Trends
In July 2026, ten people a month typed "ai text watermarking" into Google. In August it was 1,000, and the term went from a research phrase to a mainstream search in a single month (Rising Trends data as of Aug 2026). Nothing about the technique changed that month. What changed was the law: on 2 August the EU AI Act's marking obligations came into application, and within two weeks Anthropic had published an explainer on how its watermark works.
Almost everything ranking for the term is a vendor page selling you a way around it. That is the part worth sitting with. The removal side of this market is more than ten times the size of the technique itself, and it got there first. Below is what the mark actually is, who is shipping it, what the regulation requires, and the one number that tells you how easily it comes off.
Key takeaways:
- "ai text watermarking" went from 10 searches in July 2026 to 1,000 in August, up 3,233% year over year and classified EXPONENTIAL in the Rising Trends database (data as of Aug 2026).
- The mark is not a hidden character. It lives in which of several equally good words the model picked, chosen with a secret key instead of a plain random number.
- The removal terms are bigger than the method. "ai watermark remover" runs at 12,100 searches a month against 1,000 for the technique.
- OpenAI published the number everyone else avoids: on 400-token passages, swapping 10% of the words cut detection from about 92% to 66%, and swapping 25% cut it to 17%.
- Only Anthropic can read Anthropic's mark and only OpenAI can read OpenAI's. Both detectors are private preview, open to regulators, researchers and fact-checkers rather than to you.
- The fastest-growing term in the whole cluster is not a remover. It is "synthid detector", up 1,043% in a year. People are starting to check rather than strip.
Let's get into it.
The curve
Here is the five-year search history for the term, straight from our database. For four years it is a flat line along the bottom, the signature of a phrase that lives in papers and nowhere else.
Two years ago the term had zero recorded volume. A year ago it had 30. Over the last three months it averages 343, and that average is doing a lot of work, because July was 10 and August was 1,000. This is not a ramp. It is a step, and the step lands on the month the rule did.
The curve on its own would be unremarkable. What makes it interesting is the company it keeps.
The term for the technique sits at the bottom of its own family. "ai watermark remover" is 12,100 searches a month, twelve times the thing it removes, and "remove ai watermark" adds another 1,900. Those two predate text marking and are mostly people trying to get a logo off a picture, so do not read them as pure text demand. But the shape is still the point: the counter-tool market was built and ranked long before the technique arrived, and it is sitting there ready. C2PA, the file-metadata standard that handles images, pulls 4,400. You can follow all of it on the live ai text watermarking trend page.
What the mark actually is
Start with what it is not. It is not white text, a zero-width space, a Unicode trick or a tag in the file. Anthropic's explainer is blunt about it: "Nothing is added to the text and there are no hidden characters."
Here is the mechanism. A language model writes one token at a time, and at most decision points several words are equally good. In "the weather today was cold and...", both "overcast" and "grey" work. Normally a random number settles it. A watermarked model uses a secret key plus the few words before it to settle it instead. In Anthropic's words, "the words that Claude picks are still random, but now, one can check the sequence of words and see if it's consistent with the choices Claude would make if it was using the key."
That page, published on 14 August 2026, is the first plain-English account of the method from a frontier lab, and the three limits it lists are the ones that matter. Detection "doesn't work well on small samples", because a short passage holds too few choices to measure. The mark is "sparser on factual passages", because when the next word has to be "Mathematica" there is no choice to encode anything in. And code gets very little of it, for the same reason: exact output leaves no room.
The technique is not new and it is not Anthropic's. It is a version of SynthID-Text, which Google DeepMind published in Nature in 2024 after testing it live across nearly 20 million Gemini responses and finding no measurable change in quality. Anthropic traces the family further back, to a 2022 proposal by Scott Aaronson. What is new in 2026 is that three labs shipped it at once, and the reason is regulatory rather than technical.
Why it broke out in August
Article 50(2) of the EU AI Act says providers of systems generating synthetic text "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated", and that the solution must be "effective, interoperable, robust and reliable as far as this is technically feasible". There is a carve-out for systems performing "an assistive function for standard editing". Those obligations came into application on 2 August 2026.
Ahead of that date, the European Commission reported that about 190 organisations had signed the Code of Practice on Transparency of AI-generated Content, the voluntary route to demonstrating compliance. Anthropic, Google, Meta, Microsoft, Mistral, Cohere and OpenAI are all on the provider list.
So the sequence runs: 2 August the rule lands, 11 August Anthropic's support page goes up, 14 August the explainer follows, and the search curve moves from 10 to 1,000 inside the same month. Then on 5 October OpenAI published its own approach, which is when the story reached people who do not read AI policy. This clip on the OpenAI rollout, posted on 9 October, is the version most people met it in.
Note what the clip gets right and what the headlines got wrong. OpenAI is not watermarking ChatGPT everywhere. It is doing so in the EU only.
