Claude's Invisible Signature: How Text Watermarking Works

Claude's invisible signature. How text watermarking actually works. Starting this year, some of what Claude writes will carry a hidden, checkable mark — not a stamp, not hidden characters, something stranger. By the end of this video you'll know exactly what changes, who else is doing this, why it's so much harder for text than for a picture, and what it genuinely can and can't prove. On the 11th of August, Anthropic said Claude will start watermarking the text it generates. Four days later, a follow-up post laid out how. Future Claude models carry it automatically. Models released before the 2nd of August fall under a transition period — Anthropic says it's rolling watermarking out to those "over the coming months." Here's the part that doesn't make it into most headlines: Anthropic's own post frames this as meeting a legal requirement, not shipping a feature. In July, Anthropic signed the EU's Code of Practice on Transparency of AI-Generated Content, under the EU AI Act. Roughly 190 organizations signed the same code. It requires marking AI-generated text. Anthropic doesn't pitch this as a tool against plagiarism or misinformation. It's compliance, stated plainly. Anthropic is one of six major labs that signed that code. What they've actually shipped is wildly different. Google got there first: back in 2024, it put the same underlying technique into the Gemini app and tested it across roughly 20 million real responses. OpenAI built a detector, then reportedly shelved it. Meta has a research project, not a live product. Microsoft watermarks images, video, and audio in Copilot — but not text. Mistral has shipped nothing. And one name is missing from the signatory list entirely: xAI's Grok never signed. The method traces back to a real, named piece of research: "Scalable Watermarking for Identifying Large Language Model Outputs," published in Nature in October 2024, by a Google DeepMind team that includes Sumanth Dathathri and Pushmeet Kohli among its authors. It's called SynthID-Text. Kohli's team ran it across roughly 20 million live Gemini responses and found people couldn't tell the watermarked replies apart from ordinary ones. Anthropic's version is built on this same underlying idea. Here's what it is not: no secret characters, no invisible letters, nothing added to the text at all. What changes is quieter than that. When a model picks a word, and several words would have worked equally well, that choice normally comes from plain randomness. Watermarking replaces that randomness with something derived from a secret key and the words just before it. The word Claude picks still looks random to you. But someone holding the key can check whether that sequence of "random" choices matches what the key would have produced. The published technique behind this has a name: tournament sampling. At each word, the key splits a huge pool of candidate words into pairs, scores each pair, keeps the winner, then pairs up the winners again — round after round, like a knockout bracket — until one word remains. A separate independent study, testing this technique on a smaller model, ran that bracket thirty rounds deep. Detecting it later means replaying those scores, not the actual bracket, and checking whether the words that appeared line up with the key more often than chance allows. The obvious worry: does this make Claude's writing worse. Both Anthropic's internal testing and Google DeepMind's published research say no. Across those 20 million Gemini responses, people showed no preference either way. Anthropic reports the same: no impact on content, creativity, or readability, confirmed by human raters in controlled tests. It does have real limits, though: it's sparser on purely factual text, where there's less room to choose between equally good words, and it can't be applied to code at all, where the exact output matters. Here's the part almost nobody explains: an image is a much easier place to hide a signal than a sentence. A photo has millions of pixels, each with room to nudge slightly — spread a signal thin across all of them and it survives cropping, filters, compression. A sentence is a short chain of specific, meaningful words. There's nowhere to hide a signal in "the capital of France is Paris" — change one word and you're simply wrong. A University of Maryland researcher put it plainly: reliable text watermarking is fundamentally hardest exactly where answers are close to fixed — facts, and code. One mix-up worth clearing up: this is not the same technology as the AI detectors most people have actually met — Turnitin, GPTZero, and similar tools. Those tools guess from writing style alone, with no secret key and no access to how the text was generated. Anthropic's watermark is the opposite: nothing to guess, just a key-based check against how the words were actually chosen. And it only works for text that came from a watermarking provider in the first place — a locally run open model answers to nobody, because whoever runs it controls the dice. Only someone holding Anthropic's key can check the watermark — Anthropic says it will offer a detection API, but hasn't shipped one yet. Here's the mistake to avoid: detection can only tell you Claude was "likely involved" at some point. It cannot tell "Claude wrote this" apart from "Claude heavily edited this." It also doesn't work well on short passages — confidence only builds up over length. And a watermark's absence proves nothing. It can't confirm a text is human-written, and it can't identify a different AI system entirely. Two ways this mark comes off, both documented. The gentle one: translate the text into another language, and reporting on DeepMind's own work says the watermark weakens sharply. The aggressive one: paraphrase it. Researchers tested this directly against an earlier watermark from this same family and cut its detection rate from 99.8 percent to under 10 percent, just by rewriting. SynthID-Text holds up better against paraphrasing than that older method — but "better" isn't "immune." Anthropic's own team makes the obvious point: once every word has been replaced, it's fair to ask whether "AI-generated" still describes the result at all. To make "statistically detectable" concrete: this exact family of watermark — not Anthropic's method, an earlier relative of it — has real published numbers. In 2023, a University of Maryland team built a version that splits the vocabulary into a "green list" and biases word choice toward it. On a 36-token watermarked passage, you'd expect about 9 green-list words by pure chance. The actual text contained 28. The odds of that happening by chance: roughly one in seventeen trillion. Four things worth carrying out of this. One: this is a compliance move, driven by EU law, and Anthropic is catching up to Google here, not leading. Two: text is fundamentally harder to watermark than an image — there's just less room to hide a signal in a sentence than in a photo. Three: a watermark check can tell you Claude was probably involved — not how much, and not that a rival claim of "human-written" is false. Four: translation and paraphrasing both weaken it, one of them badly — so treat any watermark check as a clue, never a verdict.