AI text watermarks: how they work and what survives a rewrite

The reference design is the paper by Kirchenbauer and colleagues. Before each word is generated, the model uses the previous token to seed a random split of its vocabulary into a "green" list and a "red" list, then softly raises the probability of green tokens during sampling. Human writers do not know the lists, so their text contains green tokens at the chance rate; watermarked text contains far more. A detector that knows the seeding rule counts green tokens and reports a p-value for how unlikely that count is in unmarked text (Kirchenbauer et al. 2023, A watermark for large language models, arXiv 2301.10226, read 9 November 2026).

Two consequences follow from the last row. A watermark is a choice the model maker makes; nobody can watermark text after the fact, and nobody can detect a watermark that was never applied. And a watermark detector answers one narrow question, "does this text carry my mark", which is a different question from the one asked by the classifiers covered in what AI detectors measure.

Two are documented by their makers, read on 9 November 2026. Google states that it has "expanded SynthID to watermarking and identifying text generated by the Gemini app and web experience", that a language model assigns each candidate word a probability score, and that "SynthID adjusts these probability scores to generate a watermark" which "doesn't affect the quality of the output" (Google DeepMind, SynthID, read 9 November 2026). Google also states that Gemini, Search and Chrome can check an uploaded image, video or audio clip for a SynthID mark, and that its SynthID Detector portal, launched in 2025, covers images, video and audio from Google and partners.

Anthropic states that it signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, that Claude models launched in the EU on or after 2 August 2026 "support machine-readable marking at launch", that generated text "will carry embedded watermarks" applied "at the model level" wherever Claude is offered, and that it is adding watermarks to models released before that date (Anthropic, How Claude marks AI-generated content, read 9 November 2026). The same article states that watermark detection is "currently in private preview" for eligible organisations such as regulators, media, fact-checkers, researchers and educational bodies, and that a detected mark shows text "may have been processed by Claude" without confirming full provenance, read 9 November 2026.

Several humanizer vendors sell "watermark remover" or "watermark detector" features that name other model makers' watermarks, read on 9 November 2026. This page cites only what a model maker documents, and on 9 November 2026 that was Google's SynthID Text and Anthropic's Claude watermark. A vendor claim that a given chatbot's text carries a hidden mark is a claim about a system the vendor does not control, and none of the vendor pages read for this guide published the method behind the claim.

It weakens it, and how much depends on how many tokens change. A green-token watermark is a count. Replace enough words and the count drifts back toward the chance rate; Kirchenbauer and colleagues' sensitivity analysis is about exactly that trade between the number of tokens altered and the strength of the remaining signal (Kirchenbauer et al. 2023, read 9 November 2026).

Krishna and colleagues tested the attack directly. Their paraphraser, DIPPER, with 11 billion parameters, was run against watermarking alongside GPTZero, DetectGPT and OpenAI's classifier, and paraphrasing reduced detection across all of them, with DetectGPT falling from 70.3 percent to 4.6 percent at a 1 percent false positive rate; the authors proposed a retrieval defence, matching candidate text against a store of the model's past outputs, that recovered much of the loss (Krishna et al. 2023, arXiv 2303.13408, read 9 November 2026).

Wu and colleagues' survey of the detection field groups the methods into watermarking, statistics-based, neural and human-assisted detectors, and lists paraphrase attacks, out-of-distribution text and the lack of a shared evaluation framework among the open problems for all four (Wu et al. 2025, A survey on LLM-generated text detection, Computational Linguistics 51(1), read 9 November 2026). A humanizer is a paraphrase attack in that taxonomy, and the survey treats its effect on watermarks as an unsolved problem rather than a settled one.

Anthropic's own article agrees on the direction. It lists text that "has been heavily edited, paraphrased, translated, or mixed into other writing" and passages that are "very short" among the cases where Claude output may carry no detectable mark, read 9 November 2026.

So the honest answer to "does humanizing remove an AI watermark" is: a heavy rewrite reduces the statistical signal, a light one may not, and nobody outside the model maker can check which happened, because the detector is theirs.

The detectors this site runs, GPTZero, Originality.ai, Copyleaks, Pangram and ZeroGPT, are classifiers. They were trained on human and machine text and report how machine-like a passage looks, whoever generated it and whether or not it carries a mark. A watermark detector tests for one specific hidden pattern and is blind to everything else.

That difference is why the published method on this site checks humanizer output on five public classifiers and records nothing about watermarks: on 9 November 2026 there was no public text watermark check an individual could run, at Google or at Anthropic. The classifier evidence, including the 2023 finding that paraphrased AI text was identified only 26 percent of the time, is on the page about whether AI detectors work, and the humanizer side of the same evidence is on do AI humanizers work.

No detector score should be the only evidence in a misconduct case, and a watermark is not a detector score at all; it is a maker's own stamp, readable only by the maker. The guides hub holds the rest of this series.