{"id":14726,"date":"2026-08-25T08:39:27","date_gmt":"2026-08-25T07:39:27","guid":{"rendered":"https:\/\/www.blopig.com\/blog\/?p=14726"},"modified":"2026-08-25T08:39:29","modified_gmt":"2026-08-25T07:39:29","slug":"claude-now-watermarks-its-text-heres-what-is-actually-happening-under-the-hood","status":"publish","type":"post","link":"https:\/\/www.blopig.com\/blog\/2026\/08\/claude-now-watermarks-its-text-heres-what-is-actually-happening-under-the-hood\/","title":{"rendered":"Claude now watermarks its text: here’s what is actually happening under the hood"},"content":{"rendered":"\n

On 11 August Anthropic announced that every Claude model released after 2 August 2026 will watermark the text it produces. Not just in the chat app: the watermark lives at the model level, so it is there whether the text came through the API, Claude Code, Cowork, or anything else built on top. A follow-up post<\/a> a few days later explained the mechanism, and the short version is that it’s a version of DeepMind’s SynthID-Text, which in turn descends from a scheme Scott Aaronson sketched out while at OpenAI in 2022.<\/p>\n\n\n\n

Predictably it has caused a lot of confusion, especially in the academic circles (“is it zero-width characters?”, “can I strip it with a regex?”, “does this mean Turnitin finally works?”), most of which comes from not knowing how an LLM actually turns a probability distribution into words. So this post starts there, builds the watermark up from the sampler, and then tries to be honest about what it does and doesn’t mean for people who write papers and mark essays for a living.<\/p>\n\n\n\n

Nothing here is hidden: the watermark is not metadata, not invisible Unicode, not a hidden token. It is a statistical pattern in which words were chosen, which is exactly why it survives copy-paste and exactly why it fades when you rewrite.<\/p>\n\n\n\n\n\n\n\n

The easy part: how a language model decodes<\/h2>\n\n\n\n

A language model does not emit words. At every step it emits a vector of logits, one per entry in its vocabulary (tens of thousands of tokens: words, sub-words, punctuation), and a function called softmax turns that into a probability distribution over what comes next:<\/p>\n\n\n\n

\"\"<\/a>
The softmax: p of token t given context equals exp(z_t over T) divided by the sum over all tokens of exp(z over T)<\/figcaption><\/figure>\n\n\n\n

where z<\/em> <\/strong>are the logits and T<\/strong> is the temperature. Something outside the model, the sampler<\/em>, then has to pick one token from that distribution, append it to the context, and run the forward pass again. Greedy decoding takes the argmax; ordinary sampling draws from p<\/em>. That draw is where the randomness in “regenerate response” comes from, and that randomness is the entire raw material of the watermark.<\/p>\n\n\n\n

\"\"<\/a>
Figure 1. Two next-token distributions. On the left the model is genuinely undecided between several good adjectives; on the right there is only one sensible continuation.<\/figcaption><\/figure>\n\n\n\n

The important quantity is the entropy of that distribution. In Figure 1, the left-hand prompt has lots of roughly-equivalent continuations; the model has a few bits of freedom, and whichever word is picked, the reader would not notice. The right-hand prompt has essentially no freedom. Keep that asymmetry in mind: a watermark can only hide in freedom the model already has. Anthropic’s own description is that it “uses low-stakes choices” and that the words “are still random, but the source of the randomness is different”.<\/p>\n\n\n\n

The idea in one sentence<\/h2>\n\n\n\n

Replace the sampler’s true random number generator with a pseudo<\/em>-random one seeded by a secret key and the last few tokens. Anyone with the key can then re-derive what the random numbers “should” have been at each position and check whether the text is suspiciously consistent with them.<\/p>\n\n\n\n

That’s it. Everything else is engineering to make the pattern detectable after a few hundred tokens while keeping the distribution of text (almost) unchanged.<\/p>\n\n\n\n

The lineage: from Aaronson’s Gumbel trick to SynthID<\/h2>\n\n\n\n

It’s worth walking through the three generations of this idea, because Claude’s scheme is the third and is easiest to understand as a refinement of the first two.<\/p>\n\n\n\n

