Skip to main content
AI Watermark Removal

Detector

AI Text Watermark Detector

There's no public detector for Claude's text watermark, and Google's detector is runnable code whose applicability to your text is disputed by Google's own sources. The tools most people actually reach for aren't checking for a watermark at all, and they say so themselves.

Published 2026-08-11Updated 2026-08-11Research/proposal

Key takeaways

  • Claude has a confirmed text watermark, live since August 2, 2026, but no public detector. Anthropic's own support article still calls technical detection documentation forthcoming.
  • Gemini's detection method, SynthID Text, is thoroughly documented and open-sourced, but a Google-affiliated forum reply says it doesn't apply to Gemini API text at all, only, per Google's marketing page, to the app and web experience.
  • The underlying statistics are real and well studied. The original green-list/red-list scheme uses a one-proportion z-test on token frequency, and a 2024 follow-up found the signal survived heavy human paraphrasing once a detector had roughly 800 tokens, at odds low enough (1 in 100,000) to trust.
  • Even a real watermark detector can be attacked. Researchers approximated a provider's secret key from public queries for under $50 in 2024, then used it to forge the signal onto text the provider never wrote, or erase it from text it did.
  • Generic AI detectors are a fundamentally weaker tool. GPTZero, Originality.ai, and ZeroGPT all confirm, in their own published materials, that they score writing style rather than any provider's watermark.

Detection model

Watermark checker vs AI detector

Watermark checker

Looks for an intentional provider signal such as Claude text marks, SynthID Text, C2PA, or another known provenance layer.

Generic AI detector

Estimates whether text looks model-generated using style, probability, or classifier signals.

Why this distinction matters

A watermark-checker verdict is stronger evidence, because it's checking for a specific, intentionally embedded signal. A generic detector score is a probabilistic style guess that can misfire on short text, heavy editing, translation, or simply unusual human writing. Treat the two as different categories of evidence, not interchangeable confidence scores.

What a real watermark detector checks

Confirmed

You'll learn what separates a watermark test from a vibes-based AI score, in about a paragraph of statistics.

A genuine text watermark detector isn't scanning for a mark. It's running a statistical test on the sequence of words a model chose, asking whether that sequence matches a pattern only someone holding the right key could have produced.

The foundational version is Kirchenbauer and colleagues' 2023 green-list/red-list scheme. It splits the vocabulary into two pseudorandom groups before every token, reseeded from whatever came before, then nudges sampling toward the green group.

Detection is a one-proportion z-test: count how often green tokens actually got picked, then check whether that rate could plausibly have happened by chance. The output is an interpretable p-value, not a vague AI-like score.

SynthID Text builds on the same basic idea with something more elaborate, tournament sampling, where candidate tokens compete across sampling rounds before one is picked. Google describes two scoring approaches its own reference detector can use, a mean score and a Bayesian score.

Google also documents three ways a detector could be deployed:

  • Fully private, where only the provider can check anything
  • A semi-private API with limited third-party access
  • Fully public

Its documentation doesn't say which of the three, if any, Google actually runs for Gemini in production.

Claude: the watermark shipped, the detector didn't

Confirmed

Here's exactly what Anthropic has committed to, and what nine days of waiting produced.

Anthropic's support article states that compatible Claude models have woven an imperceptible watermark into generated text since August 2, 2026, worldwide. That covers the API, Claude, Claude Code, Claude Cowork, Claude Tag, and Claude models accessed through AWS, Google Cloud, or Microsoft Foundry.

The same article says Anthropic is working to let users and third parties detect that mark and will publish technical documentation later. As of August 11, 2026, nine days after rollout, that documentation hadn't appeared and no public Claude detector existed.

What Anthropic has confirmed is narrower than a working tool. A detected mark would only indicate content may have been processed by Claude, not proof that it was.

Anthropic also lists the conditions where marks may not be recoverable at all:

  • Models released before the rollout
  • Heavily edited or translated text
  • Very short passages
  • Files whose metadata was stripped by re-saving, format conversion, or a screenshot

Gemini: the method is public, its scope isn't

Community discussion

You'll see why running Google's own detector and getting a clean result may tell you nothing at all.

