The Green List
The Green List
A working explainer every number on this page is computed live

A statistical bias
you cannot see,
and cannot un-write.

Since August 2026 the text Claude produces carries a machine-readable watermark. Not an invisible character, not a hidden metadata field — nothing has been added to the text at all. What was changed is the source of the randomness the model uses to pick each word.

This page implements the whole family of techniques — green lists, Gumbel sampling, SynthID's tournament, semantic hashing, multi-bit payloads — in a toy language model you can drive. Turn the key, generate, then try to wash the mark out.

The toy model is there because every one of those schemes needs to reach inside the sampling loop, and no API will let you. One technique doesn't need that — and the last plate runs it against real language models, live.

Fig. 0 — hold the sheet to the light
Green-list words z-score p-value move the pointer over the text
01 — The premise

Text is discrete. So where is there room to hide anything?

With an image you can nudge pixel values by a fraction of a shade and no eye will catch it. A sentence has no such slack: swap one word and the meaning moves. For years that was the standard argument for why text watermarking could not work.

The argument has a hole in it. A language model does not emit the next word; it emits a probability distribution over the next word, then draws from it. At a great many positions that distribution is genuinely flat-ish — "the river slid / drifted / turned past the town" are all fine. The model is effectively tossing a weighted coin, and nobody downstream can tell which face came up or whether the toss was fair.

That is the room. The watermark does not add anything to the text. It replaces the coin.

Plate A

One position, one distribution

where the freedom actually lives
Reading

Entropy H is the honest measure of watermark capacity at a position: H = −Σ pᵢ log₂ pᵢ. At H = 0 there is exactly one thing the model can say and no key on earth can influence it. Temperature widens or collapses the distribution — and with it, the room.

Scroll that control down to a factual position and the entropy goes to zero. This single fact governs everything that follows: watermark strength is not a property of the algorithm, it is a property of the text. A page of flowing prose carries a strong mark. A page of arithmetic carries none.

02 — 2023 · Kirchenbauer, Geiping, Wen et al.

The green list

The founding trick, and still the clearest one to reason about. Before each token, hash the preceding few tokens together with a secret key. Use that hash to split the entire vocabulary in two: a green list and a red list. Then quietly add a bonus to every green word's logit.

Generation — the biased draw seedt = PRF( key, tokent−H … tokent−1 )
Gt = a random γ-fraction of the vocabulary, chosen by seedt
ℓ̃t[i] = ℓt[i] + δ · 1[ i ∈ Gt ]   →   sample from softmax(ℓ̃t)

Two knobs. γ is how much of the vocabulary is green — a half, a quarter. δ is how hard the thumb presses on the scale. Because the split is re-drawn from the preceding tokens at every single step, the green list is a different arbitrary half of the dictionary at every position, and no fixed word is ever "the AI word".

A third knob hides in the seed: H, how many previous tokens go into the hash. The original paper uses one. This page uses four, matching SynthID-Text — a wider window means far more distinct contexts, which matters enormously once you see the detector in action. It also makes the mark more brittle, since editing one token corrupts the context of the next H as well.

The consequence that makes it useful: detection needs the key and nothing else. Not the model, not the prompt, not the logits. Anyone holding the key can recompute every green list from the text itself.

Plate B

The split, and the price of it

key + context window → a fresh partition
The vocabulary, partitioned by this key and this context
green list — nudged up red list — nudged down change one letter of the key or the context and the whole split is redrawn
What δ does to one real distribution
original p after the green bonus candidate names in green are on the green list
The bill

This is the distortion the next twenty years of research is about. At δ = 0 nothing happens and nothing is detectable. Push δ up and the mark gets loud, but the model is now measurably not saying what it would have said — visible above as KL divergence, the information-theoretic gap between the two bars.
Implementation note Real KGW seeds a PRNG from the context window and permutes the whole vocabulary, taking the first γ|V| entries as green. This page uses the equivalent hash-per-candidate form — PRF(key, context, candidate) < γ — which gives each token an independent γ-chance of being green under the same context. Same statistics, far less arithmetic per keystroke.
03 — The other half

Detection is just a coin-flip test

The detector never sees the model. It takes the text, recomputes every green list from the key, counts how many words landed green, and asks the oldest question in statistics: could a fair coin have done this?

