Anthropic now marks everything its new models write, and the EU AI Act’s transparency rules are in force. For translation the answer is short: the watermark barely changes the output, and it will not reliably tell you whether a deliverable was machine-made.
An invisible watermark in AI-generated text sounds like a hidden signature: zero-width Unicode characters between words, a pattern of double spaces, the first letters of the first six sentences spelling out A.I.S.L.O.P. Implemented that way, a watermark wouldn’t survive normal handling, because a retype or a CAT-tool QA pass strips it. Such schemes exist, and services sold online as “AI watermark removers” work mostly at this level. Look at what Anthropic and Google actually ship, and there’s nothing added to the text at all. Only the choice of words carries the mark. Put a marked text through translation, and the mark is mostly gone.
We got curious about what watermarking means for translation quality and for AI detection in deliverables, so we went through fifteen years of research. Quality barely moves. Detection is the part that breaks: segments are too short to carry a mark, a translation pass removes whatever the source had, and in a pipeline the mark points at whoever edited last.
Why AI watermarking is suddenly live
The EU AI Act’s transparency rules took effect on August 2, 20261. Anthropic’s watermark ships with Claude models launched from that date onward, wherever they run (API, apps, AWS, Google Cloud), and worldwide, not only in the EU2. Today’s flagship Claude models came out a few weeks before the cutoff, so they sit in a transition period: Anthropic says marking for earlier models is in progress, with no date2. Google researchers built a watermark for its statistical MT output back in 20115, and the company has been marking Gemini output since 2024 with SynthID3. OpenAI built a watermark for ChatGPT text and, by its own account, keeps it unreleased4. If your translation stack calls a frontier model anywhere, watermarked output is either already in it or arrives with the next model release.
Google researchers watermarked MT output back in 2011. Gemini has carried SynthID since 2024
So does the watermark change the output? Will deliverables get flagged as AI-made? There’s fifteen years of research on both. Quality mostly survives. Detection is the problem: nothing published detects reliably on segment-sized text, and translation removes existing watermarks.
How the watermark actually works
The reference design comes from John Kirchenbauer, Jonas Geiping, Tom Goldstein and colleagues at the University of Maryland (ICML 2023)6. Ask a model to continue “The new dashboard makes it easier to…” and it weighs a dozen good options: track, monitor, spot, review. Before each of these choices, a watermarked model hashes the few preceding words into a seed. The seed splits its entire vocabulary into two random halves — call them green and red — and green words get a small bonus. The split changes at every position, and without the key it can’t be guessed. It picks “monitor” where it might have picked “track”. No reader can tell, because both were good.
The detector holds the key, so it can replay every split and count. Human text lands near 50% green, while watermarked text runs consistently above6. Suppose the count over a full page comes back 65% green across 300 positions: that is like flipping 300 coins and getting 195 heads. The detector knows nothing about any single word and nearly everything about the whole text.
The watermark can only exist where the text leaves room for choice.
The extra weight on green words only matters where the model has real options. After “New Year’s” the next word is “Eve”, watermark or not. No scheme overrides a confident choice, because that would produce visible errors. The watermark can only exist where the text leaves room for choice. Google’s SynthID (the one in production in Gemini, written up in Nature in 2024) rearranges sampling instead of biasing scores and came out quality-neutral across roughly 20 million live responses3. Anthropic has described what its mark does (an in-text watermark, plus signed metadata on files) but not the algorithm behind it2. Every published scheme runs into the same constraint.
Why translation is hard to watermark
Open-ended prose offers hundreds of free choices per page, and the Maryland group could detect their mark in as few as 25 tokens of it6. Translation sits at the other end of the scale. The source has already decided the content, and the glossary has decided the terminology. Tags, placeholders and locale formats are close to deterministic. Engines decode at or near temperature zero, which removes the sampling randomness several schemes depend on. What remains is a synonym choice here, a clause order there.
Detection needs more text than translation provides. In SynthID’s published evaluation, detection at a 1% false-alarm rate becomes reliable only over hundreds of tokens, and that is measured at temperature 0.73. A typical CAT segment is 20 to 60 tokens, produced closer to temperature 0. In 2011 Ashish Venugopal, Franz Och and colleagues watermarked the output of Google’s statistical MT system — the concern then was keeping MT output out of the training data Google mined from the web. They did not attempt sentence-level detection. Classification worked only at document level5.
