How LLM Watermarking works

In August 2026 Anthropic announced an invisible watermark for the text of Claude models launched from 2 August onward. No current model carries it yet, so the marking starts with the next launch. The watermark lives inside the sampling loop and proves far less than most people assume. We'll build the mechanism up from tokens and logits, work a detection example by hand, and finish with what a watermark can and cannot tell you.

On 11 August 2026 Anthropic said Claude models launched from 2 August onward will carry a machine-readable text watermark, built on Google DeepMind's SynthID-Text approach. None of the current models carries it yet. This post explains how a watermark hides inside the sampling loop, how a detector turns word choices into a statistical score, why paraphrasing breaks it, and why a detected watermark is evidence of processing rather than proof of authorship.

Introduction

On 11 August 2026 Anthropic announced that Claude will mark the text it generates so the text can later be checked by machine. Nothing visible is added. No extra tokens are spent, the price is the same, and Anthropic reports a negligible effect on speed. What changes is how the model picks each word.

Every serious text watermarking scheme comes down to the same three facts.

• One token at a time: A token is the unit a language model reads and writes, usually a word or part of a word.
• One pick per step: At each step the model picks one token from hundreds of thousands of options.
• What a watermark is: A rule for making that pick.

We'll build the mechanism from logits and sampling, work a detection example by hand, then take Anthropic's rollout as the case study. After that, the rival approaches, the attacks that remove a watermark, who carries the risk, and what a watermark can actually prove.

Every factual claim about Anthropic here comes from its help-centre article and reporting on it. Where a detail has not been disclosed, this post says so rather than guessing.

Why text is the hardest thing to watermark

Marking an image is easy because an image has enormous slack. You can nudge thousands of pixel values by an amount no eye can see and the picture still looks identical. Audio is the same, and both carry far more data than the meaning needs.

Text has almost none of that slack. Every token carries meaning, and changing one changes what the sentence says. So a watermark has to be built out of the only freedom that exists, the choice between words that would each have been acceptable.

That freedom is uneven. A sentence of opinion has many acceptable next words, so a watermark can be encoded there. A name or a line of code has almost one. The same scheme is strong on an essay and weak on a function signature.

Signing the file is the obvious alternative. C2PA is an open standard that attaches signed metadata recording what produced a file, and it is cryptographically strong. It also disappears the moment someone copies the words out or screenshots the page. A statistical watermark is built into the text itself, so it survives copy-paste. But it is probabilistic, so it is not always certain.

A signature protects a file. A statistical watermark protects the words. They fail in opposite situations, which is why serious provenance work uses both rather than picking one.

What the watermark is for

The demand comes from several directions, and they want different things from the same signal.

• Regulation: Article 50 of the EU AI Act sets transparency obligations for AI-generated content, and it is the stated driver behind Anthropic's rollout. The marking is applied worldwide, not only in the EU.
• Platform moderation: A platform that can measure how much of its incoming text was machine-written can rank, rate-limit, or label it without judging quality.
• Academic integrity: Educators want to know whether a submission was written by the student. This is also where a wrong answer does the most damage to a real person.
• Enterprise governance: A company that has told regulators which systems touch its documents needs some way to check that claim after the fact.
• Training data hygiene: Model builders want to know which of the text they scrape came out of another model, so their training set does not quietly fill with machine output.

Only one of those needs certainty about a single document, the one that accuses a person. The others just need a rough signal across many documents. That difference decides which uses of a watermark are reasonable.

How a watermark fits inside the sampling loop

The watermark goes into the last of the steps a model runs for every word it writes.

Read the pipeline left to right. The model reads everything written so far and produces logits, raw scores, one for every token in its vocabulary. The four bars are the four candidates carried through the rest of this post.

Two more steps prepare the scores before the pick.

• Temperature: Temperature controls how adventurous the pick is. A low setting like 0.7 makes the strong scores stand out more, so the model plays it safe. A high setting like 1.4 pulls the scores closer together, so weaker words get a real chance. The dashed bars in the diagram show the 1.4 version. Under the hood, every score is simply divided by the temperature.
• Softmax: Softmax turns the scores into probabilities that add up to one. That gives the model a real set of odds to pick from.

Truncation drops the unlikely tail before anything is picked. Two rules do it.

• Top-k: Top-k keeps only the k most likely tokens and drops the rest. With k set to 3, the top three survive and the fourth is dropped.
• Top-p: Top-p keeps the smallest group of top tokens whose probabilities add up to p. With p set to 0.9, all four survive here, because the top three only add up to 0.87.