Detection — the one-sided test Under the null hypothesis "this text was not written with the key",
each token is green with probability γ, independently.  So |s|G ~ Binomial(T, γ), and

z = ( |s|G − γT ) ⁄ √( T·γ·(1−γ) )     p = 1 − Φ(z)

A z of 4 means the green count sits four standard deviations above what chance allows — a one-in-thirty-thousand coincidence. A z of 8 is one in 10¹⁵. There is no machine learning in the detector; it is a proportion test you could run in a spreadsheet, which is exactly why it is trustworthy in a way that "AI detector" classifiers are not.

Paste anything into the bench below. Your own writing will sit near zero, because your writing has no relationship to the key.

Plate C

Detector bench

text in, z-score out — no model required
Load a sample
Load a sample or paste text, then press Analyse.
Per-token evidence
scored above chance scored below chance dropped — this context has already been counted
Try the wrong key. Try your own paragraph. Try the same text under a scheme it wasn't marked with. All three should collapse to z ≈ 0 — that collapse is the whole guarantee, and it is what keeps the false-positive rate calculable rather than guessed at.
Why repeated contexts are thrown away The PRF is deterministic: the same context window followed by the same token yields the same green verdict every time it occurs. Counting it twice adds a second copy of one observation and pretends it is two, which inflates z on any repetitive text. Real detectors deduplicate. Switch the control above to count every token and run the factual or code sample — the z-score jumps, and every point of it is fake.
04 — The first objection

You just made the model worse

Adding δ to a logit is not free. Words that should have been rare become less rare. Over a long passage that is a real, measurable change in what the model is willing to say — and the first place it hurts is precisely where quality matters most.

The fix is a genuinely elegant piece of sleight of hand. Do not touch the distribution at all. Touch the dice.

Sampling from a distribution requires a source of randomness. Nothing says that source has to be true randomness — a pseudorandom stream derived from a secret key is, to any observer without the key, indistinguishable from noise. Sample with those numbers instead, and the sequence of draws now correlates with a stream only the key-holder can regenerate. Methods built this way are called distortion-free.

Imagine playing Monopoly, and instead of rolling dice you read digits from π, starting a million places in. The game plays identically. But lay out every move afterwards and compare it with π, and you can prove which game was played. Anthropic's analogy for distortion-free watermarking, August 2026
The nuance almost every explainer drops "Distortion-free" does not mean the model's next-token distribution is untouched at the position in front of you. It cannot: once the key and the context are fixed, the pseudorandom numbers are fixed too, and the choice at that position becomes lopsided — for pure Gumbel it becomes fully deterministic. The guarantee is an average. Over the key — equivalently, across the thousands of different contexts a real passage moves through — the frequencies come back to exactly p. The dice are loaded at every individual roll and fair over the whole game. Plate D measures both views, and they disagree sharply.
Plate D

Did the distribution survive?

Monte Carlo — draw the same position thousands of times
true p (what the model meant) KGW green list SynthID tournament Gumbel-max

Flip Measured between the two regimes and watch the story invert. At a single fixed context every scheme distorts, Gumbel most of all — it collapses to one token. Averaged across contexts, Gumbel and the tournament return to p to four decimal places while KGW keeps a residue that grows with δ. That residue is the quality you spent to buy detection strength; the other two bought theirs with compute instead.
05 — 2022 · Aaronson; Kuditipudi et al.

The Gumbel-max trick: same odds, rigged dice

The cleanest distortion-free scheme. Give every candidate token a pseudorandom number rᵢ ∈ [0,1) derived from the key and the context, then pick the candidate maximising rᵢ1/pᵢ.

