How Claude's Text Watermark Works — Signing Text Without Changing a Single Token

How Claude's Text Watermark Works -- Signing Text Without Changing a Single Token

In August 2026, Anthropic announced that every piece of text Claude generates now carries an invisible watermark. No characters are added. No hidden Unicode is inserted. And yet, given the text, Anthropic can statistically test whether Claude produced it. How is that possible?

This is Part 1 of a 2-part series on Claude's watermark.

• [Part 1](/post/claude-watermark-part1-en) (this post): How the watermark works -- sampling, the secret key, tournaments, detection, and its limits
• [Part 2](/post/claude-watermark-part2-en): Applying the same algorithm (SynthID-Text) to a local open model and running generation, detection, and removal attacks yourself

1. What Actually Happened

Let's get the facts straight first. The key points from Anthropic's announcement:

• Scope: Every Claude model released on or after August 2, 2026. That includes the API, claude.ai, Claude Code, and access through AWS, Google Cloud, and Microsoft Foundry.
• Geography: Worldwide, not just the EU.
• Why now: EU AI Act Article 50 became enforceable on August 2, 2026, requiring "machine-readable marks" on the output of newly launched generative AI systems.
• Method: A variant of SynthID-Text, published by Google DeepMind in *Nature* in 2024.
• Cost and speed: No extra tokens, so no extra cost, and a "negligible" effect on speed.
• No identifying information: The watermark cannot be traced to a person, organization, or conversation.
• Detection API: Coming "soon"; details still being worked out.

And the single most important sentence in the announcement:

A watermark only helps test whether Claude might have produced or processed the content. It doesn't say anything about ownership or authorship.

The watermark tells you that Claude may have generated or touched the text. It says nothing about who the author is. We'll come back to why that distinction matters in the final section.

2. Intuition: Two Writers of Equal Skill, One With a Habit

To understand the watermark, recall how an LLM produces text.

An LLM generates one token at a time. At each step it outputs a probability distribution over "what comes next" and then draws one token from it. The word "draws" is the whole story.

Consider "The sky today is ___". Plausible continuations: "cloudy", "overcast", "gray", "gloomy". If the model assigns 40% to "overcast", 35% to "gray", and 20% to "gloomy", any of them produces a perfectly fine sentence.

Ordinary sampling leaves that choice to pure randomness. The watermark replaces that randomness with pseudo-randomness derived from a secret key.

From the outside, the output is still "one of the reasonable options". Quality is unchanged. But someone who holds the key knows that, at this position, one particular option was *supposed* to be favored -- and when that pattern shows up consistently across hundreds of tokens, it is no longer coincidence.

The analogy: two writers of identical skill, except that one always rolls a specific loaded die when choosing between synonyms. You cannot tell from a single sentence. But if you own that die and read a whole essay, you can be confident who wrote it.

This is why Anthropic can say "nothing is added to the text". The only thing that changes is where the randomness comes from.

3. The Mechanism: SynthID-Text, Step by Step

Now let's walk through the actual algorithm, following the structure of the SynthID-Text paper (Dathathri et al., *Nature*, 2024). I'll focus on inputs and outputs rather than equations.

3.1 Context Window: The Last Few Tokens Become the Seed

The watermark needs a different seed at every position. Otherwise the same word would be favored everywhere and the text would fall apart.

SynthID-Text uses the previous H tokens (H=4 in the paper) as seed material. Hash the last 4 tokens together with the secret key, and you get a random number unique to the current position.

Two consequences follow:

1. Same key, same previous 4 tokens, same random number, always. A detector can reproduce the randomness at every position from the text alone.
2. Change any of the previous 4 tokens, and that position's random number changes. Editing one word breaks the watermark signal at that word and the 4 positions after it.

3.2 g-values: A 0/1 Score on Every Candidate Token

Once the seed is fixed, a pseudo-random function g is evaluated on every token in the vocabulary. In the simplest version, g is either 0 or 1. Same seed, same token, same g-value.

These g-values are the watermark's "marks". In the next step, the model will slightly prefer tokens with g=1.

3.3 Tournament Sampling: Bias Without Distortion

This is SynthID-Text's clever part. Naively adding a probability bonus to g=1 tokens would distort the distribution and hurt quality. Instead, the algorithm runs a tournament.

1. Draw several candidates (say 2^m) independently from the model's original distribution.
2. Pair them up; in each pair, the token with the higher g-value wins. Ties are broken randomly.
3. Pair up the winners and compare again, this time using g-values from a different seed.
4. After m rounds, the last survivor is the output token.

Why this works so well:

• All candidates come from the original distribution, so a token the model assigned near-zero probability will essentially never appear.
• Where the model is confident (after "The capital of France is", every candidate is "Paris"), the tournament is between identical tokens and does nothing. The watermark gets weaker there, but quality is perfectly preserved.
• Where the model hesitates (multiple synonyms), the candidates are diverse, the high-g one wins, and signal accumulates.

This is exactly why Anthropic says the watermark is "sparser on factual passages". The watermark only lives where the model had a choice.

