How Claude's Text Watermark Works (And Where It Breaks Down)
by Syed Sibtain, System Analyst
Introduction
Most of us have stopped being surprised when we read something written by AI. It appears in our emails, documents, pull request descriptions, and, increasingly, on the internet. But underneath all of this sits a quieter question.
How do we actually know?
I have been curious about the inputs and outputs of these models lately. Not the "can anyone tell if my LinkedIn post was written by AI, or if my brother used AI to write his assignment" version of it. The real question, for me, is this. AI-generated text is going to be everywhere in the near future, or it's already everywhere. Is there any way at all to prove that a piece of text came from a specific model? Was it Claude, or Gemini, or ChatGPT? And can we do that without hurting the quality of the text, and obviously without spying on the person who wrote it?
And I will be honest. By the time I finish writing this blog, I might end up getting it proofread by AI, or asking it to fix my grammar.
This is not a brand new idea. Google already ships something similar with SynthID, and Anthropic, moving at their usual crazy speed, recently shipped their own answer to this. They added a text watermark to Claude's outputs. In this blog, I will walk you through what it is, how it actually works under the hood, and the part I find most interesting, which is where it quietly breaks down. Because once we understand the mechanism, the limitations are not bugs. They fall directly out of the design.
The Problem of Proving Where Text Came From Without Breaking It
At first glance, watermarking text sounds easy, right? Just hide some signal in the text, or encode something into it.
But text is not a good place to hide anything.
Think about how this works with images. An image has millions of pixels, and we have plenty of space to insert a hidden signal by slightly altering just a few of them. There is no such privilege in text. Every word is visible. An invisible pixel cannot be introduced secretly. If we change one word, the reader will see a different word.
So any text watermark has to do a few hard things at once.
- Invisible to the reader. The text must read exactly as well as it did before.
- No quality cost. No weird word choices, no drop in creativity or accuracy.
- No extra cost. It can't add tokens, latency, or price.
- Verifiable. Someone with the right key must be able to check it later.
- Privacy-preserving. It must not encode anything about who used the model.
Anthropic is doing this now because of regulations, specifically the EU Code of Practice on Transparency of AI-Generated Content, and the EU AI Act in particular. However, regardless of the paperwork that led to it, the technical problem is interesting.
How It Actually Works
To understand the watermark, we first need to understand how a language model chooses its words.
A model such as Claude generates text token by token. At each step, there isn't a single "correct" next word. It follows a probability distribution over a large number of candidates. And often, several of those candidates are equally good. Think about a sentence that might continue with "big" or "large", "however" or "but", "quick" or "fast". It hardly matters which one we pick in terms of semantics.
Normally, the model breaks these ties using a plain source of randomness, effectively a coin flip.
With the watermark, instead of that coin flip, the model uses a secret key with the recent context to guide the decision rather than selecting at random from the equally good possibilities. Here, recent context just means the handful of words right before the current one, the same words the model is already looking at to decide what comes next.
next_word = f(secret_key, preceding_words)
The output still appears very natural, and it is impossible for the reader to tell that "big" was selected using a key rather than a coin. However, those key-guided decisions leave a subtle, constant mark throughout the entire text.
This is Google DeepMind's SynthID-Text method, which expands upon a concept first put forth by Scott Aaronson in 2022. Instead of creating something new, Anthropic embraced it. You can read more about SynthID here.
Why This Design Is So Elegant
Once we understand the mechanism, a few useful properties become available for free.
- No extra tokens. Nothing is being appended. Only which word is chosen among equals is under our control. The same speed, length, and cost.
- No quality hit. Because the watermark only acts on choices that were already interchangeable, testing showed no statistically significant difference from the unwatermarked model in content, creativity, or readability.
- No user identity. The key signals "Claude was involved," and nothing more. It cannot be linked to a particular individual or group.
How Detection Works
Detecting the watermark is simply the opposite of embedding it, which involves steering word selections with a key.
Given a piece of text and the same secret key, we can replay the process. At each position, we check how often the actual word matches what the key would have predicted. Ordinary human-written text matches the key's predictions no more than random chance would. Watermarked Claude text matches far more often than chance, and that gap is the signal.
To perform this check, we need the key, and Anthropic says a detection API is on the way. And given the speed at which they ship, it will come pretty soon.
Where It Breaks Down (And Why That Makes Sense)
This is the section I want to focus on because it is where the design shows itself.
The entire watermark lives in one place, the freedom to choose between equally-good words. Every limitation is really just a place where that freedom disappears.
- Short text. Few words means few choices, which means not enough signal to accumulate. A one-line answer is nearly impossible to watermark reliably.
- Factual passages. When there's exactly one correct term, there's nothing to swap. Precise, factual writing carries a sparser signal.
- Code. Code has to be exact, and you can't casually swap a variable name or a keyword. So code is barely watermarked at all, though comments may carry some.
- Editing and proofreading. When Claude only polishes a human's draft, nearly all the words are still the person's. There's very little the model actually chose, so there's very little to watermark.
And there are two boundaries that should be clearly stated.
- It cannot distinguish original Claude output from Claude output that a human has heavily rewritten.
- It cannot detect text from other AI systems. This is Claude's watermark, not a universal one.
None of these limitations are unintentional flaws. They are the immediate and honest result of concealing a signal in word choices that are optional.
The signal fades as that freedom goes away, whether through code, precise terminology, short writing, or human editing.
What About Images and Files?
Text is the hard case. For images and other files, Anthropic uses a completely different and more established tool called C2PA (Coalition for Content Provenance and Authenticity), an open industry standard. In plain terms, C2PA is a way to attach a tamper-proof label to a file that records where it came from and how it was made.
Instead of altering the content, C2PA attaches cryptographic provenance metadata. That is just a fancy way of saying a signed record of where the file came from, one that cannot be quietly changed without breaking the signature. Think of it like a wax seal on a letter. You are not rewriting the letter. You are just attaching proof of who sent it. It's a cleaner approach precisely because files, unlike prose, have room to carry that metadata without touching the content itself.
Conclusion
I like how much of this design is just an honest recognition of the limitations. Since it is impossible to hide an invisible pixel in a sentence, the watermark works with the text's one piece of slack, the instances in which many words are equally correct, and guides those with a key.
That's also why the limitations are so easy to reason about. The watermark is strongest where text is most free, and weakest where it is most constrained. It costs nothing, doesn't identify users, and doesn't degrade the writing. But it won't survive a genuine human rewrite, which, depending on where you stand, is either its biggest weakness or its most reasonable boundary.
As AI writing gets more common, I'm still developing my own judgment about how far this type of provenance signal can go. But as a piece of engineering, it's a thoughtful answer to a genuinely hard problem.
Thank you for reading! I will probably get it proofread with AI, and later see if there's a score on how much AI changed it, or whether it just says "generated by Claude". Let's see. I'll come back with a new blog once the API is available.