AI Watermarking 2026: Can It Really Stop AI Misuse?
On 2 August 2026, Anthropic began hiding an invisible signal inside everything Claude writes for you. Google does the same with Gemini. OpenAI has signed up to it too. The signal is called a watermark, you cannot see it, you cannot switch it off, and it is meant to answer one question later on: was this text written by a machine?
AI watermarking works by nudging the model's word choices as it writes, in a pattern that a detector holding the right key can recognise afterwards. Nothing is added to your text. No hidden characters, no metadata, no tag at the bottom. The mark lives in which words the model picked, and to anyone reading it, the text looks completely ordinary.
Every major AI lab now does this, because the EU's AI Act started requiring machine-readable marking of AI-generated content on that date. The stated purpose is specific: the law names five harms it wants to reduce, from disinformation campaigns to fraud, impersonation and fake reviews.
So this article does what a security assessment does. I take the control, I take the five harms the legislation itself names, and I work through what the mark actually reaches in each case, who commits those harms in practice, and what it costs an adversary to step around it. Along the way we cover how the technique works, what the research says about removing and forging the mark, what it costs to switch to an unmarked provider, and what any of this means if you run AI in production. That matters most in a future where models touch routine professional writing, from commit messages to client emails.
The short version of the headline question first, because you deserve it up front: no public detector exists yet, so today nobody outside the vendor can check anything. But that is the least interesting finding here. The more useful question is whether this control does the job it was built for, and that is what the rest of the piece measures.
What This Assessment Found
TL;DR: the verdict in four lines
Against the five harms the law names, coverage is partial in every case and zero in none.
One paraphrase, or an afternoon self-hosting, puts an adversary outside it.
The law exempts assisted editing. The mechanism cannot express that exemption, so it marks it anyway.
The law permitted a primitive anyone could verify. The vendor shipped one only it can read.
Start with the property everything else follows from: the mark records processing, not authorship, and Anthropic says so themselves. Generated from nothing, translated, or tightened by four words, the signal is identical. That would be a footnote if machine assistance were rare. It isn't going to be. A provenance signal carries information only when it's unusual, so as assistance becomes ambient, a mark meaning "a model was involved" ends up on the overwhelming majority of professional text and stops distinguishing anything. About as diagnostic as knowing the document was typed.
The operational limitation is simpler and, for now, decisive. As of 11 August 2026 there is no public verification path: no detector, no published specification. Nothing in this article can be checked by you, by me, or by anyone outside Anthropic.
A note on scope. This assesses Anthropic's announced text-watermark implementation, not the EU AI Act. Those are different objects, and conflating them is the most common error in the coverage I've read. Every attack I describe is published work, from ACL, ICML, NDSS and vendor threat intelligence. Nothing here is novel or disclosed for the first time.
This didn't start as a research question. I write, I use a model to tighten what I've written, and that now carries a mark as though a machine produced it. My own company is building everything through AI, not as an experiment but as the way the work gets done, so the annoyance turned into something more specific: if models eventually touch most professional writing, what will the mark still distinguish? That is what the rest of this measures, along with the question that follows it. This cost a great deal to build across an entire industry. Does it actually do anything?
Scope and Mechanism
Anthropic's marking has two halves: an embedded AI text watermark in generated text, and C2PA provenance metadata on generated SVG, PNG and JPG files. Worldwide, not just in Europe. No opt-out.
One precision worth holding onto: Anthropic's announcement is partly prospective. Models launched on or after 2 August support marking at launch. Older models are described as in progress. Detection documentation is described as forthcoming. Platform support may vary. So the honest statement is not "your Claude output is marked", it's "models launched on or after 2 August 2026 support marking at launch, and nobody outside Anthropic can currently confirm what any specific session produced."
The mechanism is worth understanding properly, because almost every popular explanation of it is wrong.
Nothing is inserted into your text. No hidden character, no invisible payload, no delimiter. At every word position, a secret key splits the model's entire vocabulary, roughly a hundred thousand tokens, into two halves. Call them green and red. The split reshuffles at every position, seeded by the words that came before. When the model picks the next word, green tokens get a small nudge upward in probability.
That's it. Every word in the output is an ordinary word. There's nothing anomalous to find.
Detection works backwards. The detector holds the key, replays the same splits across your text, and counts how often the words landed green. Human writing lands green about half the time by chance. Watermarked text runs higher. The question is whether the excess is too large to be luck.
