How Claude Hides Its Watermark in Text

Since 2 August 2026, every text that Claude writes carries a watermark. You cannot see it, you cannot copy it away, and Anthropic can use it to determine after the fact whether a text came from Claude. When I read that, my first question was how this is supposed to work at all. For images, after all, watermarking is a solved problem. For text, things look different.

A photo has millions of pixels, and every single one of them can be made a tiny bit lighter or darker without any human noticing the difference. So there is plenty of room for a watermark, and if you spread it widely enough across the image, it even survives cropping, compression and screenshots. Text has no such slack. A paragraph has perhaps 800 characters, and every single one of them carries meaning. You cannot move a comma without somebody noticing. So where is a watermark supposed to go?

In this post I explain how Anthropic answered that question. To keep the explanation from staying abstract, we rebuild the scheme in Python (without a real language model, which is the practical part of the trick) and use the rebuild to try out what the watermark survives and where it disappears. You do not need any background in machine learning for this. A little Python helps with reading the code, and I explain the statistics that deliver the proof at the end along the way.

What Anthropic announced

All Claude models released from 2 August 2026 onward mark their output from day one. The first model with a watermark is Fable 5.1, and the older models are supposed to follow by 2 December 2026. The reason is Article 50 of the EU AI Act, which demands machine-readable marking of AI output.

The announcement itself was initially a single support article, which the press discovered on 11 August. Three days of screenshots of cancelled subscriptions on X and speculation on Reddit about how this might work followed. On 14 August, Anthropic supplied the explanation in a blog post. Since then we know how it was implemented and no longer have to guess.

The watermark lives in the choice of words

Anthropic uses SynthID-Text by Google DeepMind. What we will rebuild here, however, is a related, simpler scheme that was traded as the hottest candidate during the days of speculation and that I will call green list from here on. The core idea is the same for both -- SynthID is more complicated and in return has the advantage that the statistical properties of the marked text are closer to those of unmarked text. For a blog post the green list is more illustrative, and I will come back to the difference at the end.

The idea

A language model does not write letter by letter but in chunks called tokens. Often a token is a whole word, sometimes a part of a word or a punctuation mark (for simplicity I will nevertheless speak of "words" in what follows). The fixed list of all tokens a model knows is its vocabulary, some tens of thousands of entries for real models.

Writing then proceeds word by word, and every step works the same way. The model looks at the text so far and gives every word in its vocabulary a score: the higher, the better the word fits at this spot. The scores are then converted into probabilities, and the next word is drawn according to these probabilities. So the best word wins most of the time -- but not always -- and that is why a language model gives you a slightly different answer to the same question every time. In the jargon the scores are called logits and the conversion softmax, and that is what they are called in the code below as well.

At many points in a text, several words have almost the same score:

"The result was impressive / remarkable / astonishing / striking."

Each of these variants says the same thing, and the reader does not care which one the model picks. A signal can be hidden in this slack. All you have to do is make the choice between the equivalent words according to a fixed rule. A simple version of this can be imagined like so:

Two people agree in advance: "In every sentence I send you, the third word starts with a letter from the first half of the alphabet." The text reads perfectly normally. But whoever knows the rule checks a few dozen sentences and knows with high statistical confidence whether the message came from that person.

Why are a few dozen sentences enough for this? In a text without such an agreement, the third word starts with a letter from A to M by chance in only roughly half of the sentences. If it does so in 40 out of 40 sentences, that can no longer be chance, and at the same time the person has written nothing that anybody would notice.

The rule in the green list scheme is a little more complicated. It is computed afresh for every word from the previous word and a secret key, using a cryptographic hash. A hash is a function that turns an arbitrary input into a number that looks random: the same input always yields the same number, but whoever does not know the input cannot predict the number. So the rule changes with every word, and without the key nobody can say what it is at any given position.

Invisible Unicode characters, homoglyphs or special "load-bearing" phrases play no role in this. The watermark is a statistical signal in the choice of consecutive words.

No language model needed

For the rebuild we do not need a language model, a random number generator is enough. That works because the watermark only kicks in behind the model. All it sees of the model is the list of scores, one per word in the vocabulary. Whether that list comes from 400 billion parameters or from a random number generator is of no concern to the scheme. So we replace the language model with a model of a language model (as a physicist I am used to models of models): a function that returns plausible scores for a given context.

Here I show only the instructive excerpts, the complete rebuild is available as a Gist.