Aaronson (2022), the “exp-minimum” \/ Gumbel sampler.<\/strong> A standard fact: if you want to sample a token from p<\/em>, draw an independent uniform *u<sub>t<\/sub>*<\/em> \u2208 [0,1] for every token and pick the t<\/strong><\/em> that maximises *u<sub>t<\/sub>*<\/em><sup>1\/*p*<\/em><sub>*t*<\/em><\/sub><\/sup>. The result is exactly<\/em> distributed as p<\/em>, as long as the *u<sub>t<\/sub>*<\/em> are uniform and independent of p<\/em>. Aaronson’s trick is to make *u<sub>t<\/sub>*<\/em> not truly random but *u<sub>t<\/sub>*<\/em> = PRF<sub>*k*<\/em><\/sub>(last H<\/em> tokens, t<\/em>), a pseudo-random function of a secret key k<\/em> and a short context window. Per-step, the output distribution is still exactly p<\/em> (the *u*<\/em>‘s are still uniform as far as anyone without the key is concerned). But a detector with the key can recompute *u*<\/em> for each emitted token and compute the score<\/p>\n\n\n\n

\"\"<\/a>
S equals the sum over positions of minus log of one minus u<\/figcaption><\/figure>\n\n\n\n

For human text, each u<\/em> is just a uniform number, so S<\/em> is a sum of Exp(1) variables with mean n<\/em>. For watermarked text, the sampler systematically chose tokens with large u<\/em>, so S<\/em> is inflated, and the inflation is larger wherever the entropy of p<\/em> was high. A z-test on S<\/em> gives you a p-value.<\/p>\n\n\n\n

Kirchenbauer et al. (2023), the “green list”<\/strong>. A blunter, more robust variant: seed a PRNG with the hash of the previous token(s), use it to split the vocabulary into a “green” half and a “red” half, and add a bias \u03b4 to every green logit before softmax. Detection just counts green tokens; under the null, about half should be green. This is easy to reason about but it does<\/em> change the text distribution (you are literally pushing logits), and with a large \u03b4 it degrades quality.<\/p>\n\n\n\n

SynthID-Text (Dathathri et al., *Nature*<\/em>, 2024), tournament sampling.<\/strong> This is what Claude uses. The two ingredients are:<\/p>\n\n\n\n

1. <\/strong>g-values.<\/strong><\/em> For each decoding step, hash the key together with the previous H<\/em> tokens (the paper uses a sliding window of a few tokens) to seed a PRNG, and use it to assign each vocabulary token a pseudo-random score g<\/em><sub>\u2113<\/sub>(*t*<\/em>) \u2208 {0,1}, independently for each of m<\/em> “layers” \u2113 = 1..m<\/em>.<\/p>\n\n\n\n

2. Tournament sampling.<\/em> <\/strong>Instead of drawing one token from p<\/em>, draw 2<sup>*m*<\/em><\/sup> candidates i.i.d. from p<\/em>. Pair them up; in each pair the candidate with the higher g<\/em><sub>1<\/sub> wins (ties broken at random). Pair the winners; now compare *g*<\/em><sub>2<\/sub>. Continue for *m*<\/em> rounds and emit the single survivor.<\/p>\n\n\n\n

\"\"<\/a>
Figure 2. One decoding step with a SynthID-style watermark. The model’s forward pass and the softmax are untouched; the orange boxes are the only additions.<\/figcaption><\/figure>\n\n\n\n

Why the tournament rather than the Gumbel trick? Two reasons. First, the outcome is biased toward tokens with high g<\/em> without<\/em> modifying the logits, so the language model itself needs no change; it is purely a sampler swap, which is exactly why Anthropic can say it has “negligible impact on the speed of models” and “produces no extra tokens”. Second, because the candidates are drawn from p<\/em>, a token with probability 0.94 will show up in nearly every slot of the tournament and win regardless of its g<\/em>, while a token at 0.05 only wins when its g<\/em> happens to be high. The watermark strength is automatically proportional to the entropy available. The paper also shows you can get a non-distortionary<\/em> version (the per-step expected distribution over a batch of responses equals p<\/em>) by tracking and re-using the random seeds, and a stronger distortionary<\/em> version that sacrifices a little diversity for a stronger signal. Anthropic hasn’t said which knob settings they’ve chosen, only that they implemented “a version of” the approach.<\/p>\n\n\n\n