In plain English
Imagine a dictionary where every word carries an invisible tick or cross, reshuffled after every word you write. The model is told: when you have a genuine choice between equally good words, lean toward the ticks. Any single tick proves nothing, because half of all words are ticks. But a thousand words that are sixty-five percent ticks did not happen by accident.
Which makes the signal a probabilistic assertion, computed by whoever holds the key, about whether a body of text is statistically unusual. And because it rests on statistics, length matters: a handful of words cannot establish a pattern, while a long passage gives the detector far more to work with. Hold that thought, because how much text you actually need turns out to be the most widely misreported fact in this whole subject.
Compare that to the primitive it's often confused with. A digital signature is deterministic: I sign with a private key, anyone holding an authentic copy of my public key verifies it, and the answer is yes or no. No secret needed to check. Identity binding, knowing the key really belongs to me, stays a hard problem for both. But the verification asymmetry is total. One is checkable by anyone; the other only by the vendor.
Five Stages: From Signal to Consequence
One distinction is worth fixing in your head before the assessment starts, because most argument about watermarking collapses it. A mark passes through five separate hands between being applied and mattering to anyone, and they are not the same hands.
Embedding. The bias applied during generation. Controlled by the vendor.
Verification. Reading the mark back. Requires the secret key. Controlled by the vendor.
Interpretation. Someone infers what a verification result means about a person. A third party does this.
Downstream decision. A consequence follows: a grade, a rejection, a takedown, an HR process. Institutions do this.
Regulatory enforcement. Statutory action against providers. Authorities do this.
The design effort and the verified capability sit in the first two stages. The harm to individuals lands in the third and fourth.
The Commission's guidelines do address provider marking, deployer labelling and enforcement authorities separately, so it isn't a governance vacuum. But the vendor specifies stages one and two and has published neither. And the translation from "this text is statistically unusual" to "this person did something wrong" is where a probabilistic signal meets an institutional decision, with no published specification to appeal against.
The Exemption the Signal Doesn't Encode
Here is the part I find genuinely interesting, and it took me a while to see it.
Article 50(2) of the EU AI Act watermarking rules contains a carve-out:
"This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof."
The Commission's guidance gives grammar correction as its example. Article 50(4) does something similar for published text: the disclosure duty falls away where content has undergone human review or editorial control and a person holds editorial responsibility for it.
Read those together and a pattern emerges. The law repeatedly defers to human editorial judgement. It draws a line between a machine producing something and a machine helping with something.
Now look at what shipped. Anthropic's marking applies to all generated text. There is no assistive-editing mode, no threshold, no distinction between "wrote this from nothing" and "fixed the commas."
The exemption means marking isn't required for assistive editing, not that it's prohibited. And conditional marking isn't impossible in principle: a provider could use dedicated editing modes, compare input to output, or classify the task. This isn't a claim about physics. It's a claim about the announced design. Article 50 exempts standard assistive editing from mandatory marking, yet Anthropic's all-output approach can mark proofreading and other assisted work. Its binary signal records processing, not the degree or the authorship of the contribution.
Anthropic's own documentation corroborates this. Their limitations section says a detected mark doesn't establish that Claude wrote the text, because people often use Claude to edit material they already had.
And that gap widens rather than staying still.
The exemption was presumably written imagining assistive editing as the edge case, the occasional grammar check against a baseline of human-written text. Run that assumption forward five years into AI-driven engineering, where a model touches the majority of professional writing before it ships, and the exemption stops describing the exception. It describes the norm.
Which means the category the law explicitly chose not to require marking for is the category that ends up marked most often. Not because anyone decided to override the carve-out, but because a binary signal applied at the sampling step has no way to honour it. The proportion of marked text that represents genuine machine authorship falls every year, while the proportion that represents a human being helped by a machine rises, and the mark reads identically for both.
A signal only carries information when it is unusual
2023
Marked text is the exception. The signal says something.
The direction of travel
Marked text is the norm. The signal says almost nothing.
Illustrative only. No prevalence data has been published, so these proportions are not measured and should not be read as data. Green blocks represent text carrying a mark.
The one thing
A signal degrades when the population it's measuring shifts underneath it. This one is measuring "was a model involved," in a world that is rapidly answering yes to everything.
What It Does Achieve
Before the coverage assessment, the case for the defence, stated properly, because an assessment that only prosecutes isn't an assessment.
