Claude’s text watermark relies on hidden patterns in word choices

Anthropic has disclosed that its forthcoming Claude text watermark uses a secret pattern in the model’s word-selection process, rather than hidden characters or metadata. The method can identify text that Claude likely generated or substantially processed, but it needs enough text to produce a reliable result and can be defeated by a complete rewrite.

The company says its system is based on SynthID-Text, a watermarking approach developed by Google DeepMind. It does not insert extra tokens, invisible Unicode characters or user-specific information. Instead, it changes how Claude resolves low-stakes choices between several plausible next words. Anthropic explains in its official post that the watermark changes the source of randomness used during text generation, while aiming to preserve the model’s normal output quality and probability distribution.

Large language models generate text one token at a time. At many points, several possible words would make sense. A watermarking system uses a secret key and parts of the preceding text to determine which option should be favoured or selected when such choices arise. Over a longer passage, those decisions create a statistical pattern that the key holder can test for later.

Detection depends on a secret key and sufficient length

The watermark is not visible in the text itself. It also cannot be checked by conventional AI detection services, schools or editors unless Anthropic provides access to its detector. Anthropic says it plans to offer a watermark detection API.

James Padolsey, writing for declaude, describes the broader principle as a sequence of weighted choices. In a common approach, a secret key assigns candidate words to temporary “green” and “red” groups. Watermarked output contains more green selections than chance would predict. The detector recreates those groups using the key, then measures whether the pattern is statistically significant.

SynthID-Text uses a more complex selection process than a simple probability boost, according to Padolsey. It runs a secret tournament among candidates drawn from the model’s normal probabilities. The goal is to create a detectable pattern without systematically changing how likely individual words are overall. Anthropic compares the method to using a known sequence of random numbers rather than ordinary dice rolls. The results should still appear random, but a party with the sequence can test whether it was used.

Both Anthropic and Padolsey stress that short passages are difficult to assess. Watermarks need many word choices to build evidence. They are also weaker in factual writing, quotations, lists, tightly constrained text and code, where there may be only one correct next token. A grammar-only edit of human-written text may leave too little Claude-generated material to detect.

Rewriting is the main weakness

Light editing may dilute a watermark while leaving enough original phrasing for a detector to find a signal. A full rewrite can remove it because the statistical evidence depends on sequences of words that remain intact. Padolsey cites tests of open watermarking implementations in which extensive recomposition reduced detector performance to chance levels. He cautions that Anthropic’s production implementation remains undisclosed, so outside researchers cannot yet independently test Claude’s specific watermark.

The approach has prompted a sharp debate about quality and provenance. In a commentary on his site Daring Fireball, John Gruber argues that even subtle shifts in word selection can compromise precision because near-synonyms are not interchangeable. He questions whether user feedback studies can detect small changes in prose quality and criticises provider-only detection as opaque.

Anthropic rejects the premise that the method harms output. It says internal tests found no measurable effect on creativity, readability or content quality, and cites Google DeepMind research that found no statistically significant difference in user ratings between watermarked and unwatermarked responses. The company also says the watermark establishes only that Claude was likely involved in producing or processing text. It does not prove authorship, identify a user or establish ownership.

Sources

• How AI text watermarking works – declaude
• How Claude’s text watermarking works – Anthropic
• Anthropic’s “Watermark” Text Adulteration in Claude Is a Perversion of Writing – Daring Fireball