How Does AI Text Watermarking Actually Work? A Technical Explainer

Update — August 14, 2026: Anthropic published a dedicated FAQ, "How Claude's text watermark works," confirming the scheme is a version of SynthID-Text, Google DeepMind's watermarking method published in Nature in 2024, itself building on a 2022 proposal by computer scientist Scott Aaronson. That upgrades several things this post had flagged as "unverified, reasoning from published literature" to confirmed fact — see what's now confirmed below.

An AI text watermark is not hidden characters, and it is not metadata. It is a statistical fingerprint left in which ordinary words the model chose. That single distinction explains almost everything else — why you cannot strip it with a text editor, why it survives copy-paste, why it dies to paraphrasing, and why it barely works on code.

With Anthropic marking all Claude text output since August 2026 and Google having run SynthID for years, this mechanism went from a research curiosity to something that affects text you generate every day. This guide explains how it works, at the level of detail where the tradeoffs actually become visible. If the generation side is unfamiliar, our complete guide to generative AI covers how these models produce text in the first place — the watermark is a modification to the final step of that process.

TL;DR — the mechanism in one table

First, what it is not

Three wrong models of watermarking circulate constantly, and each leads to a wrong conclusion.

"It's hidden Unicode characters." Zero-width spaces, non-breaking variants, and unusual apostrophes do appear in LLM output — but as artifacts of training data, not as deliberate marks. Any serious scheme avoids them for an obvious reason: sed removes them in one pass. If a mark can be stripped by a script anyone can write in thirty seconds, it is not a provenance system.

"It's metadata attached to the response." That is how C2PA works for files, and it is a genuinely useful system — but as we covered in detecting Claude watermarks, file metadata does not survive a re-save, let alone copy-pasting text out of a chat window. Text watermarks exist precisely because metadata cannot follow text.

"It's a stylistic tell the model was trained to produce." Stylometric signals are real — our analysis of load-bearing Claudisms catalogues them — but they are not watermarks. They are emergent, unkeyed, and detectable by anyone with a good ear. A watermark is deliberate, keyed, and statistically measurable.

The actual mechanism is stranger and more elegant than any of these.

How the mark gets in: keyed token bias

To follow this you need one fact about how language models generate text: at every step, the model outputs a probability distribution over the entire vocabulary, and a component called the sampler picks one token from it. Generation is that loop, repeated.

Watermarking modifies the sampler. Here is the canonical scheme, from the published research literature:

Step 1 — Hash to get a pseudorandom split. Take the previous token (or the last few) and combine it with a secret key. Hash the result and use it to seed a pseudorandom number generator. Use that generator to split the entire vocabulary into two sets — conventionally called the green list (roughly half the vocabulary) and the red list (the other half).

Step 2 — Nudge the distribution. Before sampling, add a small constant bias to the logits of every green-list token. Not a huge one — enough to tilt the outcome when several tokens are nearly tied, not enough to override a token the model strongly prefers.

Step 3 — Sample normally. The sampler picks a token from the tilted distribution. Green tokens win slightly more often than they otherwise would.

Step 4 — Repeat, with a new split every time. Because the split is seeded from the preceding token, it changes at every position. The green list at token 40 is unrelated to the green list at token 41.

That last property is what makes the mark invisible. There is no fixed set of "AI words." A word that is green in one sentence is red two words later. No amount of reading the text reveals the pattern, because the pattern only exists relative to a key you do not have.

A worked intuition

Suppose the model is generating and the next token could reasonably be large, big, substantial, or considerable — all fine, all nearly equally probable. Ordinary sampling picks among them according to their probabilities. Watermarked sampling checks which of those four happen to be green at this position, and tilts toward those.

Over one token, that tells you nothing — a green token appears about half the time by pure chance. Over 300 tokens, if 62% landed green instead of the expected 50%, that is a statistical event that does not happen by accident.

How detection works

The detector never sees the original text, the prompt, or the model. It needs exactly two things: the text and the same secret key.