Watermarking was never proposed as an enforcement mechanism. It's a provenance layer, and the honest version of the vendor's position is something like: the detector isn't intended to decide authorship, fraud or truth. It supplies one calibrated signal, usable in ranking, investigation, aggregate campaign analysis, and defence in depth.
That position has real content. A thousand long, unedited influence posts generated by a hosted model are detectable, and they're aggregatable: the statistical evidence across a campaign is far stronger than for any single post. It also raises friction for casual mass-generation, and creates an audit substrate platforms could build on if a detector ever ships.
One measurement problem cuts against me. Anyone deterred, who considered a marginal misuse and didn't bother because the output would be marked, is invisible to this analysis. You cannot measure deterrence by counting the people you didn't catch. I have no way to size that effect, and neither does anyone else.
Coverage Against the Five Named Harms
The AI Act's Recital 133 states the problem it's solving:
"A variety of AI systems can generate large quantities of synthetic content that becomes increasingly hard for humans to distinguish from human-generated and authentic content. The wide availability and increasing capabilities of those systems have a significant impact on the integrity and trust in the information ecosystem, raising new risks of misinformation and manipulation at scale, fraud, impersonation and consumer deception."
Five harms. Let's take each one and ask what a text watermark actually reaches.
| The harm | Who does it | Coverage | What limits it |
|---|---|---|---|
| Misinformation at scale | State networks: Doppelganger, Spamouflage | PARTIAL | Marked and aggregatable. Paraphrase or self-host and you are outside it. |
| Manipulation at scale | Same state networks | PARTIAL | Often uses true content, selectively framed. A mark cannot flag framing. |
| Fraud (BEC, phishing) | Organised crime: SE Asia, West Africa | PARTIAL | No detector to check with. Detection is post-hoc: the money is gone before anyone looks. |
| Impersonation | Organised crime (Arup: $25.6M) | PARTIAL / N.A. | Textual only, and not applicable to the Arup case: that was video and audio, outside a text mark. |
| Consumer deception | Fraud rings, reputation services | PARTIAL | Paraphrasing is trivial at volume. Human review farms predate AI. |
No row reaches full coverage. No row is zero either, and nobody has published prevalence, deterrence or detection-rate data, so the honest conclusion is that coverage is bounded.
On the first two harms, the coverage is genuine. Google's threat intelligence names DPRK, Iran, PRC and Russia as operationally using AI, and a campaign like Russia's Doppelganger or China's Spamouflage generates exactly the long-form hosted output the mark handles best. Detection strengthens as evidence accumulates across a campaign, so this is the one place the technique does what it was built for. What sits outside it is everything those actors can trivially do instead: paraphrase, self-host, or use a provider that doesn't mark. Manipulation is weaker still, for a reason no technique fixes: it frequently uses true content, selectively framed. A mark tells you a machine was involved. It cannot tell you the framing is dishonest.
On fraud, I have to correct something I believed until I read the source material. I assumed a phishing email or a scam message was simply too short to carry a detectable mark. That is wrong, and it is the single most widely repeated error about this technology.
Kirchenbauer and colleagues report z=4 at sixteen tokens, detection from as few as twenty-five, z above five at thirty-five, under stated laboratory parameters with key access. A phishing email is comfortably longer. So length isn't the limit. The limits are that no detector exists to check with; that these actors already use jailbroken commercial models, which Check Point's 2026 report identifies as the dominant pattern, favouring jailbroken mainstream models over self-hosted ones; and that detection is post-hoc. The victim has wired the money before anyone could run a check.
Impersonation is where the modality mismatch bites. The reference case is Arup: $25.6 million across fifteen transfers in a single day, January 2024, after a finance employee joined a video call where the CFO and several colleagues were all deepfakes. Textual impersonation: partial coverage. That case: not applicable, it was video and audio, and Anthropic's file marking covers SVG, PNG and JPG. The C2PA specification itself covers video and audio, along with PDF and fonts. The capable standard exists. It just isn't deployed against this.
Consumer deception fails on economics rather than technique. Fake reviews and synthetic testimonials are produced at volume by fraud rings and reputation-management services, and at that volume a paraphrasing pass costs almost nothing per item. Human review farms predate AI and never went away. And no platform can act on any of it while there is no detector to act with.
The conclusion is narrower than I expected: coverage is bounded. Not zero. And I can't tell you it's concentrated in the wrong places, because nobody has published prevalence data, deterrence data, or detection rates against real activity. That absence is worth stating on its own.
