Statistical Text Watermarking

Standard decoding already narrows the field before any watermark gets involved. Top-K or Top-P sampling trims a model's full vocabulary down to a shortlist of tokens it considers plausible for whatever comes next.

A statistical watermark works inside that shortlist. It nudges which token from the narrowed pool actually gets picked, following a pattern tied to a secret or pseudorandom key.

Nothing visible changes. No label, no punctuation trick, no hidden character on the page.

This page covers what happens after generation: how a detector who knows the key finds the pattern, and what happens when someone without the key goes looking anyway.

Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein's 2023 paper describes the clearest version. Before each token, the model's vocabulary splits into a green sublist and a red sublist, reseeded from the tokens that came before (or from a fixed key in later variants), and sampling leans softly toward green.

A watermarked passage ends up with more green tokens than chance alone would produce. The detector doesn't hunt for a single marker.

It counts green-token frequency across the whole passage and runs a one-proportion z-test against what pure chance predicts. That produces an interpretable p-value, and it doesn't require access to the model at detection time.

A 2024 follow-up from largely the same group stress-tested this against human rewriting, LLM paraphrasing, and dilution in longer mixed documents. The watermark stayed statistically detectable after strong human paraphrasing once a detector had roughly 800 tokens to work with, at a false-positive rate of one in 100,000.

Christ, Gunn, and Zamir gave this whole approach a rigorous foundation at COLT 2024. They defined watermarking in cryptographic terms and constructed a scheme where, absent the secret key, watermarked text and ordinary text are computationally indistinguishable under standard cryptographic assumptions.

That's a proof, not marketing language. Nobody without the key is supposed to tell the difference, no matter how much text they see.

In 2024, the same year, Jovanović, Staab, and Vechev at ETH Zurich's SRI Lab tested what that guarantee is worth once a real system sits behind a public API. Querying the API for under $50 in total cost was enough to approximate the provider's secret green-list rule.

With that approximation in hand, they ran two attacks:

• Spoofing: forging the watermark onto text the model never wrote, succeeding more than 80% of the time.
• Scrubbing: stripping it from text the model did write, pushing success from near 0% to over 85% in settings people had assumed were safe.

The cryptography wasn't wrong. Christ, Gunn, and Zamir's proof holds for a key that never leaks any signal, and Jovanović and colleagues showed that cheap, repeated queries against a real deployment leak enough about the key's behavior to defeat that assumption in practice.

A 2025 follow-up from the same lab now runs statistical tests that detect the presence and identify the family of the three most popular watermarking schemes from black-box queries alone, no logits access required. That's the prerequisite skill both stealing and spoofing depend on.

Google's SynthID Text is the most developed real-world version of this family of techniques. It's applied as a generation-time logits processor after Top-K and Top-P sampling narrow the candidate pool, and the Nature paper behind it describes a tournament-sampling design.

Google documents it as robust to mild paraphrasing while acknowledging that thorough rewriting or translation can greatly reduce detector confidence, and has open sourced SynthID Text for developers. That deployment and robustness claim is documented specifically for the Gemini app and web experience.

Whether the Gemini API applies the same watermarking is disputed. A Google-affiliated developer-forum reply dated August 5, 2026 states plainly that generated text from the API is not SynthID-watermarked and that native text watermarking isn't currently planned, which directly conflicts with Google DeepMind's own SynthID page. No primary source reconciles the two, so treat API behavior as unconfirmed.

There's a related gap worth noticing. Google's own Gemini Apps help page for verifying AI-generated content covers images, video, and audio, and not text.

Google's documentation also describes three possible ways a text detector could be deployed, fully private, semi-private API, or public, without saying which one Google itself runs. That's why there's still no button you can press to check a passage of Gemini text.

When Anthropic announced that Claude now embeds invisible watermarks in its text output, the r/singularity thread reacting to it spent most of its energy guessing at a mechanism. People know invisible watermarks in images. Text isn't pixels.

Commenters floated:

• Hidden Unicode or invisible characters
• Overrepresented n-grams
• First-letter or sentence-position patterns
• Token-probability nudges
• Something SynthID-like, or several signals stacked together

None of it is confirmed. Anthropic's own announcement doesn't name a mechanism, so every theory above, even the ones that resemble SynthID's actual documented approach, is inference by analogy rather than a disclosed method.

The thread also raised a concern worth stating honestly: that statistical watermarking could be weak on short passages, brittle under paraphrasing, and specifically awkward in code, where nudging token choices risks bugs or stylistic weirdness.

That's a genuinely open question this site's research hasn't resolved, for Claude or for the field generally. Some commenters also imagined an arms race of de-watermarking tools, false-watermarking attacks, and model-to-model laundering.