How Claude's Text Watermark Works

Anthropic's Claude text watermark is not a hidden character. It is not metadata. It is not a signature at the end. It is a pattern in the words themselves, and the difference decides what any tool can honestly claim about it.

The mechanism is called a statistical watermark. Every time Claude picks a word, it makes a small, keyed nudge toward one word out of several that would have worked equally well. The nudge is too small for a reader to notice. A verifier with the secret key can measure that the nudge is there, across enough of the text, and score how likely it is that Claude wrote it.

If that sounds abstract, here is what actually happens inside the model when it generates a sentence, and how the key turns it into a mark.

Step 1: the model has many good options for the next word

Language models generate one token at a time. A token is roughly a word or part of a word. At every step, the model looks at what it has written so far and computes a probability for every possible next token.

Sometimes there is a clear winner. If the text so far is "The capital of France is," almost all of the probability lands on "Paris." There is no meaningful choice.

But often there are many next tokens that would work equally well. "The report showed strong ..." could reasonably continue with "growth," "gains," "results," "performance," "momentum," or several others. All of them are fine sentences. All of them carry the same meaning.

Anthropic calls these the low-stakes choices. They are the raw material of the watermark.

Step 2: the key turns the low-stakes choices into a signal

Anthropic and the SynthID-Text technique it is based on (Google DeepMind, Nature, October 2024) both use the same trick, sometimes called Gumbel-softmax watermarking or tournament sampling. The intuition:

1. The model has a set of equally good next tokens.
2. A pseudorandom function, keyed with Anthropic's secret and seeded by the previous few words, assigns each token a small score.
3. Instead of picking uniformly among the good tokens, the sampler slightly prefers the token with the higher score.
4. The reader sees a normal, well-written sentence. No token is wrong. Nothing is added.
5. A verifier with the same key can compute, for every position in the text, whether the chosen token had the high score. If those wins pile up above what you would expect by chance, the text is watermarked.

Anthropic's own summary of this design, from its August 14 blog post:

"Watermarking uses the key and a few words that come before to settle what word the model should pick. Low-stakes choices between equally good words are made using the key. That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it."

Scott Aaronson, who proposed the underlying idea at OpenAI in 2022, confirmed the lineage in an August 22 post: Anthropic's scheme is in the same family as SynthID-Text and his own 2022 proposal.

Step 3: where the mark is skipped

The mark is not applied when there is no real choice.

Anthropic's example is code:

"Where an exact output is required, where there isn't a choice, and something would be factually wrong or a piece of code would break if a different term was chosen, the watermark isn't applied. But in areas where there is an arbitrary choice between particular words or terms within the code, the watermark can be used, such as comments within code."

So a function name, a required keyword, or a factual constant is not nudged. A comment above it, or the wording of an error message string, can be.

The same principle applies to text. Named entities, quoted facts, and mandatory phrasings pass through untouched. The mark lives in the connective tissue: the verbs, adverbs, transitions, and reorderings that any competent writer could have picked differently.

Why no hidden characters

Anthropic laid this out explicitly in five design principles on August 14, 2026:

1. The difference between watermarked and un-watermarked text is not distinguishable to readers.
2. Nothing is added to the text and there are no hidden characters.
3. Watermarking does not require extra tokens and does not cost more.
4. Watermarking carries no identifying information and cannot be traced to a specific person, organization, or chat.
5. Watermarking is not specific to Claude; the design is a general one.

Principle two is the one worth quoting anywhere the "Claude uses invisible Unicode" claim shows up. Anthropic did not add zero-width joiners, narrow no-break spaces, byte-order marks, or any other non-printing character. Every character in Claude's output is one you can see and paste into Notepad without loss.

The confusion has a real history. In April 2025, OpenAI's o3 and o4-mini models were briefly caught inserting U+202F (narrow no-break space) in longer responses. OpenAI said it was a "quirk of large-scale reinforcement learning," not a watermark, and it went away in retests. That story is what makes people expect an AI watermark to look like a stray character. Anthropic's is not built that way.

What breaks it, and what does not

Because the mark lives in word choice, robustness to editing depends on how much word choice you change.

Anthropic's own summary:

• Copying and pasting does nothing. The pattern is in the words, not in metadata or characters, so any transfer that preserves the text preserves the mark. Copy from Claude, paste into Notepad, paste from Notepad into an email; the mark travels with the text.
• Light editing probably will not remove it. Fixing a typo, cutting one sentence, or reordering a paragraph leaves most of the low-stakes choices intact.
• Heavy editing or paraphrasing weakens it. The more original word choices you replace, the fewer keyed picks remain to score.
• A complete rewrite where every word is replaced removes it.
• Translation by Claude carries the mark forward, because "every word is chosen by Claude."
• Translation through another model or another human likely weakens or removes it.

Search Engine Journal summarized Anthropic's own robustness admission in a headline on August 15: "Anthropic Reveals What The Watermark Is And How It Can Be Defeated." The defeat mechanisms are the same ones the research community has known about for two years: rewrite through a different model, translate through a chain, or edit heavily by hand.

How a detector will read your text

When Anthropic ships the detection API, the reader-facing verdict will not be "AI or human, 87 percent." It will be closer to a statistical confidence that the watermark signal is present or absent in the text you submit. Two important properties come with that:

1. Longer text is easier to score. The more low-stakes choices in the sample, the tighter the confidence. Short passages, such as a subject line, a headline, or a post, may not carry enough signal to score at all.
2. The verdict is about processing, not authorship. Anthropic says the mark shows Claude "may have produced or processed" the text. Proofreading, translating, summarizing, or reformatting a document through Claude can plant the mark on text that a human wrote first.

That is why any honest detector will report Clean, Found, Unknown, or Unsupported, with a note on why. A three-word input is not enough evidence for Found or Clean. A model that has not been retrofitted yet is Unsupported. A confident Clean means the sample was long enough and the signal was not there.

What this means for you

If you are worried about a piece of text carrying Claude's mark, the mechanism tells you what to expect:

• Removing invisible characters or metadata will not touch it. That is a different problem.
• Copy and paste alone will not remove it. Neither will fixing grammar.
• The two ways to reduce or defeat the mark are the two Anthropic named itself: rewrite every word, usually through another model, or heavily edit until few original Claude choices remain. Both cost quality. Neither is guaranteed.
• The only party who can tell you for sure whether a specific passage is marked is Anthropic, through the future detection API. Everyone else is guessing.