Provider Substitution: Measuring the Exit
If you want to understand what a control does, look at what it costs to leave it.
One correction first, because a lot of commentary gets this wrong. The Code of Practice is voluntary. Article 50 is not. A provider that didn't sign the Code but operates in scope still has to comply by other adequate means. So "not a signatory" does not mean "doesn't mark," and with no detector to check with, I can't confirm any hosted provider's output is unmarked. What follows measures switching cost, not confirmed absence of a mark.
| Method | Effort | Who sees the prompt | Mark status | |
|---|---|---|---|---|
| Stay put | Your current hosted provider | — | that vendor | marked |
| Tier 1 | A different hosted provider (three lines of curl) | ~30 seconds | that vendor | unverifiable |
| Tier 2 | Repoint your existing tooling (two environment variables) | ~90 seconds, once | that vendor | unverifiable |
| Tier 3 | Fully local — weights on your own hardware | an afternoon | nobody | no provider to apply one |
"Unverifiable" is not "unmarked". The Code of Practice is voluntary; Article 50 is not, and with no public detector nobody can confirm a hosted provider's output either way. Only the local tier removes the question entirely.
Tier one: a different hosted provider. Three lines of curl. About thirty seconds. Your prompt goes to that vendor instead. Mark status: unverifiable.
Tier two: repointing your existing tooling. Two environment variables and about ninety seconds, once. Your coding assistant keeps working exactly as before, against a different model. I published the setup I use as a small open-source repo if you want to time it yourself. No proxy and no router software, which matters for reasons I come back to below. Mark status: still unverifiable.
Tier three: fully local. Weights on your own hardware. An afternoon to set up properly, and the only tier where the absence of a mark is structurally guaranteed, because there is no provider in the loop to apply one.
Look at what happens across those tiers. Effort rises trivially. Exposure falls. The most private option is the one with the fewest parties in the trust path, and it's also the only one where you can be certain about marking.
That produces an incentive gradient pointing away from auditable, jurisdictionally reachable providers and toward self-hosted weights.
That's a prediction reasoned from the mechanism and from demonstrated adversary adaptiveness, not an observation. Google's threat intelligence currently shows the opposite: threat actors "struggle to develop custom models and instead rely on mature models such as Gemini." But that data predates the incentive, and its own finding is that these actors take the path of least friction. That's a statement about adaptability, not loyalty.
Before anyone treats that as advice
Moving providers moves your data, it does not protect it. Routing through an aggregator improves your legal recourse, not your data residency: the prompt still reaches the underlying vendor, and now two parties have seen it. And I use no router software at all for supply-chain reasons: when I audited this category I found one router storing keys in plaintext and another disabling TLS verification, and LiteLLM was compromised through a poisoned scanner in its own CI. A router you can't compromise is one that isn't there.
Attacking the Mark: Removal and Forgery
There are no published attacks against Anthropic's specific scheme, because nobody outside Anthropic knows what it is. Against the published class of schemes, the literature on AI watermark removal is mature.
| Attack | What it does | Cost to the attacker | Source |
|---|---|---|---|
| Paraphrase | Replaces token choices wholesale. The cheap route. | one prompt | TSAPA, ACL Findings 2026 |
| Edit the tokens | Needs roughly a quarter of tokens changed, assuming full knowledge of the mark. | expensive | Kirchenbauer et al. |
| Character-level | Homoglyphs, zero-width characters. Defeated by canonicalisation. | cheap, but defended | NDSS 2026 |
| Forge or amplify | Makes a mark appear where it shouldn't. Triggered 0 of 6 detectors. | supply-chain access | arXiv 2605.28632 |
| Misattribute | Carries a trusted model's mark without its key. | distillation access | DITTO, EACL 2026 |
Every attack above is published research. None of it is novel or disclosed here for the first time.
The result that matters most is an ICML 2024 paper with the title "Watermarks in the Sand." It proves that under stated assumptions, no strong watermarking scheme can resist removal without significantly degrading output quality, and the proof is constructive, supplying an attack that needs only ordinary access to the model plus a second, weaker open-source model used to reject low-quality rewrites. No secret key required.
It deserves its actual scope, though. It doesn't prove weaker watermarking has no utility, or that removal is always cheap in practice. Going from "cannot be made universally removal-resistant" to "therefore useless" is a perfect-solution fallacy.
