doesn’t touch the words, so the mark survives. Rearranging the words changes the context of the recalculation, and the mark falls apart.
What follows from this
A detected mark does not prove that Claude wrote the text. Proofreading, translating, or summarizing someone else’s text leaves exactly the same mark. The mechanism cannot tell a generated draft from an edited paragraph, and it says nothing about what share of the text is machine-written.
An absent mark proves nothing at all. It could be a human, a model without watermarking, or another vendor with its own key.
Detection does not work across vendors, even with an identical mechanism. You need the specific vendor’s key. This follows directly from the SynthID Text method. Google DeepMind has released its implementation and a detector. Anthropic’s detector is not published yet; a public API has been promised.
Why wouldn’t a vendor simply publish the key? Detection would become available to everyone, no API required.
The thing is, with the key you can not only verify a mark but forge one. For instance, plant a Claude mark on someone else’s text and get a false positive. So trust in the detector lasts exactly as long as the key stays uncompromised.
What this means for self-hosted
There is a practical takeaway here for self-hosted model infrastructure. The EU AI Act covers not only companies registered in the EU, but everyone operating on its market. It applies to those who deploy AI systems on the EU market and to those whose product serves EU users. Personal non-professional use is exempt (Article 2). But once a company deploys a model to power its product in the EU, it falls under the EU AI Act.
And here open-weight models differ from an API. The vendor is not present on your servers at generation time, so nobody will place the mark for you. The mark, and the obligation to place it, sit with the owner of the service. How this works legally and what to do about it is a topic for a separate article.
Conclusion
Hidden patterns exist, and Anthropic has described in detail how they are placed and what they do to the output. But a 100% way to tell whether a text was generated is not among them, and never will be - that is a property of the method. What you can do is measure the probability that a specific vendor’s model had a hand in the text, given that vendor’s key and a long enough passage.
The mark says nothing about authorship, and its absence means nothing. It is tied to one vendor and does not survive translation.
The service I started with sells cleaning your text of something that isn’t in the text. The exact same mistake works in reverse: treating a positive detection as proof. The primary source states the limitations of the method plainly. And to see them, it’s enough to understand how the method works.