The Watermark Hiding Inside Claude's Words

You may have heard that Claude is adding a watermark to the text it generates.

That sounds like Claude is going to put something like this at the end of every answer:

This text was generated by AI.

It is not.

There will be no visible label. No special font. No obvious symbol.

The idea is much stranger: the words can look completely normal while the way they were chosen contains a hidden statistical pattern that a machine can look for later.

Anthropic has announced plans for invisible, machine-readable text watermarks in Claude, with the move tied to the European Union's new AI transparency rules. Reporting on the system says Anthropic's approach is based on Google's SynthID-Text research, although Anthropic has not published every detail of its production implementation. ¹

So what actually changed?

What Claude is doing

Claude is Anthropic's AI assistant, similar to ChatGPT or Gemini. You type a prompt and it generates a response one piece at a time.

The new idea is to make those generated pieces leave a statistical fingerprint.

Without a watermark, you can picture generation like this:

prompt = "Explain how Wi-Fi works"
 
while not finished:
    probabilities = model.predict_next_token(context)
    token = sample(probabilities)
    context += token

The model predicts possible next tokens, then chooses one.

With watermarking, the basic process becomes more like:

prompt = "Explain how Wi-Fi works"
 
while not finished:
    probabilities = model.predict_next_token(context)
 
    # Hidden watermark logic influences the sampling.
    token = watermarked_sample(probabilities, secret_key)
 
    context += token

The important part is that the watermark is added while Claude is choosing the words.

It is not a hidden note attached to the final text.

It is not a secret character that sits between two spaces.

The signal lives in the pattern of choices.

A simple example

Imagine an AI is trying to complete:

The weather outside was

There are many reasonable choices:

cold
cool
grey
overcast
pleasant

A normal model already has probabilities for those choices:

choices = {
    "cold": 0.40,
    "cool": 0.25,
    "grey": 0.20,
    "overcast": 0.10,
    "pleasant": 0.05,
}

A watermark does not need to completely change those probabilities.

It can make tiny changes:

choices = {
    "cold": 0.39,
    "cool": 0.25,
    "grey": 0.20,
    "overcast": 0.11,  # slightly favoured here
    "pleasant": 0.05,
}

A reader would never notice that one word got a tiny preference.

Then, on the next token, a completely different set of candidates might get the preference.

After thousands of choices, those tiny nudges form a pattern.

That pattern is what a detector is looking for.

Why text watermarking is difficult

Watermarking a picture is relatively intuitive.

A picture can contain millions of pixels:

pixel pixel pixel pixel pixel
pixel pixel pixel pixel pixel
pixel pixel pixel pixel pixel
       ... millions more

You can change some pixels by a tiny amount and the picture can still look identical.

Text has almost no spare space.

Take this sentence:

The meeting starts at nine.

Suppose you try to hide a message using invisible characters:

The meeting[hidden character] starts at nine.

That might survive a casual copy and paste.

But run the text through a normalizer and it could disappear immediately.

You could also use look-alike Unicode characters:

normal:    The meeting starts at nine.
watermark: The meeting starts at ninе.

The second e above could be a visually similar character from another alphabet.

But that is not a robust solution either.

Copy the text into another system, normalize it, or convert it to plain ASCII and the watermark can vanish.

So the interesting approach is to hide the signal inside normal language choices.

The trick is that language models already make choices

This is the key idea.

An LLM does not normally decide an entire paragraph in one shot.

It generates a token, then uses that token as context for the next decision.

Very roughly:

Your prompt
     ↓
predict next token
     ↓
choose token
     ↓
predict next token
     ↓
choose token
     ↓
predict next token
     ↓
...

Suppose the model currently has these options:

choices = {
    "large": 0.50,
    "big": 0.30,
    "huge": 0.15,
    "vast": 0.05,
}

There is nothing special about large, big, huge, or vast.

They are simply plausible choices.

The watermark can slightly influence which one wins.

The trick is that it does not permanently prefer the same word.

If every watermarked answer suddenly used big instead of large, people would notice.

Instead, the preferred choices can change from step to step.

That makes the signal statistical rather than visible.

Think of it like a rigged coin

Imagine a normal coin:

Heads: 50%
Tails: 50%

Now imagine a secret system changes the odds a tiny amount each time:

Flip 1
Heads: 51%
Tails: 49%
 
Flip 2
Heads: 49%
Tails: 51%
 
Flip 3
Heads: 52%
Tails: 48%
 
Flip 4
Heads: 48%
Tails: 52%

Look at one flip and you learn almost nothing.

Look at a few flips and you still cannot confidently tell that anything unusual happened.

Look at thousands of flips and a detector that knows the secret pattern can start asking:

Does this sequence behave like the special coin?

Text watermarking works on a similar idea.

The "coin flips" are token choices.

The secret configuration determines the small bias.

The final paragraph is the long sequence of choices.

