How Claude's Text Watermark Works: It's in the Words It Picks

0:00Two Paragraphs, One Watermark: text watermarking

Two paragraphs on screen. Both are the opening of a cover letter for the same developer job. They say the same thing, in plain, normal English. Neither one looks strange. One is watermarked by Claude, and one is not. Can you see it? Since August, every piece of text Claude writes carries a watermark, everywhere in the world, and you can't turn it off. Look closely. There's no hidden character, no invisible space and no odd word. Paste both into a code editor and you'll see only ordinary letters. Claude always has a few words to choose from. The watermark is the choice it made. You can't see it by reading. A checker that holds Anthropic's secret key can. In this video: how Claude picks a word, how a secret key turns those picks into a signature, how the checker reads it back, and what removes it. At the end, we come back to these two paragraphs, and to what a match really proves.

1:13How Claude Picks a Word: tokens and sampling

Back to the cover letter. Claude has written "I am writing to apply for the", and now it has to pick the next word. First it gives every word it knows a score. Almost all of them score close to zero. A few score high: "position", "role", "job". Claude turns those scores into odds. "position" gets the biggest share, "role" a little less, and "job" less again. Then Claude picks one at random, weighted by those odds. Usually that's the favourite, but not always. That random pick is why you get a slightly different answer each time you ask the same question. Strictly speaking, Claude picks tokens, which are a word or a piece of a word. We'll keep calling them words. A cover letter is a few hundred of these picks in a row. At most of them, several words would fit, and any of them reads fine. Those free choices are where the watermark goes. Next: what decides the pick once the watermark is on.

2:27The Key: SynthID-Text tournament sampling

With the watermark on, Claude's odds don't change: still "position", "role", "job". What changes is how it picks. Anthropic holds a secret key. It's a long random number that nobody outside Anthropic has. The key is mixed with the last few words, "apply for the". That mix gives every candidate word a score. The score has nothing to do with how good the word is. Anthropic says its watermark is a version of SynthID-Text, which Google published. This is how Google's version uses the scores. First, Claude draws a handful of candidates from its normal odds, so likely words get drawn more often. For example: "position", "role", "role", "job". They play off in pairs. In each pair, the word with the higher key score wins. The winners meet again, until only one is left. Say "role" wins. It was a good word anyway, because it came from Claude's own odds, so the reader notices nothing. With the same key and the same last few words, the scores come out the same every time. Whoever holds the key can work them out again later. This happens at every free choice in the cover letter. Each pick leans a little towards the words the key scores high. No single word gives it away. The lean only shows up when you count, and that's the checker, which comes next.

4:13The Checker: detecting the watermark

The checker gets the text and nothing else: no chat history and no account. It goes through the cover letter word by word. For each word, it takes the few words before it, mixes them with the key, and works out the same score Claude used. Then it asks one question about each word: did the word that's actually there score high? A person writing knows nothing about the key, so their words score high about half the time, by chance. Claude's words won play-offs on that very score, so they score high more often than half the time. One word proves nothing, because a person's words score high half the time too. Ten words prove very little. So the checker keeps a running count. Over a few hundred words, a person's cover letter stays near half, and Claude's climbs clearly above it. The checker gives a probability, a score from low to high. The higher the score, the more likely Claude wrote it. Short text doesn't give it enough words to be sure. The two cover letters from the start are a few hundred words each, which is long enough to get an answer. The watermark is in the words themselves, so it stays as long as the words stay. Next: what happens when the words change.

5:47What Keeps It, What Wipes It: edits, translation and code

Copy and paste the cover letter: the words are the same, so the mark is the same. Fix a few words by hand: most of the words stay, so most of the count stays. The mark gets weaker, but it doesn't go away. Ask Claude to "make it sound more human": Claude writes new words, but it picks them with the same key, so the new words carry the mark too. Ask Claude to translate it into another language: same thing. Every new word is still Claude's pick, made with the key. Paste it into a different chatbot and ask for a rewrite: that model picks its own words without Anthropic's key. The new words don't lean anywhere, and the count drops back to about half. Rewrite every word yourself: same result. The words are yours now. Code is different. Often only one token is correct, like a bracket or a keyword. With no choice to make, there's nothing to mark. Comments and variable names are free choices, so that's where the mark sits. Anthropic says the watermark's effect on code is negligible. So the mark lives in the words Claude picked with the key. While those words stay, the mark stays. Once someone else picks the words, it's gone. Next: when the checker does find a match, what does that actually prove?

7:26What a Match Proves: provenance and the EU rule

Back to the two cover letters. Anthropic's checker would give letter A a low score, and letter B a high one. Here's what happened. The same person wrote both. They typed letter A themselves. For letter B, they gave Claude their own draft and asked it to polish it. Same person, same job, same ideas. All the checker can see is that Claude picked letter B's words. So a match means Claude chose these words. It doesn't say whose ideas they were, who sent the letter, or which account asked. And no match doesn't prove a person wrote it. It could be another chatbot's work, or a full rewrite. Who can run the checker? For now, not you. Anthropic gives it to a short list: regulators, police, news outlets, fact-checkers, researchers, schools and some companies. Why does it exist at all? A new EU rule asks AI companies to mark the text their models write. Anthropic turned the watermark on for everyone, everywhere. OpenAI marks ChatGPT's text only in the EU. Claude always has a few words to choose from. The watermark is the choice it made, and it tells you who chose the words, not who wrote the letter.