A watermark in plain text sounds impossible: text has no pixels to hide data in, and no metadata survives copy-and-paste. Yet Google has watermarked text from the Gemini app and web experience since 2024, and as of August 2026, new Claude models mark text at the model level. The marks are invisible, survive copying, and work because they live in the choices between characters, not in the characters themselves.

Writing is a series of small choices. A model writes by rolling weighted dice among several words that would each be fine. At each fork, a secret key splits candidate words into green and red, then tilts the dice a little toward green. The nudge is mild: a red word can still win. With the key, you can re-colour any text and simply count how many came up green. Marked text lands green too often to be luck.

What editing does to the mark: it lives in runs of untouched wording. Editing erases it exactly where the runs break. On real implementations, about 0.5% of windows survive heavy edits, and detector accuracy falls from certain to a coin flip. Light or one-pass paraphrase dilutes the mark; it becomes detectable again after roughly 800 tokens (about 600 words). What removes the mark is recomposition that shares no runs of wording with the original.

Only the key-holder can check detection. Google runs an early-access detector portal for Synth ID; Anthropic says detection tooling is forthcoming. A watermark check is a deliberate, key-gated statistical test—not an "AI detector" like GPT Zero that guesses from style.