Text watermarking for AI models: How a hidden pattern in word choice marks Claude’s output

An LLM text watermark is a hidden statistical pattern in the words an AI model chooses. Nothing is added to the text. A reader sees ordinary prose, but a detector holding a secret key can test whether the word choices fit the pattern, and so whether a particular model probably wrote or shaped the text.

Anthropic recently extended this idea to three more Claude models, as covered in our report on Claude’s invisible text watermark.

A pattern hidden in ordinary choices

Think of a friend who, whenever two words fit equally well, always picks the one that comes first alphabetically. No single sentence looks odd. Across a whole letter, though, the habit shows up as a pattern that a person who knows the rule can check.

A language model faces such choices constantly. After “The weather was”, words like “mild”, “pleasant” and “cool” may all work. A watermark steers those near-ties in a way only the key holder can recognize.

Nudging the dice instead of editing the text

A language model writes one token (a word or word fragment) at a time. At each step it produces probabilities for many candidates, then samples one, like rolling weighted dice.

A watermark replaces the ordinary random roll with a keyed one. The key and the preceding words decide which of the plausible candidates gets a small boost. Anthropic describes its approach this way, and says it only touches low-stakes choices where several options are about equally good.

Detection runs the same math backward. For each token, the detector asks whether it landed on the boosted side more often than chance would predict. One token proves nothing. Hundreds of tokens can add up to strong evidence, which is why detectors report a probability instead of a yes or no.

From green lists to SynthID

The best-known early design came from University of Maryland researchers John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers and Tom Goldstein, in a 2023 paper presented at ICML (a major machine learning conference). Before each word, their method picks a randomized set of “green” tokens and softly promotes them during sampling. A statistical test with interpretable p-values then checks for an excess of green words. The authors say the detector needs no access to the model’s API or parameters.

In 2024, Google DeepMind announced SynthID-Text. It adjusts the probability scores of candidate tokens, and detection compares the resulting word choices against the patterns expected for watermarked and unwatermarked text. Google says this adds the mark without compromising quality, accuracy, creativity or speed, and it planned to open-source the technique through its Responsible Generative AI Toolkit.

Anthropic says its watermark is a variant of SynthID-Text. It uses a secret key and the preceding words to choose among plausible candidates.

Who uses it today

Claude is the case in the news. Anthropic’s documentation says supported models carry the watermark. The mark does not insert extra tokens or invisible characters, and it holds nothing about the people or organizations using the model. Developers do not need to change their requests.

There is one practical catch on Claude Sonnet 4.6. If a request moves the sampling settings temperature, top_p or top_k away from their defaults, the reply can come back unmarked. Anyone who depends on the watermark is told to leave all three out, even when a framework or client library fills them in automatically.

That fits the mechanism. These settings reshape the probabilities the model samples from, which is the very step where the watermark does its work.

Anthropic says detection is in private preview for eligible organizations such as regulators, researchers and media, and for enterprises with their own compliance obligations. It also ties its rollout to an EU requirement that took effect on August 2, 2026. Models released before that date are on a transition period.

Why a missing mark proves so little

Watermarks are probabilistic, so they fail in predictable ways. Anthropic and Google describe similar limits:

• Short text. With few tokens, there is too little evidence. Confidence grows as text gets longer.
• Factual text and code. Exact wording is required, so there are few near-ties to steer. Google says the method is less effective on factual prompts.
• Rewriting. Anthropic says light editing probably will not remove the mark, but a full rewrite will. Google reports that confidence drops substantially after thorough rewriting or translation.
• Human text, lightly edited. Anthropic says proofreading human writing usually leaves too few Claude-chosen words to detect.

The result is asymmetric. A detected mark suggests Claude was involved, but it cannot separate “Claude wrote this” from “Claude heavily edited this.” No mark means almost nothing. It does not show a human wrote the text, and it cannot identify other AI systems.

Google also notes that SynthID-Text is not built to stop motivated adversaries from misusing AI-generated content.

What to watch

Three things decide whether text watermarks become a useful tool.

1. Access to detection. A mark nobody can check is only a promise. Anthropic plans to expand access beyond the private preview.
2. Interoperability. Each vendor uses its own key. Open tooling such as the Kirchenbauer detector and Google’s planned open-source release could help, but a universal check across vendors does not exist today.
3. Robustness. Paraphrasing tools and translation remain the obvious ways around any mark, and the vendors say so openly.

Regulation is pushing adoption, and the technique is cheap for model makers because it adds no tokens. Its value for schools, newsrooms and platforms will depend on how honestly the probabilities are read. A detected mark is evidence, and an absent one is just silence.