A 1949 paper on cryptography by Claude Shannon of Bell Labs laid the groundwork for a concept that would echo far beyond its original field. The paper argued that any message produced by a communication system cannot fully escape the statistical fingerprints of its source. Every character carries the sender's probabilistic habits, and analyzing enough of them reveals the source. Shannon's insight, though born from cryptography, stated a universal truth: any content from a given information source will inevitably leave a recognizable statistical imprint, a byproduct of the generation mechanism itself.

Seventy-seven years later, this concept has taken on a distinct new form. In August 2026, Anthropic announced it would fully deploy invisible statistical watermarks on text generated by its Claude model, gradually covering existing models. The same week, debates erupted in the AI community on social media, with those using AI to write or generate videos worrying about being discovered. However, from Shannon's framework, this was always inevitable. The ability to identify AI content is not the question. The real issues are: how to identify it, who identifies it, and what the identification means.

In 1964, Harvard statisticians Frederick Mosteller and David Wallace took a bold approach to a century-old debate. The Federalist Papers, a cornerstone of American political thought, included 12 essays whose authorship was disputed between Alexander Hamilton and James Madison. The statisticians analyzed the frequency of function words like "and," "to," and "while," which, though meaningless, had stable personal usage patterns. Using Bayesian methods, they compared these frequencies in known works and applied them to the disputed texts. The conclusion was overwhelming: all 12 were almost certainly written by Madison. This method, later named stylometry, was used in court to identify anonymous letter writers and in literary studies to determine authorship. In 1995, the FBI applied similar techniques to help identify the Unabomber, Ted Kaczynski. A 10,000-word manifesto published by a newspaper contained many personal writing habits, and a systematic comparison with Kaczynski's private writings concluded they were "almost certainly by the same author," providing a key basis for a search warrant. Shannon's proposition was repeatedly validated: a person's word-choice probability distribution is stable enough to be identified, and too difficult to erase through deliberate control.

The process of generating text with a language model involves calculating the probability distribution for the next word at each step, sampling a word, and repeating hundreds of times. Each model's probability distribution has systematic differences due to varying training data, architecture, alignment, and decoding parameters. Given the same context, GPT and Gemini assign different probabilities to words like "transform," "reshape," "impact," or "disrupt." These differences accumulate over hundreds of generations, leaving a discernible statistical profile. In 2023, researchers including Mitchell from Stanford published DetectGPT, a study showing that text generated by a language model tends to be near a "local maximum" of its own probability function. Randomly rewriting the text locally would likely produce a version with lower probability. By using this curvature, it was possible to determine if a text was likely generated by a specific model without any pre-embedded watermark. In tests detecting fake news from a specific model, DetectGPT improved the hit rate from 0.81 to 0.95. However, the limitations of passive detection soon became apparent. In January 2023, OpenAI released its own AI text detector, only to take it offline five months later due to low accuracy. It correctly identified only 26% of AI writing but misclassified 9% of human-written text as AI. This tool, which used a style classifier, demonstrated that having a statistical signature in AI content is different from having a reliable, universal detector. This is the reality faced by Chinese platforms implementing AI content labeling. On September 1, 2025, the "AI-Generated Content Labeling Measures" (the "Labeling Measures") jointly issued by four departments took effect, with platforms like Douyin, Kuaishou, Xiaohongshu, Bilibili, and Weibo launching AI content labeling features. Third-party evaluations found that the automatic recognition capabilities varied widely, with Kuaishou performing well initially while Douyin's detection was nearly ineffective. By late October, another evaluation showed a reversal, with Douyin having the highest recognition rate for AI-generated videos, while Kuaishou, Xiaohongshu, and Video Account failed to label AI videos without watermarks. Limited by technology and cost, platforms mostly rely on AI watermarks embedded in videos or creator self-declarations. If content lacks both a creator label and a platform-generated tool, passive detection accuracy drops significantly.

