how AI text watermarking works: a visual guide
← declaude<br>How AI text watermarking works.
A gentle, visual walk through how a statistical mark hides inside<br>generated text, and what erases it.
From the folks at NOPE, as a companion<br>to declaude.
A watermark in plain text sounds impossible. Text has no pixels to hide data in, and<br>no metadata survives copy-and-paste; every character is right there in front of you.<br>Where could a mark possibly go?
And yet the marks are real. Google has watermarked text from the Gemini app and<br>web experience since 2024 (its API is, at the time of writing, a<br>documented<br>exception), and as of August 2026, new Claude models mark text at the model<br>level, with earlier models being brought in behind them. They're<br>invisible, they survive copying, and they<br>work because they don't live in the characters at all. They live in the<br>choices between them.
Five short steps, each with something to poke at. Nothing harder than counting.
Writing is a series of small choices
A secret key leans on those choices
Whoever holds the key can count
What editing does to the mark
What this means in practice
1. Writing is a series of small choices
The one idea in this step: a model writes by rolling weighted dice<br>between several words that would each be fine.
When a model is mid-sentence, it doesn't know "the next word." It has a shortlist,<br>like autocomplete, with preferences. Here's a real kind of moment, one word from the<br>end of a sentence:
the sentence being written
The results of the study were quite
🎲 roll the dice<br>🎲 roll ×20<br>Each roll sweeps the shortlist, lands on one word (odds matching the<br>bars) and drops it into the sentence above. The dots tally where the rolls land: try<br>×20 and watch the pile take the shape of the odds. Notice what never changes:<br>every landing makes a perfectly good sentence.
A page of text contains hundreds of these little forks, one per word, and at many of<br>them several options are equally fine. That slack is the raw material. Whoever gets to<br>lean on how the dice land can hide a pattern in the text without changing what it says.
2. A secret key leans on those choices
The one idea in this step: the key secretly colours the shortlist and<br>gives one colour a gentle nudge. The text still reads normally.
Here is the classic recipe (Kirchenbauer 2023; Google's SynthID reaches the<br>same end by a subtler, tournament-style route). At each fork, secret-keyed maths splits<br>the candidate words into<br>green and<br>red , an arbitrary colouring only the<br>key-holder can reproduce. Then the dice get tilted a little toward green.
the sentence being written
The results of the study were quite
apply the secret key<br>🎲 roll the dice<br>🎲 roll ×20<br>No key applied: these are the model's own preferences.<br>Dashed outlines will show the old odds once the key is on.
Two things make this sneaky. The nudge is mild: a red word can still win, it's just<br>a little less likely. And the colouring is not a fixed property of the word: the key<br>computes it from a short run of the words just before, so the same candidate is green<br>after one prefix and red after another:
The same four candidate words, coloured by the key after six different<br>prefixes. The key sees the words just before it; the calendar position is invisible to it. Only the<br>overall lean toward green accumulates, and only the key-holder knows which<br>words were green where.
(Two siblings, same principle.<br>Google's SynthID (the one in production) replaces the nudge with a tiny secret<br>tournament: a few candidates are drawn from the model's own odds, the key scores them,<br>and the bracket is arranged so that, averaged over the key's draws, every word's odds<br>stay exactly what the model intended. Aaronson's scheme, built at OpenAI, skips<br>even that and derives the dice-rolls themselves from the key. Different maths, same<br>principle: the mark lives in the choices.)
3. Whoever holds the key can count
The one idea in this step: with the key, you can re-colour any text and<br>simply count. Marked text lands green too often to be luck.
Detection doesn't read the text or judge its style. The detector replays the<br>key-holder's colouring over the words and counts how many came up green. Without a mark<br>(or without the right key), green should win about half the time. A coin flip. Here's<br>an ordinary-looking paragraph; try both keys on it:
count with the right key<br>count with the wrong key<br>📖 keep reading: same mark, ×4 the text<br>greens: – of<br>55
coin flip
flag bar (this length)
Filled-and-underlined chips are green, dashed outlines are red. The<br>words read identically either way; the colouring exists only in the key-holder's<br>maths. With the wrong key the split is meaningless, and the count sits at chance.
Note how demanding the bar is. This paragraph is visibly tilted and still too<br>short to flag. Detectors are tuned so that false alarms are vanishingly rare; the<br>price is that short, edited, or weakly marked text is often missed, and 55 words<br>of a mild lean isn't...