Since August 2026 the text Claude produces carries a machine-readable watermark. Not an invisible character, not a hidden metadata field — nothing has been added to the text at all. What was changed is the source of the randomness the model uses to pick each word.
This page implements the whole family of techniques — green lists, Gumbel sampling, SynthID's tournament, semantic hashing, multi-bit payloads — in a toy language model you can drive. Turn the key, generate, then try to wash the mark out.
The toy model is there because every one of those schemes needs to reach inside the sampling loop, and no API will let you. One technique doesn't need that — and the last plate runs it against real language models, live.
With an image you can nudge pixel values by a fraction of a shade and no eye will catch it. A sentence has no such slack: swap one word and the meaning moves. For years that was the standard argument for why text watermarking could not work.
The argument has a hole in it. A language model does not emit the next word; it emits a probability distribution over the next word, then draws from it. At a great many positions that distribution is genuinely flat-ish — "the river slid / drifted / turned past the town" are all fine. The model is effectively tossing a weighted coin, and nobody downstream can tell which face came up or whether the toss was fair.
That is the room. The watermark does not add anything to the text. It replaces the coin.
Scroll that control down to a factual position and the entropy goes to zero. This single fact governs everything that follows: watermark strength is not a property of the algorithm, it is a property of the text. A page of flowing prose carries a strong mark. A page of arithmetic carries none.
The founding trick, and still the clearest one to reason about. Before each token, hash the preceding few tokens together with a secret key. Use that hash to split the entire vocabulary in two: a green list and a red list. Then quietly add a bonus to every green word's logit.
Two knobs. γ is how much of the vocabulary is green — a half, a quarter. δ is how hard the thumb presses on the scale. Because the split is re-drawn from the preceding tokens at every single step, the green list is a different arbitrary half of the dictionary at every position, and no fixed word is ever "the AI word".
A third knob hides in the seed: H, how many previous tokens go into the hash. The original paper uses one. This page uses four, matching SynthID-Text — a wider window means far more distinct contexts, which matters enormously once you see the detector in action. It also makes the mark more brittle, since editing one token corrupts the context of the next H as well.
The consequence that makes it useful: detection needs the key and nothing else. Not the model, not the prompt, not the logits. Anyone holding the key can recompute every green list from the text itself.
The detector never sees the model. It takes the text, recomputes every green list from the key, counts how many words landed green, and asks the oldest question in statistics: could a fair coin have done this?
A z of 4 means the green count sits four standard deviations above what chance allows — a one-in-thirty-thousand coincidence. A z of 8 is one in 10¹⁵. There is no machine learning in the detector; it is a proportion test you could run in a spreadsheet, which is exactly why it is trustworthy in a way that "AI detector" classifiers are not.
Paste anything into the bench below. Your own writing will sit near zero, because your writing has no relationship to the key.
Adding δ to a logit is not free. Words that should have been rare become less rare. Over a long passage that is a real, measurable change in what the model is willing to say — and the first place it hurts is precisely where quality matters most.
The fix is a genuinely elegant piece of sleight of hand. Do not touch the distribution at all. Touch the dice.
Sampling from a distribution requires a source of randomness. Nothing says that source has to be true randomness — a pseudorandom stream derived from a secret key is, to any observer without the key, indistinguishable from noise. Sample with those numbers instead, and the sequence of draws now correlates with a stream only the key-holder can regenerate. Methods built this way are called distortion-free.
Imagine playing Monopoly, and instead of rolling dice you read digits from π, starting a million places in. The game plays identically. But lay out every move afterwards and compare it with π, and you can prove which game was played. Anthropic's analogy for distortion-free watermarking, August 2026
The cleanest distortion-free scheme. Give every candidate token a pseudorandom number rᵢ ∈ [0,1) derived from the key and the context, then pick the candidate maximising rᵢ1/pᵢ.