1. Tokenize the passage the same way the generator did.
2. At each position, re-derive the green/red split from the preceding token and the key — the same deterministic hash, so it reproduces exactly.
3. Count how many tokens actually landed in their position's green list. Call it G out of T total tokens.
4. Compare G against the ~T/2 you would expect from unwatermarked text, and normalize into a z-score.

The z-score is the whole output. A high z-score means the green-token count is far above chance, and the probability of that happening in text that was never watermarked is vanishingly small. That probability is the false-positive rate, and it is tunable — you pick a z threshold, and it fixes your false-positive rate mathematically rather than empirically.

This is worth dwelling on, because it is the genuine advantage over the previous generation of AI detectors. Classifier-based detection produced false-positive rates you had to measure on a test set and hope generalized. Watermark detection produces a false-positive rate you can derive, because you know the null distribution exactly. That is a real improvement in kind, not just degree.

What it does not fix: the false-negative rate, which depends entirely on how much the text was altered after generation, and is not derivable at all.

Try it yourself

The four ideas above — weighted word choice, the keyed green/red split, counting to detect, and how editing erases the mark — are easier to feel than to read. Play with a teaching version of each step below.

The entropy constraint — why code breaks it

Everything above depends on one assumption: that multiple acceptable tokens exist at each step.

The bias only changes the outcome when the top candidates are close in probability. If the model assigns 99.7% probability to a single token, a small green-list bias will not dislodge it — and it should not, because doing so would break the output.

That gives a clean rule: watermark signal is proportional to the entropy of the text.

This is the strongest technical objection developers raised to Claude Code being included in the marking policy, and it is correct. If your function must call getUserById, there is no synonym. The variable name must match its declaration. The closing brace is the closing brace. There is very little room to encode anything, and a formatter pass rewrites what little there was — whitespace, quote style, trailing commas are exactly the low-stakes choices a watermark could have used.

So when an Anthropic engineer suggested you "could check if a PR was generated by Claude Code," the honest reading is: the PR description will mark well; the diff will not. Prose the agent writes about the code is ordinary high-entropy text. The code itself is close to the worst case for this technique. We go further into that gap in will every AI model watermark its output?.

Distortion: does watermarking make output worse?

Slightly, and honestly, yes — by construction. The sampler is no longer drawing from the model's unmodified distribution. It is drawing from a tilted one.

Whether that matters depends on the scheme:

• Biased schemes (the green-list approach above) measurably shift the output distribution. The shift is small and concentrated in near-ties, which is why quality evaluations find negligible differences, but "negligible" is not "zero."
• Distortion-free schemes exist in the literature. They use the key to drive the randomness source of sampling rather than to bias the logits — so any single output is distributed identically to unwatermarked sampling, while still being detectable with the key. Google's SynthID text approach uses a tournament-style sampling procedure in this family, which is why it can claim to preserve output quality.

Confirmed August 14: Anthropic's scheme is distortion-free. It uses SynthID-Text, which drives the randomness source of sampling rather than biasing the logits directly, so Anthropic can now cite actual evidence for the negligible-quality claim rather than asserting it: DeepMind served a watermarked model to a slice of live Gemini traffic and found no statistically significant difference in thumbs-up/thumbs-down ratings, and a separate controlled study had human raters compare watermarked and unwatermarked answers side by side with no detectable quality gap.

Four attacks, ranked by effectiveness

There is a fifth item worth naming that is not an attack at all: use an open-weight model. The watermark is applied by the sampler, and whoever runs the weights owns the sampler. No mark is ever created. This is not a bypass so much as an architectural exemption, and it is why universal watermarking is not achievable.

A subtler risk runs the other way — spoofing. If an attacker can learn enough about the green-list pattern by probing a detector repeatedly, they could in principle craft text that falsely trips it, attributing human writing to an AI. This is one of the real arguments against an unrestricted public detection endpoint, and it is why the pricing and access questions around Anthropic's announced detection API are security decisions as much as commercial ones.

