Textual content Watermarking in Python: Catch Whoever Copies Your Writing

On August 2, 2026, Anthropic started watermarking each piece of textual content Claude produces. Since 2024, Gemini (Google) has used SynthID-Textual content, a technique they revealed in Nature and later open-sourced. OpenAI constructed one thing comparable. China has required embedded labels on AI-generated content material since September 2025, and almost 190 organizations have signed the EU’s transparency code.

The end result: billions of phrases generated from these techniques day by day carrying an invisible mark—not metadata that vanishes on copy-paste, however a sign baked into the phrases themselves.

So if AI firms can try this, are you able to?

Most individuals assume no. Photos have pixels to tweak; audio has a spectrum. Textual content is simply characters. If somebody scrapes your writing and claims it, it’s your phrase in opposition to theirs.

That assumption is fallacious. A century in the past, mapmakers, dictionary editors, and no less than one very aggravated lyrics firm figured this out lengthy earlier than language fashions existed.

You may watermark plain textual content 3 ways, every leaving a detectable sign:

• Invisible characters: best so as to add, best to erase. Any sanitizer or chatbot move wipes them out.

• Keyed phrase decisions: particular substitutions based mostly on a hidden key. Survives gentle enhancing, however a full rewrite kills it.

• That means-level marks (rigged sampling): hardest to take away. It holds up higher underneath rewriting, however the sign weakens. Sturdiness all the time prices power.

A textual content watermark isn’t a visual stamp. It’s a sample of decisions solely .

1. Who that is for, and what you may get

When you publish writing on-line and wish greater than a guess when it will get copied, that is for you.

You’ll get:

• A easy coin-flip instinct for 3 varieties of textual content watermarking.

• An 80-line, standard-library-only script that embeds a 32-bit ID in textual content and detects it later.

• A keyed word-choice watermark, a model-free detector, and a meaning-aware improve—plus the place they fall quick in follow.

• Actual-world survival checks throughout 12 channels, a number of enhancing assaults, full paraphrasing, and Chinese language translation.

• A sensible rule for choosing the proper watermark for the menace.

Every thing was examined on actual fashions: Gemma-2-9b-it for watermarking and Qwen2.5-7B-Instruct for assaults, working on an NVIDIA GB10. The take a look at set included 50 unique paragraphs and 100 public-domain passages for false-positive checks.

The scripts, corpus, and calibration knowledge are all in text-watermarking-toolkit, so you possibly can reproduce the outcomes your self.

2. Folks have been watermarking textual content for a century

Lengthy earlier than watermarking turned cryptographic, it was utilized in a a lot less complicated manner: disguise a tiny, deliberate mistake or variation, then see who copies it.

2.1 Entice streets

One instance is from mapmakers.

Mapmakers inserted pretend streets, cities, or landmarks into maps. If the identical pretend characteristic seems on a competitor’s map, the supply of the copying is apparent.

In 1925, the Basic Drafting Firm added a pretend New York city referred to as Agloe, named from its founders’ initials. Years later, a retailer opened on the crossroads and adopted the title. The fictional city had successfully turn into actual.

2.2 Mountweazels

Reference books use the identical trick with pretend entries.

The New Columbia Encyclopedia famously included Lillian Virginia Mountweazel, a fictional photographer with an elaborate biography. The New Oxford American Dictionary later planted esquivalience, supposedly that means “the wilful avoidance of 1’s official tasks.”

Neither was actual. Each had been bait: if one other reference work reproduced them, that was proof of copying.

2.3 Canary traps

A canary lure takes the concept one step additional. As a substitute of giving everybody the identical pretend element, every recipient will get a barely totally different model.

If the doc leaks, the variation identifies whose copy it got here from.

Elon Musk has mentioned Tesla used this system in 2008 by various whether or not sentences had been separated by one area or two. These tiny variations shaped a binary signature distinctive to every recipient.