The exponent does the work. A high-probability token has 1/pᵢ small, so rᵢ1/pᵢ stays close to its own r — it barely needs luck. A rare token is raised to a huge power, crushing its score to near zero unless it drew a number startlingly close to 1. Weigh those two effects and the win probability comes out at exactly pᵢ. No approximation, no distortion.
Detection inverts it. Recompute rᵢ for the token that actually appears. In human text those numbers are just noise: uniform, mean 0.5. In watermarked text every token is a winner, and winners drew high. The mean drifts above 0.5, and the same z-test as before applies.
Given the key and the context, the winner is fixed. There is no randomness left to draw. Ask the same question twice and Gumbel returns the same sentence twice.
SynthID-Text keeps real randomness and spends the key somewhere else entirely: on refereeing. Draw 2m candidates from the true distribution, then run a knockout bracket in which the key decides every match.
Why the distribution survives: entries are drawn from p, with replacement. A word with probability 0.6 walks into the bracket holding roughly 60% of the seats. It wins more often because it is there more often, not because the key favours it. DeepMind proved token-level distribution preservation exactly for the two-candidates-per-match, binary-g configuration.
Detection is the same shape as everything else on this page: recompute all m g-values for every token in the text and average them. Under the null that mean is 0.5. A tournament survivor is a token that won m coin-flip matches it was chosen to win, so the mean climbs — and with m layers per token, one token now donates m bits of evidence instead of one.
And unlike Gumbel, real sampling is still in the loop. Regenerate the same prompt and you get a genuinely different answer that is still watermarked. That is the reason this is the family that shipped.
A toy language model with real per-position distributions. Pick a scheme, turn the key, generate — then click any word to see the distribution it was drawn from, what the key did to that draw, and whether the outcome actually changed.
Click a word in the output to open it up.
Every claim about watermark strength is really a claim about how much freedom the text had. Switch the lab to Factual reference and the z-score falls through the floor — not because the algorithm failed, but because there was nothing to bias.
Anthropic's own documentation makes the point with an example: in "Newton's principal work is Principia …", the only word that can follow is Mathematica. There is no second candidate, so there is no nudge, so that token contributes pure noise to the detector — it still gets counted, diluting the statistic. Low-entropy passages do not merely fail to help; they actively drag the average back toward chance.
Same for arithmetic, quoted material, code, structured formats, and — critically — anything where a human wrote most of the words and the model only edited. This is why the honest failure mode of text watermarking is a false negative, and why short texts are hopeless: 20 tokens simply cannot outvote the noise.
Every scheme on this page — green lists, Gumbel, tournament — encodes the mark in the surface identity of tokens. Replace the tokens and keep the meaning, and the evidence goes with them. This is not a bug anyone has fixed; it is the open front of the field.
The 2023 result that set the agenda: run generated text through a dedicated paraphrase model and essentially every detector of the day collapsed. The attack needs no key, no knowledge of the scheme, and no skill — a second language model rewriting the passage is sufficient.
The bench below runs four attacks against a live watermarked passage. Watch which ones matter.
A detector is a threshold on z. Move it down and you catch more marked text and start accusing innocents; move it up and you miss real cases. There is no setting that does both, and the arithmetic is completely explicit.
If paraphrase kills token-level marks, stop marking tokens. Mark meaning. A paraphrase preserves the sentence's position in embedding space almost by definition — so put the watermark there instead.
SemStamp works a sentence at a time. Generate a candidate sentence, embed it, hash the embedding with locality-sensitive hashing — random hyperplanes through the space, each one splitting it in half — and read off which cell the sentence landed in. The key declares some cells valid. If the candidate landed in an invalid cell, throw it away and generate another. Repeat until it lands in a valid one.
Now paraphrase the sentence. Its vector moves — but only a little, because it still means the same thing. Unless the move crosses a hyperplane, the cell is unchanged and the watermark survives. PASA (2026) formalises the trade-off between detection accuracy, robustness and distortion, and pushes the same idea into a distortion-free framework.