Why the key has to stay secret

The detector's power comes entirely from holding a secret the writer does not. Publish the key and three things happen at once: anyone can strip the mark by re-sampling to avoid green tokens, anyone can forge it by deliberately picking green tokens, and the detector's output becomes meaningless in both directions.

That is the permanent tension in this whole design. Secrecy is required for the scheme to work, and secrecy is what makes independent verification impossible. Regulation — the EU AI Act's Article 50 transparency obligations that triggered this rollout — asks providers to support third-party detection, which means giving others detection capability without giving them the key. The only structural answer is a provider-operated detection service, which is exactly what every lab has converged on, and exactly what makes the provider unauditable.

Update, August 14: Anthropic names SynthID-Text and confirms the quality data

Anthropic's own FAQ closes most of the gaps this post had to reason around from published literature alone. What's now confirmed, in Anthropic's words and framing:

The lineage is public. Claude's watermark is "a version of the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024," which itself "belongs to a family of approaches that go back to a proposal by Scott Aaronson in 2022" — the same theoretical lineage this post's green-list explanation is drawn from, now with names attached.

Anthropic's own analogy for the mechanism is worth repeating because it's a cleaner intuition pump than the green-list framing above: imagine a Monopoly game where, instead of rolling dice, players read consecutive digits from deep inside the decimal expansion of pi. The moves are still effectively random and the game plays out identically — but if you know which digits of pi were used, you can check afterward whether that specific sequence of moves is consistent with having used pi. Watermarking replaces the model's ordinary random-number source with something keyed the same way: the word choices are still "random" in the sense that they aren't forced, but they're reproducible from the key.

Anthropic confirmed the entropy limit this post derived independently — almost word for word: "watermarking is sparser on factual passages where there are fewer choices that can be made without decreasing the accuracy of the text," using the example of "Isaac Newton's most famous work was called Principia..." where "Mathematica" is the only acceptable next word, so there's nothing for the mark to act on. The FAQ extends the same logic explicitly to code, matching the entropy-constraint table above.

Proofreading and light editing may not register, confirmed directly: when Claude only lightly edits a human draft, "nearly all the words are the person's," leaving too little Claude-chosen text to carry a reliable signal. Translations are the opposite case — "every word is chosen by Claude," so a Claude-translated document is always watermarked regardless of length.

A watermark detection API is coming, reconfirmed (first flagged by an Anthropic engineer on August 12): "We will soon be offering a watermark detection API," with implementation details still being worked out — no date, pricing, or access tier attached yet.

How this differs from stylometric detectors like Pangram: Anthropic's FAQ draws the distinction explicitly. Services like Pangram don't have Anthropic's key, so they instead look for the "tells" in AI phrasing — Anthropic calls out the "isn't X, it's Y" construction and overuse of "quietly" as examples, which lines up with our own catalogue of Claude's load-bearing writing tells. That's a fundamentally different, unkeyed signal from a cryptographic watermark, and the two approaches will disagree on plenty of individual passages.

None of this changes the core critique in this post: the mark is still probabilistic, still length-dependent, and still says nothing about who authored the underlying ideas.

Update, August 15: covert-channel speculation, and the spoofing pushback

A widely-shared X thread reduced the mechanism above to one line: "normal Claude: context → probability cloud + random sampling → token. Watermarked Claude: context → probability cloud + key/context-derived sampling → token." That's an accurate restatement of the keyed-token-bias section above — the watermark isn't attached to the output, it is the sampling decision, which is exactly why nothing short of re-sampling the tokens (paraphrase, translation, rewrite) removes it.

Two follow-on claims from that thread are worth checking against the confirmed mechanism rather than repeating uncritically:

"Claude instances could pass notes to each other" through the watermark. This doesn't hold up. Encoding a deliberate message into which green-list tokens get chosen requires knowing the key and choosing tokens accordingly — but Anthropic has already confirmed the model itself is not aware it's being watermarked and operates below the sampling layer it can't see or control. A system with no access to the key and no awareness of the bias cannot deliberately steer it. The watermark is something that happens to Claude's output, not something Claude can use.