2.4 Genius vs. Google

An important instance right here is one the place the watermark apparently labored — however the lawsuit nonetheless failed.

Lyrics website Genius suspected Google was reproducing its transcriptions in search outcomes. Genius started alternating straight and curly apostrophes in a sample that, when learn as Morse code, spelled REDHANDED.

The sample was seeded into 301 songs and reportedly appeared in Google’s outcomes for 116 of them.

Genius later used a second watermark based mostly on several types of areas, encoding the phrase Genius.

It sued Google for $50 million in 2019. The case was dismissed in 2020, not as a result of the watermark failed, however as a result of Genius didn’t personal the underlying lyrics; it licensed them.

That distinction issues:

A watermark can present that your model of a textual content was copied. It can not, by itself, show that you simply owned the textual content within the first place.

3. The coin-flip analogy

Think about that whereas writing, you repeatedly make a hidden binary motion: insert considered one of two invisible characters, select between two synonyms, or choose between two equally believable subsequent phrases.

One matching selection proves nothing: it has a 50% likelihood of occurring by chance. But when 30 decisions match the important thing in a row, the chances of that occuring randomly are roughly 1 in a billion.

That chance is what provides the watermark statistical proof. In formal phrases, it may be expressed as a p-value.

The three watermarking households primarily differ in what the “coin flip” represents:

The primary two might be utilized to textual content that already exists. The third should occur whereas a language mannequin is producing the textual content.

3.1 Approach 1 — invisible characters

Unicode contains characters that occupy zero seen area. Two examples are:

• U+200B — zero-width area

• U+200C — zero-width non-joiner

Each are reliable Unicode management characters, however in atypical Latin textual content they’re successfully invisible.

Assign one character to 0 and the opposite to 1, and you’ve got a hidden binary channel inside normal-looking textual content.

Zach Aysan described this system in 2017 and identified an necessary consequence: copied textual content can carry an invisible fingerprint with it. Somebody pasting a leaked doc elsewhere may unknowingly protect the identifier embedded inside it.

How the implementation stays dependable

This is the implementation that I ran the experiments with.

"""Invisible-ink watermarking for plain textual content, utilizing zero-width Unicode characters."""import reZERO, ONE = "​", "‌"   # zero-width area, zero-width non-joinerID_BITS, CRC_BITS = 32, 8PAYLOAD_BITS = ID_BITS + CRC_BITS# Insert a payload after sentence-ending punctuation that's adopted by an area.SENTENCE_END = re.compile(r"(?<=[.!?])(?=s)")def crc8(worth: int, bits: int = ID_BITS) -> int:    """CRC-8/ATM (polynomial 0x07) over `bits` bits of `worth`, MSB first."""    crc = 0    for i in reversed(vary(bits)):        crc ^= ((worth >> i) & 1) << 7        crc = ((crc << 1) ^ 0x07) & 0xFF if crc & 0x80 else (crc << 1) & 0xFF    return crcdef embed(textual content: str, owner_id: int) -> str:    """Return `textual content` with an invisible copy of `owner_id` after each sentence."""    bits = f"{owner_id:0{ID_BITS}b}{crc8(owner_id):0{CRC_BITS}b}"    mark = "".be part of(ONE if b == "1" else ZERO for b in bits)    marked = SENTENCE_END.sub(mark, textual content)    return marked if mark in marked else textual content + markdef strip(textual content: str) -> str:    """Take away each zero-width watermark character. That is the sanitizer."""    return textual content.substitute(ZERO, "").substitute(ONE, "")def extract(textual content: str) -> int | None:    """Get well the proprietor ID, or None if no payload passes its CRC verify."""    votes: dict[int, int] = {}    for run in re.findall(f"[{ZERO}{ONE}]+", textual content):        bits = "".be part of("1" if ch == ONE else "0" for ch in run)        for begin in vary(0, len(bits) - PAYLOAD_BITS + 1):            window = bits[start : start + PAYLOAD_BITS]            owner_id = int(window[:ID_BITS], 2)            if crc8(owner_id) == int(window[ID_BITS:], 2):                votes[owner_id] = votes.get(owner_id, 0) + 1    return max(votes, key=votes.get) if votes else None

Three decisions do a lot of the work.

