A Brief History of AI Trace Tracking

In 1949, Claude Shannon of Bell Labs published a paper titled *Communication Theory of Secrecy Systems* to explore cryptography, which put forward a conclusion that has been continuously expanded ever since:

No message generated by any communication system can completely break away from the statistical characteristics of its source.

Because every character carries the sender's probabilistic habits, the source will emerge once enough characters are analyzed.

Shannon was discussing cryptography, but this insight applies far beyond the field of cryptography.

What he meant is: as long as the content is generated by an information source, it will inevitably leave identifiable imprints at the statistical level. This imprint does not need to be deliberately embedded, it is a by-product of the information generation mechanism itself.

77 years later, this proposition has taken a brand new concrete form.

"In August 2026, Anthropic announced that it will fully deploy invisible statistical watermarks in text generated by the Claude model, and gradually cover all existing models.

Almost in the same week, the AI circle on social media was caught in heated debates, and people who use AI to write and generate videos began to worry that their works would be detected.

But if we return to Shannon's framework, this outcome was actually destined long ago. There is no suspense that AI-generated content can be identified. The real problems lie ahead: in what way to identify it, who will do the identification, and what the identification means afterwards.

I

Habits are Secret Signals

In 1964, Harvard statisticians Frederick Mosteller and David Wallace did a bolder thing.

*The Federalist Papers* is one of the most important political documents in the early days of the founding of the United States. It was co-authored by Hamilton, Madison and others. The authorship of 12 of the papers has been disputed for more than 100 years, and both Hamilton and Madison claimed to be the authors.

The statisticians adopted a new approach, paying more attention to the frequency of use of function words such as and, to, and while.

Although these words have no substantive meaning, there are stable individual differences in the frequency at which each author uses them.

The two statisticians finally used the Bayesian method to count the occurrence frequency of these words in the signed articles with known authors, and used the probability model to compare the disputed papers.

The conclusion is overwhelming: almost all 12 papers can be confirmed to be written by Madison.

This method later got a special name, Stylometry.

It is used in courts to identify the authors of anonymous letters, and in literary studies to judge disputed texts. In 1995, in the most famous practical application, the FBI used a similar method to help lock down a suspect.

At that time, Kaczynski, the most well-known "Unabomber" in American history, had a large number of personalized wording habits in his 10,000-word manifesto sent to newspapers. Forensic linguists systematically compared the manifesto with Kaczynski's private texts, and concluded that the two were "almost certainly written by the same author". This analysis became the key basis for applying for a search warrant.

Shannon's proposition has been repeatedly verified in these cases. The probability distribution of a person's word choice has quite stable personal characteristics at the statistical level, which are too many to be completely eliminated through deliberate control.

By the same token, today's large language model, as a form of language, can also be tracked.

II

The Accent of Language Models

The process of a language model generating text is to calculate the probability distribution of the next word at each step, sample a word from the distribution, add it to the text, and then perform the next calculation. This process is repeated hundreds of times to produce a piece of text.

There are systematic differences in the probability distribution of each model, because the training environment, data, architecture, alignment method and decoding parameters are all different.

Facing the same context, GPT and Gemini assign different probabilities to the words "change", "reshape", "influence" and "subvert", and the differences appear in a systematic way in every generation. The difference in a single word selection is tiny, but after hundreds or thousands of accumulations, this systematic difference will leave a distinguishable outline in the statistical structure of the entire text.

In 2023, researchers led by Mitchell from Stanford University published the DetectGPT study, which found that text generated by a certain language model often lies near the "local maximum" of the model's probability function.

If this text is partially rewritten randomly, the rewritten version will usually fall to a lower probability position.

Using this curvature feature, it is possible to judge whether a piece of text is more likely to be generated by a certain model without pre-embedding any watermark at all.

In a detection experiment targeting fake news generated by a specific model, DetectGPT increased the hit rate from 0.81 of the previous best method to 0.95.

But the ceiling of passive detection was soon exposed.

OpenAI released its own AI text detection tool in January 2023, and took it offline 5 months later on the grounds of "too low accuracy". It could only correctly identify 26% of AI-generated writing on its own evaluation set, and mistakenly judged 9% of human-written articles as AI-generated.