So the two rules give different answers here. Top-k drops learns, top-p keeps it. That is normal, and real systems usually apply both, which means the stricter one wins.

Then sampling picks one of the survivors at random according to those probabilities. That last box is the keyed sampler, and it is the only stage a watermark touches.

That last step needs a source of randomness. Ordinarily it comes from wherever your machine gets random numbers, and nobody cares which value it used. A watermark cares.

The watermark works on this table. P(token | context) is the normal choice. P'(token | context, key) is the watermarked choice. The best methods keep the same probabilities and only change how the final token is picked.

Three schemes explain the whole idea. We'll take them from the easiest to picture to the one Anthropic uses, which is not the order they were published.

Scheme 1. Green and red lists, the simplest to picture

A coin that is bent, just a little, lands on heads 51 times in 100 instead of 50. Watch one flip and you see nothing wrong. Count a thousand flips and heads is clearly winning. This scheme bends the model's word choices the same way, and the detector counts.

Kirchenbauer and colleagues published this scheme in 2023. Before each word, it splits the vocabulary into two halves, a green list and a red list. Every green token gets a tiny boost to its logits, and the model picks as normal.

Which half a token lands in looks random but is not. A hash of the secret key and the previous token decides it, and the same input always gives the same answer. That is what pseudorandom means. So anyone with the key can replay the text and rebuild every green list, without the model.

The push towards green is small, so the model still writes naturally, but it adds up. A normal model picks green about half the time, roughly 100 words out of 200. A watermarked model picks green more, about 137 out of 200. Too many green words, and that is the watermark. The cost is that the odds shift a little, so the text is not quite what the model would have written on its own. That is the distortion the next scheme avoids.

Scheme 2. Keyed randomness, the one without the distortion

The upgrade swaps the coin instead of bending it. The new coin is perfectly fair, but you secretly know the order of heads and tails it will produce. The odds never change, only where the randomness comes from.

Scott Aaronson proposed this in 2022 while at OpenAI, a few months before the green and red list paper. It comes second here because it is easier to follow after the first. This scheme never touches the probabilities. It only changes where the random numbers come from, working them out from the key and the recent words instead of the usual source. The odds stay the same, so quality never drops. That is what distortion-free means. Scheme 1 made green words more likely, which changed the writing slightly. This one keeps every word exactly as likely as before.

This is how Anthropic describes its approach. The choices are still random, but the source of the randomness is changed. The probabilities stay the same.

Scheme 3. Tournament sampling, the one that actually shipped

Tournament sampling is a knockout tournament between words. The model nominates a few candidates it already likes, they play elimination rounds, and the key decides the tie-breaks. The winner is always a word the model itself proposed.

SynthID-Text, introduced by Google DeepMind in 2024, turns the keyed-randomness idea into a practical system. It uses tournament sampling. The model picks several possible tokens, compares them using random values based on the key and recent context, and picks a winner. It can keep the original output distribution or make the watermark stronger by slightly reducing quality.

DeepMind validated it across nearly 20 million Gemini responses and it runs in Gemini today, the first text watermark deployed at production scale. Anthropic says its own marking is a version of it.

Detection is a statistics problem

Detection is coin counting. Fair flips give about half heads, and 137 heads out of 200 is something else entirely. The detector counts the word choices the key favours and asks how far the count sits from half.

A detector never looks at writing style. It uses the key to work out which words were favoured, then counts them. Too many means watermarked.

For the green and red list scheme, the maths is simple. Use the key and the previous token to rebuild the lists, then count how many tokens are green. Without the key, you would expect about half to be green. The z-score tells you how far the actual count is from that expected value.

The formula is easier than it looks. For a 200-token passage.

• Start with the expected number: If half the tokens are green, we expect 100 out of 200.
• Allow for chance: We will not always get exactly 100. Around 93 to 107 can happen naturally.
• Compare the actual result: We got 137 green tokens, which is far above 100.

This gives a z-score of about 5.2, meaning the result is very unlikely to happen by chance.

For a shorter example, 19 green tokens out of 30 gives a z-score of about 1.5. Human text can easily get a score like this, so short text is not enough to prove it is AI-generated.

A z-score of around 4 gives a false-positive rate of about 3 in 100,000. That sounds low, but across 1 million submissions, it could still wrongly flag about 30 students.

