Yes for closed frontier models, and structurally never for open weights. That split is the entire story, and everything else about AI watermarking follows from it.
The question got sharper on August 11, 2026, when an Anthropic engineer on the Claude Code team responded to the Claude watermarking announcement with a direct statement of intent: "This is part of working with the EU AI Act, other labs are adding similar watermarking. It's hard to identify AI-generated text, and this gives people better tools to do that." He added that Anthropic will also ship a text detection API that anyone can use.
So the convergence is real and acknowledged. The interesting question is what it converges on, and what it can never reach.
TL;DR — the state of play
| Question | Direct answer |
|---|---|
| Does Google watermark? | Yes — SynthID across generative image, audio, video, and text |
| Does Anthropic? | Yes — all text from models launched on/after August 2, 2026 |
| Does OpenAI? | Not confirmed. Unicode oddities in output have been described as quirks, not a mark |
| Are other labs joining? | Per Anthropic, yes — "other labs are adding similar watermarking" |
| Can open-weight models be forced to? | No. The mark lives in the sampler, which the operator controls |
| Is the model aware it's watermarking? | No — it happens below the model, in the sampling layer |
| Does it survive copy-paste? | Yes. Editing degrades it; heavy paraphrase generally destroys it |
| Does it work on code? | Poorly. Low-entropy output has too few equivalent choices |
| What's forcing this? | EU AI Act Article 50 and California transparency law |
How the mark actually gets in
The mechanism is worth understanding precisely, because most of the arguments about watermarking are really arguments about where in the stack it lives.
At each generation step a language model produces a probability distribution over next tokens. A sampler picks one. In ordinary decoding that choice depends on temperature and the distribution itself. In a watermarking scheme, a secret key partitions the vocabulary and the sampler is nudged toward the key's preferred subset whenever multiple tokens are roughly equivalent. A detector holding the same key re-scans the text, measures how far the actual token choices skew toward that subset versus chance, and reports a confidence score once enough tokens accumulate.
Three consequences fall directly out of that design, and each one answers a question people keep asking:
The model does not know. Asked whether the agent would be aware of the traces it was inserting, the Anthropic engineer answered flatly: "agent will not be aware." Watermarking sits below the model in the serving stack — a layer above the API response, not something the model reasons about. You cannot prompt it away, and the model cannot tell you whether a given passage is marked.
It needs entropy. The scheme works by choosing between equivalent options. Prose has enormous flexibility — dozens of ways to phrase a sentence with no meaning change. Code does not. If the correct next token is return, there is no equivalent alternative, and no signal can be embedded there. This is the single strongest technical objection raised in the developer backlash, and it is correct: code carries far less watermark signal than prose, which makes the "check whether this PR was written by Claude Code" use case — one the Anthropic engineer explicitly named — the weakest application of the technology, not the strongest.
It slightly perturbs output. By definition the sampler is not emitting the token it would otherwise pick. In high-entropy prose the alternatives are near-equivalent and the cost is negligible. It is not zero, though, and "the model is no longer giving you its unmodified output" is a fair characterisation, if a small one in practice.
Who marks what, as of August 2026
| Provider | Text watermark | File/media provenance | Public detector |
|---|---|---|---|
| Yes — SynthID, in production for years | Yes, across image/audio/video | Partial, ecosystem tooling | |
| Anthropic | Yes — models from August 2, 2026 | C2PA on supported file types | API announced, not shipped |
| OpenAI | Not confirmed | C2PA on image output | No |
| Open-weight models | Not enforceable | N/A | N/A |
Google's SynthID is the reference implementation everyone else is measured against, and the Anthropic engineer pointed to it directly when asked how the technology works. That is a meaningful admission: the frontier labs are not each inventing a scheme, they are converging on a published approach with known properties — including its known weaknesses.
Why open weights break the whole thing
This is where the universal-watermarking thesis fails, and it fails for reasons no amount of regulation resolves.
The watermark is applied by the sampling pipeline. If you download open weights and run them yourself, you control the sampling pipeline. Replacing a watermarking sampler with a standard one is a small code change, and in an open ecosystem it happens within days of release, permanently, in public.
You can require open-weight publishers to ship watermarking samplers. You cannot require the person running the weights on their own hardware to keep it — and there is no technical mechanism to detect, at inference time, whether they did. Enforcement would require controlling execution, which is exactly what open weights preclude.
The downstream effects are concrete rather than theoretical:
- A permanently unmarked tier exists. Anyone who wants unmarked output has a supported, legal, high-quality path to it. The strong open-weight models we cover — from Nemotron and Qwen-class releases to Chinese frontier open models — are good enough that "switch to open weights" is a real answer, not a sacrifice.
