What is AI watermarking?

Watermarking is a method to detect AI-generated content that relies on manipulating the frequency at which an LLM uses certain words. It's then possible to detect those changes in word frequency and determine if a piece of text was written by a certain AI model.

How does watermarking work?

LLMs operate by inputting a bunch of words, and then outputting a bunch of possible words that could follow those words in the sentence. This is how AIs write: they read a sentence and produce a list of words that could come next in the sentence. Each of these words is given a probability of how much the LLM wants to put it next. Then, the LLM chooses from that list a word to actually go next, but not necessarily (or even usually) the absolute MOST likely next word – if, given any sentence, say "I walk my…" the LLM always chose the most likely next word "dog", LLMs would say the same thing every time they were asked the same question.

So you have a partial sentence and a list of possible next words to choose from. The process by which the LLM chooses the next word is where the watermark comes into play: it's nudging around probabilities of those next word choices.

Another way of saying this is as follows. Consider the collection of possible words an LLM could use – that is, any possible word that an AI model could ever say. We'll call this the LLM's vocabulary. Watermarking works by pseudorandomly selecting a subset of the vocabulary, and applying a tiny modifier to its score that increases the likelihood some words will be chosen.

A pseudorandomly selected subset of the LLM's vocabulary is watermarked

So when the LLM makes a ranked list of potential words, the modifier makes it so they are slightly higher on the list than they otherwise would be, and so more likely to be chosen.

Watermarked words move slightly higher on the LLM's ranked list of next words

The watermark is detected by looking at the output text and determining how frequently the watermarked words appear. If they appear in the text more frequently than they do in baseline English, then that's considered a positive result, and the watermark detector returns that the text is AI generated.

What does an AI watermark look like?

AI watermarks are invisible, and studies indicate that AI watermarking does not degrade the quality of outputs. This may seem counterintuitive: if watermarks alter the probability that some words appear in an LLM output, shouldn't that be noticeable to a human, just like how we notice when LLMs use words like delve?

This is because the list of watermarked words is generated at each token. That is, the subset of vocabulary words that are selected to be watermarked changes with each new word in the sentence. This means there's much more variance in the vocabulary than one would expect if the watermarked set were one fixed, predetermined set of words.

What are the advantages of AI watermarking?

Watermarks are advantageous for AI detection for several reasons. First of all, watermarking can achieve a high degree of certainty on relatively few words, although as with Pangram, certainty decreases as segments get shorter. Watermarks are also specific to each model – while Pangram only tells you whether a text was AI generated, watermarking has the ability to tell you exactly which AI model outputted the text. However, a positive result on a watermark is also specific to the model: if you put ChatGPT text in a Claude watermark detector, it will return a negative result, because the watermark only appears in Claude-written text.

Watermarking is also easy to implement on the side of AI companies: watermarks can be implemented at relatively low cost, and they don't require retraining the model to be used.

Can AI watermarking be beaten?

Watermarking is brittle, and can be trivially overcome by algorithmic strategies that Pangram is robust to, like humanizers. It's easy to defeat an AI watermark detector by swapping words for synonyms, because the watermark is embedded in word choice. Watermarking is also binary: Pangram's detector can distinguish AI-assisted and mixed human/AI content, whereas watermarking only tells you whether a piece of text passed through an LLM as the final step before it got to you.

While watermarking can tell you if a model wrote a piece of text, a negative result on a watermark detector doesn't tell you that the text wasn't AI-generated, or even that it wasn't generated by the model in question: it only tells you that the watermark for that model isn't there. The text could easily be written by a different model, or passed through a humanizer or similar program that swapped out words in the text for synonyms.

Does Claude implement AI watermarking?

Yes, currently, Claude models use AI watermarking in order to comply with EU regulations: Anthropic began watermarking Claude outputs on August 2, 2026, as it announced in its blog.

Presently, ChatGPT does not implement AI watermarking, and there is no credible AI watermarking detector or checker for ChatGPT generated text.

Does watermarking affect Pangram?

AI watermarking does not have much of an effect on Pangram's AI detection. Because watermarking is just subtly nudging the probability scores of the words LLMs use, watermarked LLM output will remain detectable by Pangram.

Ultimately, watermarking only marks the most blatant and unaltered AI output, where no effort has been made to obfuscate AI use. We aim to be much more granular, and distinguish between AI assistance, mixed AI/human text, and fully AI-generated text. We're also agnostic to the model used to generate text, unlike watermark detectors.

We view AI watermarking as complementary to Pangram. We also think it is generally good for the world to have more transparency in AI authorship.

FAQ

Does ChatGPT have a watermark?

No, ChatGPT does not watermark its text. OpenAI built a system for watermarking text in 2024 but never released it.

What is SynthID?

SynthID is Google's watermark used in Gemini models since 2024.

How can I check whether a piece of text has an AI watermark?

AI watermark detectors are released by the company that makes the model, and so checking text for a watermark requires that the company give access to the private key they used to generate the watermark. As of September 14th, 2026, no AI company has released an AI watermark detector for text publicly, although Gemini has a public image detector.

Does Pangram detect AI watermarking?

Pangram does not currently support AI watermarking detection.