Detection: it’s a hypothesis test, not a classifier<\/h2>\n\n\n\n

The detector needs the key (that’s why Anthropic is offering a detection API<\/em> rather than publishing weights for a detector). Given a document, it re-tokenises it, slides the same H<\/em>-token window along, recomputes the g<\/em>-values for every layer and every position, and averages. For a human-written document, each *g*<\/em> is a fair coin, so the mean sits at \u00bd with standard deviation \u221a(1\/(4*mn*<\/em>)) over n<\/em> tokens. For watermarked text the mean is pushed above \u00bd. The test statistic is just<\/p>\n\n\n

\n
\"\"<\/a>
z equals the mean g minus one half, divided by the square root of one over four m n]<\/figcaption><\/figure>\n<\/div>\n\n\n

and you pick a threshold for the false-positive rate you’re willing to live with. (The real SynthID detector learns a slightly smarter weighted score, and there’s a Bayesian variant, but the logic is the same.)<\/p>\n\n\n\n

I wrote a ~40-line toy version of all this, with a 50-token vocabulary, m<\/em> = 4 layers, and synthetic “high entropy” and “low entropy” next-token distributions, to make two points visually. It’s a caricature, not a reproduction of Anthropic’s numbers, but the shape is what matters.<\/p>\n\n\n\n

\"\"<\/a>
Figure 3. Toy simulation of the detection z-score as a function of sample length for high- and low-entropy text. The dotted line is the 99th percentile of unwatermarked text.<\/figcaption><\/figure>\n\n\n\n

<\/p>\n\n\n\n

Two things fall out of Figure 3 that map directly onto caveats in Anthropic’s post. The signal grows like \u221an<\/em>: a tweet’s worth of text is hopeless, a paragraph is borderline, a page is unambiguous. This is the “doesn’t work well on small samples” caveat. And low-entropy text carries a much weaker signal because the tournament has nothing to choose between: “Watermarking is sparser on factual passages where there are fewer choices that can be made without decreasing the accuracy of the text.” Code is the extreme case; Anthropic says the watermark effectively lives only in comments, where there is free choice of wording, and that “where an exact output is required \u2026 the watermark isn’t applied”.<\/p>\n\n\n\n

\"\"<\/a>
Figure 4. Toy simulation: replacing a fraction of the tokens in a 300-token watermarked passage with human-chosen ones. The z-score falls roughly linearly with the fraction replaced.<\/figcaption><\/figure>\n\n\n\n

<\/p>\n\n\n\n

Figure 4 is the editing question. Each human-rewritten token contributes a fair-coin g<\/em> instead of a biased one, so the signal decays smoothly with the fraction of text replaced rather than vanishing at the first edit. That’s why the official line is that “light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will”. It’s also why a paraphrase through a different<\/em> LLM is the canonical attack: the SynthID paper itself reports that paraphrasing degrades detection substantially, and nothing about Claude’s implementation changes that arithmetic. There is one subtlety the figure hides: because the g<\/em>-values are seeded by the preceding H<\/em> tokens, editing one word also scrambles the seeds for the next H<\/em> positions, so real-world decay is a bit steeper than my token-replacement toy suggests. Conversely, inserting or deleting tokens doesn’t desynchronise the detector globally, because the window re-aligns after *H*<\/em> tokens; this is the main advantage over schemes that key on absolute position.<\/p>\n\n\n\n

What it proves, precisely<\/h2>\n\n\n\n

This is a zero-bit watermark. It encodes one bit of information: “the sampler that produced these word choices was holding Anthropic’s key.” It does not encode who you are, which conversation it came from, or which model. Anthropic’s post is explicit that “there’s nothing in the watermark, or its key, that would allow anyone to recover any information about the user, their organization, or their chats.”<\/p>\n\n\n\n

It also, and this is the bit people keep getting wrong, does not distinguish *authorship*<\/em> from *processing*<\/em>. If you hand Claude your own paragraph and ask it to translate it, every output word is chosen by Claude, so the translation is fully watermarked. If you ask it to fix your commas, almost no words are chosen by Claude and the watermark has nothing to attach to. Anthropic’s framing: the detector can only answer “What is the likelihood this was partly written by Claude?”, and it cannot separate “Claude wrote this” from “Claude heavily edited this”. A positive result says Claude was in the pipeline somewhere; a negative result says nothing at all, because most of the world’s LLMs aren’t Claude and older Claude models aren’t watermarked yet either.<\/p>\n\n\n\n

