What Is LLM Watermarking? How AI Text Watermarks Work, Methods and Who Uses Them

How can you tell whether a piece of text was written by AI? Research has shown that AI detection tools, which guess from the characteristics of the writing, can be easily evaded just by paraphrasing. That is why LLM watermarking, which places an invisible mark in text at the moment the AI generates it, is drawing attention. After Google began using it in Gemini in 2024, Anthropic and OpenAI also started watermarking their own AI's text in 2026, and regulation has begun to require it as well. Based on research papers and official information, this guide covers how LLM watermarking works, the main methods, its limitations and what each company is doing, as of October 9, 2026.

What LLM watermarking is

LLM watermarking is a technology that embeds a statistical mark, imperceptible to people, in text generated by an LLM (large language model). Rather than adding symbols or invisible characters to the text, it leaves its mark by slightly biasing how the AI chooses the next word.

When an LLM writes, it repeatedly assigns probabilities to candidates for the next word (strictly speaking, the next token) and picks one of them. LLM watermarking adds a rule based on a secret key to this choice. Someone who knows the key can look at the text and statistically confirm that "there are too many words following the rule to be a coincidence."

How it differs from AI detectors and C2PA

Besides LLM watermarking, there are other ways to identify AI text, such as the following.

AI detection tools: estimate afterwards how AI-like a text is from its characteristics. They work even without a mark, but they are only estimates. In one study, simply paraphrasing the text with another AI lowered the detection rate of one such tool (DetectGPT) from 70.3% to 4.6%
C2PA (Content Credentials): attaches signed provenance information to a file. It suits image and document files, but cannot be attached to ordinary text that gets copied and pasted

Anthropic also uses both for Claude's output: a watermark for text and C2PA for the files it generates. C2PA is covered in "What is C2PA?".

Main methods

There are several families of LLM watermarking. Here are the most representative.

The green-list method

A leading method published in 2023 by researchers at the University of Maryland (Kirchenbauer et al., ICML 2023).

Using the preceding word and a key, the vocabulary is re-split each time into a "green list" and a "red list"
A small bonus is added to the scores of green-list words so they become slightly more likely to be chosen
For detection, the number of green-list words is counted and a statistical test checks whether there are more than chance can explain

The paper showed a detection rate of roughly 98% or more on 200-token texts. The mechanism is easy to understand, and it is also implemented in Hugging Face Transformers. On the other hand, because it biases word choice, it may slightly affect the quality of the text.

Distortion-free methods

To eliminate the impact on text quality, methods that add a watermark without changing the probabilities the AI would originally choose from are also being studied.

Aaronson's method: introduced in 2022 by computer scientist Scott Aaronson, who was doing research at OpenAI at the time. Word choice is determined by random numbers generated from a key, and he said a few hundred tokens are enough to get a sufficient signal
Robust methods: researchers at Stanford University presented a method that can still detect the watermark even when 40 to 50% of the words are randomly rewritten (Kuditipudi et al., 2023)
Undetectable watermarks: one study showed theoretically that, without the key, it is computationally hard to distinguish watermarked text from the original AI's text (Christ et al., 2023)

Google's SynthID Text and OpenAI's textGrain are also based on this "preserve quality" approach.

Other methods

Other proposals include methods that embed the watermark at the level of sentence meaning rather than individual words to make it robust to paraphrasing (such as SemStamp), methods that embed information such as a user ID, and methods that publish the key so anyone can verify the watermark.

How detection works

Detecting LLM watermarks has the following characteristics.

A key is required: with most methods, the watermark cannot be detected without the secret key used to add it. As a result, detection is basically possible only for the company that added the watermark or people it has shared the key with.
Results are probabilistic: detection results are probabilistic judgments such as "likely watermarked," "not watermarked" or "uncertain."
A certain length is needed: short texts do not allow a statistical judgment. Research often evaluates texts of around 200 tokens, and for OpenAI's textGrain, with false positives held to 1%, detection rates of about 80% at 200 tokens and about 95% at 400 tokens have been reported for text in fields such as psychology.
Hard to embed in text with fixed answers: when the next word is almost uniquely determined, as in program code, boilerplate or factual answers, there is little room to bias word choice, so the watermark becomes weaker.