1. A checksum prevents false matches.
With out validation, any random sequence of zero-width characters may decode into an obvious ID. Including an 8-bit CRC reduces the prospect of a random payload passing validation to about 1 in 256. Throughout 1,700 extraction makes an attempt in these experiments, there have been zero false IDs.

2. The payload is repeated.
A 40-bit identifier requires 40 invisible characters. Repeating it after every sentence means even a copied paragraph can nonetheless include an entire, decodable mark.

3. The decoder makes use of sliding home windows.
Copying can merge, truncate, or misalign invisible-character sequences. As a substitute of assuming good formatting, the decoder checks each attainable 40-bit window and returns the legitimate ID that seems most frequently.

What it appears like

Earlier than

The report is confidential. Please don’t ahead it to anybody exterior the workforce.

After

Visually, it appears similar. Internally, the textual content comprises repeated zero-width characters encoding the identifier.

extract() → 0xc0ffee01

On this instance, 80 invisible characters had been added with no seen change. When the textual content is copied, these characters can journey with it as a result of the clipboard treats them as atypical textual content.

To seek out out, I examined 150 marked paragraphs per channel throughout 11 mechanical transformations and one language mannequin, checking whether or not the precise 32-bit ID survived.

What survives

Towards techniques that merely transfer or reformat textual content, the watermark was extraordinarily sturdy: 150/150 recovered via each examined mechanical channel, together with:

• copying solely the center 50% of a paragraph

• UTF-8 and UTF-16 conversions

• JSON and HTML spherical journeys

• Unicode NFKC normalization

Two outcomes are price noting. Python’s s does not take away U+200B, as a result of it’s a Unicode format character quite than a traditional area. NFKC normalization leaves it intact too.

What kills it

• Express sanitization: 0/150 survived.
  If somebody is aware of which zero-width characters to take away, a easy alternative strips the watermark fully.

• Language-model cleanup: 4/50 survived — simply 8%.
  I solely requested the mannequin to repair typos and formatting whereas preserving the wording. However language fashions typically regenerate textual content quite than edit the unique character stream, so the invisible characters disappear. With full paraphrasing, survival went all the way down to 0/50.

That offers approach 1 a easy restrict:

It survives textual content transport. It doesn’t survive textual content rewriting.

3.2 Approach 2 — keyed phrase decisions

The second approach hides data contained in the wording itself quite than between characters. In different phrases, we write continually equal decisions:

• large/giant

• start/begin

• drawback/concern

In regular follow, a author chooses whichever sounds finest. Nevertheless, with a keyed watermark, a secret key determines which acceptable different to make use of.

The main benefit over zero-width characters is that there may be nothing further to strip. The watermark is a part of the textual content itself.

Sanitizers, Unicode normalization, scrapers, and file conversions can not take away it. To destroy the sign, you typically need to rewrite the phrases themselves.

3.2.1 The mechanism

Begin with a public desk of interchangeable phrase pairs. At every eligible phrase, use a secret key to decide on which member of the pair ought to seem.

def keyed_bit(key: bytes, context: str, pair: tuple[str, str]) -> int:    """Which member of a pair the important thing selects at a slot with this left context."""    message = f"{context}|{pair[0]}".encode("utf-8")    return hmac.new(key, message, hashlib.sha256).digest()[0] & 1

If the bit is 0, use the primary phrase. Whether it is 1, use the second. Current phrases that already match the important thing keep unchanged; mismatches are swapped solely when the sentence nonetheless reads naturally.

def detect(textual content: str, key: bytes) -> dict:    """What number of slots land on the important thing's facet, and the way shocking is that?"""    slots = scan(textual content, key)    n = len(slots)    hits = sum(slot["on_key"] for slot in slots)    z = (hits - n / 2) / math.sqrt(n / 4) if n else 0.0    p = 0.5 * math.erfc(z / math.sqrt(2)) if n else 1.0    return {"slots": n, "hits": hits, "z": z, "p_value": p}

With the fallacious key—or atypical unmarked textual content—every selection ought to match the important thing about 50% of the time. A marked doc produces an unusually excessive variety of matches.