Each round uses a different key (a "layer"); the number of layers is called the "depth", with a default of 30. More layers means a stronger signal; zero layers is just ordinary sampling.

3.4 The Non-Distortionary Property

The SynthID-Text paper proves an important theoretical property: tournament sampling is non-distortionary at the single-token level. If you ran the same prompt infinitely many times, the expected next-token distribution of the watermarked model equals that of the original model.

The caveat is "single draw". If the same context recurs, the same seed is reused, so diversity across multiple generations can shrink. The paper handles this with repeated-context masking: if a window of H tokens has already been seen, that position is left unwatermarked and falls back to ordinary sampling.

Anthropic reports that internal testing showed "no impact on content, level of creativity, or readability", and DeepMind reported no statistically significant difference in user satisfaction across 20 million live Gemini responses.

4. Detection: A Fight Against 0.5

The detector needs only the text and the key. No model required.

1. Tokenize the text.
2. At every position, reconstruct the seed from the previous H tokens and the key, and compute the g-value of the token that was actually chosen.
3. Average the g-values over all positions and all layers.

On unwatermarked text (human writing, another model's output, or Claude output under a different key), g-values are coin flips. The average lands near 0.5. On watermarked text, g=1 tokens were chosen more often, so the average is clearly above 0.5.

Confidence scales with token count. One token tells you nothing; dozens begin to show a tilt; a few hundred let you say "less than 1% chance this is coincidence". The paper also trains a Bayesian detector on top of the g-values, which works considerably better on short texts than the plain mean.

What follows from this design:

The last row matters. Without the key, detection is impossible. That's why Anthropic has to ship its own detection API, and why nobody else can build an independent "Claude detector".

5. Limits: What Erases the Watermark

This is the part to be honest about. Anthropic itself says that "light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will."

5.1 Editing

Changing one word alters the seed at that position and the next H positions, breaking the signal there. The rest is intact. In a 200-token paragraph, swapping 10 words damages at most 50 positions and leaves 150 untouched. Still detected.

Signal drops roughly linearly with edit rate. Where it crosses below the detection threshold is something we'll measure directly in Part 2.

5.2 Paraphrasing

This is the real threat. Feed the watermarked text to a different model (say, a small local open model) with "rewrite this", and every token choice now belongs to that model. The meaning survives; Claude's loaded-die fingerprint does not.

The attack is cheap. A small local model is enough, and it runs on a laptop. Output quality may drop slightly, but for someone trying to hide AI use, that's an easy trade.

5.3 Translation

Anthropic says text translated *by* Claude is watermarked, since Claude chose every word. Conversely, translating Claude's output with some other tool wipes the watermark, because every word choice changes.

5.4 Code

In code, syntax removes most of the choice. After for i in range(n):, very few tokens are possible. Anthropic acknowledges the effect on actual code is negligible and applies mostly to comments. A code watermark is, in practice, a comment-and-docstring watermark.

5.5 The Detection API Itself

Only Anthropic holds the key, so detection results are something you have to take on trust. If the API produces a false positive, the accused has structurally no way to contest it. Once schools and employers start using this API to "detect AI use", that becomes a real problem.

6. What It Stops and What It Doesn't

Look back at Section 5 and one pattern stands out. Every way to remove the watermark amounts to handing the word choices to someone other than Claude -- a human editor, another model, a translation tool. And the cost of doing that is a few seconds per text and one local model.

So I think the accurate mental model is not "a detection tool" but "a mark that survives only on unprocessed output". It cannot stop someone who has decided to hide it. It does catch text that nobody bothered to hide.

Where the watermark genuinely works:

• Bulk automated generation: spam, review manipulation, content farms -- anywhere raw output is published unedited. Detection rates here are very high.
• Platform-level filtering: looking at accounts rather than individual posts -- "90% of this account's posts are raw Claude output".
• Regulatory compliance: EU AI Act Article 50 requires "the existence of a machine-readable mark", not "perfect detection". That requirement is met.

Where it doesn't:

• A motivated individual: one paraphrase pass and it's gone.
• Authorship determination: the watermark only says "Claude touched this". If a human writes a draft and Claude proofreads it, the watermark is present. If Claude writes a draft and the human rewrites it from scratch, the watermark is absent. In both cases the watermark points the *opposite* way from the true author.

This is why Anthropic explicitly says the watermark "doesn't say anything about ownership or authorship". That sentence isn't a legal disclaimer; it's a technical fact.

7. Summary

In Part 2, I'll stop explaining and start measuring. SynthID-Text is already implemented in Hugging Face transformers, so we'll apply it to a local open model (Gemma 2 2B) and check in numbers: how the g-value distributions of watermarked and plain text actually separate, how many tokens detection needs, what fraction of words you have to change before it disappears, and what a single paraphrase pass with a local model does to it.

References

• Anthropic, How Claude's text watermarking works (2026)
• Dathathri et al., Scalable watermarking for identifying large language model outputs, *Nature* (2024)
• Sebastian Raschka, How Claude's Text Watermarking Works (2026)
• Hugging Face, SynthID Text in transformers
• TechCrunch, Anthropic says it will watermark text generated by its AI models (2026)