Weaknesses and attacks

LLM watermarking has weaknesses that are known from research.

Paraphrasing: paraphrasing with another AI greatly weakens the watermark. OpenAI has published that replacing 25% of words with synonyms lowers textGrain's detection rate to 17%.
Translation: it has been shown that having the AI generate text in another language first and then translating it removes the watermark.
Emoji attack: another known trick is to instruct the AI to insert an emoji between every word and then delete the emojis afterwards, breaking the watermark.
Spoofing: attacks that infer the watermark's rules and forge the watermark on human-written text are also being studied. In one study, the watermark's rules were inferred through queries to an API, and both forgery and removal achieved success rates above 80% at a cost of under 50 dollars.
Open models: with models anyone can run, the watermarking step can simply be removed.

What each company is doing

Following Google, Anthropic and OpenAI also started watermarking their own AI's text in 2026.

OpenAI: in 2024, it took a cautious stance on introducing text watermarks, citing how easily they can be evaded through translation and similar means, and the risk that non-native English speakers' use of AI could be unfairly suspected. On October 5, 2026, it changed course and announced its own watermark, textGrain. It is being introduced in ChatGPT and Codex in the EU and is available optionally worldwide in the API. For details, see "What is textGrain?".
Google: developed SynthID Text and announced in 2024 that it was using it in Gemini. It has been released as open source. For details, see "What is SynthID Text?".
Anthropic: watermarks text generated by Claude. Models released on or after August 2, 2026 support it from launch, and earlier models are also watermarked on Anthropic's own services. The method is based on SynthID Text, and because there is no reliable way to apply it separately by region, it is applied worldwide.
Meta: has released TextSeal, a research tool for text watermarking, as open source.

The detectors from OpenAI and Anthropic are both provided only to vetted researchers, regulators and similar parties, and are not freely available to the general public.

Regulation

A major reason LLM watermarking has spread is regulation.

EU: Article 50 of the AI Act requires providers of AI that generates content, including text, to mark their output in a machine-readable format so that it can be detected as AI-generated. This provision has applied since August 2, 2026. However, under the 2026 amendment to the AI Act (the Digital Omnibus), only AI systems placed on the market before that date get a grace period until December 2, 2026 for the machine-readable marking obligation. OpenAI, Google, Anthropic, Meta, Microsoft, Mistral and others have signed the code of practice setting out concrete methods.
China: rules requiring labels on AI-generated content have been in force since September 1, 2025. They require visible labels on text and invisible labels in file metadata. Adding digital watermarks is only recommended.
Japan: the AI Guidelines for Business issued by Japan's Ministry of Internal Affairs and Communications (MIC) and Ministry of Economy, Trade and Industry (METI) ask organizations developing advanced AI to introduce mechanisms, such as digital watermarks where technically feasible, that make AI-generated content identifiable (they are not legally binding).

Points to note by role

Users and educators

Because text watermark detectors are available only to a limited number of organizations, ordinary people have almost no way to check the text they have. In addition, not finding a watermark does not prove that a person wrote the text. AI detection tool results are also only estimates, so they should not be used as grounds for concluding that a student's or applicant's writing was produced by AI.

Developers

If you are building your own service on an open model, you can add watermarks with tools such as the following.

Hugging Face Transformers: supports both the green-list method and SynthID Text, and can be used just by passing a configuration when generating text
vLLM: version 0.30.0, released in September 2026, includes a watermarking feature (the Gumbel-max method) as standard. The method and key are set when starting the server. However, generation with the temperature set to 0 and beam search are not watermarked
MarkLLM: a research toolkit for trying out many methods in one place

If the key leaks, the watermark can be forged, so the key must be managed carefully.

Summary

LLM watermarking is a technology that leaves an invisible mark in the process by which an AI chooses words, so that it can be checked later with a key. After Google began using it in Gemini in 2024, Anthropic and OpenAI followed in 2026, against the backdrop of EU regulation, by watermarking their own text.

On the other hand, it is hard to embed in short texts or texts with fixed answers, it weakens with paraphrasing and translation, and only a limited number of people can detect it. It is best understood not as a decisive way to identify AI text, but as one mechanism for AI providers to fulfill their responsibilities. The differences between technologies are summarized in "AI watermarks compared".