Generation — argmax instead of a draw ri = PRF( key, tokent−1, candidatei ) ∈ [0,1)
next token = arg maxi   ri1/pi

Classical result: this selects token i with probability exactly pi.

The exponent does the work. A high-probability token has 1/pᵢ small, so rᵢ1/pᵢ stays close to its own r — it barely needs luck. A rare token is raised to a huge power, crushing its score to near zero unless it drew a number startlingly close to 1. Weigh those two effects and the win probability comes out at exactly pᵢ. No approximation, no distortion.

Detection inverts it. Recompute rᵢ for the token that actually appears. In human text those numbers are just noise: uniform, mean 0.5. In watermarked text every token is a winner, and winners drew high. The mean drifts above 0.5, and the same z-test as before applies.

Plate E

The rigged draw, step by step

watch the second-favourite win on a lucky number
Determinism — the catch

Given the key and the context, the winner is fixed. There is no randomness left to draw. Ask the same question twice and Gumbel returns the same sentence twice.

Determinism is why a chat product cannot ship plain Gumbel. Users regenerate a reply expecting a different answer and get a photocopy. Fixing it means salting the key per request — which weakens detection, because the detector must then try every salt.
06 — 2024 · DeepMind, Nature · shipped in Gemini, then in Claude

Tournament sampling

SynthID-Text keeps real randomness and spends the key somewhere else entirely: on refereeing. Draw 2m candidates from the true distribution, then run a knockout bracket in which the key decides every match.

Generation — a bracket, not a draw 1.  sample 2m candidates i.i.d. from p  (repeats allowed — this is the crucial part)
2.  for each layer ℓ = 1…m:   g(token) = PRF( key, ℓ, tokent−1, token ) mod 2
3.  in every pairing, the larger g advances; ties broken by a fair coin
4.  the survivor is emitted

Why the distribution survives: entries are drawn from p, with replacement. A word with probability 0.6 walks into the bracket holding roughly 60% of the seats. It wins more often because it is there more often, not because the key favours it. DeepMind proved token-level distribution preservation exactly for the two-candidates-per-match, binary-g configuration.

Detection is the same shape as everything else on this page: recompute all m g-values for every token in the text and average them. Under the null that mean is 0.5. A tournament survivor is a token that won m coin-flip matches it was chosen to win, so the mean climbs — and with m layers per token, one token now donates m bits of evidence instead of one.

And unlike Gumbel, real sampling is still in the loop. Regenerate the same prompt and you get a genuinely different answer that is still watermarked. That is the reason this is the family that shipped.

Plate F

The bracket

2m entries · m layers · one survivor
emitted token equal g-values — the key has no opinion, so that match is a fair coin flip a token appearing twice is not a bug: entries are drawn from p with replacement
Seats in the bracket vs. true probability
true p share of entries this draw
Evidence yield

More layers means more bits per token and a sharper detector — but also 2m samples drawn per token. The published system runs a small m; the point of the design is that m trades statistical power against compute, never against quality.
07 — Everything at once

The lab

A toy language model with real per-position distributions. Pick a scheme, turn the key, generate — then click any word to see the distribution it was drawn from, what the key did to that draw, and whether the outcome actually changed.

Plate G

Generate & inspect

click any word
Output scores above chancethe key changed this wordfaded = forced by syntax, or a repeated context
Token inspector

Click a word in the output to open it up.

The changed counter uses a coupled draw: the watermarked and unwatermarked samplers are handed the identical uniform, so a token is only counted as changed when the key genuinely flipped that outcome. Typically a small minority of positions — the watermark is a whisper repeated hundreds of times, not a shout.
08 — The budget

Entropy is the currency, and most text is poor

Every claim about watermark strength is really a claim about how much freedom the text had. Switch the lab to Factual reference and the z-score falls through the floor — not because the algorithm failed, but because there was nothing to bias.

