“Does AI watermark its output” has no single answer, because the three major vendors made different choices and shipped them at different times.
The comparison
| Anthropic (Claude) | OpenAI (ChatGPT) | Google (Gemini) | |
|---|---|---|---|
| Text watermark | Statistical, token-level, live from 2 Aug 2026 | Researched, not deployed as a public checkable text watermark | Not a comparable public text watermark |
| Image / media marking | C2PA manifests on file output | C2PA metadata on image output | SynthID, embedded in the pixels of images, audio, video |
| Driver | EU AI Act Article 50(2) transparency code | Voluntary commitments, C2PA membership | C2PA membership plus in-house research |
| Public detector | Forthcoming, not available | Not applicable for text | Limited access |
| Survives copy-paste | Yes, for text | Not applicable | Yes, for media |
| Trivially stripped | No, for text | Metadata yes | Harder, embedded in pixels |
Why the mechanisms differ
Statistical text watermarking biases which token the model picks among near-equivalent candidates, keyed to a secret. The signal is spread across a passage, so it needs length to be detectable and it degrades under heavy rewriting. It is the only approach that survives copy-paste out of a chat window, which is why regulation pushed toward it.
File metadata such as C2PA attaches a signed manifest to the file. Cryptographically strong as a record, structurally fragile as a marker: converting the format, re-saving, or screenshotting usually drops it. It is a provenance record, not a lock.
Pixel-embedded marking such as SynthID hides the signal in the image data itself, so it survives resizing, cropping and compression far better than metadata. It has no text equivalent that is publicly deployed.
What each one can actually prove
Less than the marketing implies, in every case.
- A text mark shows the model touched the text. Not that it composed it. Claude may have proofread or summarised something a person wrote.
- No mark proves nothing. The model may predate the rollout, the passage may be below threshold, or a different vendor was used.
- Metadata absence proves nothing at all. One re-save removes it, and people re-save files constantly for entirely innocent reasons.
Anyone building policy on top of detection, in education, publishing or HR, needs those three limits written into the policy.
What this means if you are cleaning text
If your source was Claude, invisible-character cleaning does not touch the watermark. If your source was ChatGPT, there is no deployed public text watermark to remove in the first place, and what detectors flag is style rather than a mark. Either way, the tools selling zero-width deletion as watermark removal are mislabelling ordinary text hygiene.
The useful framing: clean characters because they break systems, and treat provenance as a disclosure question rather than a technical one. How to remove the Claude watermark, honestly.
Who this is not for
Anyone hoping one of these vendors left an easy exit. None of them did, and the differences between them are about what each mechanism can survive, not about which is easiest to defeat.
More detail on the Anthropic side: what Claude’s text watermark actually is.