Neither an AI watermark nor an AI detector can prove that a person did not write a piece of text. The AI watermark vs AI detector difference is about what each one can show. A watermark hit says one company's model was probably involved at some point, and Anthropic's own FAQ admits it "cannot distinguish 'Claude wrote this' from 'Claude heavily edited this'." A detector hit says the writing resembles typical model output, and the free detectors wrongly flag human writing far more often than the paid ones. Anyone facing an accusation should ask which kind of evidence is behind it, because the two support very different sentences.
Key takeaways
- A watermark is a signal planted at generation time and readable only with the vendor's key. A detector reads writing style and needs no key.
- Anthropic says a detected Claude mark cannot tell writing from heavy editing, and carries no information about the user.
- Short passages and dense factual writing carry too little signal for a reliable watermark reading.
- In a 2025 study, the open-source RoBERTa detector flagged roughly 30 to 78 percent of human text as AI. Pangram flagged almost none on medium to long passages.
What is the difference between an AI watermark and an AI detector?#
A watermark is evidence somebody planted on purpose, while a detector looks for habits that emerged by accident. According to Anthropic (2026), Claude's watermark works by biasing the model's word choices with a secret cryptographic key, and checking for it requires that same key. The signal exists only because the vendor designed it in.
A commercial detector such as Pangram, OriginalityAI or GPTZero never sees a key. It analyses the writing itself, including sentence lengths, word rarity and the phrasing patterns models fall into. Anthropic gives two examples of such patterns in its own FAQ. Models are fond of the construction "this isn't X, it's Y", and they use the word "quietly" far more often than people do. The company adds that spotting these habits is fundamentally different from checking for a watermark.
The diagram below sets the two methods side by side.
That difference explains the rest of this page. A detector works on any text from any model, because every model leaves some style behind. A watermark check works on one vendor's output and nothing else.
Who can check for a watermark today?#
Almost nobody can check for Claude's watermark today, which means most claims that a text is "watermarked" are made by people who could not have tested it. Anthropic's detection API is in a private preview. According to its Help Center, access is limited to organisations with a duty under EU law, such as regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations and EU civil society groups, plus companies that must verify marks for their own compliance.
Anthropic says it plans to widen access over time. Until then, a teacher, an employer or a browser extension has no way to run the check. Anyone who says a text "has the Claude watermark" is guessing, or is describing a detector result in the wrong words. A detector, by contrast, can be run by anyone with a browser and a credit card, so almost every accusation made today comes from the style side, whether or not the person making it knows that.
What can a positive result actually prove?#
A watermark hit proves less than most people assume, and Anthropic is the one saying so. According to Anthropic (2026), a mark "only helps test whether Claude might have produced or processed the content", and it says nothing about ownership or authorship. The Help Center adds that people use Claude to proofread, translate, summarise and convert files, so a marked text can rest on ideas that came entirely from a person. The Claude watermark explainer covers how the mark is applied in the first place.
The chart below takes five claims people tend to make after a detection and checks each one against Anthropic's own documentation.
Only one claim holds, and only as a likelihood. A detection cannot show that the person contributed none of the ideas, and it cannot separate heavy editing from light proofreading. It cannot tell a translation of the person's own essay from text generated from scratch, which is the problem the post on watermarks and translated writing is about. Nor can it name a person. Anthropic states that nothing in the mark or its key lets anyone recover information about a user, an organisation or a conversation.
A detector hit proves something different again. It names a resemblance, not a system. It says the writing looks statistically like model output, and it will fire on a person who happens to write in a flat, predictable register. Collapsing either result into "the detector said it was AI" is where accusations go wrong.
Why a short reply gives no reliable answer#
Length decides whether a watermark can be read at all. Detection needs many free word choices to build up a measurable bias, and Anthropic notes that it does not work well on small samples, with confidence rising as a passage grows. The curve below is a sketch of the direction Anthropic describes. The company has published no measured figures.
A one-sentence message is effectively unreadable in any useful sense, while a long report can carry enough signal for a confident result. Quoting three sentences from a longer document and testing those alone is a much weaker test than checking the whole, so a result on a fragment says very little.
Why factual writing carries almost no signal#
Precise writing leaves the watermark nothing to work with. The mark works by nudging the model between equally good words, so wherever only one word is correct, there is nothing to nudge. Anthropic's example is "Isaac Newton's most famous work was called Principia", where the next word has one right answer. The same applies to proofreading, where the mark can only sit in the handful of words Claude changed, and to code, where comments are the main place the wording is free.
The result is a bias nobody designed. A dense technical summary carries a thinner signal than a loose opinion piece of the same length, whatever share of each a model wrote.
How does each method fail?#
The two methods fail in opposite directions, which is why one cannot stand in for the other. A watermark ignores style completely, so robotic prose cannot trigger it and human-sounding prose cannot hide it. It fails when the words themselves change. According to Anthropic's Help Center, marked text may not register if it was heavily edited, paraphrased, translated or mixed into other writing, if it is very short, or if it came from a model released before marking began. In a simulation of the published scheme, Balakhonov (2026) found that a full rewrite by another model could remove the mark.