Anthropic's own documentation makes the point with an example: in "Newton's principal work is Principia …", the only word that can follow is Mathematica. There is no second candidate, so there is no nudge, so that token contributes pure noise to the detector — it still gets counted, diluting the statistic. Low-entropy passages do not merely fail to help; they actively drag the average back toward chance.

Same for arithmetic, quoted material, code, structured formats, and — critically — anything where a human wrote most of the words and the model only edited. This is why the honest failure mode of text watermarking is a false negative, and why short texts are hopeless: 20 tokens simply cannot outvote the noise.

Plate H

Capacity map

where the mark can land, and where it cannot
Per-token entropy — bar height is the room available at that position
Detection strength by text type (800 tokens, SynthID m=3)
z-score reached
This sample

"Effective tokens" counts only positions where the model had a real choice. The detector, of course, cannot compute that column — it has no idea which words were forced. It scores everything, which is why the achieved z tracks the effective count while the confidence interval is set by the total.
09 — The unresolved problem

Paraphrase

Every scheme on this page — green lists, Gumbel, tournament — encodes the mark in the surface identity of tokens. Replace the tokens and keep the meaning, and the evidence goes with them. This is not a bug anyone has fixed; it is the open front of the field.

The 2023 result that set the agenda: run generated text through a dedicated paraphrase model and essentially every detector of the day collapsed. The attack needs no key, no knowledge of the scheme, and no skill — a second language model rewriting the passage is sufficient.

The bench below runs four attacks against a live watermarked passage. Watch which ones matter.

Plate I

Attack bench

how much editing does it take to wash the mark out?
The attacked text
token replaced by the attacker
z-score vs. attack strength
dashed line = the z ≈ 4 evidentiary threshold
The adaptive attack is the interesting one. It is not random editing: it recomputes the g-values and deliberately chooses replacements the detector will score low. At the same edit rate it destroys far more evidence than blind paraphrase — the published version of this idea against SynthID is the 2026 layer-inflation attack.
10 — The part that gets people fired

Thresholds, false alarms, and length

A detector is a threshold on z. Move it down and you catch more marked text and start accusing innocents; move it up and you miss real cases. There is no setting that does both, and the arithmetic is completely explicit.

Plate J

Where to put the line

the null distribution never goes away
10,000 simulated documents
unmarked text (the null) watermarked text
Evidence accumulates with the square root of length
Drag the length down to 40 tokens and watch the two distributions merge. This is the mathematical content of "the signal is insufficient for short texts": a paragraph-length answer, an email, a chat reply, a commit message — none of them carry enough draws to separate from chance at any threshold you would be willing to defend.
11 — 2024–2026 · SemStamp, PASA

Move the mark out of the words

If paraphrase kills token-level marks, stop marking tokens. Mark meaning. A paraphrase preserves the sentence's position in embedding space almost by definition — so put the watermark there instead.

SemStamp works a sentence at a time. Generate a candidate sentence, embed it, hash the embedding with locality-sensitive hashing — random hyperplanes through the space, each one splitting it in half — and read off which cell the sentence landed in. The key declares some cells valid. If the candidate landed in an invalid cell, throw it away and generate another. Repeat until it lands in a valid one.

Now paraphrase the sentence. Its vector moves — but only a little, because it still means the same thing. Unless the move crosses a hyperplane, the cell is unchanged and the watermark survives. PASA (2026) formalises the trade-off between detection accuracy, robustness and distortion, and pushes the same idea into a distortion-free framework.

The catch is written into the geometry: sentences near a boundary are fragile, rejection sampling costs real generation compute, and the whole thing depends on an embedding model that both parties agree on.

Plate K

Embedding space, partitioned by the key

drag the paraphrase radius and watch cells survive or fail
Reading

valid cells — sentences are accepted here sentence survived paraphrase paraphrase pushed it across a boundary
More hyperplanes means finer cells and more bits per sentence — and a shorter distance to the nearest boundary, so robustness falls. That tension is the entire design space of semantic watermarking, and no one has escaped it yet.
12 — 2025 · Qu et al., USENIX Security

Not "was this AI", but "whose"

Everything so far answers one bit: marked, or not. Multi-bit watermarking embeds an actual payload — an account ID, a timestamp, a session — into the same statistical slack.

