How Does Claude Watermark Work ? Claude Ai Watermark Explained

On 2 August 2026, new transparency obligations under Article 50 of the EU Ai Act kicked in across the EU, with consequences that reach far beyond Europe.

One of the big changes is that providers of generative Ai systems are expected to use technical methods to mark Ai generated content in a way that machines can detect, even when a human reader cannot see anything unusual.

Anthropic was one of the companies that signed the EU Code of Practice on Transparency of Ai Generated Content. Then publicly explained that new Claude models would generate text containing a watermark and that older models would gradually follow.

But when we hear the word watermark, most of us imagine something added to a document.

Perhaps a logo across an image. Hidden metadata inside a file. An invisible character buried between words.

Claude’s text watermark is none of those things.

Nothing is added to the finished text. There are no secret characters to find and delete. Instead, the watermark is created while Claude is writing by subtly influencing the choices it makes between possible words.

To understand why that matters, we first need to understand how Ai text detection worked before watermarking.

How Traditional Ai Text Detectors Work

Traditional Ai detectors such as the tools people have been using to check essays, articles and other written content do not have a secret fingerprint hidden inside the text to look for.

They have to make an educated statistical guess. They analyse characteristics of the writing and look for patterns associated with machine generated text. That might include Oxford commas, em dashes, eight to twelve word sentences, repeated sentence structures, predictable transitions, familiar Ai phrases and other wording that often gives Ai writing away.

Anthropic gives a wonderfully simple example. Ai models have become rather fond of constructions such as “this isn’t X, it’s Y” and apparently use words such as “quietly” rather more often than you might expect.

A conventional Ai detector can notice patterns like these.

But noticing that something looks like Ai writing is fundamentally different from detecting a watermark. Claude’s watermark introduces another source of evidence entirely.

Statistical Watermarking Came Before Claude

The idea of statistically watermarking language model output did not suddenly appear with Claude in 2026.

In 2023, John Kirchenbauer and fellow researchers published A Watermark for Large Language Models, describing a system that could place an invisible statistical signal into generated text. The basic idea is surprisingly easy to understand. When an Ai model writes, it does not normally have only one possible word available. Imagine it has reached:

“The weather outside was…”

Perhaps cold, grey, awful, wet and miserable could all make sense.

A watermarking system can use those moments of choice to create a pattern.

What Are Green Tokens and Red Tokens ?

This is where the famous green list and red list explanation comes from.

Technically, language models work with tokens rather than simply words. A token might be a complete word, part of a word or punctuation. But for simplicity, we can think of them as words here. In the Kirchenbauer approach, possible tokens are pseudorandomly divided so that some belong to a preferred green list. The model is then given a subtle bias towards choosing from that green list. It does not have to choose green every time. That would make the watermark far too obvious. Instead, across a sufficiently long piece of writing, the generated text should contain an unusually high number of secretly preferred choices.

And crucially, a word is not simply green forever.

The preference can depend on context. The same word can therefore be preferred at one point in a piece of text and not preferred somewhere else. That is what makes this a statistical pattern rather than a secret vocabulary of suspicious words.

What Is a Z Score ?

Once you understand green and red tokens, the idea of a z score becomes much easier.

The detector knows how many green choices it would normally expect to appear by chance.

It then counts how many preferred choices actually appear in the text. The z score essentially asks: Is the number of green choices so unusually high that it is unlikely to have happened by chance ?

The further the observed pattern moves away from what we would normally expect, the stronger the statistical evidence becomes. Kirchenbauer’s published research uses z scores when evaluating this green list watermarking approach.

But this is where many explanations of Claude’s new watermark start to become muddled.

Claude is not simply using the Kirchenbauer green list system.

Claude Uses Google DeepMind’s SynthID Text

Anthropic says Claude’s watermark is a version of SynthID Text, a watermarking method developed by Google DeepMind and published in Nature in 2024.

It follows the same broad principle. Use the choices available while an Ai model is generating text to create a statistical pattern that ordinary readers cannot see. But SynthID Text changes how those choices are made.

Instead of simply describing the process as putting possible words into green and red pools and nudging the model towards green, SynthID Text uses pseudorandom g values and Tournament sampling.

Anthropic does not publish its secret key or every implementation detail of Claude’s production watermark. The explanation below describes the published SynthID Text mechanism that Claude’s watermark is based on rather than pretending we can see inside Anthropic’s private production system.

Where Does Hugging Face Fit In ?

You may also come across Hugging Face when researching SynthID Text but it is important to understand where it actually fits.

SynthID Text needs secret watermarking information during generation so that its pseudorandom g values can later be reproduced for detection.

Developers can implement SynthID Text through Hugging Face Transformers, where the watermarking configuration is supplied to the generation process. This gives developers a practical implementation of the SynthID technique rather than merely a description of the mathematics in a research paper.

But Claude does not need Hugging Face for this to work.

