Understanding AI Watermarking: Who Owns Your Words?

If you publish with an LLM in the loop, you may already be carrying someone else’s fingerprint in sentences you consider yours. Not a footer. Not a disclaimer. A quiet preference for one synonym over another, repeated across hundreds of word choices, that a detector with the right key can treat as evidence the model was involved.

Marketers feel this first. A draft lands in a CMS, a compliance tool lights up, a partner asks whether the copy is AI-generated, and the honest answer is more complicated than a checkbox. You researched the product. You wrote the outline. You threw out three openings. Then you asked a model to tighten a paragraph. Who authored that page?

Two Different Kinds of Watermarks

Labs don’t all mark text the same way, and some don’t mark it at all. The useful split is between edit-based marks and sampling marks.

Character Watermarks

Edit-based marks hide in characters you cannot see: zero-width spaces, bidirectional overrides, tag characters, odd Unicode spaces. They survive copy and paste. They are also easy to strip, and they are not what Anthropic describes for Claude. In Anthropic’s own words,

Nothing is added to the text, and there are no hidden characters.

Sampling Watermarks

Sampling marks live in the words themselves. When an LLM has several acceptable next tokens, a secret key plus the previous tokens can bias which one it picks. Google DeepMind published that family as SynthID-Text. Anthropic says Claude’s watermark is a version of the same approach. Nothing is inserted. The sentences still read as English. The detector scores the pattern.

That distinction matters because much watermark remover talk mixes the two. Stripping invisible characters is lossless hygiene. Attacking a sampling mark means rewriting the prose. Those are not the same job, and they should not be sold as the same guarantee.

Which AI Platforms Watermark Text

As of August 2026, confirmed statistical text watermarking is concentrated in two consumer stacks. Everyone else is either unmarked on text, unmarked on a particular API surface, or using a visible label instead of an invisible sampling bias.

The timing is not accidental. The EU AI Act’s transparency rules for synthetic content apply from August 2, 2026. Providers must mark machine-generated audio, image, video, or text in a machine-readable way where it is technically feasible. A voluntary Code of Practice gathered the large labs. Anthropic, Google, Meta, Microsoft, Mistral, and OpenAI are among the provider signatories.

xAI is not on that transparency list.

Claude models launched on or after that date embed the mark worldwide, across the chat product, the API, Claude Code, and cloud partners. Older models are in a transition. A hit, Anthropic is careful to say, only means Claude was likely involved. It cannot tell a first draft from a heavily edited paragraph, and it is weak on short answers, code, and light proofreading.

Gemini has carried SynthID-Text in the app and web experience since 2024. That is the broadest long-running consumer deployment. It also has the most public documentation, including an open-source reference implementation. A thorough rewrite or translation drops detector confidence, which is another way of saying the mark is the wording.

ChatGPT still does not watermark ordinary text. OpenAI applies C2PA Content Credentials and SynthID to generated images, and SynthID to some audio. Help documentation still talks about expanding provenance to text as a goal, not as a live feature.

Grok is the other unmarked-text stack that matters for writers. xAI’s public materials describe optional disclosures and a visible mark on Imagine images and video. They do not describe a SynthID-style sampling watermark in Grok prose. I did not add a Grok bypass to the plugin I describe below, because there is nothing statistical to bypass, and there is no honest way for WordPress to know which model drafted a paragraph.

A Co-Author Does Not Get the Only Byline

My objection is not that machines help. It is that a watermark treats the model as the author of work I directed.

I write the prompts. I do the research. I construct the article: the angle, the outline, the claims I will stand behind, the examples I will not invent, the sentences I will throw away. I verify every statistic and quote. Then I use AI’s assistance the way I have used editors, researchers, and junior writers for years. The model is a co-creator. It is not the author.

I would not accept a human co-author leaving my name off the piece. I do not accept a lab weaving a secret signature through the wording so that a later detector can imply the opposite. If the work is mine to publish, the byline is mine to defend. A statistical preference inside the thesaurus is not a contract I signed.

A second problem is practical. A watermark that cannot distinguish Claude wrote this from I used Claude to punch up a bridge paragraph is a blunt instrument pointed at every marketer who works the way professionals actually work. Assistive editing is supposed to be outside the hardest EU marking rules. Sampling bias does not know the difference.

Additionally, I don’t live in the EU. I’m not governed by their laws.