Reliable detection needs hundreds of tokens. A typical CAT segment is 20 to 60.
The detection paradox: constrained text reads as human
Fu, Xiong and Dong (AAAI 2024)7 describe what they call the detection paradox: when the task leaves little choice in wording, humans write what the machine would have written. A professional translator and an engine render “Invoice #4187 is due March 3” identically, and no statistic separates identical texts. Repetitive text produces the opposite error. Pierre Fernandez and colleagues showed that repeating phrases break the statistics behind detection. In their test an ordinary bulleted list, with no watermark in it, came back positive — and the test reported the kind of certainty that is supposed to mean a mistake is practically impossible8. The more repetitive the text, the more confidently wrong the verdict can be. UI strings, product catalogs, and anything pretranslated from TM repeat phrases the same way.
So per-segment detection does not work in any published scheme. Document-level detection is plausible for long prose translated in one pass by one watermarked model: possible for marketing copy, not for UI strings.
Translation removes watermarks
The same mechanism works in reverse: a translation step erases whatever watermark the source carried.
Zhiwei He and coauthors asked the question directly, in a paper titled “Can Watermarks Survive Translation?” (ACL 2024)9. The measured answer is no. The watermark signal in a text and in its own translation barely correlate. One pass through another language took detection from near-certain to close to random: AUC 0.54–0.67 depending on scheme, where 0.5 is chance. A watermark is a statistical pattern over specific tokens in a specific language. Translation keeps the meaning and replaces every token, and the mark is a property of the exact tokens.
The research literature calls this the cross-lingual watermark removal attack9. If someone wants to “launder” AI-generated text past a detector, the cheapest published method is translation: generate, translate, publish in the target language. Proposed defenses don’t hold up well. The 2025 follow-up work shows translation-robust schemes failing outside a handful of high-resource languages, and the current best fix is back-translating a suspect text before testing it10. Any MT engine is, functionally, a watermark remover.
Any MT engine is, functionally, a watermark remover.
Provenance doesn’t travel through translation: a watermarked English master produces thirty locale versions with no watermark in any of them. And a compliance rule that assumes the mark stays with the content breaks as soon as the content is translated. It will be interesting to see how this works for the AI Act at home: the EU runs in 24 official languages and translates almost every piece of content into several of them.
In multi-step pipelines, the last model gets the attribution
Production translation is no longer one engine emitting one output. A typical setup we run at Intento pairs a translation model with an LLM step that enforces terminology, tone of voice, and tags in one pass. Heavier setups add a QA check against the full set of requirements, an auto-edit pass that fixes what QA flagged, and tag repair. The translation model and the LLMs often come from different vendors. The research on watermarks in chains is young but consistent.
Each rewrite weakens the previous marks: one paraphrase pass roughly halves detection, and five passes leave under 20% (Sadasivan and colleagues, University of Maryland)11.
When two watermarked models meet, the later one wins
When two watermarked models touch the same text, the later one wins. A NAACL 2025 study (“Lost in Overlap,” Luo and coauthors)12 rewrote watermarked text with a second watermarked model: the first mark dropped to between 0.2% and 15% detectability while the second read out at 91–99%. The deliverable points at whoever edited it last, not at who did the work. Claude translates, a Gemini-based step post-edits: the document now reads as Gemini’s.
The deliverable points at whoever edited it last, not at who did the work.
Small edits leave almost no mark, yet can still get a document flagged. Editing is low-freedom work, so a watermarked model fixing tags adds close to nothing13. But span-level detectors (WaterSeeker and its relatives) reliably find one watermarked paragraph inside ten thousand mostly-human tokens, where whole-document tests read zero14. So a human translation lightly post-edited by a watermarked model gets flagged, while a fully machine-translated document that got one extra rewrite comes out clean. What detectors flag has little to do with how much AI touched the text, and in these two cases the relationship is inverted.
