AI watermarking is a technique that modifies the output of generative AI models, such as large language models (LLMs), allowing it to be later identified as AI-generated. Watermarks are one of several techniques used for AI content detection, and include both traditional digital watermarking techniques on media files and metadata, and text watermarking techniques specific to LLMs that have been developed during the 2020s AI boom. Recent research in text watermarking has focused on statistical watermarking techniques, which were first introduced in 2022, with the first production deployments in 2024.
Most deployed text watermarking algorithms use a secret only known to the specific model provider, and the detection algorithm requires knowing the secret, as the text is not distinguished in a generally human or machine-readable way. As a result, determining if text is watermarked requires access to the secret, or an API provided by the model provider, and there is no general-purpose way to determine if text is watermarked without knowing what model produced it and access to the corresponding detector.
Watermarking has been one focus of the regulation of artificial intelligence, examples including the European Union's Artificial Intelligence Act and the California AI Transparency Act, which both began requiring watermarking of AI output in August 2026.
Early text watermarking research, dating back to 1997, embedded information in existing documents, for example through formatting changes or syntactic and semantic transformations of the text. In November 2022, Scott Aaronson first proposed statistical watermarking for LLM outputs. In his scheme, the sampling of successive tokens is steered by a keyed cryptographic pseudorandom function, so that the model's authorship can later be demonstrated statistically by anyone holding the key. A prototype was built at OpenAI by Hendrik Kirchner.
The 2023 paper A Watermark for Large Language Models proposed the "green-red list" watermarking method. This was followed by Google's 2024 paper Scalable watermarking for identifying large language model outputs, which introduced their SynthID method. The paper described the first production deployment of generative text watermarking in Gemini. OpenAI claimed in 2024 that it had built a watermarking system for ChatGPT, but opted not to deploy it out of concerns around false positives for non-native English speakers and the risk of users switching to competitors.
Google announced a SynthID based detector in May 2025, and announced an expanded rollout in May 2026. Anthropic announced in August 2026 that their model Claude would watermark all its output. They announced that they would release a detection API, which they released in private preview in September 2026 to certain groups such as regulators and law enforcement, but was not made publicly available. On 5 October 2026, OpenAI announced that it would roll out watermarks for its models, though only in the EU over the next few weeks, and announced a new watermarking strategy, which they called textGrain. The company announced a detection API would be made available to researchers and regulators.
China announced requirements around AI watermarking in 2022, and the requirement was rolled out in September 2025.
The 2024 European Union Artificial Intelligence Act introduced a requirement for AI model providers to watermark their output, with the provision entering into force in August 2026.
There have been various efforts in the United States to regulate AI watermarking. In July 2023, the Joe Biden administration announced a "voluntary commitment" from seven US AI companies to develop AI safeguards, including via watermarking. Biden's October 2023 Executive Order 14110 identified the development of watermarking systems as a policy goal, but the order was rescinded by Donald Trump in January 2025. Legislative attempts include the federal AI Labeling Act, first introduced in 2023 and reintroduced in 2026. State-level legislation requiring watermarking has been enacted in Washington via HB 1170, and in California via the California AI Transparency Act.
Autoregressive large language models generate text by producing a probability distribution of the next word, and sampling over that distribution at random. Text watermarks function by modifying the selection process over that distribution.
Generally, detecting these watermarks require knowledge of a specific secret key known only to the model provider. The presence of watermarks is difficult to detect without knowing the secret key. The ability of a specific piece of watermark detection software to detect watermarks is generally limited to output generated by that provider.
Different methods are used than for text watermarking. For example, Anthropic uses C2PA watermarks, and Google uses C2PA and SynthID watermarks, for which it provides a detection API.
The green-red list method was introduced by John Kirchenbauer and collaborators at the University of Maryland in 2023 in Proceedings of Machine Learning Research. It was one of the first examples of how to implement a text watermark, and is the most widely cited technique. It sorts candidate words into a red list, which appears at standard frequency, and a green list, which appears at increased frequency. Over a large sample size of generated text, the words on the green list will appear more often. Text not written by a watermarked language model will tend to contain a random mix of words, allowing detection to function by performing a statistical test if the green list words appear more often than if they were random.
Specifically, at each step, Kirchenbauer's approach uses the previous token to seed a pseudorandom function; this function is used to partition the possible next tokens into the red and green lists. He describes the "hard red list" algorithm, where tokens on the red list never appear, and the "soft red list" algorithm, where the red list tokens retain their normal weights and green list tokens have their weights increased by δ, a value described as a bias. The algorithm causes distortion of the output, and choosing larger values for δ increases detectability, especially in shorter texts, at the cost of introducing more distortion.
The green-red list method can be contrasted with nondistorting methods, which have the property that the distribution of watermarked responses matches the original distribution. Nondistorting methods include Scott Aaronson's 2022 method, SynthID-Text, and textGrain.
Diffusion LLMs generate text by unmasking a fixed-length batch of tokens. In this case, biasing word selection using the left-to-right mechanism, no longer works, and one needs to take into account biassing from unmasked tokens from both sides.
Applying watermarks, by definition, changes the outputted text, but views vary on whether it changes the quality of the text. The original Google paper introducing SynthID watermarks concluded that watermarking did not negatively affect user feedback over 20 million responses. However, others observed that watermarking performed worse in edge cases where the output text was short or there were few possible words. Watermarking can cause AI models to fail to adhere to AI guardrails. A study by Nikola Jovanović and collaborators showed that text watermarks could be removed or spoofed.
Rollout of watermarks led to criticism. Some developed tools to remove watermarks from generated text. Others considered watermarking to be a step too far, criticising that watermarks would appear in text when LLMs were used for editing and proofreading, contrary to an expectation that watermarks would mark when text was entirely generated by artificial intelligence. Some academics commented that watermarks, if they had a low false-positive rate, could be used to detect AI usage for cheating or writing low-quality papers, but might not detect users attempting to evade detection. Others worried that watermarks would be used as a definitive determination, pointing out error rates, the ability to edit or reprocess text to evade detection, and that papers could contain human-authored ideas and LLM-authored text.
Statistical watermarking techniques that modify the output probabilities of the models have been the primary focus of research and development, but other approaches to AI watermarking have been proposed or implemented. These include modifying the formatting of the output by substituting similarly displayed Unicode characters or adding non-printing characters, performing lexical substitution on the output by replacing words or phrases with synonyms, or inserting provenance-related metadata into output. Other, non-watermarking, methods of artificial intelligence content detection include using AI classifiers to flag content as AI-generated, or maintaining databases of AI-generated content.