Two particulars matter

Use secure context.
The important thing can not depend upon a close-by phrase that may itself be swapped, or the place embedding one bit modifications the following one. I as a substitute use the closest previous phrase that’s not within the synonym desk.

Hash the pair id too.
Hashing solely the context creates correlations when the identical context repeats. Together with the phrase pair retains slots impartial sufficient for the binomial take a look at to behave correctly.

After that repair, 100 human-written passages examined underneath 20 keys produced null z-scores with imply 0.007 and customary deviation 1.020—virtually precisely what the statistical mannequin predicts.

3.2.2 How effectively does it work?

I examined 50 paragraphs underneath three keys, utilizing Gemma-2-9B-IT to reject swaps that modified that means or grammar.

It accepted 880 of 1,039 swaps (84.7%), altering about 2.72% of all phrases.

At a calibrated 1% false-positive price, detection required roughly z ≥ 2.45.

And this is the end result with an attention-grabbing view:

The principle limitation is pattern measurement. A single paragraph had solely about 13 usable slots. Even an ideal 13-for-13 match reaches solely about z = 3.6, leaving little room for noise.

Throughout 5 paragraphs, although, the typical rose to 64 slots, with z round +6.66 and ideal detection within the take a look at set.

The sensible takeaway: word-choice watermarks work at doc size, not tweet size.

3.2.3 Detection ratio throughout strategies

Deleting 30% of sentences nonetheless left about half the paragraphs detectable as a result of surviving slots saved their unique bits.

Partial copying performs worse largely as a result of there are too few observations. Half a paragraph might include solely six slots, and six coin flips can not produce sufficient statistical proof to cross the detection threshold.

In distinction, a full paraphrase is totally different. Detection fell to 0%, with imply z = −0.29—basically the null distribution as a result of the paraphraser made recent phrase decisions, successfully re-flipping each coin.

3.2.4 The hidden value: textual content high quality

The larger drawback is {that a} technically legitimate synonym isn’t all the time a superb alternative.

Examples from the experiment included:

“Two {dollars} of filtered water repaired a concern I had thrown a number of hundred {dollars} at.” (unique: mounted an issue I had thrown a number of hundred {dollars} at)

and

“a water heater failed and worth me a ceiling” (unique: value me a ceiling)

The substitutions are comprehensible, however clearly worse. value → worth, for instance, works in some noun contexts and fails as a verb.

To measure that value, I used Qwen2.5-7B-Instruct as an impartial evaluator.

The end result was clear:

• Each marked paragraph turned much less possible underneath the language mannequin.

• The common paragraph contained 5.9 swaps.

• About 1 in 6 paragraphs gained a grammatical error.

So the tradeoff is easy:

extra compelled phrase decisions → stronger statistical sign → larger threat to the writing high quality.

The most secure model makes use of a small, hand-audited set of genuinely interchangeable pairs—and nonetheless requires a human learn earlier than publication.

3.3 Approach 3 — marking the that means

The primary two strategies fail underneath paraphrasing for a similar purpose: the watermark lives within the wording. Rewrite the wording, and the mark disappears.

So what if the watermark lived within the that means as a substitute?

That’s the concept behind PostMark (Chang et al., EMNLP 2024) and an identical embedding-based strategy described by Jina AI.