The construction is a natural extension. Hash the context to assign each text position to one slot of the payload. The green list at that position now depends on the value of the bit that slot is carrying. Detection reverses it: bucket the tokens by slot, and for each slot ask which bit hypothesis explains the green counts better. Error-correcting codes mop up the damage from editing.

This is the version that makes people nervous, and it is worth being precise about who has shipped it: nobody, publicly. Anthropic's documentation states explicitly that its watermark and key contain no information identifying a person, an organisation, or a conversation — the design is deliberately one bit wide. The capability nonetheless exists in the literature, and the gap between "we chose not to" and "it cannot be done" is worth keeping clear in your head.

Plate L

Write a payload into prose, then read it back

8 bits · ×3 repetition code · majority vote
Written
Recovered
Result
Per-slot confidence — each of the 24 code positions, before majority vote
Carrier text
Shorten the text and the slots run out of evidence one by one. A payload needs roughly n × (bits) × (repetition) usable positions to survive — orders of magnitude more text than a single presence/absence flag, which is the practical reason a one-bit design is the one that ships.
13 — 2025 · SAEMark

Watermarking a model you don't control

Every scheme so far reaches into the sampling loop. If all you have is an API that returns finished text, none of them apply.

The post-hoc answer is selection instead of intervention. Ask the API for several completions. Push each through a feature extractor — SAEMark uses a sparse autoencoder, the same instrument interpretability researchers use to read features out of activations — and compute a statistic. Keep the completion whose statistic lands nearest the target the key specifies. Discard the rest.

Nothing inside the model was touched, so it works on any black box, in any language, on code. The cost is blunt: you paid for k completions and shipped one, and the mark is only as strong as the spread among the candidates you happened to draw.

Everything above this point ran on a toy model, because every scheme above this point needs access to the sampling loop. This one does not — so the plate below is wired to real language models and does the real thing.

Plate N

Live: mark a model you have no access to

checking for a live endpoint…
This is the genuine construction, not a simulation of it: real continuations from a real model, selected by a real keyed statistic, with a control document built from the same pools by taking an arbitrary draft each time. Why selection has to be done per segment: picking the best of k whole documents buys only about √(2·ln k) ≈ 1.4σ at k = 8, no matter how long the document is. Selecting S times independently compounds that to roughly √S · √(2·ln k), which is what turns an unusable 1.4 into a decisive 4. That is exactly the "inference-time scaling" in SAEMark’s title, and it is paid for in API calls: S × k of them. One caveat on fidelity — the published method scores candidates with sparse-autoencoder features rather than the g-values used here; the selection logic is identical, the feature is not.
The common thread Green lists bias the logits. Gumbel biases the dice. Tournament biases the referee. Semantic marks bias which sentence is accepted. Post-hoc marks bias which draft is shipped. Every one of them is the same move: take a decision the model was free to make either way, and make it a function of a secret.
14 — Read this part twice

What a detection actually proves

The technology is sound. The inferences people will draw from it mostly are not. Anthropic's own documentation spends more words on this than on the mechanism, and it is worth restating: a positive detection says Claude was probably involved in producing these words. It does not say who wrote the document.

Plate M

Claim checker

what you may and may not say out loud
The p-value is exact and the inference is not. Everything above the statistic — "therefore the student cheated", "therefore this article is fake" — is a leap the mathematics does not license, and no amount of z will license it.
15 — How three years happened

From "obviously impractical" to shipped

2022

Aaronson's proposal

While at OpenAI, Scott Aaronson describes pseudorandomly-seeded sampling as a way to mark generated text. The idea that becomes the Gumbel family.

2023

KGW — a watermark for large language models

Kirchenbauer, Geiping, Wen and colleagues publish green lists and the z-test. The field has a baseline, two knobs, and an obvious weakness.