This tool uses a style classifier, which is completely different from watermark detection, but it proves one thing: the fact that AI content has statistical characteristics is not the same as "there exists a reliable universal detector".

This is exactly the reality that domestic platforms encounter when implementing AI content labeling.

On September 1, 2025, the *Measures for the Identification of AI-Generated Synthetic Content* (hereinafter referred to as the "Identification Measures") jointly issued by four departments came into force officially. Douyin, Kuaishou, Xiaohongshu, Bilibili and Weibo launched the AI content labeling function on the same day.

However, third-party evaluations found that the automatic identification technical capabilities of platforms are uneven: Kuaishou performed well in the first week, while Douyin's automatic identification almost failed; by late October, the evaluation of another media reversed the result: Douyin had the highest recognition rate for AI-generated videos, while Kuaishou, Xiaohongshu and WeChat Video Account did not label any watermark-free AI videos.

Limited by technology and computing power costs, most platforms mainly rely on the AI watermark built into the video or the author's active declaration for identification.

If a piece of content has neither the author's label nor is generated by the platform's own tools, the accuracy of passive detection will drop significantly.

III

From Passive to Active

As passive detection is not sufficient enough, manufacturers began to try to actively embed marks that only they can recognize during the generation process.

The logic still follows Shannon's framework: encode secret information into the channel, and transmit source information through statistical laws. People who do not know the key cannot identify it, and detectors with the key can verify it with high confidence.

Google's DeepMind was the first to turn this logic into a large-scale deployed commercial product SynthID in August 2023, which was initially used for model-generated images.

The embedding method is to write a statistical signal at the pixel level of the image, which is imperceptible to the human eye but can be recognized by SynthID's detection algorithm, and has certain resistance to common operations such as cropping, compression, and adding filters. It was later extended to audio and video, and extended to text in May 2024, deployed in Gemini's dialogue interface.

Google's text watermark mechanism makes extremely tiny adjustments to the vocabulary probability distribution according to a key-based algorithm before the model generates each word, so that the final vocabulary selection sequence statistically conforms to a hidden rule.

The research team called the specific method "Competition Sampling", which encodes information by adjusting the competition rules between words. The entire text looks completely normal on the surface, and the signal is hidden in the statistical pattern of "which word is chosen and which word is not chosen each time".

Google compared the watermarked and non-watermarked versions in nearly 20 million Gemini user responses, and there was no significant difference in user satisfaction scores.

At the 2026 I/O conference, the scale of SynthID was disclosed: more than 100 billion AI-generated images and videos have been watermarked, the marked amount of AI-generated audio is equivalent to 60,000 hours of playback time, and Gemini users have initiated a total of 50 million watermark verifications.

OpenAI, NVIDIA and other major manufacturers also announced that they will join the SynthID ecosystem, and Google has also integrated SynthID verification capabilities into search and browser tools.

Different from the industry's active marking, the domestic policy direction requires AI models to actively leave marks in the data structure.

Article 5 of the Identification Measures requires that metadata information such as the service provider code, content number, and generation attribute be written into the data structure of the file.

This choice has its institutional logic: the metadata solution has lower compliance costs, easier verification, and regulatory authorities can directly review it in a unified format.

Article 12 clearly states that service providers shall provide identification-related materials when performing algorithm filing, to provide support for preventing and cracking down on illegal and criminal activities. The core of the design is to establish a traceable institutional channel from content to service providers.

According to data as of the end of June, more than 998 large models in China have completed the filing, and more than 598 have completed registration at the provincial level; the number of users of generative AI products has exceeded 230 million.

Generation-level watermarks target bulk producers who copy and paste AI outputs as they are — such as end-to-end homogeneous content producers, bulk automated publishing accounts, and AI translation sites.

The metadata system also has advantages in this scenario. When bulk automated content is published directly without review, the metadata contains the service provider code, which can be used to trace the source along the filing information, and the possibility of taking corresponding regulatory measures can be reserved for AI content without sufficient identification.

