AI text watermarking: how it works and what it can't do

Claude started watermarking its text output this month. When the news landed, most explanations I saw guessed at hidden characters: zero-width spaces, odd Unicode, metadata smuggled into the clipboard.

That is not how it works. The watermark is statistical. It lives in which words the model picks when several words would do, and there is nothing in the text you could point to and delete.

Anthropic's announcement explains the mechanism at a high level. The short version:

• The requirement comes from the EU AI Act's transparency rules, which Anthropic signed onto in July 2026.
• The rollout is global, because shipping two different Claudes was not practical.
• New models watermark at launch. Older models get it over the coming months.
• Generated files like PNGs get a signed C2PA content credential instead, which is a different mechanism entirely.

What the announcement does not give you is a feel for the machinery: how a watermark can survive in plain prose, why a detector can only ever say "likely", and how fast the signal dies when you edit. That is what this post is for.

One honesty note before the figures. The simulations below run a small SynthID-style scheme I wrote for this post, with a made-up key and hand-built word distributions. The mechanics are the same shape as the real thing; every number is illustrative. Nobody outside Anthropic has the real key, and that is rather the point.

A language model picks each word by rolling dice

A language model produces text one token at a time. At every step it assigns a probability to each candidate for the next token: maybe "missing" gets 40%, "invalid" 25%, "stale" 15%, and so on. Then it samples one. The sampling step needs a source of randomness, and normally that source is an ordinary random number generator that nobody ever thinks about.

That anonymous random number is the entire attack surface for a text watermark. The probabilities are the model's opinion. The random number is just a tiebreaker, and nothing says it has to be anonymous.

The watermark changes the dice, not the odds

The scheme Claude uses is based on SynthID-Text, which Google DeepMind published in Nature in 2024 and has been running in Gemini since then.

Instead of an arbitrary random number, the sampler derives its randomness from a secret key plus a few of the words that came just before. Each candidate word gets a keyed score, call it g, and the sampler uses those g-values to settle ties the probabilities leave open.

The candidate probabilities do not change. Averaged over many contexts, the watermarked sampler picks each word exactly as often as the plain one. What changes is which specific word wins in which specific context, and that pattern is checkable later by anyone who holds the key.

The deploy failed because the config file was ____

missing

40%

invalid

25%

stale

15%

empty

12%

corrupted

8%

SampleWatermark on

press Sample to pick the next word

One pick1,000 conversations

Same probabilities either way. The watermark only changes which random number decides.

This also answers the determinism worry that came up in almost every thread: no, Claude will not start producing identical outputs. With the same key and the exact same preceding words the keyed pick repeats, but conversations never share their entire history, and every earlier word reshuffles every later g-value. And where there is no randomness at all, greedy decoding at temperature zero, there is nothing for the watermark to redirect.

You cannot read the difference. Try it

If the distribution is untouched, a watermarked passage should read exactly as well as an unwatermarked one. That claim is testable on you.

Below are five pairs of passages built from identical word distributions. In each pair, one passage was sampled with ordinary randomness and one with the keyed sampler.

Passage AThe morning train was crowded, so I stood the whole way and read on my phone. The ride felt shorter than usual, which was a pleasant surprise.Passage BThe morning train was packed, so I stood the entire way and read on my phone. The ride felt shorter than usual, which was a pleasant surprise.

round 1 of 5 · score 0 · pick the watermarked passage

Both passages come from the same candidate distributions. One used ordinary random sampling, one used the keyed sampler.

Scoring around chance here is the expected outcome, and it is worth sitting with what that means: the watermark is not a style, a tone, or a tell. It is a pattern in choices that were all defensible anyway, detectable only if you can recompute the g-values.

Low-entropy text cannot hold a watermark

The watermark needs choices to hide in. Information theory gives that a name: entropy, the amount of genuine freedom in the next-token distribution. I think of it as an entropy budget:

• Creative prose has a large budget, because many words read equally well.
• A factual answer has a small one, because accuracy pins the words down.
• Code has almost none: the compiler accepts one spelling of const, and the API is called filter whether or not a watermark would prefer otherwise.

The harbor was quiet that evening , and the boats swayed gently against their moorings .

next-token entropy per position (hand-assigned, illustrative)

signal-carrying tokens: 10 of 16 (63%) · threshold 1 bit

Creative proseFactual answerCode

Many words could be swapped without changing the meaning. Most tokens leave room for the keyed pick.

This is why Anthropic's FAQ says code carries minimal watermark, with comments and local names as the exception, and why light proofreading of your own writing barely marks it: when Claude changes three words in your paragraph, there are only three choices to hide signal in.

The fear that watermarking would force worse code, raised in several threads, has the mechanism backwards. Where there is no freedom, the watermark does not push; it goes quiet.

Detection is a statistic, not a verdict

Detection works by recomputing g-values. Take a passage, take the key, score every word against its context, and average. Text nobody watermarked averages g around 0.5. Text from the keyed sampler averages higher, because the sampler favored high-g words wherever it had room. The gap per word is small, so confidence comes from length: a z-score grows with the square root of the number of scored words.

False-positive rate:1%0.1%0.01%· dashed curves show the other two rates

150 tokens · 45% detection at a 0.1% false-positive rate

Creative proseFactual answerCode

Drag across the chart. Toy model: each signal token shifts mean g by 0.09; 60% of tokens carry signal in this content type.

