How Does Claude's Invisible Watermark Work?

Anthropic has started weaving an invisible, machine-readable mark into everything Claude writes, and it has not published how the mark actually works. Anthropic's own support documentation confirms the shape of the problem and the shape of the limits, but not the mechanism. Based on the published academic literature on large language model watermarking, here is our reasoned hypothesis for what is likely happening under the hood.

This blog is our own theory, written by matching Anthropic's disclosed behavior against known, published watermarking research. It is not confirmed by Anthropic.

What did Anthropic actually disclose?

Ars Technica reported that Anthropic is now marking Claude's output to comply with the EU AI Act, which requires AI providers to watermark AI-generated or manipulated content. In Anthropic's words, quoted in that piece: "We're adding marking to Claude's output to comply with the EU AI Act, and other labs are taking similar steps. It's hard to identify AI-generated text, and this gives people better tools for identification."

Anthropic's support documentation fills in the rest of the disclosed facts:

• The mark covers text from Claude, Claude Code, Claude Cowork, Claude Tag, and the Claude Platform API, across every supported model, worldwide.
• For text, Claude "weaves an imperceptible watermark directly into the text itself. You won't see it, and it doesn't change the meaning, quality, or readability." Files (.svg, .png, .jpg) get a separate, unrelated mechanism: signed C2PA provenance metadata, an existing open industry standard, not a mystery to reverse-engineer.
• The mark is a "machine-readable" signal: software can detect it, people cannot.
• A mark appears even when Claude only edited, translated, or summarized text a person already wrote. Attribution reflects that Claude touched the text, not that Claude originated the ideas.
• Anthropic explicitly lists what breaks it: heavy editing, paraphrasing, translation, and format conversion can all remove the signal, and screenshots strip it entirely. Very short passages "may lack reliable signals."
• Detection mechanics are not published yet. Anthropic says specifics are "coming."

Why does this look like a statistical watermark, not a hidden character?

"Imperceptible" and "doesn't change the meaning, quality, or readability" could describe two very different tricks. One is old and crude: hide zero-width Unicode characters or steganographic whitespace inside the text. The other is newer and more plausible: don't touch the characters at all, bias which words the model picks in the first place.

The disclosed explanations points to the second option to be the likely implementation. Hidden Unicode characters are binary: either the exact character survives a copy-paste, or the mark is gone. That does not match Anthropic's description of a gradient of robustness, surviving light edits, degrading under heavy edits, failing under paraphrase and translation. A gradient like that is the signature of a statistical watermark: a signal spread thinly across hundreds of individual word choices, where each edit removes a little evidence rather than deleting the whole thing at once.

This exact statistical approach has a name in the research literature, and it is the leading explanation for what Claude is doing.

How does a keyed green list nudge the model's own choices?

The foundational scheme here comes from Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein, in their 2023 paper "A Watermark for Large Language Models". At each generation step, a keyed hash of the preceding token (or tokens) pseudorandomly splits the entire vocabulary into a "green" list and a "red" list, commonly a 25/75 or 50/50 split. Before sampling the next word, the model adds a small logit bias, a nudge to the raw score it assigns each candidate word before that score is converted into a probability, to every green-listed token. The model still tends to say whatever it was going to say. It just leans toward the green option when several choices were roughly equally good.

That "roughly equally good" condition is the whole trick, and it is why Anthropic can honestly claim no quality cost.

Why doesn't the bias cost quality?

The nudge is soft, not a hard rule, and that matters. When the model is genuinely torn between several synonyms or phrasings, entropy is high, and a small green bias is enough to tip the choice. When the model is nearly certain (the answer to "the capital of France is" carries almost all its probability on one token), the bias is too small to overturn that near-certainty, and the model outputs the correct, unwatermarked word regardless of color. The signal only expresses itself exactly where a nudge is harmless: synonym choice, word order, phrasing. That is the mechanism behind Anthropic's "doesn't change the meaning, quality, or readability" claim, and it is precisely why the same research paper reports negligible quality loss at typical settings.

How does the bias accumulate across a response?

Run that process across a full response and the small leans compound. Nothing about any individual word looks unusual. But across a few hundred tokens, a text with no watermark should land roughly at the baseline green rate (about 50% for an unbiased 50/50 split, lower for a smaller green list), while a watermarked text lands noticeably above it, commonly 70 to 80% depending on how much genuine choice the response contained.

How would you detect it without needing the model at all?

Detection needs only the secret key, not the model itself. A detector re-derives the green list at each position using the same keyed hash, counts what fraction of the actual output landed green, and runs a one-proportion statistical test (a z-test) against the expected baseline rate. Over a few hundred tokens, a real gap between "50% expected" and "78% observed" produces a p-value far past any reasonable doubt, without ever touching Claude's weights. That is exactly the kind of lightweight, model-independent check a company would build to comply with a regulation, and it lines up with Anthropic's note that detection specifics are still being finalized rather than shipped as a public tool on day one.