On removal by editing, the original paper gives a widely-quoted figure: stripping the mark from a long sequence requires modifying roughly a quarter of the tokens. Less quoted is the sentence after it, which assumes an attacker with complete knowledge of the watermark making maximally adversarial choices that damage quality. That's the best case for an informed attacker; without the key it's harder. So editing isn't the cheap route. Paraphrasing and back-translation are, because they replace token choices wholesale rather than flipping them individually.
Character-level attacks, homoglyphs and zero-width characters, work on a smaller perturbation budget than token-level ones, because a single character can disturb several tokens through the tokeniser (NDSS 2026). But the original paper anticipated this and named the defence: canonicalise the input before testing. Cheap, and it means character attacks aren't a free win.
Then there's the direction most coverage ignores entirely: making a mark appear where it shouldn't.
A 2026 paper describes a supply-chain attack on the random-number generator that decides the green and red split during generation. It amplifies the watermark rather than erasing it, and in testing it triggered none of the six leading detectors that examine the text itself, while inflating the watermark's statistical strength by up to a factor of 2.42. The signal was manipulated and every detector said nothing was wrong.
A second paper, DITTO, from EACL 2026, demonstrates something adjacent: a malicious model generating text carrying the authentic-looking watermark of a trusted victim model, without access to that model's key. It works by exploiting what researchers call watermark radioactivity: train a new model on watermarked output, and the pattern is inherited along with everything else. The authors state the harm plainly: seamless misattribution of harmful content, such as disinformation, to reputable sources.
Don't overreach on that, though: DITTO misattributes to a model or provider, not to a named person. If someone generated watermarked text and claimed you wrote it, your drafts, publication history and file hashes would rebut it. A statistical threshold isn't cryptographic proof of anything.
Taken together, these results fix the signal's evidentiary weight. It can be stripped. It can be forged. It can be amplified invisibly. What it produces is non-exclusive probabilistic evidence that text was processed by a model, not proof of who wrote it.
What This Means If You Build With LLMs
Concretely, for anyone running AI in production. This is where threat modeling AI systems meets a control you cannot currently test.
You cannot integrate watermark detection into anything today. There is no public verification interface and no detector specification. If it's on a roadmap, take it off. If it's been promised to a client, unpromise it.
Don't let a future detector result function as authorship evidence. Not in HR processes, not in academic integrity cases, not in incident response. It records processing. The vendor says so themselves.
If a pipeline genuinely requires unmarked output, the only structurally guaranteed route is having no provider in the loop: self-hosted weights. Every hosted option is unverifiable, whether or not the vendor signed anything.
Provenance you can act on today is C2PA. Open standard, verifiable by anyone, covering images, video, audio, PDF and fonts. It answers "who vouches for this," which is what incident response actually asks. Re-encoding and most social platforms strip it, so it's evidence when present rather than proof when absent. Still more than the alternative offers.
What to watch: publication of a detector and specification; whether platforms begin acting on provenance signals; whether the Commission's guidelines start addressing the interpretation and decision stages rather than just marking.
What would change this assessment: a published specification, a public detector, and measured false-positive rates on human text that a model has edited. If those three things arrive, most of what I've written here needs revisiting.
What the Design Reveals
The thing I keep returning to is that Article 50 didn't require this.
Recital 133 names the acceptable techniques: watermarks, metadata, cryptographic provenance, logging, fingerprints. Cryptographic provenance, meaning signatures, the deterministic primitive anyone can verify, is expressly on the list. It's already deployed for images through C2PA, in the same Anthropic announcement, applied to files while text got the watermark.
So the law permitted a verifiable primitive. The vendor shipped an unverifiable one.
| Modality | Formats | In the C2PA spec | Shipped for Claude files |
|---|---|---|---|
| Images | SVG, PNG, JPG | covered | yes |
| Video | MP4, MOV (BMFF) | covered | Claude does not generate these |
| Audio | WAV, MP3, AIFF | covered | Claude does not generate these |
| Documents | PDF, EPUB | covered | not deployed |
| Fonts | OpenType, TrueType | covered | not deployed |
The $25.6M Arup fraud was video and audio. C2PA covers both, and Claude does not generate either, so no vendor decision was available there. The point is narrower and sharper: the signature-based half of this standard is verifiable by anyone, and it is the half that got deployed for files while text received a mechanism only the vendor can read.