Google's SynthID-Text research is the clearest public example of this kind of generative text watermarking. ²

So where does SynthID come in?

Google calls its text watermarking system SynthID-Text.

The research was published in Nature in 2024. The system does not edit finished text. It changes the sampling process used to generate the next token.

The paper describes three important pieces:

1. Generate a secret signal for the current step
2. Use that signal while choosing the next token
3. Later, use the same information to look for the pattern

One of the interesting parts of SynthID-Text is its Tournament sampling method.

You can imagine a simplified version like this:

                Possible tokens
            ┌────┬────┬────┬────┐
            │ big│large│huge│vast│
            └────┴────┴────┴────┘
                     ↓
             hidden scoring
                     ↓
              tiny tournament
                     ↓
                  winner
                     ↓
                  "large"

That is simplified on purpose.

The real algorithm is more complicated. It uses several scoring functions and a random seed derived from the recent context and a watermarking key. Tokens effectively compete through multiple rounds until one is selected. ²

The important idea is simple:

The watermark is created by controlling the choice, not by changing the finished sentence afterward.

How can a detector see something you cannot?

Suppose you give a detector a long paragraph.

The detector has the information needed to reconstruct the hidden scoring pattern.

It can then walk through the text and ask something like:

score = 0
 
for token in text:
    expected = watermark_score(context, secret_key)
 
    if token_matches_watermark_pattern(token, expected):
        score += 1
 
if score > threshold:
    print("Watermark detected")
else:
    print("No reliable watermark detected")

That is not Google's actual production detector. It is a small teaching example.

The real detector uses statistical scoring.

The important thing is that one word does not prove anything.

A few words do not prove anything.

The detector becomes useful because it can combine evidence across a much longer sequence.

In normal writing, the choices should look roughly like ordinary chance.

In watermarked writing, the choices should show a small but detectable preference for the hidden pattern.

Google's SynthID-Text paper describes exactly this general structure: a watermarking key influences generation, and a detector later tests the resulting text for the corresponding statistical signal. ²

Why the watermark can survive copy and paste

This is one of the most important differences from invisible-character tricks.

Imagine the final output is:

The city was unusually quiet after the storm.

If the watermark were just a hidden Unicode character, copying the sentence through a system that strips those characters could destroy it.

With generative watermarking, the evidence is carried by the token sequence itself.

So ordinary operations such as:

Claude
  ↓
copy
  ↓
paste
  ↓
Google Docs
  ↓
copy
  ↓
email

do not automatically remove the pattern.

You copied the same words.

The statistical evidence is still in those words.

That does not mean the watermark survives every possible transformation.

It means normal copy and paste is very different from completely rewriting the text.

The big weakness: rewriting

Now imagine Claude produces:

The city was unusually quiet after the storm.

Another model rewrites it as:

The streets became strangely calm once the storm had passed.

Same idea.

Different words.

That matters because the watermark lives in the original sequence of choices.

Translate it.

Paraphrase it.

Rewrite every sentence.

Substantially edit it.

The original pattern can become much harder to detect.

This is a known limitation of generative text watermarking, and Google's own research evaluates the effect of edits and paraphrasing. ^{2 3}

That is why a watermark should not be imagined as an indestructible serial number.

It is better thought of as a statistical signal that can survive ordinary handling but can be weakened by sufficiently large changes to the text.

Short text has another problem

Watermark detection needs evidence.

Consider:

Hello.

There are almost no choices to analyze.

Now consider:

A 2,000-word essay about the economics of renewable energy...

There are thousands of generated tokens.

That gives the detector much more information.

This leads to a simple rule:

more text
   ↓
more token choices
   ↓
more statistical evidence
   ↓
easier detection

The opposite is also true.

Very short text is much harder to identify reliably.

Highly constrained text can also be difficult because the model has fewer reasonable alternatives to choose from.

Code is especially awkward

Imagine Claude generates:

def add(a, b):
    return a + b

It cannot freely replace the important tokens with random alternatives.

This:

return a + b

cannot safely become:

banana purple submarine

The program would stop working.

That is why natural-language prose gives a watermark more freedom than highly constrained output.

The more different ways there are to say something without changing its meaning, the more room the generation process has to hide a statistical signal.

Claude's watermark is not an AI detector

This is probably the easiest thing to misunderstand.

A watermark and an AI detector are different systems.

A watermark is put into the generation process:

Model
  ↓
generate tokens
  ↓
add hidden statistical pattern
  ↓
text

A generic AI detector works afterward:

finished text
     ↓
detector
     ↓
"this looks like AI"

That distinction matters.

An AI detector is making an inference from the writing.

A watermark is a signal deliberately inserted by the generator.

That makes a watermark closer to provenance than to a generic AI classifier.

And generic AI detectors have a bad track record

OpenAI released an AI text classifier in 2023 and later shut it down because of its low accuracy.