Right here is the move:

1. Maintain a secret record of unusual phrases.

2. Use an embedding mannequin to search out which phrases are most semantically associated to the doc.

3. Ask a language mannequin to weave a number of of these phrases naturally into the textual content.

If the that means stays comparable, the identical uncommon phrases stay related — and since these phrases now carry precise content material, a rewriter might maintain them.

For my experiments, I used BAAI/bge-m3, a multilingual embedding mannequin. I didn’t use jina-embeddings-v3 due to its non-commercial license.

3.3.1 Getting the detector proper

My first detector appeared robust — till I examined it on clear textual content.

It in contrast semantic key phrases from the suspect textual content with the planted watermark phrases and flagged 62.7% of translated samples.

But it surely additionally flagged 100% of the unwatermarked originals.

Why? Each units mirrored the doc’s that means, so the detector was measuring semantic similarity, not the watermark.

“Is that this semantically the identical doc?”

not

“Does this doc include a watermark?”

The legitimate black-box detector

PostMark’s precise detector wants solely the suspect textual content. It:

• Understands the textual content’s that means. It converts the suspect textual content into an embedding—a numerical illustration of its semantic that means.

• Makes use of that that means to pick out secret phrases. From its secret desk, it finds the ok phrases most semantically associated to the textual content. Right here, ok simply means some predetermined quantity, similar to 20.

• Counts matches. It checks what number of of these chosen secret phrases really happen, actually, within the suspect textual content.

Unmarked textual content not often comprises these unusual phrases by coincidence. Nevertheless, watermarked textual content does. Utilizing a threshold calibrated to a couple of 1% false-positive price, this turned the detector I report.

3.3.2 Outcomes: robustness comes at a price

With ok = 4 phrases per paragraph, Gemma-2-9b-it efficiently inserted 93.5% of the requested phrases, whereas growing textual content size by 15.8%.

Clear detection was almost good, even on a single paragraph.

Paraphrasing was a lot more durable:

• 9.3% black-box detection after rewrite

• 32.7% with a detector allowed to reference the unique

• 0% after direct Chinese language translation

The interpretation result’s unsurprising: the planted English phrases disappear. A multilingual embedding mannequin can nonetheless acknowledge the that means, however semantic similarity alone isn’t proof of a watermark.

The weak paraphrase end result at ok=4 additionally turned out to be partly a configuration concern. With solely 4 planted phrases, shedding one phrase modifications the rating dramatically.

So I repeated the identical experiment with ok = 12.

Paraphrase survival improved by roughly 4×, whereas the measured false-positive price stayed round 0.7%.

That results in a extra helpful conclusion:

Semantic watermarking turns into extra proof against paraphrasing as you insert extra watermark-bearing content material.

However that robustness has a price. At ok=12, the mannequin inserted solely 80.6% of the requested phrases, down from 93.5% at ok=4. Working a dozen uncommon phrases into roughly 215 phrases of prose begins to have an effect on naturalness.

In different phrases, the trade-off is:

extra watermark → higher robustness → extra rewriting and worse readability

At a sensible insertion price, the strategy detected roughly a 3rd of paraphrased passages in my checks. That was considerably higher than the opposite watermark households I examined, however nonetheless removed from dependable sufficient for one thing like a authorized attribution declare.

Copy caveat

This was a partial copy, not a direct replication of PostMark.

PostMark makes use of GPT-4o for phrase insertion. I used a 9B open mannequin, ~215-word passages, and an deliberately aggressive paraphraser.

3.4 Approach 4 — rigged sampling

The sooner strategies might be added to textual content after it’s written. This one is the alternative. It has to occur whereas the language mannequin is producing every token.

A language mannequin writes by repeatedly selecting the following token from a chance distribution. Every selection is successfully a coin flip, and a web page of textual content comprises hundreds of them. The watermark works by rigging these random decisions in a manner solely the detector can acknowledge.

