On this page
What Watermarks Do LLMs Leave in Generated Code?
Text watermarks like SynthID-Text and Claude's watermark exist — but code has no deployed watermark yet. Here's how watermarking works and why code resists it.
Quick answer
- Text watermarking is real and deployed: Google’s SynthID-Text and Anthropic’s Claude watermark both mark prose invisibly.
- Watermarks are statistical patterns the model embeds during generation, not visible labels.
- Code has no deployed watermark — no major coding assistant marks generated code today.
- Code resists watermarking because it’s short, gets reformatted and refactored, and is often rewritten.
- What people call “AI code detection” today is style fingerprinting, which is not a watermark.
What is an LLM watermark?
An LLM watermark is a statistical pattern a model embeds in its own output during generation, detectable only by someone who knows the scheme. During generation, the model subtly biases its token choices — Google DeepMind’s SynthID-Text uses tournament-based sampling, and Anthropic’s Claude watermark biases what it calls “low-stakes choices” in phrasing. The result looks and reads like normal text, but a detector holding the right key can confirm with high statistical confidence that a given passage came from that model. This is different from a visible label or a style guess: the watermark is embedded at generation time by design.
Which watermarks are actually deployed?
Two systems are in production for text. SynthID-Text, described in a Nature paper in 2024 and documented in Google’s responsible-AI docs, watermarks and detects generated text with high accuracy while preserving quality. Anthropic announced Claude’s text watermark in August 2026, describing it as a pattern in low-stakes generation choices. Both target prose. Neither system claims to watermark code, and independent probing (like ETH Zurich’s analysis of SynthID-Text) shows the schemes themselves are detectable and attackable in various ways — which is why even text watermarking is far from a solved problem.
Do watermarks work on code?
No deployed watermark works on code, and there are structural reasons. First, code is short: watermark detection needs enough tokens to reach statistical significance, and most functions or files are too small. Second, code gets transformed automatically — formatters, minifiers, linters, and transpilers rewrite tokens wholesale, destroying the statistical pattern. Third, developers refactor and rewrite generated code, which removes whatever pattern survived. Text survives light editing, but code rarely survives development untouched. As of late 2026, no major coding assistant ships watermarking for generated code, and the research focus remains on prose.
What traces does AI code actually leave?
If not watermarks, what do people point at? Style fingerprints and metadata. Style fingerprints are the statistical tells detectors score: uniform identifier lengths, over-commenting, repetitive function structure — the same patterns covered in how to prevent AI code detection. Metadata traces include generator banners (“Generated by Copilot”), .env files and boilerplate scaffold that models produce by default, and commit patterns. None of these are embedded markers; they’re observable habits, which is why they’re unreliable as proof and removable by rewriting. Understanding the difference matters: a watermark is evidence, a fingerprint is a guess.
Where this bites vibecoders
Vibecoders are told their AI-generated code “has a watermark” — and they panic, or worse, they trust detectors that are really doing style guessing. The practical truth is reassuring and uncomfortable at once: there is no watermark in your code today, so rewriting it genuinely removes the detectable signals; but text watermarking is already deployed, and the same research could reach code. The working assumption for now: your code’s trace is its style, and better code is the fix — not searching for an invisible marker that doesn’t exist yet.
Where AI coding assistants get this wrong
- Claiming their output carries a “watermark” when no code watermarking is deployed.
- Generating style-consistent output (uniform naming, boilerplate comments) that reads as machine-made — the closest thing to a real trace.
- Assuming text watermarking works on code, when reformatting and refactoring destroy the statistical pattern.
- Recommending “watermark removal” tools that are really style rewrites, priced as if they did something cryptographic.
Checklist
- Understand that code has no deployed watermark — detection claims are style guesses.
- Know the two real systems: SynthID-Text and Claude’s text watermark, both for prose.
- If you must prove a code’s origin, keep provenance in the workflow (commits, prompts, disclosure), not in detection.
- If you want AI output to stop looking machine-made, rewrite it properly — that removes the actual signals.
- Watch for code watermarking announcements; “rewrite it” stops working the day one ships.
FAQ
Can AI providers watermark generated code today?
Not in practice. The watermarking systems deployed so far — Google’s SynthID-Text and Anthropic’s Claude text watermark — target natural-language prose, not code. As of late 2026, no major coding assistant ships watermarking for generated code, and the reasons are technical: code is short, gets reformatted and refactored, and the statistical patterns watermarks rely on are destroyed by normal development.
How do text watermarks actually work?
During generation, the model subtly biases its token choices toward a secret pattern — SynthID-Text uses tournament-based sampling, Claude biases “low-stakes choices” in phrasing. A detector that knows the scheme can statistically confirm the pattern. Users can’t see it, and it doesn’t change the meaning, which is why it survives normal editing but not rewriting.
If there’s no code watermark, how do people claim code is AI-generated?
They’re using style fingerprints, not watermarks: uniform naming, over-commenting, repetitive structure, and metadata traces like generator banners or environment files. Those are statistical guesses, not embedded markers — they’re exactly what makes detectors unreliable and what a genuine rewrite removes.
Will code watermarking arrive eventually?
Possibly. Text watermarking is deployed and improving, and the same research could extend to code. But the obstacles are bigger: code is shorter than prose, gets minified and reformatted automatically, and is often rewritten by the developer. Any scheme would have to survive those transformations, and none has yet.
Related topics
- Can AI-Generated Code Be Detected?
- How to Prevent AI Code Detectors From Flagging Your Code
- What Is AI Code Validation?