When passive detection is insufficient, companies began actively embedding unique identifiers during the generation process. The logic remains within Shannon's framework: encoding secret information into the channel to convey source information through statistical patterns. Those without the key cannot detect it, but those with the key can verify it with high confidence. In August 2023, Google DeepMind became the first to deploy this logic at scale with SynthID, initially for generated images. The method involves writing a statistical signal into the pixel data of an image, invisible to the human eye but detectable by SynthID's algorithm, with some resistance to cropping, compression, and filtering. It was later extended to audio and video, and to text in May 2024, integrated into the Gemini interface. Google's text watermarking mechanism, known as "tournament sampling," makes tiny adjustments to the word probability distribution before each word is generated, using a secret key. This ensures the final sequence of words follows a hidden statistical pattern. The adjustments are made to the competition rules between words, encoding information without affecting the surface text. In comparisons of nearly 20 million Gemini user responses, Google found no significant difference in user satisfaction between watermarked and unwatermarked versions. At its May 2026 I/O conference, Google disclosed that SynthID had been applied to over 100 billion AI-generated images and videos, and the amount of AI-generated audio marked was equivalent to 60,000 years of playback. Gemini users had initiated 50 million watermark verifications. Major companies like OpenAI and Nvidia announced they were joining the SynthID ecosystem, and Google's verification capabilities were extended to search and browser tools. In contrast to industry-led active watermarking, China's policy direction requires AI models to actively embed identifiers within the data structure. Article 5 of the "Labeling Measures" requires that the file's data structure include metadata such as service provider codes, content IDs, and generation attributes. This approach has its own institutional logic: metadata solutions are more compliant and easier to verify, allowing regulators to use a unified format for direct review. Article 12 states that service providers must provide labeling-related materials when fulfilling algorithm registration, supporting the prevention and cracking down of illegal activities, the core of which is to establish a traceable channel from content to service provider. By June's end, over 998 large models had been registered in China, with 598 registered at the provincial level. The user base for generative AI products exceeded 230 million. Generative-level watermarks target those who copy and paste AI output directly, such as end-to-end homogeneous content producers, bulk automated publishing accounts, and AI-translated websites. The metadata system has an advantage in this scenario: when bulk automated content is published without review, the metadata contains the service provider code, allowing for source tracing through registration information, and enabling regulatory action against insufficient AI labeling.

A common belief is that taking a screenshot of AI-generated text and using OCR to re-recognize it will remove the watermark. This is true for metadata-level watermarks, but not for generative-level watermarks. The watermark is encoded by influencing which words are selected, so the language itself contains the statistical patterns and model fingerprints. If the screenshot is converted to pixels and then OCR back to text, and if the OCR is accurate enough, the resulting word sequence is almost identical to the original, and the watermark remains. Just as printing a rhyming poem, taking a photo, and OCR-recognizing it back to text will not erase the rhyme. The only way to truly eliminate generative-level watermarks is to regenerate the language, meaning understanding what the AI wrote and then writing a similar expression from scratch. Google and Anthropic have both acknowledged that significant rewriting, translation, or heavy mixing with other text can make the watermark undetectable. However, the gap between "may cause detection failure" and "easily broken" is smaller than many think. In 2025, the WaterPark benchmark systematically evaluated 10 watermarking methods across 12 attack types, 3 language models, and 5 datasets. SynthID had a 99.8% detection rate on unaltered text, but this dropped to 49.8% under moderate rewriting. After just one round of processing with an AI rewriting tool, the detection rate for all tested methods fell below 30%. An experimental study in July 2026 tested 846 rewriting attacks on three major watermarking schemes, including SynthID. SynthID's watermark removal rate exceeded 98%, while the other two were completely removed 100% of the time. SynthID also produced a 5.4% false positive rate on human-written text and gave an "uncertain" detection result for 80% of its own watermarked text. The researchers concluded that current AI watermarks cannot meet the specific requirements for judicial adoption, and no publicly available text watermarking scheme can be used as independent evidence in court. Anthropic's latest technology also has a potential flaw: while it promises to provide third-party APIs to detect Claude watermarks, users could also use these APIs to obtain feedback signals that confirm the removal of the watermark. By continuously rewriting and checking the API, they could ultimately clean the AI watermark. Based on current watermark effectiveness, those who carefully revise and polish an AI draft are less likely to be detected. The watermark system is truly effective against those who copy and paste AI output for bulk, automated publishing, which is often the primary target of policy. Beyond this, watermarks have two other limitations. First, the watermarking process requires sufficient linguistic complexity. If the answer is deterministic, like "What city is the Oriental Pearl TV Tower in?" the model will only answer "Shanghai." In this case, the watermark has no probabilistic space to intervene. Second, detecting a watermark does not necessarily prove the article was generated by AI. If a human-written article is then proofread or translated by an AI model, the output could also contain a watermark. Anthropic has specifically warned about this logical flaw: when a detector indicates "this content was processed by Claude," it cannot be inferred that "the ideas of this article came from AI."