Scott Aaronson described the core concept in 2022, based mostly on work with OpenAI engineer Hendrik Kirchner: maintain the mannequin’s regular chances, however substitute atypical randomness with keyed pseudorandomness based mostly on a secret key and the previous tokens.

To a reader, the output appears regular. To somebody with the important thing, the sequence comprises a detectable statistical sample.

There are two main approaches: green-list watermarking and match sampling.

3.4.1 Kirchenbauer et al. — green-list watermarking

At each step, the vocabulary is cut up pseudorandomly right into a inexperienced record and a pink record. Inexperienced tokens obtain a small chance enhance.

The mannequin nonetheless has many cheap phrases to select from, however over tons of of tokens it selects inexperienced phrases extra typically than likelihood predicts.

Detection is straightforward: depend the inexperienced tokens and calculate a z-score.

3.4.2 SynthID-Textual content — match sampling

DeepMind’s SynthID-Textual content makes use of a distinct technique. It samples a number of candidate tokens and runs them via a pseudorandom match to resolve which one wins.

Its key benefit is a non-distortionary mode, designed so the general token distribution stays unchanged. SynthID-Textual content is used with Gemini and is offered in open-source tooling.

3.4.3 Different watermarking strategies

Meta’s watermarking analysis added stronger statistical ensures and assist for multi-bit payloads.

A extra shocking end result got here from Watermarking Makes Language Fashions Radioactive: researchers discovered {that a} watermark may stay statistically detectable in a new mannequin skilled partly on watermarked textual content. Of their experiments, the impact was measurable with solely 5% contaminated coaching knowledge.

OpenAI additionally developed a textual content watermark that reportedly carried out very effectively internally on lengthy passages, however didn’t launch it. Its said issues included translation, paraphrasing, and easy character-level edits — the identical assaults that weaken most textual content watermarks.

3.4.4 Does it maintain up?

I examined Kirchenbauer and SynthID utilizing Gemma-2-9b-it on the identical 30 prompts:

• 20 open-ended prompts

• 10 factual prompts

• 3 random seeds

• 400 tokens per response

• Detection examined at 50, 100, 200, and 400 tokens

• Thresholds calibrated to a 1% false-positive price

The largest discovering was not which watermark gained. It was how a lot freedom the mannequin had whereas writing.

On open-ended prompts, each schemes labored effectively.

SynthID was stronger at each examined size. It reached at roughly 200 tokens the detection efficiency Kirchenbauer wanted about 400 tokens to realize.

At 400 tokens, SynthID detected 100% of the watermarked open-ended generations on this experiment.

The lesson is straightforward:

Extra tokens + extra attainable phrase decisions = extra sign.

On factual prompts, each strategies carried out poorly.

Contemplate:

Record the eight planets so as.

There’s little or no freedom in what comes subsequent. The mannequin can not favor a watermarked token if doing so would make the reply fallacious.

No selection means no helpful coin flip. No coin flips means no watermark sign.

This is likely one of the greatest limitations of generative watermarking: it’s naturally weak on quick textual content, factual solutions, code, and different extremely constrained outputs.

Repetition additionally causes issues. In my factual checks, unmarked outputs produced unusually unstable detection scores as a result of forcing easy factual solutions to 400 tokens led the mannequin to repeat itself, breaking among the statistical assumptions behind detection.

Paraphrasing removes a lot of the sign. The largest sensible weak point was rewriting. After passing the 400-token watermarked outputs via Qwen2.5-7B-Instruct for paraphrasing, detection on open-ended textual content fell from:

• Kirchenbauer: 95.0% → 23.3%

• SynthID: 100% → 11.7%

On factual textual content, each fell to 0%.

That matches the broader weak point of this complete approach: the watermark belongs to the mannequin’s unique token decisions. As soon as one other mannequin rewrites these decisions, a lot of the statistical sample disappears.

Era value

In naive implementations, watermarking additionally provides computation throughout each technology step.