Who is actually shipping it
Three labs, three different bets on how far to go.
| Provider | Method | Where it applies | Who can detect it |
|---|---|---|---|
| Anthropic | SynthID-Text variant | Supported models, worldwide, all surfaces | Private preview |
| OpenAI | textGrain | EU only for ChatGPT and Codex; opt-in in the API | By application |
| Google DeepMind | SynthID-Text | Gemini app and web | SynthID Detector |
Anthropic went widest. Its support page on marking AI-generated content lists 16 Claude models, of which 9 currently carry text watermarks, with the rest covered by the law's transition period for models released before 2 August. All 16 attach C2PA Content Credentials to generated files. Marking is applied at the model level and worldwide, which the company explains plainly: it does not yet have "a durable way to scope it by region".
OpenAI went narrow and published its failure rates. Its approach to EU text provenance rules puts textGrain behind an opt-in flag in the API, off by default, and applies it to ChatGPT and Codex in the EU only. The textGrain technical report carries the method. On benchmarks, the watermarked and unwatermarked versions of its Astra model land within a point of each other, 94.44% against 93.94% on GPQA Diamond.
Google got there two years early. SynthID covers text, image, audio and video, and it is the only one of the three with a detector the public has heard of. That shows up in the search data.
The growth ranking is the opposite of the volume ranking. The marking terms are the ones moving: synthid detector is up 1,043% in a year and "ai watermark" is up 1,025%, while ai watermark remover crawled 22%. The removal business is large and flat. The checking business is small and compounding.
What changes if it works
Detection stops being a guessing game and becomes a permissions question. Today's AI checkers read style: they look for the tells, the phrasings models overuse. Anthropic notes two of its own, a fondness for "this isn't [X], it's [Y]" and heavy use of the word "quietly". A watermark needs none of that. It is a statistical test against a key, and it either matches or it does not. The catch is that only the lab holding the key can run it, which turns detection into something you apply for rather than something you buy. That is a real shift for the cybersecurity and compliance tooling market, which is used to buying detection outright.
The scrubbing industry is selling the wrong fix. The tools that strip zero-width characters and em dashes are solving a 2023 problem, as we found when we looked at the AI text cleaner trend. Nothing was added to the text, so there is nothing of that kind to remove. What does weaken the mark is rewriting, and the tools that do that are a different product.
Compliance becomes a model-selection question. If you build on Claude, your outputs carry a mark whether or not you serve the EU. If you build on OpenAI, they do not unless you turn it on. That is now a line item in a procurement checklist, alongside the governance questions running through the wider generative AI stack.
The skeptic's view
The strongest objection is mathematical, and it predates every announcement above. In "Watermarks in the Sand", presented at ICML 2024, Hanlin Zhang, Boaz Barak and four co-authors proved that under natural assumptions, strong watermarking is impossible. Their attacker needs no key and does not need to know which scheme is in use. It needs only a way to judge quality and a way to perturb text. They removed the marks of three published schemes "with only minor quality degradation".
OpenAI's own numbers say much the same in applied terms. Replacing 10% of the words in a 400-token passage drops detection from about 92% to 66%. At 25%, it falls to 17%. Anthropic puts it in a sentence: "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will."
The second objection is about who gets caught. James Padolsey, who built the interactive explainer that most engineers learned this from, argued in August that Anthropic's blanket approach goes further than the law requires and lands on the wrong people. "The result is a signal broad enough to implicate harmless and assistive use, yet fragile enough to be removed by a motivated person through substantial recomposition," he wrote. "A watermark that burdens the candid and yields to the deceptive is not meaningful transparency. It is compliance theatre."
The third objection is about the prose. John Gruber called the scheme a perversion of writing, on the grounds that "no two synonyms carry the exact same meaning" and that a model nudged toward one of them is no longer picking the best word for the reader. "The idea that anything other than my needs should factor into the generation of text for me is patently offensive," he wrote. His post drew 825 points and 731 comments on Hacker News, roughly eleven times the attention Anthropic's own explainer got there. The argument that a 51-49 nudge measurably degrades writing is not settled, and Google's 20-million-response experiment is evidence against it. But the volume of the reaction is itself a data point about how this landed.
What to watch
Watch whether detection opens up. Both detectors are gated today. If either opens to the public, "ai text watermarking" stops being a term people look up once and becomes a workflow, and you would see it in the ai text watermarking curve before you see it in a press release.
Watch the detector terms against the remover terms. "synthid detector" at 2,400 and growing 1,043% a year against "ai watermark remover" at 12,100 and growing 22% is the live scoreboard for whether this becomes infrastructure or stays a nuisance. The day a remover term starts compounding again is the day someone shipped something that works.
Watch the carve-out. Article 50 exempts systems doing "standard editing". Anthropic already concedes that a lightly proofread document may carry no detectable mark at all. If regulators tighten that boundary, the blast radius moves from people generating text to people merely using assistance, which is the fight Padolsey picked. Our AI category hub tracks where the surrounding terms are heading.
The honest summary is that three labs have shipped a technique that works well on long, unedited, discursive text and poorly on everything else, because a law required something and this was the something available. It is a useful provenance hint and a terrible proof. The search data says the public worked that out quickly: they searched for the remover first, and they are only now getting round to the thing being removed.
Want to catch a term like this in the month it steps from 10 searches to 1,000? Read our guide on how to identify market trends, follow the live ai text watermarking dashboard page, or see what is breaking out right now on the Rising Trends dashboard.