Anthropic uses its own version of the SynthID Text approach for Claude and keeps its production watermarking key private. There is no public evidence that Claude’s watermark is implemented through Hugging Face. 

Hugging Face helps us understand how developers can actually implement SynthID Text but it should not be confused with the infrastructure Anthropic uses to watermark Claude.

Kirchenbauer 2023 → green / red  + z score

↓

Google DeepMind 2024 → SynthID Text

↓

Hugging Face → public implementation developers can work with

↓

Anthropic 2026 → Claude uses its own version of SynthID Text

I recently looked at what actually happened when OpenAI’s models escaped their sandbox and reached Hugging Face.

How Claude’s Watermark Actually Works

Let’s start with Claude writing normally.

Claude looks at each word that has already been written and calculates probabilities for what could sensibly come next.  Suppose several different words would all work.  This is where the watermarking process gets involved.  The SynthID Text system can be understood like this:

Secret key + recent text → pseudorandom seed → g values → Tournament sampling → chosen word

Let’s break that down.

1. The Secret Key

The watermarking system has a secret key.

That key matters because the watermark is not supposed to be a pattern that anybody can simply recreate by looking at the text.  Without the key, an outside observer cannot reliably reconstruct which tokens were favoured at each point.

In the published SynthID research a secret watermarking key is combined with recent text context to generate pseudorandom information used during token selection.  

Anthropic confirms that Claude also uses a key but has not published the size or value of Claude’s production watermarking key. The key is not the watermark itself.  It is the secret used to generate a large sequence of context dependent decisions.  The same key can produce different token preferences at different positions, depending on the preceding text.

This also means there is no universal list saying:

apple = green

extraordinary = red

The preference changes with context.  The detector needs enough text to make a reliable decision.  It uses the secret key to check whether the word choices show the expected watermark pattern.  A short passage does not give it enough word choices to tell the difference between:

• a real watermark
• normal random word choices

Anthropic says detection does not work well on small samples because there are fewer word choices and therefore less information to analyse.  Some reports describe roughly 200 tokens, or about 150 words, as a useful reference point but Anthropic does not give that specific threshold in its public explanation.  That does not mean short text has no watermark signal.  It means there may not be enough text to detect that signal reliably.

2. Pseudorandom Does Not Mean Truly Random

The system then produces information that appears random but is repeatable when you have the same key and input.  Think of it as a secret mathematical mixer.  Put the same secret key and the same relevant context into the process and it can reproduce the same pseudorandom information.

A keyed cryptographic construction such as HMAC SHA256 is a useful example of the kind of secret keyed mixing process people may be familiar with.

However,  Anthropic has not publicly said that Claude’s production watermark specifically uses HMAC SHA256, so it should not be confused with the name of Claude’s actual secret mechanism.

3. The g Values

Now we reach the slightly strange sounding part.

g values.

SynthID uses pseudorandom watermarking functions that assign g values to candidate tokens.  In the main published experiments, Google DeepMind primarily used g values drawn from a Bernoulli 0.5 distribution, producing values of 0 or 1. For a beginner, there is a very easy way to picture this.

Think:

1 = green

0 = red

That is only an analogy.  SynthID is not literally maintaining permanent green and red word lists.  But it gives us the right mental picture. The model is biased to choose green listed tokens over red-listed tokens for that particular context.

What Is a Bernoulli Trial ?

Think of a Bernoulli trial as a simple digital coin toss. It only has two possible outcomes:

1 (Yes / Heads / Unlocked)

0 (No / Tails / Locked)

How the Bernoulli “Coin Flip” Runs the Tournament

 Inside the published SynthID system, pseudorandom Bernoulli g values act rathe like a high speed coin flipping machine that produces 1s and 0s.

When your word tokens enter the tournament, the system uses those 1 or 0 values to judge the matches:

If a token gets a 1, it gets a little statistical green bonus.

If a token gets a 0, it doesn’t get the bonus.

Why Use Bernoulli g Values ?

A 1 or 0 value is extremely simple for a computer to work with. Computational simplicity is therefore one practical advantage of using binary Bernoulli g values, although Google DeepMind does not state that this was the specific reason it chose them.

In DeepMind’s published SynthID experiments, the researchers generally used 30 layers of Tournament sampling. Anthropic has not publicly confirmed that Claude’s production version uses the same 30 layer configuration.

DeepMind’s published testing found that Tournament sampling added very little computational overhead and Anthropic similarly says Claude’s watermarking has negligible impact on generation speed.

So, whenever you see that fancy word “Bernoulli,” just picture a tiny, invisible coin flipping Heads or Tails behind the scenes to give certain words a tiny nudge.

4. The Tournament

Now the words compete.

SynthID samples candidate tokens from the language model’s normal probability distribution.

Those candidates are paired against one another. In each match, the candidate with the higher g value wins.  The winners progress into another round where another g function is used.  The process continues until one candidate remains.  That winner becomes the next token in the text.

Hence the name:

Tournament sampling.