Detection needs length. Below roughly 100 tokens there is not enough signal for any threshold to mean much. A tweet, a paragraph, or a quoted excerpt sits under the floor no matter how good the scheme is.

The detector never needs the model, only the tokenizer and the key, so it is cheap to run. Everything depends on the key. Whoever holds it can check. Without it the watermark is unreadable.

Anthropic's rollout, what is known and what is not

Announced on 11 August 2026, the marking applies to Claude models launched on or after 2 August 2026. Support for older models is described as in progress. No released Claude model carries the text watermark yet, because the current line all launched before that cutoff.

Here is what Anthropic has stated, what the published research already establishes, and what has not been disclosed.

• Confirmed by Anthropic: Coverage spans the Claude API, the Claude apps, Claude Code, Claude Cowork, Claude Tag, and the AWS, Google Cloud and Microsoft Foundry integrations. Article 50 of the EU AI Act is the stated driver, applied worldwide. Generated SVG, PNG and JPG files get signed, tamper-evident C2PA metadata instead, a different mechanism from the text watermark.
• Confirmed about cost and quality: Negligible speed impact, no extra tokens, same price. Human raters saw no quality difference between watermarked and unwatermarked answers.
• Confirmed about robustness: In Anthropic's own words, light editing probably will not remove the watermark completely, and a complete rewrite where every word is replaced will. It survives copy and paste and grammar-only edits. It is weak on short texts, and weaker on constrained text such as factual passages and code, where there are fewer free choices to encode a signal in.
• Established by the research: The lineage runs from Aaronson's 2022 proposal through the Nature SynthID-Text paper. That gives you the shape of the mechanism, the role of the watermark key, and the statistical nature of detection, without Anthropic having to restate any of it.
• Not disclosed: Which exact SynthID-Text configuration is used, meaning the context window size, whether it runs distortionary or not, and the number of tournament layers. Nobody outside Anthropic knows, and this post does not guess.
• Also not disclosed: Who gets detector access, and whether it will be public, gated, or platform-only. No false-positive numbers have been published for Claude's deployment and no public detection tool has shipped. Anthropic says detection will be covered in forthcoming technical documentation.

That last gap is the biggest problem. A watermark nobody can check is just a promise. And who gets the detector is a hard question.

The approaches side by side

Five designs cover almost everything in the field. The table below shows where they differ.

The first three are part of the same development. Kirchenbauer et al. showed that watermarking works, but it slightly changes the output. Aaronson's earlier proposal avoids that change by altering how the random choice is made instead of the scores. SynthID-Text then made that practical at scale.

The fourth takes a different approach. In 2023, Christ, Gunn, and Zamir showed that a watermark can be cryptographically hidden. Without the key, no test can tell the watermarked text from normal text. This is stronger than simply making the watermark hard to remove. It matters when you do not even want an attacker to know that a watermark exists.

The fifth should be used in every system. C2PA metadata can be checked using a public signature, but it can disappear when a file is re-encoded. It is the strongest signal, but also the easiest one to lose.

Why paraphrasing wins and editing does not

The asymmetry between light editing and rewriting follows directly from the mechanism.

Fix a typo, change a comma, swap one adjective. Every other token keeps the identity the key gave it, because its place in the sequence is unchanged. A handful of positions move in a passage of hundreds, and the count barely shifts.

Now paraphrase the whole thing. Every word is drawn again, from a process that has never seen the key. The agreement collapses to what chance would give. Sadasivan and colleagues found recursive paraphrasing effective against detectors generally in 2023. Kirchenbauer's group found it weakens the signal without always destroying it, and that detection can recover given enough tokens.

The other weaknesses come from the same place.

• Translation: Translating and translating back is a paraphrase performed by a different system, so it has the same effect on the score.
• Mixing: A document that is half human and half machine dilutes the signal roughly in proportion. Detection over a whole document says little about which half is which.
• Short text: Under about 100 tokens there are too few word choices to count, so the score stays low even for watermarked text. Flip a coin four times and three heads proves nothing. No scheme gets around this.
• Constrained text: Code and dense factual writing have few acceptable alternatives per position, so there is little room to encode with. You cannot swap a method name to carry a bit.
• Regeneration: Running the same task through an unwatermarked model removes the watermark completely, because it was never there. Open-weight models make this available to anyone who can run the weights.

Two problems that point the other way

Research also talks about spoofing. If an attacker can make enough queries, they may learn how the watermark works and create text that looks like it came from someone else's model. This can make human text look AI-generated, and changing the detection threshold will not fix it.