Play with the curve and two practical truths fall out:

1. Short text is undetectable. A tweet-sized passage does not contain enough signal to clear any reasonable false-positive threshold, and a code snippet is worse because barely any of its tokens are scored at all.
2. The answer is always a probability. Anthropic has said a detection API is coming but not when; the FAQ is careful to say detection can only report that Claude was "likely involved", not that Claude wrote the text, and not that a human did not.

Hold that limit against how detectors get used in practice. Teachers, editors, and hiring managers want a yes or a no. A watermark checker will hand them "62% at this length", and the temptation to read that as a verdict will be enormous. The people most at risk are the ones a short-sample false positive lands on.

Paraphrasing erodes it, rewriting deletes it

The watermark's other honest limit: it only survives in the words the model chose. Edit a word and its g-value is replaced by whatever your word happens to score, which is uniform noise. Edit enough words and the average sinks back toward 0.5.

We moved the reporting job to its own worker last month, and the change was simpler than we feared. The old job started every night at two and kept a database connection for the entire run. Under the new setup each report grabs a connection only while it saves, so the pool stays free for user traffic. Latency on the dashboard dropped the first night, and nobody has noticed the two a.m. slowdown since.

Words paraphrased0%

what the detector seesmean g 0.68

0.50 = unmarked

Shading shows each surviving word's g-value. Dotted words have been paraphrased away from the keyed pick.

mean g 0.68 (unmarked text ≈ 0.50) · z 2.1 · likely Claude-involved

Each edited word swaps to a synonym and takes a fresh, unkeyed g-value. The detector only sees what survives.

Anthropic says this plainly in its own FAQ: editing degrades the signal, and a complete rewrite removes it. Removal tools appeared within days, which surprised nobody. I read the code and full commit history of one of them, watermarks-remover, and it is more instructive than its name suggests:

• The first commit landed the morning after the announcement; six days later it had 88 commits and five releases.
• In all of that, there is no statistical-watermark removal code. The deterministic part strips invisible Unicode and file metadata, which is a different problem the watermark never used.
• The layer aimed at the actual watermark is a set of paraphrase prompts that the tool hands to whatever other model you point it at. You are the rewrite model.
• It cannot check its own work either, and to its credit it says so. With no public detector and no key, its 267 tests cannot contain a single statistically watermarked fixture, and its README concedes that no tool can certify text will pass a check nobody has shipped.

Its most honest line asks why anyone would pay for a premium model and then rewrite the output with a cheaper one. That is the entire removal economy in one sentence: paraphrase blindly, lose the quality you paid for, and hope.

This limit cuts both ways, and both directions matter:

• If you feared the watermark as a surveillance instrument, the erosion curve plus the FAQ's design should lower your pulse: the mark carries no identifying information, cannot be traced to a person or a chat, and dies under determined editing.
• If you hoped it would end AI-generated spam and essay mills, the same curve says no. It will catch lazy copy-paste at scale. It will not catch anyone who cares enough to rewrite.

Where the critics are right

The pushback deserves a fair hearing, because parts of it are correct.

The strongest version came from Isaac Flath, in the most-liked reply to the announcement: word choice is a core part of writing quality, and "no statistically significant difference" is a claim about the evals Anthropic ran, not about everything a writer might care about.

He is right about the logic. Benchmarks cannot prove a negative, and imperceptible-to-readers is a weaker claim than identical. The honest statement is that the output distribution, conditioned on one fixed key, is genuinely different from the unwatermarked model's, and the evidence that nobody can tell is empirical, not mathematical.

The empirical evidence is real, though. Gemini has shipped this exact scheme to a very large user base since 2024, DeepMind reported no quality regression across millions of rated responses in the Nature paper, and two years of Gemini text produced no thread of writers noticing the watermark. It was there the whole time.

The surveillance worry I find much weaker, for the reasons the erosion section shows: no identity in the mark, no per-user key, and a signal that paraphrasing destroys. A watermark this easy to remove makes a poor leash. The cancellation threats are a market question, and the market will answer it; my bet is that OpenAI ships something similar within a year, because the same EU rules apply to everyone.

The cat-and-mouse game nobody can win

Zoom out from the mechanism and the shape of the game is familiar. Regulators want AI-made text to be distinguishable from human work: the EU AI Act here, similar rules forming elsewhere. Users who want the opposite reach for paraphrase tools, rewrite models, or an hour of manual editing. Every scheme in this post can be defeated by someone who cares, and every removal trick can be answered with a stronger scheme. Neither side runs out of moves, so the game just goes around again.

I think the honest question is why we are playing at all. A watermark that dies under editing cannot enforce anything. All it can do is sort text into "nobody bothered to hide this" and "unknown". If the goal is catching bulk spam and lazy copy-paste, that sort has real value. If the goal is restoring the belief that a human wrote what you are reading, no round of this game will deliver it, and the next scheme will not either.

That question, what the fight is actually for, deserves more airtime than the mechanism, and it is the one almost nobody in the announcement threads was asking.

The real risk is the detector, not the watermark

Here is where I land. The watermark itself is close to the best version of a bad-option space: distribution-preserving, identity-free, cheap, and honest about its limits. The risk sits downstream, in how a yes-or-no detector product will get used on ten-sentence writing samples by people who never read the FAQ's word "likely".

If you write with Claude, your text did not get worse this month, and you can verify that yourself above. If you review other people's text, the thing to internalize is the detection curve: below a few hundred words it is noise, and even above that it is a probability, not a confession.

I still have one question I cannot answer from the outside: when the detection API ships, will it report the score and the passage length, or just a label? The number forces honest use. The label invites the exact misuse the watermark's own design tried to avoid.