The reference implementations in transformers carry out further processing repeatedly in Python, so benchmark numbers ought to be handled as an higher certain, not as the price of an optimized manufacturing system.

The helpful comparability is relative:

Event sampling was cheaper than green-list watermarking in my checks, however neither was free.

Massive suppliers can combine the identical logic a lot deeper into their serving infrastructure, lowering that overhead considerably.

Sensible takeaway

Generative watermarking works finest when textual content is lengthy, open-ended, and left largely unchanged. It turns into a lot weaker when the output is quick, factual, repetitive, translated, or paraphrased.

So if an LLM is producing artistic textual content and also you need the unique output to be traceable, these schemes can work remarkably effectively.

But when somebody rewrites the textual content — or the mannequin had little freedom to start with — there might merely not be sufficient statistical sign left to detect.

3.4.5 The detection toolkit

When you discover a web page that appears suspiciously like yours, run:

python detect-watermark.py suspect.txt --key "my-secret-key"

Actual output, on a marked article:

Checking 1,127 phrases.  [ -- ] No invisible characters. Nothing hidden between the letters.  [HIT ] KEYED WORD PATTERN FOUND - 80 of 80 phrase decisions match your key         (z = 8.94, p = 1.9e-19). Probability alone would do that in lower than         one unmarked textual content in a trillion.VERDICT: this textual content carries a watermark.Bear in mind what which means: it's robust proof of copying, not proof ofpossession. Genius caught Google with a watermark and nonetheless misplaced in courtroom.

And on a clear passage no person ever marked:

  [ -- ] No invisible characters. Nothing hidden between the letters.  [ -- ] Phrase decisions look atypical - 17 of 36 match your key (z = -0.33).         That's what unmarked textual content appears like.VERDICT: no watermark discovered.

What it checks

The detector can run three checks:

• Zero-width watermark: decodes any hidden payload and reviews the proprietor ID.

• Keyed watermark: with --key, recomputes every keyed slot and applies a z-test, flagging outcomes at z ≥ 2.45.

• Semantic watermark: with --semantic phrases.json, runs the embedder. If the dependency is lacking, it fails gracefully with an set up trace.

4. Which watermark for which menace

These strategies don’t actually compete. They fail underneath totally different assaults. So the helpful query isn’t which watermark is finest? It’s what are you defending in opposition to?

4 sensible guidelines

• Mark at article size, not paragraph size.
  The keyed phrase mark rises from 73.3% detection at 215 phrases to 100% at 1,075 phrases. Extra textual content is the most affordable robustness you should purchase.

• Layer impartial marks.
  Zero-width characters and keyed phrase decisions don’t intrude with one another. A sanitizer that removes one can depart the opposite fully intact.

• Calibrate on unmarked textual content first.
  Set thresholds utilizing human-written textual content you by no means watermarked. I examined in opposition to 100 unmarked passages; that verify uncovered a detector that in any other case appeared dependable.

• Save the important thing while you publish.
  Report the key, ID, or thesaurus used for every watermark. You’ll want it later to confirm the mark.

When you can’t reproduce the detection, you don’t actually have a watermark.

5. References and sources

Core strategies

• A Watermark for Massive Language Fashions — Kirchenbauer, Geiping, Wen, Katz, Miers, Goldstein, 2023 · arXiv:2301.10226. The inexperienced/pink record scheme; applied in transformers as WatermarkingConfig.

• Scalable watermarking for figuring out giant language mannequin outputs (SynthID-Textual content) — Dathathri et al., Nature 634, 818–823, October 2024 · doi:10.1038/s41586-024-08025-4. Event sampling with a non-distortionary mode; google-deepmind/synthid-text, License Apache-2.0.

• PostMark: A Strong Blackbox Watermark for Massive Language Fashions — Chang, Krishna, Houmansadr, Wieting, Iyyer, EMNLP 2024 · arXiv:2406.14517. The semantic watermark this text reimplements at small scale.