I Asked Claude to Help Me Strip Watermarks

I did the homework before I asked anyone to write code. The leading open-source stack for this problem is Guillaume Meyer’s watermarks-remover, an MIT-licensed project that splits the work the way it should:

• Layer A for invisible Unicode
• Layer B for a constrained rewrite that tries to disrupt sampling marks, plus file-level C2PA and metadata stripping.

A smaller sibling with the same A/B model is ScrubAI. WordPress already had narrower paste cleaners. None of that is a magic fail the official detector button, and the maintainers are honest about it.

I asked Claude to build a WordPress plugin on that architecture for my own site, for content I own, with the same limits those repositories already document. The response, seriously, was literal:

No, I won’t do that.

That was enough. I canceled a $ 200-per-month Claude account, moved the work to Grok, reviewed the projects I had been running there, and updated them. Then I built the plugin myself, with Grok’s assistance, on the same open-source design I had already chosen. If a lab is going to watermark sentences, it also doesn’t get to refuse the hygiene tools that exist publicly on GitHub.

What I Shipped On This Site

The result is a WordPress plugin called Martech Zone Watermarks. It runs on this site today. It is not a public marketplace product, and it is not a claim that any vendor detector will fail. It is a local, reviewable pipeline for drafts I am responsible for.

Automatic processing never fires when I open a post in the editor, and it never fires when I hit Update on an existing article. Gutenberg’s auto-draft dance is skipped. The plugin only steps in on a first insert of a new draft from a programmatic source (WP-CLI, an importer flag, and a couple of optional remote sources), or when I explicitly run a bulk action from the posts or acronyms list.

That gate is the whole point. I want new machine-assisted drafts cleaned before I review them. I do not want a silent rewrite of a published article I already signed.

The capabilities below are what the plugin actually does, not a brochure.

• Bulk Remove Watermarks: a native list-table bulk action on posts, acronyms, and any other configured types. Selected IDs are queued and processed one AJAX request at a time so a long selection cannot time out.
• Constrained paraphrase: optional Layer B. A Cloudflare Worker calls hosted Llama with a prompt that keeps facts, order, structure, HTML, shortcodes, and URLs, then picks among a couple of candidates. It stays off until you set the Worker URL and secret. Rewritten posts remain drafts.
• Draft-only automatic gate: first programmatic insert of a draft or pending item, not editor saves, not published updates, not auto-drafts.
• Revision comparison flag: each cleaned item gets a Watermarks removed badge. When a before-and-after revision pair exists, the badge links to WordPress’s side-by-side diff. Red is what left. Green is what arrived.
• Unicode Layer A clean: a PHP port of watermarks-remover’s lossless character scrub, with an optional HTTP sidecar. Emoji sequences stay intact. Typographic apostrophes stay intact. Invisible carriers and exotic spaces do not.
• WP-CLI: wp mtz-wm inspect, clean, and rewrite for a single ID, including an immediate Layer B run when you pass --now.

Together, those pieces cover the two jobs that actually exist: strip the invisible junk you can prove, optionally paraphrase when you accept a wording change, leave a flag you can click, and never auto-publish the result.

How a Draft Actually Gets Cleaned

On a programmatic insert, WordPress fires wp_insert_post_data before the row is written. The plugin stashes the raw body, runs Layer A, and writes the cleaned content. After saving, it stores the raw copy, Layer A stats, a cleaned status, and the flag. It also writes two revisions: the watermarked original and the cleaned body. That pair is what the flag opens.

If Layer B is enabled for that post type, it schedules a cron event. This site disables internal WP-Cron and lets Ofelia run due events about every ten minutes, so the paraphrase doesn’t sit inside the insert request. The Worker rewrites Gutenberg prose blocks, Layer A runs again on the output, and the update is all or nothing. One failed chunk keeps the Layer A body and marks the job failed. The post stays a draft either way.

Bulk action is the same Layer A path, one ID per request. Published items can be scrubbed of invisible characters. Layer B still only queues for drafts, and it will not re-queue a piece that already made it through a rewrite.

I will say the quiet part plainly. Layer A is verifiable. You can re-scan the bytes. Layer B is best-effort against statistical marks. Private vendor detectors are not something a plugin can certify. If the only change was a zero-width character, WordPress’s diff can look almost empty. That is expected. The compare screen was built for visible wording.

If you want a model that does not weave a sampling watermark through the draft in the first place, that is why I am writing in Grok now.

Try Grok