So what does this mean for academia?<\/h2>\n\n\n\n

The assessment:<\/strong> The honest starting point is that the current generation of “AI detectors” used in universities are stylometric classifiers. They look at perplexity and burstiness, they have well-documented false-positive problems for non-native English writers, and several institutions have quietly stopped using them. A keyed watermark is a categorically different object. Its false-positive rate is a number you set, it does not care about your writing style, and the evidence it gives is a p-value rather than a vibe.<\/p>\n\n\n\n

But look at what the test actually conditions on. It detects Claude<\/em>, not AI<\/em>. A student who uses a different model, an open-weights model on their laptop, or a Claude model from before August gets a clean result. A student who paraphrases Claude’s output through another model gets a clean result. A student who asks Claude to proofread a genuinely self-written essay gets a clean result, which is the outcome you’d want, while a student who writes a draft and asks Claude to “tighten this up” gets a partial signal that’s hard to interpret. So what a department could realistically do with the detection API, once it exists, is catch the laziest category of misuse (verbatim, long, high-entropy prose from the most recent Claude models) with very high confidence and essentially zero false accusations. That’s not nothing. The cases that cause the most damage to students are the false accusations, and this removes them for the subset it covers. It does not, though, give you a general “was this written by a human?” oracle, and any vendor who bundles the API into a product called “AI Detector” is selling the negative result as something it isn’t.<\/p>\n\n\n\n

There’s also a governance question the announcement opens up rather than settles. The key is Anthropic’s. Detection goes through Anthropic. The EU Code of Practice is what forced this (Anthropic signed in July, with the watermark rolled out globally because, in their words, they “don’t yet have a durable way to scope it by region”), and the Code’s concern is disclosure of synthetic media, not academic integrity. Whether universities get access at all, at what rate limits, whether the results are auditable, whether students can run the check on their own work before submission: none of that is decided. My guess is that the short-term effect on assessment policy is small, and that the real lever remains what it was last year, which is designing assessment where using a model is either allowed and declared or genuinely unhelpful.<\/p>\n\n\n\n

The literature:<\/strong> This is where I think it gets more interesting, and where I haven’t seen much discussion. Publishers have spent two years asking authors to declare LLM use with no way to check. For high-entropy prose (introductions, discussion sections, cover letters, reviewer reports) there is now, in principle, a key-holder who could check. A journal could ask Anthropic’s API whether a submitted manuscript is watermarked. So could a funder with a pile of grant applications, or a conference with a suspicious spike in reviews that all sound the same.<\/p>\n\n\n\n

Three consequences follow. The first is that the “processing, not authorship” point matters enormously here. Translation, the use case that non-native English speakers most legitimately depend on, is the one that watermarks most strongly. If editorial policies start treating a positive detection as evidence of undeclared ghost-writing, the people who get hurt are exactly the ones the stylometric detectors already hurt, just via a different mechanism. Any sane policy has to be “undeclared drafting<\/em> is the issue”, and the watermark cannot tell you which one it’s looking at.<\/p>\n\n\n\n

The second is about the corpus itself. A persistent, keyed signal in a large fraction of newly written text is a tool that nobody in bibliometrics has had before. Anyone with key access could estimate what fraction of abstracts in a given journal, field, or year were Claude-touched. That’s a fascinating measurement and an obviously dangerous one if done per-author. Where the boundary sits is going to be fought over.<\/p>\n\n\n\n

The third is methodological and closer to home for those of us who train models. Watermarked text is now entering the training data of the next generation of models, including our own fine-tunes on scraped literature. A SynthID-style watermark is designed to be invisible to the model’s own distribution, so in principle it is harmless to train on, but “in principle” is doing some work: a model trained heavily on Claude output will have learned a slight preference for high-g<\/em> continuations under Anthropic’s key, which means the detector could light up, faintly, on text from a model that has never been near Anthropic’s servers. Whether that effect is measurable at realistic data mixtures is an open question, and a nice one for someone’s summer project.<\/p>\n\n\n\n