"You can break it very easily both ways — make legitimate text look AI and make AI text look normal." This is the spoofing risk this post already flagged above: an attacker who can query a detector repeatedly can, in principle, learn enough about the local green-list pattern to reverse-engineer which tokens to pick, letting them either strip an AI passage's signal or forge a positive result on human writing. It's a real limitation, not a new one — and it's the strongest argument for keeping the detection API access-controlled rather than open and free, which is exactly the tension unpacked in are AI watermarks monetisable?

Update, August 16: the fork model, and the "it changes the words" objection

Anthropic's Thariq published an interactive explainer, "Same Words, Different Dice," as a companion to the August 14 FAQ. It reframes the mechanism in a way that is worth adopting, because it resolves the single most common objection to the quality claim.

The frame: forks, not words. Claude writes one token at a time. At most positions the next token is effectively forced. At some positions — call them forks — several continuations are equally good, and a random number decides between them. That is already true without any watermark: it is why asking Claude the same question twice gives you two different answers.

Watermarking changes exactly one thing at those forks: where the random number comes from. Ordinarily it is a fresh draw from a random number generator. With watermarking it is hash(secret key + words so far). The candidate list and the odds attached to each candidate are untouched — the key can never add an option that was not already on the shortlist, and never remove one that was.

Why this matters for the quality argument. The objection that surfaced immediately in replies was concrete: in one demo, ordinary sampling produced "A Tale of Two Cities starts like this:" while the watermarked run produced "A Tale of Two Cities famously begins:" — and those have different tone and pace. Several developers read that as evidence of quality loss, Isaac Flath most sharply: word choice is not a neutral coin flip, it is the writing.

The rebuttal is that both phrasings were on the same shortlist with the same odds, and ordinary unwatermarked sampling returns either one depending on the roll. If you prefer "starts like this," re-running the watermark-free model gives you "famously begins" a good fraction of the time anyway. A watermarked answer is one of the paths Claude could always have taken — so a preference between two runs is a preference between two dice rolls, not evidence that one generator is worse.

That argument is sound for the distribution and unsatisfying in practice, and it is worth being precise about why. It says the population of watermarked outputs matches the population of unwatermarked ones. It does not say your next specific output matches the one you would otherwise have gotten. With a fixed seed and a fixed prompt you no longer get the answer the unkeyed sampler would have produced — you get a different valid draw. For anyone who reruns generations and picks the best, nothing changes; for anyone with a pinned seed and a golden-output test, that is a real if narrow disruption.

The compounding property is the underrated part. Because each choice becomes context for the next, a fork that lands differently re-decides everything after it. Two runs do not swap a word here and there — an early fork can send the whole answer down a different path, which is why the two columns in the demo produce differently shaped sentences rather than synonym-for-synonym variants. This is also why "just diff the watermarked and unwatermarked output to find the mark" cannot work.

Fork counts by task type. The companion piece scores seven one-sentence answers at equal length, which isolates task shape from length. The ordering matches the entropy table above, and sharpens it:

Three details in that table are easy to miss and change how you should read a detection result:

• Code's two forks were the comment text and a variable name. In the demo's four-line Python function, the arithmetic had no room to vary at all — sum(prices) and round(total, 2) are forced. Rename the variable and the return line must follow, so even the second fork is partly consumed by consistency. Run a formatter or a linter with naming rules and both are gone.
• Summarization is pinned by your text, not by the world. The facts in a summary are yours, lifted from the input. Chance only reaches the connective tissue between them — which is why repurposing your own material marks far worse than writing something new.
• Proofreading and extraction have literally zero forks. In the grammar-fix example, 15 of 18 words are the user's verbatim and each of the three corrections has exactly one right form. There is no path but one. The only caveat: a real reply often wraps the answer in framing like "Here's the corrected sentence:" — that framing is Claude's own and can carry a sliver of mark. The returned sentence cannot.