- The marks land on the compliant. Watermarking catches the person using the official API for legitimate work and misses the person who deliberately wants to evade it. That is an inverted incidence curve, and it is the most substantive criticism of the entire approach.
- Adversarial use routes around it first. Propaganda operations and bulk content farms — the harms most often cited to justify marking — are the users least likely to be running a marked frontier API in the first place.
- It advantages non-compliant jurisdictions. If marking is a regulatory burden that only Western closed labs carry, the competitive effect is real, and this argument is being made loudly. Whether it outweighs the transparency benefit is a genuine policy dispute rather than a settled one — our open-weight versus closed model guide covers how the tradeoff looks from the buyer's side.
What the marking is actually good for
Given all of that, is watermarking pointless? No — but its honest value proposition is narrower than the framing around it.
It is not a forensic tool. The Anthropic engineer conceded the point directly when a user asked whether it was easy to bypass: "yeah it's not perfect, you can edit it but it's a first step." Anyone building a policy that treats a watermark hit as proof is misusing it, for reasons we covered in how to detect a Claude watermark.
It is a scale filter. Where marking helps is high-volume triage: a platform screening millions of uploads, a journal screening submissions, a marketplace screening listings. At that scale, a signal that catches the lazy majority and misses the determined minority still removes most of the volume. That is the same logic behind Spotify demoting AI-generated artist profiles — the goal is repricing bulk output, not adjudicating individual cases.
It is a distillation tripwire. The accusation raised repeatedly in the backlash — that the real motive is detecting when a competitor trains on your model's outputs — is probably partly true, and is not obviously illegitimate. If a rival model's training data is full of your watermark, that is evidence. Labs have not led with this justification because "we are protecting our moat" markets worse than "we are helping you identify AI content," but it is a coherent reason to build it.
It is regulatory compliance. The most honest answer to "why now" is Article 50 and its California analogue. The Anthropic engineer said so in his first sentence. Compliance-driven features get built to satisfy the requirement, which is why they tend to be first steps rather than complete solutions.
The developer objection worth taking seriously
The loudest community reaction — a widely-upvoted thread arguing "our data, Anthropic's mark?" — mostly conflates marking with ownership, and on that specific point it is wrong. A provenance signal is not a copyright claim, and Anthropic's terms still assign output rights to the customer.
But strip away the ownership framing and a real concern remains, and it is this: a persistent, machine-readable signal that AI touched your work can become consequential in contexts you do not control. Large codebases accumulate marks across thousands of files. Third parties will eventually be able to scan for them. Due diligence in an acquisition, an employment policy, a compliance audit, or a future platform rule could all treat that signal as meaningful — and none of those processes will be careful about the difference between "Claude wrote this" and "Claude reformatted this."
That is a legitimate thing to plan around, and the planning is not exotic. Keep your own provenance trail. Know which parts of your stack were AI-assisted and to what degree, before someone else's scanner tells a worse version of that story. It is the same discipline that OpenJDK's outright ban on AI-generated contributions is a blunter response to.
Bottom line
Every closed frontier model will watermark its output, and soon — regulation requires it, Google has done it for years, Anthropic just did it, and Anthropic says the others are following. No open-weight model will reliably carry a mark, because the mark lives in code that the operator owns.
That leaves a permanent two-tier world: a marked tier used by people doing ordinary work through official APIs, and an unmarked tier available to anyone with a GPU and a reason. Watermarking is genuinely useful for filtering volume at platform scale. It will never be useful for catching someone who does not want to be caught, and every honest description of it — including the one from the engineer who shipped it — says exactly that.
Related on explainx.ai
- Anthropic is watermarking Claude text — the announcement that triggered this question
- How to detect a Claude watermark — what verification actually looks like today
- Are AI watermarks monetisable? — the business model forming around detection
- The case FOR AI watermarks — the counterweight to this post's skepticism
- How AI text watermarking actually works — the sampler-level mechanism open weights escape
- Spotify labels AI artists — provenance signals becoming ranking inputs
- Open-weight vs closed models: how to choose — the tier this analysis says now diverges further
- EU AI Act and US policy: complete guide — the Article 50 machinery behind the timing
- LinkedIn's C2PA Content Credentials — the metadata approach that copy-paste defeats
- LLM text detection with classical ML — what detection looked like before watermarks
- OpenJDK bans AI-generated code — a project responding to exactly this signal
Primary sources: Anthropic engineering commentary on X (August 11–12, 2026) · Anthropic Help Center, "How Claude marks AI-generated content" · Google SynthID documentation · EU AI Act Article 50(2) Code of Practice
Accurate as of August 12, 2026. Statements about watermarking mechanics describe the general published approach in the literature and Google's SynthID as a reference; Anthropic has not published its exact scheme. Provider comparison reflects public statements at time of writing. Follow @explainx_ai for updates.