A few things I’d want to see before trusting it operationally<\/h2>\n\n\n\n

The detector’s false-positive rate is a design parameter, but it’s a design parameter *under the null of truly random g<\/em>-values. Real human text isn’t a random draw from Claude’s distribution; it has its own token statistics, and the hash of “the previous H tokens” is only pseudo-random if those tokens vary. Highly repetitive text (tables, boilerplate methods sections, citation lists) will produce repeated seeds, and repeated seeds produce correlated g<\/em>‘s and a broken variance estimate. SynthID deals with this by de-duplicating repeated windows before scoring, and I’d want to know Anthropic does too, and what the measured false-positive rate is on a realistic corpus of scientific writing rather than on web text.<\/p>\n\n\n\n

I’d also want to see the distortion numbers. Anthropic says there is “no impact of watermarking on the content, level of creativity, or readability”, which for the non-distortionary variant is true in expectation across responses<\/em>, but tournament sampling with m<\/em> layers and a fixed seed does reduce diversity within a single long response. For most use cases nobody will notice. For sampling-heavy scientific uses (generating many candidate sequences, say, and scoring them) it is at least worth measuring.<\/p>\n\n\n\n

Finally: the key. Detection being an API run by the key-holder is fine as long as the key-holder is neutral, available, and around. Every sentence in that clause is an assumption.<\/p>\n\n\n\n

Summary<\/h2>\n\n\n\n

The watermark is a change to the dice, not to the model. At each step, Claude draws a handful of candidate next tokens from its ordinary distribution and holds a small tournament between them, refereed by pseudo-random bits derived from a secret key and the previous few tokens. With the key you can replay the referee’s calls and test whether the text won its matches suspiciously often. The signal scales with length and with how much freedom the model had, which means it is strong for long creative prose, weak for short or factual text, nearly absent for code, and erased by a full rewrite.<\/p>\n\n\n\n

In my opinion, it is a good, precise tool for one narrow question (“was recent Claude in the loop here, at length?”) and a poor tool for the question everyone wants answered (“did a human write this?”). Treat it as a p-value with a specific null hypothesis, be careful about what that null is, and don’t let anyone tell you it’s a plagiarism detector.<\/p>\n\n\n\n

Sources<\/h2>\n\n\n\n

– How Claude’s text watermarking works \u2014 Anthropic<\/a> <\/p>\n\n\n\n

– Anthropic says it will watermark text generated by its AI models \u2014 TechCrunch, 11 Aug 2026<\/a><\/p>\n\n\n\n

– Anthropic shares more details about how Claude’s new watermarks will work \u2014 TechCrunch, 15 Aug 2026<\/a><\/p>\n\n\n\n

– Anthropic reveals what the watermark is and how it can be defeated \u2014 Search Engine Journal<\/a><\/p>\n\n\n\n

– EU compliance, delivered globally \u2014 Euronews<\/a><\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

On 11 August Anthropic announced that every Claude model released after 2 August 2026 will watermark the text it produces. Not just in the chat app: the watermark lives at the model level, so it is there whether the text came through the API, Claude Code, Cowork, or anything else built on top. A follow-up […]<\/p>\n","protected":false},"author":127,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","wikipediapreview_detectlinks":true,"_monsterinsights_skip_tracking":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[633,915],"tags":[],"ppma_author":[810],"class_list":["post-14726","post","type-post","status-publish","format-standard","hentry","category-ai","category-llms"],"jetpack_sharing_enabled":true,"authors":[{"term_id":810,"user_id":127,"is_guest":0,"slug":"qurat_ul_ain","display_name":"Qurat Ul Ain","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/5d944f20580dcd92d39e5181dd1d503473b22b3674b6bca845ce79547918ccd1?s=96&d=mm&r=g","author_category":"","user_url":"","last_name":"Ul Ain","first_name":"Qurat","job_title":"","description":""}],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/posts\/14726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/users\/127"}],"replies":[{"embeddable":true,"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/comments?post=14726"}],"version-history":[{"count":5,"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/posts\/14726\/revisions"}],"predecessor-version":[{"id":14786,"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/posts\/14726\/revisions\/14786"}],"wp:attachment":[{"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/media?parent=14726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/categories?post=14726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/tags?post=14726"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.blopig.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=14726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}