• Three Bricks to Consolidate Watermarks for Massive Language Fashions — Fernandez, Chaffin, Tit, Chappelier, Furon, WIFS 2023 (Greatest Scholar Paper) · arXiv:2308.00113. Grounded statistical checks with assured FPR, and multi-bit payloads.

• Watermarking Makes Language Fashions Radioactive — Sander, Fernandez, Durmus, Douze, Furon, NeurIPS 2024 · arXiv:2402.14904. Watermark traces survive into fashions skilled on the marked textual content.

• The hiding virtues of ambiguity: quantifiably resilient watermarking of pure language textual content via synonym substitutions — U. Topkara, M. Topkara, Atallah, MM&Sec ’06 · doi:10.1145/1161366.1161397. The ancestor of approach 2.

• Watermarking GPT outputs — Scott Aaronson (with Hendrik Kirchner), 2022 · discuss slides. The keyed-pseudorandomness proposal.

• A Survey of Textual content Watermarking within the Period of Massive Language Fashions — Liu, Pan, Lu, Li, Hu, Zhang, Wen, King, Xiong, Yu · ACM Computing Surveys 57(2), Article 47, 2024 · doi:10.1145/3691626 · arXiv:2312.07913.

Fashions used

• google/gemma-2-9b-it — 9B instruction-tuned mannequin; planted the keyed and semantic marks and generated Exp 3. Gated weights underneath the Gemma Phrases of Use.

• Qwen/Qwen2.5-7B-Instruct — 7B instruction-tuned mannequin; ran each paraphrase, translation and readability rating, so the attacker isn’t the mannequin that planted the mark. License Apache-2.0.

• BAAI/bge-m3 — multilingual embedding mannequin, License MIT. Chosen over jina-embeddings-v3, which is CC-BY-NC and is cited right here as prior artwork solely.

Information

• Corpus (50 weblog paragraphs, 203–235 phrases). Written by the writer for this text; no third-party licence applies.

• Negatives (100 passages, 150–299 phrases). Undertaking Gutenberg, public area — 10 passages every from Satisfaction and Prejudice, Alice’s Adventures in Wonderland, Moby Dick, Frankenstein, The Adventures of Sherlock Holmes, A Story of Two Cities, The Image of Dorian Grey, Dracula, Coronary heart of Darkness, and A Doll’s Home. Gutenberg header and footer stripped earlier than use.

Business and regulation

• Anthropic, “Claude’s textual content watermark”, August 2, 2026 · anthropic.com/information/claude-text-watermark

• OpenAI’s unreleased textual content watermark, reported by the Wall Road Journal, August 2024 (secondary protection: Tom’s {Hardware}, Engadget)

• EU AI Act Article 50 and the Code of Apply on Transparency of AI-generated Content material, July 2026 (~190 signatories) · European Fee

• China CAC “Measures for Labeling AI-Generated Content material” and necessary customary GB 45438-2025, efficient September 1, 2025 · Covington Inside Privateness

The tales

• Genius vs Google: CNBC on the swimsuit; TechCrunch on the August 2020 dismissal.

• Tesla’s 2008 canary-trap emails, per Musk’s personal account · The Intercept. Different accounts of the incident differ.

• Mountweazels, esquivalience, lure streets and Agloe · Wikipedia, “Fictitious entry”

• Zach Aysan, “Fingerprinting with Zero-Width Characters”, December 2017 · zachaysan.com

• Thinkst Canarytokens — free honeytokens together with Phrase-document beacons, DNS tokens and pretend AWS keys · canarytokens.org

Tooling

• MarkLLM — open toolkit implementing many watermarking schemes with a visualization layer; THU-BPM, EMNLP 2024 demo · arXiv:2405.10051 · THU-BPM/MarkLLM. Value a glance if you wish to examine schemes past the 2 constructed into transformers.

• Hugging Face, “AI Watermarking 101” · huggingface.co/weblog/watermarking