Why doesn't editing Claude's own draft erase the mark?

A mark persists even when a person heavily edits or only partially uses Claude's output. In a statistical scheme, each token is one small, independent piece of evidence. Editing twenty words out of five hundred removes twenty votes and leaves the other four hundred eighty intact, so the statistical gap barely narrows. An attacker, or an ordinary user proofreading a draft, would have to rewrite a large fraction of the text before the signal genuinely disappears, and at that point they have done most of the writing themselves.

This is also where a design trade-off shows up in the literature: hashing on a wider window of prior tokens (a larger context, in the paper's terms) is harder for an attacker to reverse-engineer, but a single edit corrupts the hash seed at two positions instead of one, so it is more brittle to editing. A narrower or fixed context, the extreme case explored in Zhao et al.'s 2023 paper "Provable Robust Watermarking for AI-Generated Text" (the Unigram-Watermark), is more robust to edits and paraphrasing at the cost of being easier to reverse-engineer. Anthropic hasn't said which trade-off it made.

Why do paraphrasing, translation, and screenshots break it?

Anthropic's own list of what defeats the mark: heavy editing, paraphrasing, translation, format conversion, is exactly the known weak point of every scheme in this literature, for the same underlying reason. The watermark lives in the statistics of a specific token sequence chosen under a specific key. Run that text through a different model to paraphrase it, and the new model generates an entirely new token stream with no relationship to the original green lists. The green-token rate collapses back toward the baseline, and detection fails. Translation does the same thing by definition, since it produces tokens in a different vocabulary entirely. Semantic watermarking - embedding a signal in sentence-level meaning rather than exact token identity - is the active research response, but it is markedly less mature than token-level watermarking.

What about cryptographic or tournament sampling techniques?

Kirchenbauer et al.'s original biased-sampling scheme is the most cited version of this idea, but it is not the only one. Here are some other related works.

• Scott Aaronson, working with OpenAI, described a cryptographic approach that uses the secret key to derandomize which token gets sampled from the model's own existing probability distribution, rather than modifying that distribution. In expectation across keys, the output distribution is mathematically identical to the unwatermarked one.
• Kuditipudi, Thickstun, Hashimoto, and Liang formalized this direction in their 2023 paper "Robust Distortion-Free Watermarks for Language Models," pairing a similar sampling trick with an edit-distance-tolerant detection method built to survive insertions and deletions.
• Google shipped a related idea, a "tournament sampling" scheme called SynthID-Text (Dathathri et al., published in Nature in 2024), into Gemini at production scale. That is real-world evidence a distortion-free-style watermark can run inside a major consumer chat product without a noticeable quality hit, which is the closest public precedent we have for what Anthropic may be doing.

Here's how the three leading candidates stack up against what Anthropic actually disclosed:

Candidate mechanism	How it nudges output	Quality cost	Survives light edits	Breaks on paraphrase or translation
Hidden Unicode or steganographic characters	Embeds non-visible characters or spacing	None to the visible text, but binary and fragile	Usually no, most edits or reformatting strip it entirely	Yes, immediately
Kirchenbauer-style green-list bias	Adds a small logit boost to a keyed subset of tokens	Very low, concentrated on genuine synonym-level choices	Yes, degrades gradually with edit volume	Yes, by design
Distortion-free keyed sampling (Aaronson / Kuditipudi / SynthID-Text)	Derandomizes which token is sampled from the model's own distribution	Effectively none in expectation	Yes, with edit-distance-tolerant detection	Yes, by design

What do we still not actually know?

Anthropic marks Claude's text output with an imperceptible, machine-readable signal, driven by EU AI Act compliance, and that signal degrades under heavy editing, paraphrasing, translation, and format conversion while surviving lighter edits. Not confirmed: which specific scheme, which green-list fraction or bias strength, which context window, or whether Anthropic combined multiple techniques or built something not described in the public literature at all. Anthropic has said detection specifics are still coming. When they publish, we will find out how much of this holds up.

Why does this matter beyond Claude?

The broader lesson generalizes past any one vendor's watermark. Verifying whether content is trustworthy, whether it is a paragraph of AI-generated text or an automated action taken inside a production system, works best when the evidence is built into the process itself rather than bolted on after the fact, and when a human can still audit exactly what happened and why. We've written before about building trust in AI operations and what trust and reliability actually require from enterprise agents, and the same principle holds here: verification has to be architectural, not an afterthought.

That is the same principle behind how NeuBird AI's Production Ops Agent operates. Every investigation and every action it takes inside your environment carries a full audit trail, gated by human-in-the-loop approval, so nothing your infrastructure does is a black box either.