The catch is written into the geometry: sentences near a boundary are fragile, rejection sampling costs real generation compute, and the whole thing depends on an embedding model that both parties agree on.
Everything so far answers one bit: marked, or not. Multi-bit watermarking embeds an actual payload — an account ID, a timestamp, a session — into the same statistical slack.
The construction is a natural extension. Hash the context to assign each text position to one slot of the payload. The green list at that position now depends on the value of the bit that slot is carrying. Detection reverses it: bucket the tokens by slot, and for each slot ask which bit hypothesis explains the green counts better. Error-correcting codes mop up the damage from editing.
This is the version that makes people nervous, and it is worth being precise about who has shipped it: nobody, publicly. Anthropic's documentation states explicitly that its watermark and key contain no information identifying a person, an organisation, or a conversation — the design is deliberately one bit wide. The capability nonetheless exists in the literature, and the gap between "we chose not to" and "it cannot be done" is worth keeping clear in your head.
Every scheme so far reaches into the sampling loop. If all you have is an API that returns finished text, none of them apply.
The post-hoc answer is selection instead of intervention. Ask the API for several completions. Push each through a feature extractor — SAEMark uses a sparse autoencoder, the same instrument interpretability researchers use to read features out of activations — and compute a statistic. Keep the completion whose statistic lands nearest the target the key specifies. Discard the rest.
Nothing inside the model was touched, so it works on any black box, in any language, on code. The cost is blunt: you paid for k completions and shipped one, and the mark is only as strong as the spread among the candidates you happened to draw.
Everything above this point ran on a toy model, because every scheme above this point needs access to the sampling loop. This one does not — so the plate below is wired to real language models and does the real thing.
—
The technology is sound. The inferences people will draw from it mostly are not. Anthropic's own documentation spends more words on this than on the mechanism, and it is worth restating: a positive detection says Claude was probably involved in producing these words. It does not say who wrote the document.
While at OpenAI, Scott Aaronson describes pseudorandomly-seeded sampling as a way to mark generated text. The idea that becomes the Gumbel family.
Kirchenbauer, Geiping, Wen and colleagues publish green lists and the z-test. The field has a baseline, two knobs, and an obvious weakness.
Krishna et al. demonstrate that running text through a paraphrase model defeats essentially all detectors of the day. The attack is cheap and requires no knowledge of the scheme.
Kuditipudi et al. formalise watermarks that provably do not change the output distribution — quality objection answered on paper.
DeepMind publishes tournament sampling with a live evaluation over ~20 million Gemini responses: no statistically significant change in user thumbs-up/down. "Impractical" stops being a defensible position.
The watermark moves into embedding space via LSH and rejection sampling — the first serious answer to paraphrase.
Provably robust multi-bit watermarking (USENIX Security) embeds identifiers; SAEMark (NeurIPS) marks black-box API output by selection alone.
The EU AI Act's Article 50 transparency code of practice makes marking a compliance question. Anthropic announces text watermarking for models released after 2 August 2026 — worldwide, not only in the EU — and confirms it is a version of SynthID-Text. A detection API is stated as forthcoming.
PASA claims distortion-freedom and paraphrase resistance together. A layer-inflation attack pushes SynthID's mean g-value back toward 0.5 by re-running the tournament adversarially. Normal service resumes.
What makes this technique strange is that there is no artefact to find. There is no hidden character, no metadata, no zero-width space you can strip. The words are exactly the words the model would plausibly have written, one at a time, each individually unremarkable. The mark exists only in aggregate — a bias so slight that no single choice betrays it, and so persistent that three hundred choices cannot hide it.
Which is also why it is fragile in exactly the way its makers say it is. Rewrite the words and there is nothing left, because the words were the signal. The mark survives copying, formatting, quoting and moderate editing, and dies to a determined rewrite — a threat model that fits provenance and does not fit enforcement.
Whether that distinction survives contact with a school disciplinary committee is not a question anybody has answered with mathematics.