Google's documentation of SynthID Text is, if anything, more technically detailed than Anthropic's. The method is open-sourced, with a production-grade reference implementation shipping in Hugging Face Transformers since version 4.46, including a Bayesian detector that reports watermarked, not watermarked, or uncertain.

That's real, usable software anyone can run today. What's contested is whether it's checking anything when pointed at ordinary Gemini API output.

Google DeepMind's own SynthID page says the Gemini app and web experience carry the watermark. A Google-affiliated account on the Google AI Developer Forum, replying on August 5, 2026 to a question about EU AI Act Article 50(2) compliance for two named Gemini models, wrote that API text is "NOT SynthID-watermarked" and that native text watermarking "is not planned at the moment."

Nothing published reconciles the two. So a clean result on Gemini API output could mean the text was never watermarked in the first place, not that detection failed.

Google's own hosted checker doesn't settle it either. The SynthID Detector portal launched at I/O on May 20, 2025 with only image detection live and text detection promised in the coming weeks.

Access has stayed waitlist-gated for journalists, media, and researchers, with no public API. An independent check in November 2025 found it still waitlist-only.

Even a legitimate detector can be wrong

Research/proposal

Here's how much text a detector really needs, how it gets attacked, and one case where it failed with no attacker involved.

The statistics behind these detectors are well studied, and so are the ways around them. A 2024 follow-up to the original green-list/red-list scheme found the signal stayed detectable after strong human paraphrasing once a detector had around 800 tokens to analyze, at a false-positive rate of roughly 1 in 100,000.

Shorter passages carry a much weaker signal. That's part of why Google separately notes watermarking is less effective on short, factual responses: there's less room to nudge word choice without hurting accuracy.

The more unsettling finding is that a secret key isn't necessarily safe just because it's secret. ETH Zurich researchers showed in 2024 that a provider's green-list/red-list rule can be approximated from public API queries for under $50.

They then used that approximation two ways: forging a convincing watermark onto text the provider never generated, with over 80% spoofing success in their tests, and scrubbing a genuine watermark out, pushing removal success from near 0% to over 85% in settings assumed safe beforehand.

A 2025 follow-up from the same lab found a statistical way to catch that specific kind of forged text. So this is an active arms race, not a settled failure, and both a clean result and a confirmed match deserve some skepticism.

Generic AI detectors aren't playing this game

Confirmed

You'll see, in the vendors' own words, that the popular detectors score style and nothing else.

Most of the detectors people actually reach for don't check any of the above:

  • GPTZero describes its own tool as scoring seven components covering perplexity and burstiness, how predictable and varied the writing is, plus other style signals, with no mention of SynthID, C2PA, or any provider watermark.
  • Originality.ai describes its detector as "a modified version of the BERT model," a statistical classifier.
  • ZeroGPT calls its method "DeepAnalyse."

All three are confirmed, from their own published descriptions, to be inferring style rather than verifying an embedded signal.

That's a meaningfully weaker kind of evidence. A style-based score can be wrong in either direction for reasons that have nothing to do with who wrote the text, and OpenAI has pointed to exactly this as a reason these tools disproportionately misjudge non-native English writers.

A real watermark detector, even an imperfect one, is at least checking for something a provider deliberately put there. A style detector is checking for a vibe.

FAQ

Is an AI detector a watermark detector?

A true watermark detector checks an intentional signal a provider built in at generation time. Generic AI detectors, including GPTZero, Originality.ai, and ZeroGPT, infer style instead and are less authoritative, by their own published descriptions of their own methods.

Will a Claude watermark detector ever become public?

Anthropic says it's working toward letting users and third parties detect marks and will share technical documentation later, but hasn't set a date. None had appeared as of August 11, 2026, nine days after the rollout.

Can I run Google's SynthID Text detector myself?

The underlying method is open-sourced with a reference implementation in Hugging Face Transformers, so technically yes, for text you know came from a SynthID Text-marked source. But a clean result on ordinary Gemini API output doesn't necessarily mean detection failed. Per a Google-affiliated forum reply, that surface may never have been watermarked to begin with.

Can a watermark detector be tricked into confirming a fake match?

ETH Zurich SRI Lab researchers have shown it under lab conditions: approximating a provider's secret watermarking rule from public queries, then using it to forge a convincing match onto text that model never generated. It's an active area of both attack and defense research, not something documented as happening outside a lab.

Next steps

Sources and citation status