CiteOwl

Blog/Using AI honestly

Does AI text have a hidden watermark?

The CiteOwl Team· Updated 11 August 2026· 12 min read

Some of it does, as of nine days ago. On 2 August 2026 Anthropic began weaving an imperceptible watermark into text from new Claude models, worldwide, on every surface it sells. Google has watermarked Gemini's text for over a year. OpenAI built the same thing, measured it at 99.9% accuracy, and shelved it. None of it is visible, none of it is a character you can delete, and nobody at your university can currently read any of it.

The short version, if you are here because something scared you: no watermark has ever appeared in a university misconduct case, because there is currently no way for a university to check one. The risk in an AI-assisted paper still sits where it always did, in the reference list. Skip to what this means for your paper if that is the whole question.

What changed on 2 August 2026

Article 50 of the EU AI Act applied from 2 August 2026. It tells providers of generative systems to add machine-readable marks so AI-generated content can be detected automatically. Systems already on the EU market before that date have until 2 December 2026. The penalty ceiling is 15 million euros or 3% of worldwide turnover.

Anthropic's answer went into its help centre the following Monday. Text from Claude models launched on or after 2 August carries an embedded watermark; generated .svg, .png and .jpg files carry signed provenance metadata in the C2PA format. Two details matter more than the announcement itself. It is not EU-only: marking applies "wherever Claude is offered, worldwide," and it covers the API and Claude Code alongside the chat app, so a developer building on Claude ships marked text whether or not they knew. And it is not new-models-only for long, because Anthropic says it will retrofit already-released models during the transition period.

Anthropic's own caveat is the most useful sentence in the document, and it is worth reading twice: "A detected mark provides a signal that content was processed by Claude, but is not fully conclusive." Processed, not written. If you paste your own paragraph into Claude and ask it to fix the commas, what comes back is marked too.

Note also which obligation belongs to whom. The marking duty falls on the provider, the company running the model. The separate duty to disclose falls on the deployer, and it covers text published on matters of public interest "without human review or editorial control." Content that a person has reviewed and taken editorial responsibility for is exempt from that one. That distinction is not about student essays, but the principle underneath it is the same one your department is likely to land on: what matters is whether a human stood behind the words.

What a text watermark actually is

It is not a character, a tag or a field. It is a bias in the model's word choices.

A language model generates by repeatedly picking the next token from a ranked list of candidates. At most points in a sentence several candidates are nearly as good as each other, which is the slack a watermark lives in. The generator uses a secret key to score candidates pseudo-randomly, then systematically prefers the ones the key favours. Google's SynthID-Text does this as a knockout tournament: candidates are paired off, the pairs are settled by their key-derived scores, and winners advance until one token is left. Do that a few hundred times and the finished text carries a statistical fingerprint that a detector holding the same key can measure, while a reader sees ordinary prose.

Three consequences follow from the mechanism, and they explain almost everything else on this page.

It needs room to work. Where the model has no real choice, in a quoted title, a formula, a technical term with no synonym, there is no slack to encode into. Low-entropy text carries a weak mark or none.

It needs length. The signal is statistical, so it accumulates. Published results for SynthID-Text show a maximum true-positive rate of about 0.3 on 50-token passages at a 1% false-positive rate. A paragraph is a coin flip. An abstract is worse.

It degrades under rewriting rather than breaking. Nobody can delete it, and nobody has to. Every sentence you rewrite in your own words replaces the model's token choices with yours, and the fingerprint thins out. This is the part most coverage gets backwards: normal revision is already the most effective watermark removal there is.

The invisible characters are a different story

If you have read that ChatGPT hides watermarks in your text, you have almost certainly read about this instead, and it is a separate thing.

In spring 2025 people noticed that some OpenAI models were sprinkling unusual Unicode characters through their output, most often the narrow no-break space, U+202F, where an ordinary space belonged. It looks identical on screen and shows up immediately in any editor that reveals hidden characters. OpenAI's position was that it was an artefact of training rather than a watermark, and later models appear to have stopped doing it.

Whatever it was, it was never a good watermark. A single find-and-replace removes it, pasting into a plain text field removes it, and it survives no editing pipeline reliably. That did not stop an entire industry of "ChatGPT watermark remover" pages from growing around it, all offering to strip zero-width spaces, word joiners and soft hyphens from your document. They are removing something the current models do not put there, to defeat a check nobody runs.

The distinction is worth holding onto. Invisible characters are in the text and trivially removable. A statistical watermark is the text, in the sense that changing it means changing the words. If you want to look for either in your own document, we wrote a separate walkthrough of how to check.

Who marks what, right now

Accurate as of August 2026, and moving. Every one of these is a policy decision that can be reversed with a model release.

OpenAI's reasoning for holding back is on the record and is more interesting than a simple refusal. Internal testing put detection at 99.9%. Roughly 30% of surveyed users said they would use the product less if it shipped. The company also flagged that the method would fall hardest on non-native English speakers using it as a writing aid, which is the same bias that already breaks AI detectors. And it noted the method was defeatable by paraphrasing through another model, by translation round trips, and by inserting and then deleting characters. A watermark that determined cheaters can wash out, and honest users cannot, is a strange thing to build a policy on.