In OpenAI's own evaluation, the classifier correctly identified only a minority of AI-written text and also incorrectly labeled some human writing as AI-generated. ⁴

A Stanford-led study found another serious problem.

The researchers tested seven popular detectors on essays written by non-native English speakers and found that 61.22% of those essays were classified as AI-generated.

The researchers warned that this creates a risk of unfairly penalizing people whose English is grammatical but differs from the style represented in detector training data. ⁵

So when a detector says:

AI probability: 97%

that should not automatically be read as:

Proof that a machine wrote this.

A detector score is a prediction.

A watermark is evidence from a system that deliberately created the signal.

Those are very different things.

NeurIPS shows the problem really well

NeurIPS is one of the biggest conferences in machine learning.

For its 2026 Position Paper Track, NeurIPS used Pangram to investigate AI use.

Pangram gave 273 out of 969 submissions a score of 100%.

That sounds like 273 papers were completely written by AI.

But that is not what the score means.

NeurIPS explains that Pangram first breaks a document into windows of roughly 250 to 350 words. It then predicts whether each window contains AI-generated text.

So:

Pangram AI score = 100%

really means something closer to:

100% of the document's analysis windows
were classified as containing AI-generated text.

It does not literally mean:

100% of every word was generated by AI.

NeurIPS says this distinction explicitly. The conference also says it is moving toward provenance and audit trails rather than relying only on detection. ⁶

That is an important shift.

Why Claude is doing this now

The timing is connected to the European Union.

The EU AI Act includes transparency requirements for providers of systems that generate synthetic content. Article 50 says certain AI-generated or manipulated content should be marked in a machine-readable format so it can be detected as artificially generated or manipulated, subject to the rules and exceptions in the law.

The relevant transparency obligations begin applying on August 2, 2026. ⁷

That does not mean the EU invented SynthID.

Google had already been researching and deploying text watermarking.

What changed is that regulation made machine-readable provenance much more important for companies shipping general-purpose AI systems in Europe.

So the industry is moving from:

"Can we detect AI text?"

toward:

"Can the system produce text with
machine-readable provenance?"

Those are not the same question.

What Claude actually proves

Suppose a future Claude detector looks at a paragraph and says:

Watermark detected.

The safest interpretation is:

This text is consistent with having passed through a watermarked Claude generation process.

That can be useful.

It can help establish provenance.

It can help platforms identify synthetic content.

It can help researchers understand where AI-generated text came from.

But it does not automatically prove:

Claude wrote the original idea.

or:

A human did no work here.

or:

The entire document was generated by AI.

Consider a human-written paragraph:

I think the app feels slow because every page
fetches the same data again.

Now the author asks Claude:

Fix the grammar but keep my meaning.

Claude returns:

I think the app feels slow because every page
is fetching the same data again.

The underlying idea is still human.

Claude simply processed the text.

A watermark can potentially tell you that Claude was involved.

It cannot reconstruct the entire history of the paragraph.

That is why watermark and authorship should not be treated as the same thing.

A missing watermark does not prove a human wrote it

There is an equally important reverse case.

Imagine a detector says:

No watermark detected.

That could mean:

Human-written

But it could also mean:

Different AI system
Heavily rewritten text
Translated text
Short text
Watermark weakened by editing
Text produced before the watermark existed

So:

No watermark detected does not mean "definitely human."

It simply means the detector did not find a reliable signal.

The bigger idea is provenance

This is why the Claude announcement is more interesting than it first sounds.

For a long time, when someone handed you a paragraph, you could only inspect the final paragraph.

Now AI companies can deliberately leave evidence in the generation process.

That is a big conceptual change.

You can think about the future like this:

Model A
   ↓
generates text
   ↓
machine-readable signal
   ↓
human edits
   ↓
another system transforms it
   ↓
final document

The difficult problem is no longer simply:

"Does this look like AI?"

The better question is:

"What can we establish about how this content was produced?"

That is a provenance problem.

And provenance is much more useful than trying to make one detector decide whether a paragraph is "human" or "AI."

The whole thing in one picture

If you only remember one diagram from this article, make it this one:

                  AI model
                     │
                     ▼
             predicts next tokens
                     │
                     ▼
          ┌─────────────────────┐
          │ watermark influences│
          │ the token selection │
          └─────────────────────┘
                     │
                     ▼
                normal text
                     │
             copy / paste / read
                     │
                     ▼
                watermark
                still present
                     │
                     ▼
                detector
                     │
                     ▼
          statistical evidence

The watermark is not a visible object sitting inside the text.

It is a pattern created by the model's choices.

That is the clever part.

It is also the limitation.

Change enough of those choices, and the original signal can weaken or disappear.

So Claude is not secretly stamping a little "AI" label inside every word.

It is something more subtle.

The act of choosing the words can itself carry a hidden signature.

Sources