The mark persists longest in the training data
The mark persists longest in training data. Tom Sander and colleagues at Meta call it radioactivity. Fine-tune a model on a corpus where just 5% of the text is watermarked, and the trace shows up in the model’s own behavior — with odds of a false alarm below one in a hundred thousand (NeurIPS 2024)15. A translation memory that’s been filling up with watermarked MT output is that corpus, from the day someone uses it to adapt an engine. The watermark nobody could find in the deliverable resurfaces in next year’s model.
What does carry provenance
Token statistics can’t carry provenance through localization. The signal is too thin at the segment level, and whatever survives is lost at the language boundary or reassigned by the next pipeline step. When a client runs a detector over a translated deliverable, the result, positive or negative, means close to nothing. What does carry provenance is a record of which model did which step to which content, kept wherever the pipeline runs. Localization kept audit trails long before AI. They now need to include models. At Intento that’s the workflow observability built into our Language Hub, which traces how each translation was created and changed, step by step and model by model. In a multi-vendor pipeline it’s the only place the full history exists.
The short answers
Does the watermark change the output? Barely. The mark can only be written where several words fit equally well, so fluency and accuracy hold, and Google’s production scheme measured quality-neutral across roughly 20 million live responses3. What moves is the synonym-level choice no reader was going to notice.
Will deliverables get flagged as AI-made? Not reliably, in either direction. Segments are too short and too constrained for the statistics to work. A translation step strips whatever mark the source carried. And in a pipeline the surviving mark points at the last model that touched the text. A positive can be a lightly post-edited human translation, and a clean result can be machine output that got one extra rewrite.
References
- Regulation (EU) 2024/1689 (the EU AI Act). Article 50 transparency obligations apply from August 2, 2026 (Article 113). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- How Claude marks AI-generated content. Anthropic Help Center, 2026. https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content
- Scalable watermarking for identifying large language model outputs (SynthID-Text). Dathathri et al. Nature, 2024. https://www.nature.com/articles/s41586-024-08025-4
- Understanding the source of what we see and hear online. OpenAI, updated August 2024. https://openai.com/index/understanding-the-source-of-what-we-see-and-hear-online/
- Watermarking the Outputs of Structured Prediction with an application in Statistical Machine Translation. Venugopal, Uszkoreit, Talbot, Och, Ganitkevitch. EMNLP 2011. https://aclanthology.org/D11-1126/
- A Watermark for Large Language Models. Kirchenbauer, Geiping, Wen, Katz, Miers, Goldstein. ICML 2023. https://arxiv.org/abs/2301.10226
- Watermarking Conditional Text Generation for AI Detection. Fu, Xiong, Dong. AAAI 2024. https://arxiv.org/abs/2307.13808
- Three Bricks to Consolidate Watermarks for Large Language Models. Fernandez, Chaffin, Tit, Chappelier, Furon. IEEE WIFS 2023. https://arxiv.org/abs/2308.00113
- Can Watermarks Survive Translation? On the Cross-lingual Consistency of Text Watermark for LLMs. He et al. ACL 2024. https://arxiv.org/abs/2402.14007
- Is Multilingual LLM Watermarking Truly Multilingual? Scaling Robustness to 100+ Languages via Back-Translation. Mohamed, Gubri. 2025. https://arxiv.org/abs/2510.18019
- Can AI-Generated Text be Reliably Detected? Sadasivan, Kumar, Balasubramanian, Wang, Feizi. 2023–2025. https://arxiv.org/abs/2303.11156
- Lost in Overlap: Exploring Logit-based Watermark Collision in LLMs. Luo et al. NAACL 2025 Findings. https://arxiv.org/abs/2403.10020
- How Good is Post-Hoc Watermarking With Language Model Rephrasing? Fernandez, Sander, Elsahar et al. 2025. https://arxiv.org/abs/2512.16904
- WaterSeeker: Pioneering Efficient Detection of Watermarked Segments in Large Documents. Pan et al. NAACL 2025 Findings. https://arxiv.org/abs/2409.05112
- Watermarking Makes Language Models Radioactive. Sander, Fernandez, Durmus, Douze, Furon. NeurIPS 2024. https://arxiv.org/abs/2402.14904