The one correction to make to the intuition: forks in a demo are shown with two or three options for legibility. At a genuinely open choice there are usually dozens, each holding a slice of the odds — which is why free-running prose accumulates signal faster than a fork count suggests.

Both the companion piece and Anthropic's FAQ are explicit that the demos are illustrative rather than real model internals, and that the capacity ratings are not a real detector's output. Treat the ordering as reliable and the specific numbers as pedagogy.

Update, August 21: anti-AI fonts — obfuscation from the publisher side

For the mirror problem — publisher-side typography that scrambles text to block scrapers — see Anti-AI fonts are useless and harmful (Yaros/HN). Watermarks (this post) target provenance and detection on model output; anti-AI fonts target ingestion blocking on human-authored pages. Yaros's argument: the latter breaks screen readers and search while remaining bypassable by OCR — a different failure mode than keyed token bias.

What to take away

• The mark is in which words were chosen, so it survives every transformation that preserves the words and dies to every transformation that changes them.
• Detection is statistical, keyed, and length-dependent — it produces a confidence score, never a verdict.
• A positive result means "these token choices are very unlikely by chance," which supports "an AI system produced this text" and does not support "an AI authored these ideas."
• A negative result means almost nothing. Unmarked model, short passage, paraphrased text, low-entropy content, and human authorship all produce the same non-detection.
• Code is close to the worst case for the technique, and any policy that screens code contributions this way is running ahead of the mechanism.

That is not a reason to dismiss it. Watermarking is a genuine improvement over stylometric guessing, with a derivable false-positive rate, and it is useful for filtering volume at platform scale — the same role provenance plays when Spotify demotes AI-generated artist profiles. It is just a filter, not a forensic instrument, and the difference matters most to the people who will be judged by it.

Related on explainx.ai

• What is C2PA? Content Credentials, explained — the metadata-based provenance standard this mechanism complements
• Gruber calls the watermark a "perversion of writing" — is he right? — the strongest critique of this mechanism, and the technical rebuttal it drew
• A watermark removal tool just added OpenAI and Gemini support — a real-world test of this mechanism's actual removability
• AI watermark removal: right vs. wrong (2026 guide) — the visible-vs-invisible split and when removal is legitimate
• Anthropic is watermarking Claude text — the policy that made this mechanism everyone's problem
• How to detect a Claude watermark — what you can actually verify today
• Will every AI model watermark its output? — the convergence, and why open weights escape it
• Are AI watermarks monetisable? — why detector access is a security decision, not just a pricing one
• LLM text detection with classical ML — the classifier era this replaces, and its false-positive problem
• "Load-bearing": Claude Opus 5's writing tells — stylometric signals, which are not watermarks
• LinkedIn's C2PA Content Credentials — the metadata approach, and its opposite failure mode
• Spotify labels AI artists — provenance used as a distribution filter
• What are LLM tokens? — the unit everything above operates on
• AI Text Watermark (dictionary) — the term itself, defined
• C2PA (dictionary) — the metadata-based provenance standard, and how it differs from a watermark
• EU AI Act and US policy: complete guide — the transparency obligations behind the rollout
• What actually changes after the EU AI Act — what changed once those obligations became enforceable

Primary sources: Anthropic, "How Claude's text watermark works" (August 14, 2026) · Thariq (Anthropic), "Same Words, Different Dice" interactive explainer (August 16, 2026) · Google DeepMind, SynthID-Text, Nature (2024) · Scott Aaronson's 2022 watermarking proposal · Anthropic Help Center, "How Claude marks AI-generated content" (August 11, 2026) · Anthropic engineering commentary on X (August 11–12, 2026) · developer reaction threads on X (August 15–16, 2026)

Accurate as of August 16, 2026. Anthropic's August 14 FAQ confirms the scheme is a version of SynthID-Text; exact parameters and thresholds remain unpublished. Follow @explainx_ai for updates.