IV

Watermark Vulnerability

There was a widely circulated saying before that if you take a screenshot of AI-generated content and re-recognize it into text through OCR, the watermark will disappear.

This is true for the metadata layer. But not for generation-level watermarks, because the watermark is encoded by influencing which words are selected, and the language itself implies statistical laws and model fingerprints.

The screenshot turns the text into pixels, and OCR turns the pixels back into text. If the OCR is accurate enough, the restored vocabulary sequence is basically the same as the original, and the watermark does not disappear.

Just like printing, photographing, and OCR recognizing a rhyming poem back to text, the rhyme will not disappear.

The only thing that can eliminate generation-level watermarks is to regenerate the language, that is, to understand a paragraph written by AI, without looking at the original text, and write an expression with similar meaning from scratch.

Both Google and Anthropic have admitted that large-scale rewriting, translation, and extensive mixing with other texts may lead to undetectable watermarks.

But the distance between "may lead to detection failure" and "easy to be breached" is much closer than most people think.

In 2025, the WaterPark benchmark test systematically evaluated 10 watermark methods, covering 12 attack types, 3 language models and 5 data sets. The results showed that SynthID had a detection rate as high as 99.8% on the original unattacked text, but it dropped to 49.8% under a moderate rewriting attack.

After only one round of processing by the AI rewriting tool, the detection rate of all tested schemes fell below 30%.

An experimental study in July 2026 found that after 846 rewriting attack tests on 3 mainstream watermark schemes including SynthID, the watermark removal rate of SynthID exceeded 98%, while the other two were completely removed 100%.

SynthID also produced a 5.4% false positive rate on human-written texts, and gave an "uncertain" detection conclusion for 80% of its own watermarked texts.

The final conclusion of the researchers is that current AI watermarks cannot meet the requirements of special scenarios such as judicial admissibility, and no public text watermark scheme can be used as independent evidence in court.

Anthropic's new technology also has a hidden danger. For example, it promises to provide third parties with an API to detect Claude watermarks, but at the same time users can also use it to confirm "the feedback signal of eliminating the watermark", for example, by continuous rewriting and calling the API for inspection to achieve the final cleaning of the AI watermark.

Judging from the current watermark effect, those who carefully modify and polish the AI draft are less likely to be detected.

The watermark system is really effective in cracking down on black industry actors who copy and paste AI outputs as they are and publish them in bulk automatically, which is often the most needed target for policies to crack down.

In addition, watermarks have two other capability limitations.

First, the formation of watermarks requires higher language complexity.

If the answer is definite, such as which city the Oriental Pearl Tower is located in, the model will only answer Shanghai, and in this generation process, the watermark does not have enough probability space to intervene.

Second, detecting a watermark does not necessarily prove that the article is generated by AI.

If an ordinary article is proofread or translated by an AI model, the output content may also form a watermark. Anthropic has even specifically warned against this logical loophole. When the detector prompts "this content has been processed by Claude", it cannot be inferred that "the idea of this article comes from AI".

V

Potential Industry Gaps

Technical vulnerabilities often correspond to huge commercial gaps. Around the AI watermark system, there are still a large number of real demands at the industrial level.

The AI watermark market is valued at about 600-800 million US dollars in 2026, with a compound annual growth rate of around 25%.

This growth essentially reflects the enforcement of regulations and the maturity of watermark technology.

The first reshaped field is content moderation and compliance.

In the past, AI detection relied on style classifiers to guess whether a paragraph was generated by AI through statistical inference. After the watermark system matures, the moderation logic shifts from "guessing the style" to "checking the source". The former is probabilistic inference, while the latter is close to cryptographic source verification when conditions are met, which can be written into contracts, used for arbitration, and connected to regulatory requirements.

The tool chain around watermark detection APIs, compliance report generation, and content traceability and evidence storage is the most direct opportunity window right now, and there are even a large number of infrastructure gaps that can be applied to AI content auditing.

The Identification Measures require service providers to submit technical details of identification when filing algorithms, which in fact creates institutional demand for independent third-party compliance audit services.

Nearly 1,000 large models have been filed now, and each of them needs to prove that its