The parameter spread determines what kind of text we are modelling. It sets how far apart the scores lie and thereby the entropy, that is, how undecided the model is at a given spot. A small value means "many almost equally good words", as in free-flowing prose. A large value means "one word dominates", as with facts, quotations or code.

A real language model of course does not distribute its scores in a Gaussian over all its tokens. But all that matters to the scheme is that there is a lot of choice at some spots and hardly any at others, and the random number generator captures that.

The green list

The green list scheme has four steps:

• hash the previous token together with a secret key,
• use the result to split the vocabulary into "green" (a fraction γ, here 25 %) and "red",
• give the green words a small bonus δ on their score,
• and then draw the next word according to the modified probabilities.

The first two steps are handled by this function:

Figure 1: The chain. Every word seeds, via the hash with the secret key, the green list of the next position. That is why the split is different in every column, and that is why the detector can later reconstruct it from the text alone.

Figure 1 shows what happens over the course of a sentence. Above each position stands the chosen word, below it the vocabulary as a grid of 40 boxes, ten of which are green (in reality there are some tens of thousands of boxes; the picture is schematic). The first word "The" comes from the prompt. It has no predecessor and therefore no list either. From "The" and the key, the hash computes the green list for the second position, where "result" is chosen, and that word is on the green list. From "result" and the key, the list for the third position emerges, where the choice falls on "was", a red word, and so it continues to the end of the sentence. The arrow leading from each word via the hash box to the next split is the chain that holds the scheme together.

Two things can be seen in the picture. The split is different in every column because the seed hangs off the respective previous word. That matters, because a fixed green list would be a fixed preference for certain words, and with enough text one could find that simply by counting. This way, however, every word is sometimes green and sometimes red, depending on what comes before it. And four of the six chosen words are green, although by pure chance only 1.5 would be expected. That is the watermark.

So the list is different at every position, but with the key SECRET_KEY it can be reconstructed at any time, because all that takes is the previous word, and that is right there in the text. Without the key it is indistinguishable from chance. Only someone who knows the key can find the watermark in a text, and that is why to this day (as of September 2026) there is no way to check whether a text carries an Anthropic watermark. That service has to be provided by Anthropic itself.

The intervention

Now that we have the list, the watermark itself is simple (and this is exactly the step that is more complicated in SynthID):

The entire intervention is the inner loop: every word on the green list gets δ added to its score, everything else stays as it was.

And how large does δ have to be? Small enough that the bonus only tips the balance when the model is wavering anyway. Figure 2 shows the two cases side by side, with the candidates for the next word as bars, sorted by the model's score. On the left, for "The result was ___", the best candidates lie close together. "Remarkable" has the highest score, but "impressive" is on the green list, and with the segment marked δ on its bar it pushes past the line "best without δ" and gets chosen. On the right, for "The capital of France is ___", "Paris" is so far ahead that the green candidates "Lyon" and "Nice" do not come close even with the bonus. Here the bonus fizzles out, and the model writes Paris, just as it would have done without a watermark. So the watermark does not make the text wrong. It only intervenes where several words fit equally well.

Figure 2: The same intervention, two situations. Only on the left does δ bridge the gap between the best candidates, and only on the left does the outcome shift as a result, visible in the fact that the chosen bar is not the top one.

Detection

To check a text you do not need the model, only the text and the key (and the tokenizer that splits the text back into the same tokens). The detector walks through the text word by word, computes the green list from the respective previous word and the key, just as the generator did, and looks up whether the word actually chosen is on it. At the end it counts how often that was the case and compares with the 25 % that would be expected by pure chance.

The statistics behind this are those of tossing a biased coin. If the text carries no watermark, every word is green with a probability of 25 %. This assumption is called the null hypothesis. With 299 words you then expect about 75 green ones, sometimes a few more, sometimes a few fewer, and how large this "a few" typically is, is what the standard deviation tells you, here around 7.5 words. The z-score states how many standard deviations the count lies away from the expected value. So a z-score of 4 means: four times as far away as the normal fluctuation, and a random text achieves that in only about one in 30,000 cases. The p-value translates the z-score into this probability.

This also makes clear why the scheme has nothing to do with the "AI detectors" we have had so far. Those guess from stylistic features and are notoriously often wrong. Or, as Anthropic itself puts it:

AI detection software uses a different method, because the companies that provide it don't have our key.

With the green list watermark, by contrast, what comes out is a p-value with a cleanly defined false positive rate.