Google took the opposite bet and open-sourced SynthID-Text in late 2024, shipping it in Hugging Face Transformers so any developer can watermark their own model's output. The detector is Bayesian and returns three states rather than two: watermarked, not watermarked, or uncertain. That third state is the honest part.

How much of it survives an edit

This is where the published numbers are worth more than any vendor sentence, so here they are.

On unmodified output, first-party detection of SynthID-Text on Gemini is reported at about 99.5%. Against a research baseline on an open model, SynthID-Text hits a 85% true-positive rate at a 1% false-positive rate, where the prior state of the art managed 73%. Those are the good conditions: long text, straight from the model, untouched.

Then the numbers move. Paraphrasing or a translation round trip drops first-party detection to roughly 75 to 85%. Round-tripping through specific pivot languages does more damage, with reported true-positive rates of 0.675 to 0.76, French and Chinese at the bottom of that range. In the broader literature the picture is harsher still: across watermarking schemes generally, a robustness evaluation found that one round of paraphrasing through a competent model pushes detection below 0.3, and a few rounds below 0.15. A 2026 analysis of SynthID-Text also demonstrates a targeted attack driving detection to 13 to 15%.

Anthropic does not dispute any of this and does not need to, because it published the same caveats itself: heavy editing, paraphrasing, translation, format conversion and screenshots can all strip the mark, and metadata can simply be deleted. Its own summary is that a detected mark is a signal, and the absence of one proves nothing.

So the honest range for a real student document is wide. A paragraph pasted straight out of a chatbot: likely detectable, if anyone could run the detector. The same paragraph after you restructured the argument, cut a sentence and swapped in your own examples: probably not, and not because you were trying.

Who can actually read the mark

Almost nobody, and this is the fact that most changes how you should feel about all of the above.

Reading a statistical watermark requires the secret key it was written with, which means the provider's own detector. Turnitin does not have it. Neither does GPTZero, or any other detector your institution licenses. Those tools run their own statistical model over your writing style and produce a score that is a prediction, not a measurement. They are not looking for a watermark, and they could not read one if they found it.

What exists on the provider side is thin. Google runs a SynthID Detector portal, announced in 2025, still behind a waitlist aimed at journalists and researchers, and limited to content from Google's own models. Anthropic says it will "share details on detection mechanisms in forthcoming technical documentation" and has given no date. There is no cross-provider detector, no standard interface, and no route by which a marker grading essays on a Sunday evening gets an answer out of any of it.

That gap is not a temporary implementation detail either. A universal detector would have to hold every provider's secret keys, which is exactly the thing that makes the watermark forgeable if it leaks. The regulation asks for content to be machine-readable and detectable. It does not, and cannot easily, produce a single machine anyone can read it with.

What this means for your paper

Four things, in descending order of how much they should occupy you.

1. Your citations are the actual exposure. A reference that does not exist, or one that exists and does not say what you cited it for, is checkable by any reader in about a minute, survives every amount of rewriting, and is the thing that ends up in integrity findings. It is a real risk with a real fix. Watermarks are currently neither.
2. Your institution's disclosure rule is the next thing. Most policies now ask you to declare AI assistance, and whether you declared it is a question about you, not about your text. A mark nobody read cannot help you there and its absence cannot excuse you. Read where schools actually draw the line, then follow the format your department wants, or cite the tool properly in APA, MLA or Chicago.
3. Keep your drafting record. Version history, notes, the sources you actually opened. This is the evidence that answers a suspicion, and it has answered them long before anyone said the word watermark. It is also the one form of provenance you own outright.
4. Do not run your work through a stripper. Rewriting in your own voice already thins a statistical watermark to almost nothing, so the tool adds little. What it adds is intent. The difference between a student who used a tool and a student who removed the evidence of using a tool is the difference between a conversation and a case.

What CiteOwl marks, and what it doesn't

We are an AI writing tool, so the question lands on us too. Here is the whole answer.

CiteOwl adds no mark of its own. There is no watermarking step anywhere in the product, nothing hidden in the whitespace, and no content credentials written into your exports. A PDF, Word file or LaTeX source that leaves CiteOwl carries the title, authors and abstract you typed, and no provenance claim about how any of it was written.

The parts of the document we build ourselves are not generated at all. Equations are rendered server-side from your LaTeX into a path-only SVG, the identical bytes in the editor, the preview and the export. Figures come from PDFs you imported or images you uploaded, because CiteOwl does not generate images. Your reference list is formatted from stored source records by the exporter. None of that is model output, so there is nothing in it to mark.

The prose the agent proposes is model output, and we are not going to pretend otherwise. It comes from a frontier model run by a third party, and what that provider embeds is the provider's decision, not ours. The model CiteOwl drafts with does not currently watermark its text. That could change with a version we do not control, and we would rather say so than sell you a guarantee with someone else's hand on the switch.

What we do control is the record, and it happens to be the thing a watermark is a poor substitute for. Every sentence the agent writes arrives as a pending change with the old text beside the new one, and nothing enters your document until you accept it. So the boundary between what a model drafted and what you wrote is not something you reconstruct afterwards from a detector score. It is your document's own history, and it is there whether or not anyone ever ships a detector worth running.

We will not be building a watermark remover, and the reason is the second one above rather than the first. Ours is a tool for writing a paper you can defend line by line. A feature whose only purpose is to make the paper harder to trace is the opposite product.