I don't think that's malice, and the constraints explain it well enough. Text has no container to hold a signature the way a PNG does. Signing text means solving distribution and identity binding for every author on the internet, which nobody has done. A watermark applied at the sampling step requires no cooperation from anyone downstream. From a purely operational standpoint, it's the rational local choice.
But it produces a system with a specific shape. The capability to make claims about your writing sits entirely with the vendor. The specification isn't published. There's no opt-out, no independent audit, and no detector, so nobody can check the claim in either direction. You cannot demonstrate that your text is unmarked. Absence proves nothing, and presence proves less than it appears.
We had a version of this argument in the nineties, about key escrow. The objection then wasn't that the capability would definitely be abused. It was that you don't build a capability and sort out the governance later. The disanalogy is real and worth conceding: this is labelling public content, not decrypting private communication, and the harm is much smaller.
But the structure rhymes. Capability built first. Governance deferred. No user control. No independent verification.
What bothers me most, though, isn't the governance. It's the arithmetic.
Considerable effort has gone into this: engineering across every major lab, a Code of Practice with eighty-two signatories, regulatory drafting, compliance work at every company shipping a model into Europe. That's a real allocation of scarce attention. And the thing it bought is a signal with bounded coverage, no public way to read it, defeated by a single paraphrase or an afternoon of self-hosting, and pointed at a population where the answer to "was a model involved" is trending toward always.
The uncomfortable possibility is that this isn't a control that failed. It's a control that was aimed at a question which is ceasing to be meaningful. "Was this machine-generated?" made sense as a question in 2023, when the answer was usually no. It makes less sense every year. The question that keeps its meaning is the older one: who stands behind this, and what happens to them if it's wrong?
That question has had an answer since 1977, and the law explicitly permits it. It just didn't get built for text, because building it would mean solving identity and key distribution for every author on the internet: genuinely hard, unglamorous, and not solvable by one vendor at the sampling step.
So we got the thing that could be built alone instead of the thing that would work. And when you start looking at provenance systems through that lens, asking who can make a claim, who can check it, and who bears the consequence when the claim is wrong, you notice how few of the current designs put those three in the same hands.
Frequently Asked Questions
Can AI watermarking really tell if you used AI?
Not today, and not by anyone outside the vendor. As of August 2026 there is no public detector and no published specification for Claude's text watermark, so nobody can check a piece of text either way. Even when detection tooling arrives, a detected mark shows that text was processed by a model, not that a model wrote it. Anthropic states this limitation themselves.
Is my AI-written text watermarked?
If it was generated by a model launched on or after 2 August 2026, the vendor says marking is supported at launch. Older models are described as in progress. Since no public verification path exists, you cannot confirm the status of any specific piece of text, and neither can anyone else.
Does the EU AI Act require watermarking?
No. Article 50(2) requires machine-readable marking, and Recital 133 expressly permits several techniques, including metadata, cryptographic provenance, logging and fingerprints. Watermarking is one option among those. The law permitted a verifiable primitive; individual vendors chose which to implement.
Does watermarking apply if I only used AI to edit my writing?
Legally, Article 50(2) exempts systems performing an assistive function for standard editing, or which do not substantially alter the input data or its semantics. In practice, a watermark applied at the sampling step has no way to express that distinction, so light editing can produce marked output all the same. That gap between the law's carve-out and what the mechanism can encode is the central finding of this assessment.
Can AI watermarks be removed?
The published literature says yes for the class of schemes involved. An ICML 2024 paper proves no strong watermarking scheme can resist removal without significantly degrading quality, and supplies a constructive attack needing no secret key. Paraphrasing and back-translation are the cheap routes. Editing is not: the original paper's own figure assumes an attacker with complete knowledge of the watermark.
Is short text too short to be watermarked?
No, and this corrects a widely repeated assumption. Kirchenbauer and colleagues report detection at as few as 25 tokens, with z=4 reached at 16 tokens, under their stated laboratory parameters with the detector holding the key. A social post is longer than that. Shorter text is still weaker evidence, but 'too short to detect' is not accurate.
Should security teams build watermark detection into their tooling?
Not yet. There is no public verification interface or detector specification to build against. Treat it as something to watch rather than something to roadmap, and do not let a future detection result stand as authorship evidence in HR, academic integrity or incident response processes.
About the Author
Nathan House, Founder & CEO of StationX
Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.