A detector fails the other way. A rewrite still has to produce prose with some style, so rewording alone does not reliably fool it. It fails when a person naturally writes in a machine-like register, and when a "humanizer" tool deliberately roughens the text. Jabarian and Imas (2025) tested that second case against a commercial humanizer called StealthGPT.
According to Jabarian and Imas (2025), Pangram's miss rate stayed low under StealthGPT, while GPTZero largely lost the ability to spot AI text, with false negative rates around 50 percent and above across most genres and models. One more consequence matters for anyone accused. Because a watermark can be absent for so many ordinary reasons, the lack of a mark does not prove a person wrote the text either.
A disclosure belongs here. Robert Waithaka, who writes this site, built AI Rewriter, a fine-tuned model that rewrites text so it reads naturally, which puts it in the same broad category as the humanizer tools this section describes. It was not part of the study above, and this post makes no claim about how it performs against any detector.
How accurate are AI detectors?#
The paid detectors are far more accurate than the free ones, and the free ones are the most likely to accuse an innocent writer. The best public evidence is a 2025 working paper from the University of Chicago's Becker Friedman Institute. According to Jabarian and Imas (2025), the study used 1,992 passages across six everyday genres (news, blogs, consumer reviews, novels, restaurant reviews and résumés), pairing verified human writing with output from GPT-4.1, Claude Opus 4, Claude Sonnet 4 and Gemini 2.0 Flash.
The chart below compares how often two detectors flagged human writing as AI.
Pangram reached essentially zero false positive and false negative rates on medium to long passages, with error rising slightly on short ones. The open-source RoBERTa baseline misclassified human text as AI at roughly 30 to 78 percent depending on the scenario, and the authors call it unsuitable for high-stakes use. OriginalityAI and GPTZero formed a secondary tier. These figures come from models that predate the current generation, so the ranking is more durable than the exact percentages.
What should you ask if your writing is flagged?#
The first question is which kind of evidence the accusation rests on, because the answer decides what it can mean. If someone says the text carries Claude's watermark, ask how they checked, since access to the detector is restricted to a short list of organisations. If they used a detector, ask which one, because a free open-source tool and a commercial one differ by tens of percentage points in how often they flag human writing.
Then ask what the result can support. A watermark hit, at most, means a Claude model processed the words at some point, which is also true of proofreading and translation. A detector hit means the writing resembles model output. Neither establishes who did the thinking. How large language models write text explains why plain, predictable prose can look machine-made, and why the same habits differ between ChatGPT, Claude and Gemini.
Length and genre matter as well. A short answer, a dense factual report or a block of code gives a watermark very little to read. Anthropic wrote these limits into its own documentation months before most schools or employers will be able to run a check, which makes that documentation the most useful thing to show anyone treating a single result as proof.
Common questions#
These are the questions people ask most often after a watermark or detector result, answered from Anthropic's documentation and the 2025 detector study.
Can Pangram or GPTZero detect Claude's watermark?
No. Those tools analyse writing style and have never had Anthropic's key. Anthropic describes spotting phrasing habits as fundamentally different from checking for a watermark.
If a watermark check flags my text, what has it established?
That a supported Claude model was likely involved in producing those words at some point. Anthropic adds that the result says nothing about ownership, authorship or legal responsibility.
Does the absence of a mark prove a person wrote it?
No. Anthropic lists several reasons marked content may not register, including an older model, heavy editing or paraphrase, translation, and a passage too short to read reliably.
Can a watermark tell which AI wrote something?
Only its own. Anthropic notes the check cannot tell whether a different AI wrote the text, since another provider would hold a different key or use a different method.
Which is more reliable, a watermark or a detector?
Neither in general, because they answer different questions. A watermark says one vendor's model was likely involved, while a detector says the writing resembles model output whatever produced it.
Sources#
- How Claude's text watermark works (Anthropic, 14 Aug 2026, updated 1 Sep 2026)
- How Claude marks AI-generated content (Anthropic Help Center)
- Artificial Writing and Automated Detection (Jabarian and Imas, BFI Working Paper 2025-116)
- Scalable watermarking for identifying large language model outputs (Nature, 2024)
- An affordable AI text watermark remover (Kirill Balakhonov, 22 Aug 2026)
- Everything I could find out about AI text watermarks (Kirill Balakhonov, 16 Aug 2026)
- How Claude Watermarks AI-Generated Text (Sebastian Raschka, 22 Aug 2026)
- EU AI Act, Article 50, transparency obligations
Last reviewed: 18 October 2026. Merged with "What Claude's Watermark Proves" on this date. The detector figures come from an October 2025 working paper on earlier models, and access to Anthropic's detector is expected to widen. Both are re-checked quarterly, or sooner if Anthropic publishes calibration figures.
