How Claude's AI Text Watermark Actually Works

Anthropic's watermark adds nothing to your text. Not one character, not one hidden token, not one byte of metadata. Paste Claude's output into Notepad, strip every format, run it through every "AI remover" tool on the market—and the mark is still there. Because, as Kai lays out in a recent breakdown, the mark isn't in the text. The mark is the text.

That's the thing worth sitting with before the rest of this makes sense.

Not what you think it is

Two wrong assumptions dominate every thread about this. The first is invisible characters—swapping a normal space for a look-alike Unicode space in a secret pattern. Cheap trick, one find-and-replace destroys it, and Anthropic says explicitly they're not doing it. Which makes the removal market immediately awkward: Kai notes that at least one popular "watermark cleaner" does precisely this—strips invisible Unicode, removes a thing that was never there. Most of the category, per reviewers who tested them, normalizes punctuation and hands you back an em dash. That's the product.

The second assumption is style detection—tools like GPT-Zero or Turnitin reading statistical tells in your prose. That's a handwriting expert making a judgment call. A watermark is a serial number stamped at the factory. Completely different claims, and people mash them together constantly.

The real mechanism is called tournament sampling, and Anthropic confirmed it's using a version of SynthID-Text, Google DeepMind's scheme published in Nature in 2024, itself descended from earlier research. Here's how it works: when Claude generates text, it doesn't pick the single next word—it picks from a ranked list of plausible candidates, each with a probability attached. Normally, a random number generator breaks the tie. Watermarking changes exactly one thing: where that random number comes from. Instead of an arbitrary generator, it uses a secret key mixed with the last few tokens already written.

The sampler then runs a knockout bracket. Say the candidates are big, large, huge, vast. Each head-to-head match is decided by a hidden score derived from the key. The bracket winner becomes the next word, and then the key reshuffles because it's mixed with what was just written. Run this for long enough, and big appears exactly as often as it would have without any watermark at all. The distribution is preserved. What changes is which of the equally plausible words wins—in a pattern that one specific key can reproduce and verify.

DeepMind tested this on a large set of Gemini responses, split between watermarked and unwatermarked outputs, and found no statistically significant difference in user ratings. Human raters saw nothing.

The die with one face

Here's where it gets interesting—and where the system's limits become obvious. The watermark only works when Claude has genuine choices to make. Ask it to describe a sunset and it's holding a many-sided die: golden, amber, brilliant, fading, all defensible. Ask it what Isaac Newton's famous book was called, and after Principia, there is exactly one acceptable next word. As Kai puts it: "You can rig a die with 20 faces. You cannot hide anything in a die with one."

This is why code carries almost no watermark. Most tokens in code aren't optional—syntax is syntax. The watermark lives in the creative degrees of freedom, and code doesn't have many. Low-entropy text more broadly—anything with only one plausible next word at most positions—doesn't accumulate enough signal to detect reliably.

Detection runs the same machine backwards. A verifier re-derives what the hidden scores would have been at each position and checks whether the word actually there scored high. In human writing, that's a coin flip—about half score high by luck. In keyed text, it runs systematically above half, but only summed across many positions, never on any single word. Anthropic hasn't published a minimum length requirement, a threshold, or a false positive rate. Practitioners working from the academic literature estimate a floor somewhere in the range of 100 to 300 words, but that's inference from prior work, not Anthropic's own disclosure.

There's also a false positive mechanism that doesn't get enough attention. The hidden score depends on the preceding tokens. English reuses word pairs constantly—and when a repeated phrase hashes to the same verdict every time and keeps accumulating, highly repetitive prose can produce a confident-looking signal from nothing at all. Kai describes a writer who built a toy version of this and watched their own handwritten blog post flag positive across large stretches of text.

Removal is easy. Forgery is the actual problem.

The fight everyone is having—can I remove this?—has a boring answer. Yes, easily. An off-the-shelf paraphraser gets you most of the way there. The engineering trade-offs that make SynthID-Text harder to forge—the wider context window, the tournament structure, the caching—also make it easier to wash off. That's a real tension in the design, and it went in a direction most coverage assumes it didn't.

The risk that actually matters runs the other way. Research published in 2024 demonstrated that you can query a watermarked model's API enough times to approximately reverse-engineer its watermark and then stamp it onto text you wrote yourself—against watermarking schemes previously considered robust. Against SynthID-Text specifically, Kai notes the design holds up considerably better, with spoofing success much lower, though it climbs as an attacker's query budget increases. The researchers who did this work also built a detector for spoofing attempts that gets stronger with longer text—so this is an arms race with a scoreboard, not a one-way door. But the numbers come from research on a smaller open model, not Claude directly. Treat them as the shape of the problem, not measurements of the specific thing you're using.

The failure mode that should concern people: a watermark appearing on a paragraph a human actually wrote, in a disciplinary hearing, with a detector that publishes no error rate. Everyone's worried about a cheating student getting caught. That's the wrong end of the threat model.

Two reasons this exists, and only one gets mentioned

Anthropic frames the watermark primarily around EU AI Act compliance—Article 50 requires disclosure of AI-generated content, and a transparency code with roughly 190 signatories covers Anthropic along with other major labs. That's the stated reason.

The unstated one is training data hygiene. A watermark is a filter. If you're building next-generation models, you need some way to keep your current model's output from being scraped back into your training set and creating feedback loops. That incentive exists entirely independent of what Brussels requires, which means this feature would probably be here even if regulators had never written a word.

There's also a genuine contradiction in how the law and the technology interact. The EU carves out standard editing, spelling, grammar, and translation as activities that don't require a mark. But Anthropic watermarks translation anyway—and says the mark on translation is strong, because every output word was chosen by Claude. Meanwhile, the light copy edit that everyone is actually nervous about is exactly where the mark may be too sparse to register. The exemptions in the law and the strengths of the technology point in opposite directions.

What it actually proves

Credit where it's due: Anthropic wrote down what their tool cannot prove. It cannot confirm human authorship. It can't tell you which AI wrote something. And in their own words, it "cannot distinguish Claude wrote this from Claude heavily edited this." That's more intellectual honesty than most AI detection vendors have managed.

Temperature, top-P, and top-K controls are no longer user-accessible on Claude's newer models—set them to anything non-default and you get an error. A developer connected this to the watermarking announcement on Hacker News. Kai is careful to note that's an inference rather than Anthropic's stated rationale—reasoning models had been shedding temperature controls before any of this landed. But the structural point holds regardless of motive: if the watermark lives in the sampler, the sampler becomes a compliance surface. And compliance surfaces don't get user-facing knobs.

Practically: stop buying removal tools. There's no public detector, which means no vendor can currently demonstrate their product does anything. A market where nobody can measure the outcome is a market selling belief. If you need unmarked output for a legitimate reason, run an open-weight model locally—the mark lives in the sampler, not the weights, so whoever controls the sampler controls the mark. If you publish for a living, keep your drafts in version history. That's the only real defense against a forged mark—and it's the same defense that worked before any of this existed.

What Anthropic built answers one narrow question: did these words come out of our sampler? It answers that well when the model had genuine choices, and not at all when it didn't. It cannot see your intent, your effort, or the three hours you spent on a paragraph before you asked Claude to fix the grammar.

The detection API hasn't shipped yet. Until it does, every claim about this watermark—for it or against it—is unfalsifiable. Watch for that, not the removal tools.

---

Yuki Okonkwo covers AI and machine learning for Buzzrag.