Rewriting text kills the watermark, light edits don't

Known-key experiments described in an explainer at Declaude leave about 0.5% of windows intact after a full rewrite of text carrying MarkLLM's KGW and EXP watermarks, run on an open model and washed through declaude's full-rewrite route. By the explainer's account, detector accuracy over those runs falls from AUC 0.99 to roughly 0.5.

The explainer was written by James Padolsey at NOPE as an accompaniment to declaude, a rewriting tool, and covers how model-level text marks work. Its interactive figures are a teaching model with illustrative parameters and do not reproduce any provider's actual scheme.

At a glance

• Model-level marks live in the sampling choices rather than in the characters: a secret key splits each shortlist of candidate words into green and red groups, then tilts the sampling slightly toward green.
• Context-free unigram marks, keyed on the word itself rather than its neighbours, survived the same experiments at AUC 0.73–0.84, and marks hidden in the meaning need outline-level regeneration rather than paraphrase.
• Only the key holder can run the test, which rules out style-guessing services such as GPTZero; Google operates an early-access detector portal for SynthID, and Anthropic says detection tooling is forthcoming.

The split the explainer draws matters for anyone treating a mark as evidence. Detection here is private, probabilistic and about processing rather than authorship, which appears to leave schools and editors without a check of their own while providers hold the only test that counts. The measured erasure figures also point at a practical threat model built on full re-composition rather than on light editing, which is the opposite of how AI-detection debates usually run.

Re-composition leaves about 0.5% of KGW and EXP windows intact

The mark lives in runs of untouched wording. Each word's colouring derives from a short run of the words just before it, so a position counts as evidence only where a window of the original phrasing survives intact. In the known-key runs on an open model, washed through declaude's full-rewrite route, about 0.5% of windows survived.

Context-free unigram marks, which key the colouring on the word itself, survived the same experiments at AUC 0.73–0.84, though a colouring reused everywhere can be reverse-engineered from enough output. For marks that sit in the meaning, the explainer names outline-level regeneration as the only answer it knows.

Lighter passes do far less. In Kirchenbauer et al.'s experiments the detector recovers given enough text, with even human paraphrase becoming detectable again after roughly 800 tokens, about 600 words. What removes this family of marks is re-composition that shares no runs of wording with the original.

Kirchenbauer's 2023 scheme splits every shortlist into green and red

A model picks each word from a shortlist of candidates that would each make a fine sentence, and a page of text holds hundreds of those forks. The scheme described by Kirchenbauer et al. in 2023 uses secret-keyed maths to split every shortlist into green and red, then tilts the sampling toward green.

The nudge is mild, so a red word can still win, and the colouring is not fixed to a word: the key computes it from a short run of the words just before, making the same candidate green after one prefix and red after another. Only the overall lean accumulates.

Google's SynthID, described by Dathathri et al. in Nature in 2024, replaces the nudge with a small keyed tournament arranged so that every word's odds stay exactly what the model intended, averaged over the key's draws. Aaronson and Kirchner's scheme, built at OpenAI, derives the sampling itself from the key.

Detection counts green words, which land near half without the right key

Google has watermarked text from the Gemini app and web experience since 2024, with its API a documented exception. Detection does not read the text or judge style: the detector replays the key holder's colouring and counts greens, which land near half the time without a mark or without the right key.

In the explainer's teaching model, whose tilt is drawn strong for legibility, a 1,500-word document would flag at only about 55% green, since small leans become persuasive only through length. Its figures count words, while real detectors count tokens in the model's own tokenizer.

A found mark means processed by, not written by: Anthropic's documentation notes that human text merely proofread or translated by Claude picks up the mark. Text with only one right continuation, such as code, quotations and lists of facts, leaves the sampling too little slack to hide anything in.

Testing Claude's own mark

New Claude models mark text at the model level as of August 2026, with earlier models to follow. Anthropic's production scheme is undisclosed, so no one outside Anthropic can yet run the rewrite test against Claude's own mark. The explainer's numbers come from open implementations, and Anthropic says detection tooling is forthcoming without naming a date.