Watermark radioactivity: AI watermarking, model collapse… and you

As of October 2026, the leading commercial AI models are watermarking not just images, but text. Gemini has been watermarking at least some of its text since 2026 with SynthID. Claude started watermarking its text with an unknown system in August 2026. And, to comply with EU regulations, OpenAI started watermarking its text in October 2026 with textGrain.

But what are the practical consequences of all this watermarking? Is it as simple as being able to identify AI-written text… or could it be more complicated? Let’s talk about AI watermarking, content ingestion, and what it means for content generation as a whole.

How text watermarking works

Compared to text, watermarking an image is straightforward. You can fingerprint an image in a way that is invisible to a human user while still being reliably retained within an image. You can store meta data easily within the file. Text presents more problems; text can be copied and pasted without any formatting. It can be easily modified and rearranged. And it doesn’t carry over any meta data.

Currently, there are two major ways to watermark text:

• Green/red: Green/red watermarking alters the probabilities of specific, given words. When text is generated, the probabilities of these words will be subtly shifted. When text is ingested, the system will notice that the given words are being used with increased frequency and will consequently be able to identify it.
• Non-distortion: Non-distortion watermarking works similarly—by altering probability—but it is not static. There isn’t a list of given words; they change each time. So, rather than always increasing the frequency of a given word, the system uses a cryptographic key to apply the frequencies across different words within the text. 

Today, most systems use non-distortion watermarking. Unlike green/red watermarking—theoretically—these systems should not, over a body of text, degrade model weight. But we don’t really know yet if this is true on a practical level. There may still be patterns, hidden within the text, that can affect or degrade model performance.

Text watermarking is also proprietary. Claude can see watermarks on Claude-generated text and Gemini can see watermarks on Gemini-generated text. But Claude, in theory, cannot see watermarks on Gemini-generated text, and vice versa.

Watermarking radioactivity and model collapse

OK, now that we understand what watermarking does, there are two additional things we need to consider: watermarking radioactivity and model collapse.

Watermarking radioactivity happens when watermarking propagates once ingested. All LLM systems are probabilistic in nature. When watermarked data is used within training, the signs of those watermarks can be visible. This can depend on many factors—such as how much of the watermarked data is being consumed and how robust the watermarking is.

Model collapse can happen if an AI system trains too much on its own content. The model essentially becomes more and more like itself until it becomes incoherent.

Watermarking could be a way to protect against this; it isn’t just that the content is watermarked, it’s that watermarking lets the system determine that it’s synthetic content. (However, it can’t be used as the only control against model collapse, because models can only identify their own proprietary content.)

The consumption problem

Not all content that is referenced by an AI system has been consumed by an AI. An AI system essentially has “long term memory” (its training corpus) and “short term memory” (the open web, MCP servers, etc).

Consider a blog. It can be searched on the open web. An AI system can reference it. But the AI system doesn’t really need to know the blog; it doesn’t need to have it in its training data. Conversely, consider core documentation surrounding the release of a new version of a programming language. This is something an AI system will need to reference repeatedly to generate the right text and make the right choices.

Whether content even needs to be consumed at all is largely based on whether it’s ephemeral or evergreen. And there are workarounds; for example, an AI harness may simply know that it must check the latest Rust docs or API before writing Rust; this is known as retrieval-augmented generation (RAG).

But that isn’t flawless. Consider that when I was writing this article, I tried to look up what OpenAI’s watermarking schema was called. The AI overview responded that OpenAI did not have a watermarking schema, because its watermarking schema was not within its training corpus. Indeed, it didn’t even know that it should retrieve something. In this case, it was recency—but it highlights what can happen.

All this leads us to…

Watermarking ingestion in practice: Our open questions

AI-generated content is becoming rampant across the web. And these watermarks can be applied to text not only when text is generated entirely, but also when the content is revised, edited, or translated. 

This raises some critical questions, most of which are as yet unanswered:

• Is it harmful for an AI system to consume its own watermarked content? Truth be told, we don’t know this for sure. Because it’s so dependent on so many variables, it’s possible that a small percentage of watermarked content is fine. There are even some indications that synthetic data isn’t entirely harmful as long as it is reliably grounded in truth (which is its own adventure).
• Will AI systems refrain from consuming their own data? Even if AI content is harmful (in fact, even if it is not harmful), that’s a separate question from whether AI trainers will try to reduce its consumption. There is an argument to simply avoid AI-generated content overall because the risks outweigh the benefits. But there’s also an argument that this may become swiftly impossible; AI-generated content may soon eclipse all other forms of content on the web.
• Does watermarked content even need to be consumed? Blogs, social media posts, etc; these are the largest bodies of likely watermarked content. Papers and other more authoritative spaces are less likely to contain purely generated content. It may be the case that watermarked content, overall, is simply low signal and can be discarded.

And all these questions are separate from whether AI-generation could harm the visibility of content—whether AI-generation, for example, could send signals to search engines that your content should not be prioritized.

No one really knows the answers to these questions. These systems are being formed as we discuss them. Perhaps what would be most valuable would be to describe the ideal state of the system—the world that we believe is best. For now, when creating content, we may want to consider whether it is canonical or ephemeral; whether it must be ingested into a corpus or whether RAG might do.