2023

Paraphrase breaks everything

Krishna et al. demonstrate that running text through a paraphrase model defeats essentially all detectors of the day. The attack is cheap and requires no knowledge of the scheme.

2023

Distortion-free constructions

Kuditipudi et al. formalise watermarks that provably do not change the output distribution — quality objection answered on paper.

2024

SynthID-Text in Nature, and in production

DeepMind publishes tournament sampling with a live evaluation over ~20 million Gemini responses: no statistically significant change in user thumbs-up/down. "Impractical" stops being a defensible position.

2024

SemStamp

The watermark moves into embedding space via LSH and rejection sampling — the first serious answer to paraphrase.

2025

Payloads and post-hoc marking

Provably robust multi-bit watermarking (USENIX Security) embeds identifiers; SAEMark (NeurIPS) marks black-box API output by selection alone.

2026

Regulation, then rollout

The EU AI Act's Article 50 transparency code of practice makes marking a compliance question. Anthropic announces text watermarking for models released after 2 August 2026 — worldwide, not only in the EU — and confirms it is a version of SynthID-Text. A detection API is stated as forthcoming.

2026

The counterattack begins

PASA claims distortion-freedom and paraphrase resistance together. A layer-inflation attack pushes SynthID's mean g-value back toward 0.5 by re-running the tournament adversarially. Normal service resumes.

16 — Closing

A whisper, repeated three hundred times

What makes this technique strange is that there is no artefact to find. There is no hidden character, no metadata, no zero-width space you can strip. The words are exactly the words the model would plausibly have written, one at a time, each individually unremarkable. The mark exists only in aggregate — a bias so slight that no single choice betrays it, and so persistent that three hundred choices cannot hide it.

Which is also why it is fragile in exactly the way its makers say it is. Rewrite the words and there is nothing left, because the words were the signal. The mark survives copying, formatting, quoting and moderate editing, and dies to a determined rewrite — a threat model that fits provenance and does not fit enforcement.

Whether that distinction survives contact with a school disciplinary committee is not a question anybody has answered with mathematics.

Sources

References

  1. AnthropicHow Claude marks AI-generated content (August 2026). The announcement and the technical follow-up confirming a SynthID-Text-family design, a one-bit payload, and C2PA content credentials for non-text files.
  2. Kirchenbauer, Geiping, Wen, Katz, Miers, GoldsteinA Watermark for Large Language Models, ICML 2023. Green lists, δ, γ, the z-test.
  3. Aaronson — talk and notes on watermarking GPT outputs, 2022. The pseudorandom-sampling idea.
  4. Kuditipudi, Thickstun, Hashimoto, LiangRobust Distortion-free Watermarks for Language Models, 2023.
  5. Dathathri et al.Scalable watermarking for identifying large language model outputs, Nature 2024. SynthID-Text: tournament sampling, distribution-preservation proof, and the ~20M-response live evaluation. Reference implementation is public.
  6. Krishna, Song, Karpinska, Wieting, IyyerParaphrasing evades detectors of AI-generated text, but retrieval is an effective defense, NeurIPS 2023. The DIPPER attack.
  7. Hou et al.SemStamp: A Semantic Watermark with Paraphrastic Robustness for Text Generation, NAACL 2024.
  8. Ai & HePASA: A Principled Embedding-Space Watermarking Approach for LLM-Generated Text under Semantic-Invariant Attacks, ICML 2026.
  9. Qu et al.Provably Robust Multi-bit Watermarking for AI-generated Text, USENIX Security 2025.
  10. Yu et al.SAEMark: Multi-bit LLM Watermarking with Inference-Time Scaling, NeurIPS 2025.
  11. Liu et al.A Survey of Text Watermarking in the Era of Large Language Models, ACM Computing Surveys 2024.
  12. Kaito Sugimoto — the Zenn article this explainer was built from, including the Gumbel worked example and the tournament-sampling walkthrough.