Technical vulnerabilities often correspond to significant commercial opportunities. The AI watermark market was estimated at $600-800 million in 2026, with a compound annual growth rate of about 25%. This growth reflects the pace of regulatory enforcement and watermark technology maturity. The first area being reshaped is content moderation and compliance. Traditional AI detection relied on style classifiers, making statistical inferences about whether a passage was AI-generated. As watermark systems mature, the logic shifts from "guessing the style" to "checking the source." The former is probabilistic inference, while the latter, when conditions are met, approaches cryptographic source verification, usable in contracts, arbitration, and regulatory requirements. The toolchain around watermark detection APIs, compliance report generation, and content provenance is a direct opportunity window, with significant infrastructure gaps for AI content auditing. The "Labeling Measures" require service providers to submit technical details of their labeling methods during algorithm registration, creating an institutional demand for independent third-party compliance audit services. With nearly a thousand registered large models, each needs to prove its labeling scheme meets the mandatory national standard "Cybersecurity Technology - AI-Generated Content Labeling Methods." Currently, there are almost no dedicated commercial products to meet this demand. While some third-party organizations like PwC have offered compliance interpretations, there is a vast gap between interpretation and deliverable audit tools and automated detection services. The technical difficulties faced by platforms like Douyin, Kuaishou, Xiaohongshu, and Bilibili are also noteworthy. They need the ability to automatically detect AI-generated content, but building it in-house is expensive and lacks accuracy. An AI content detection SaaS for content platforms is an emerging market. The second direction is copyright verification. A core challenge for publishing, music, and film industries is how to prove a piece of content is original human creation in legal proceedings. When generative-level watermarks become standard for major manufacturers, "no detectable watermark signal from any known AI model" begins to have exclusionary value, particularly as supporting evidence in copyright disputes. Its legal value is real. The Chinese copyright market faces even more direct demands. Since 2025, several copyright disputes involving AI-generated content have entered judicial proceedings, but courts lack technical tools to determine the boundary between AI-assisted and AI-generated work. The "Labeling Measures" metadata system provides a traceability channel, but once metadata is lost during transmission, proving copyright ownership becomes extremely difficult. In a sense, AI content copyright registration services represent a gap where policy incentives are already in place, but technical products have not yet caught up. The third direction is quality assessment of financial information. Research reports, analyst commentary, corporate announcements, and financial media are objective information on which financial institutions rely for decisions. However, the degree of AI influence on this content is rapidly increasing. A research report generated in bulk by a large model and an original judgment from an analyst after thorough research have vastly different information content, but they may appear identical. When watermark detection capabilities become sufficiently reliable, they will inevitably be integrated into the information quality assessment systems of financial institutions. Data services subscribed to by institutions, the information grading of terminal products, and the way algorithmic trading processes news signals will all adjust accordingly. The European Securities and Markets Authority (ESMA) issued a statement on AI transparency in investment services in 2024, the U.S. SEC continues to monitor compliance boundaries for investment advisors using AI, and China's Securities Regulatory Commission is tightening quality management over securities research reports. Currently, there are almost no dedicated tools for identifying and verifying AI-generated financial content. The fourth direction is cross-border interoperability. There is a long way to go for technical standard interoperability between China's metadata system and the overseas generative-level watermark system. A content platform that is compliant in China distributing content to the European market may find that European detection systems cannot read the Chinese metadata format, and vice versa. There are currently no commercial products for standard translation and connection between different regions. Middleware services that help content companies perform format conversion, compliance mapping, and bidirectional certification between the two systems represent a window of opportunity created by the pace of policy implementation. The length of this window depends on the progress of standard recognition negotiations between China and Europe.

From Shannon's study of statistical properties in communication systems, to using word frequency to solve the mystery of the Federalist Papers, from Google modulating token probabilities into a watermark infrastructure for billions of pieces of content, to China using metadata registration to establish a traceability channel from content to service provider, all these efforts have pursued a common goal: any information production process leaves the imprint of its source, and humans are finding ways to read it. What is happening now is that the scale and institutional significance have reached a new level. In the past, imprints were left passively, requiring large samples and complex statistical methods to detect. Now, active watermarking makes the imprint machine-verifiable by design and integrated into a legally binding compliance framework. China has the "Labeling Measures," Europe has the "AI Act," and the U.S. is considering federal legislation. Watermark technology itself is still far from perfect. Numerous benchmarks and forensic evidence studies show that a single round of rewriting can render most schemes ineffective, and it is difficult to find a stable public scheme that meets the standards of independent court evidence. However, this does not prevent the industrial opportunities around the watermark system from opening up, such as compliance audit tools, content provenance, copyright verification services, financial information quality identification, and cross-system standard interoperability. These needs are real and do not require technical perfection. Some institutions even predict that the AI watermark market will grow from $10 billion to $25-50 billion. The truly difficult part of this process, however, has little to do with technology. When a machine can, with some reliability, prove that content "has been processed by AI," the next questions that must be answered will appear in contracts, copyright law, journalistic ethics, and academic integrity. What responsibility does "processed by AI" imply? What rights does it grant? This is a question that humanity has not yet explored a sufficiently consensus-based answer for.