Detector access is another problem. A public detector can help people remove the watermark. Someone could keep changing or paraphrasing text and test it until the watermark is no longer detected. Researchers call this an evasion oracle. This was also raised in the August 2026 discussion about Anthropic's plan.

A private detector limits this risk but only helps a small number of organisations. A public detector makes testing easier but can also teach people how to avoid the watermark. There is no perfect solution yet.

This section is an analysis of where the mechanism is weak, which is what you need in order to judge a deployment. It is not a guide to removing a watermark, and it is deliberately not written as one.

Who carries the risk

The costs and the benefits land on different people.

• Students: They carry the false-positive risk individually. A detector that is right 99.99% of the time is still wrong about somebody, and that somebody has to argue against a number they cannot inspect.
• Developers: Code is the weakest case by Anthropic's own statement, because there are so few free choices per position. Treating a code watermark as reliable evidence is not supported by the mechanism.
• Enterprises: Key custody becomes a real operational concern. Whoever holds the watermark key controls who can verify anything, and per-provider schemes do not interoperate, so a mixed-model shop gets several incompatible signals.
• Publishers and platforms: The best fit. They measure across large volumes, where a noisy per-document signal aggregates into something useful.
• Educators: They need per-document certainty, which is what the mechanism cannot give. A score is a reason to open a conversation, not a finding.
• Open-source users: They are outside the system entirely. Watermarking is only enforceable at the hosted-inference layer, so anyone running open-weight models controls the sampler and therefore the watermark.

There is also a disclosure question with no settled answer. Should a user be told the text they were handed carries a watermark, and can they check it themselves? Anthropic's announcement covers what is marked, not what users are told.

Where watermarking sits in a system

There are four places the watermark could live, and they are not equally good.

• In the model weights: Train the model so its output is inherently identifiable. It cannot be configured after training, it cannot be turned off for a customer who needs it off, and it is the hardest to reason about.
• In the decoding layer: Change how tokens are chosen at inference time. This is where every deployed scheme lives, including Anthropic's. It is configurable per request, costs almost nothing, and applies only where you control the sampler.
• In post-processing: Rewrite the finished text to carry a watermark. The worst option, because a second pass over the output can change what the model actually said.
• In the provenance layer: Sign the artefact and log what produced it, as C2PA does for files. Cryptographically strong, verifiable by anyone with the public signature, and lost the moment the content is copied out of its container.

The decoding layer wins for text because it is the only place with both the freedom to encode and the ability to survive a copy and paste. It is still one layer of several. Signed metadata on the file, a server-side log, and the statistical watermark in the words each cover a case the others miss.

What a watermark can and cannot prove

A detected watermark tells you the content may have been processed by Claude. It does not tell you the ideas are machine-generated. Claude may have proofread a human draft, translated it, or summarised it, and the watermark is applied either way. It records the sampling event, not the origin of the thought.

The absence of a watermark proves even less. Heavy editing removes it. So do paraphrasing, translation, converting formats and taking a screenshot. An excerpt too short to score never had enough of it, and any model without the scheme never carried it at all. So never read a missing watermark as proof that a human wrote the text.

A watermark marks the sampling event, not the ideas. It says a particular model probably chose these particular words, and it says nothing about who decided what the words should mean.

It reduces to one design fact. The watermark lives in the freedom the model has when it picks a word. More freedom means a stronger watermark, and the watermark disappears whenever someone picks the words again.

The mechanics underneath all of this, tokens, logits, softmax, temperature and sampling, are covered step by step in the LLM track in this app. If the sampling loop in the pipeline diagram at the top of this post felt like the unfamiliar part, that is the place to start.

Sources

Primary sources, so you can check the claims yourself.

• Dathathri et al., 2024: Scalable watermarking for identifying large language model outputs, Nature. The SynthID-Text paper.
• Kirchenbauer et al., 2023: A Watermark for Large Language Models. The green and red list scheme.
• Aaronson, 2022: Public lecture covering watermarking GPT outputs. The keyed-randomness idea.
• Sadasivan et al., 2023: Can AI-Generated Text be Reliably Detected? The paraphrasing attack.
• Christ, Gunn and Zamir, 2023: Undetectable Watermarks for Language Models.
• Anthropic help centre: How Claude marks AI-generated content. The source of every Anthropic claim here.
• C2PA: c2pa.org. The open standard for signed provenance metadata.