What the rebuild shows

But I had promised experiments. With the rebuild we can try out a few properties of the watermark very concretely. The exact numbers of course depend on values that differ between real LLMs and our model (we choose a vocabulary of 4000 tokens, γ = 0.25 and a deliberately strong δ = 2.0), but the basic properties should be the same.

With and without watermark

If we generate 300 tokens with and without a watermark, detection is unambiguous:

Without watermark     75/299 green (25.1%)   z =  0.03   p = 0.49
With watermark       193/299 green (64.5%)   z = 15.79   p = 1.7e-56

Without a watermark we land at γ = 25 % as expected, with a watermark at 65 %. What the z-score of 15.79 means in concrete terms is shown in Figure 3. The bell curve is the distribution of the share of green tokens for texts without a watermark. It is centred on 25 % and just 2.5 percentage points wide (one standard deviation), so practically all texts without a watermark land between about 17 and 33 percent. The unmarked text hits the middle of the curve with 25.1 %. The marked text, at 64.5 %, lies so far to the right that the curve has long since dropped to zero there. The p-value says the same thing as a number: the chance of finding this many green tokens in a text by coincidence is about 1 in a number with 56 digits. For all practical purposes it is therefore certain that the text was produced by someone who had the secret key.

This clarity is, admittedly, partly owed to our large δ. In reality you need longer texts for values this clear. Still, I find it helpful to have seen one concrete example.

Figure 3: What a z-score of 15.8 means. The z-score measures the distance to the centre of the bell curve in units of its width. The dashed line at z = 4 is the detection threshold we use from here on.

Paraphrasing

A typical question is whether the watermark can be removed simply by rephrasing the text. We simulate that by replacing a fraction of the tokens with random other ones:

 0% replaced   z = 15.79
25% replaced   z =  9.12
50% replaced   z =  5.11
80% replaced   z =  0.03

The left panel of Figure 4 shows this series as a curve. As the share of replaced tokens grows, the signal gets noisier, but slowly: whoever rewrites half of the text is still above the detection threshold with z = 5.11. The reason is that each replaced word destroys only two pairs, its own and that of its successor (whose list depends on it, after all). All other pairs stay intact and keep counting -- and at 50 % that is still a quarter of all pairs. Only when almost every word has been swapped is there no pair left, and the signal is gone. That is the explanation for Anthropic's phrasing "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will."

Low entropy

These experiments ran with spread = 3, that is, with plenty of choice at every position. But the kind of text Claude produces most often is probably code, with strict syntax rules and correspondingly low entropy. The right panel of Figure 4 shows what happens then:

high entropy (prose, spread = 1)              z = 17.53
low entropy (facts, code, spread = 20)        z =  2.57

A watermark needs freedom of choice. Where the model has none, there is nothing to mark, for "The capital of France is ___" just as for code, quotations and short answers. At low entropy the z-score of 2.57 is below the threshold from the outset, although nothing about the text was changed. Interestingly, this means that a half-rewritten piece of prose can be easier to detect than an untouched text with low entropy.

Figure 4: Both limits on the same scale. On the left, paraphrasing, simulated by the random replacement of tokens from edit_attack; on the right, the entropy of the model.

What Anthropic really uses

Anthropic, however, does not use the green list scheme we have just rebuilt.

Claude's text watermark is a version of the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024.

Our rebuild slightly distorts the probabilities via the bonus δ: green words occur somewhat more often than the model wanted. SynthID uses tournament sampling instead. There, several candidates for the next word are drawn from the unchanged distribution and compete against each other in a key-dependent tournament tree. If you build the tournament tree correctly, the output distribution stays the same on average.

This property also answers the quality question that was asked most often in my social media bubble: if the distribution does not change on average, the model does not get worse. Anthropic points to DeepMind's live evaluation over around 20 million responses in Gemini, which showed no statistically significant differences in user ratings.

Testing it on this very text

That leaves this article itself. It was written with Claude, and the last version was translated by Fable 5.1, the first model with a watermark. So this text ought to carry one. I cannot check that yet, because the key is secret and the promised detection API does not exist yet. But the rebuild at least allows an estimate. Against a strong signal speaks the fact that a good part of it consists of code with low entropy. In favour speaks the length: the z-score grows with the square root of the text length, and this article is many times the 300 tokens from the experiment. A signal that is weak per word becomes unambiguous over enough words. My prediction: no z = 15, but measurable.