Then Claude moves on to the next word and the process happens again with the newly updated context.  One individual choice tells you almost nothing.  But repeat this across a long piece of text and a hidden statistical relationship begins to accumulate between the words that were selected and the secret watermarking process.

That relationship is the watermark.

So Where Is the Watermark in the Finished Text ?

Everywhere and nowhere. There isn’t one particular word you can point at and say:

There. That’s the watermark.

The individual words are perfectly normal.  The watermark exists in the statistical relationship between many choices made while the text was generated.  This is also why copying the text into another document does not simply make the watermark disappear. There is no separate watermark file attached to it. The signal is carried by the sequence of choices in the text itself.

How Is a SynthID Watermark Detected ?

Detection effectively reverses the question. Instead of asking: Which candidate should win while generating this text ?  the detector asks:

Do the words that actually appear in this finished text match the secret statistical pattern more strongly than we would expect by chance?

With the watermarking key, the detector can recreate the relevant pseudorandom information and calculate g values for the observed text.  It then accumulates evidence across the sequence.

Longer passages generally provide more evidence because there are more choices available to analyse. Short passages and highly constrained passages provide less.

What About Bayesian and Frequentist Detection ?

This is another place where it is easy to mix different watermark systems together.

The z score we discussed earlier is useful for understanding Kirchenbauer style green list watermarking.

The published SynthID Text research evaluates several different scoring methods.

These include simple mean scores, weighted mean scores and frequentist methods that perform hypothesis testing and produce P values.

The researchers also developed a Bayesian scoring method, which was used in their main SynthID experiments.  In plain English, these are different mathematical ways of asking essentially the same underlying question:

How strong is the evidence that this text contains the expected watermark pattern rather than the pattern appearing by chance?

We therefore should not say that Claude simply calculates a z score.  Anthropic has not publicly disclosed the exact scoring implementation used by its production Claude detector.

Kirchenbauer vs SynthID Text

The Detection Blindspot

And now we arrive at one of the most important differences between Claude’s watermark and ordinary Ai detection.

A normal AI detector does not have Anthropic’s secret key.  It can analyse the writing and decide that it looks statistically similar to Ai generated text. This is not the same thing as reproducing Anthropic’s keyed watermark test. Anthropic itself makes this distinction. 

Third party Ai detectors look for characteristics and patterns in the writing because they do not have Anthropic’s key. The reverse is important too. Claude’s watermark detector is not a magical universal Ai detector. Anthropic says its watermark can answer a much narrower question:

What is the likelihood that Claude was involved in writing this ?

It cannot prove that something was written by a human. It cannot automatically identify text produced by another Ai provider. Another provider can have another key and potentially another watermarking method altogether.

Does Everything Claude Writes Carry the Same Amount of Watermark ?

No.

Watermarking needs choices.

If Claude has several equally reasonable ways to continue a sentence, the watermarking process has room to operate. If there is only one sensible answer, there may be very little room. Anthropic gives the example of completing the title of Isaac Newton’s Principia Mathematica. If Mathematica is the correct continuation, the watermark should not push Claude towards an incorrect alternative just to create a stronger signal.

The same problem occurs with exact code, factual passages and tightly constrained proofreading.  Anthropic therefore says the watermark is sparser in these situations.

That also explains why detection becomes more convincing with longer, less constrained writing. More genuine choices mean more opportunities for statistical evidence to accumulate.

Does Claude’s Watermark Change the Quality of the Writing ?

Anthropic says its internal testing found no practical impact on content, creativity or readability.

The original SynthID Text research also tested watermarking at scale on roughly 20 million Gemini responses and reported no statistically significant change in user feedback for its configured system.

This does not mean every conceivable watermark configuration is automatically harmless.

The SynthID research itself distinguishes between configurations designed to preserve the original distribution and stronger distortionary configurations that can improve detectability at the cost of text quality.

That trade off is important. A watermark is useful only if it can be detected by an authorisation. If making it easier to detect noticeably damages the writing, the watermark has created another problem.

Can Claude’s Watermark Identify You ?

No.

Anthropic says the watermark does not contain information identifying the user, organisation or individual conversation.

It is designed to provide evidence of Claude’s involvement in producing or processing the content, not to encode the identity of the person who requested it.  That distinction matters when people hear the words secret key and understandably assume Claude might be secretly stamping their account information into every paragraph.

According to Anthropic, it isn’t.

So What Has Actually Changed ?

Before watermarking, detecting Ai generated writing largely meant trying to infer its origin from characteristics in the finished text.  Claude’s watermark changes the problem. Now there can be a deliberately created statistical signal produced during generation and later tested using a secret key.

You cannot see it.

You cannot highlight it.

You cannot search the HTML for it.

And you cannot simply ask an ordinary Ai detector to find Anthropic’s secret keyed pattern.

That leads to the obvious next question. If you cannot see Claude’s watermark and you do not have Anthropic’s secret key, can you remove it ?

That question has already produced GitHub tools claiming to tackle exactly this problem.

And that is where things become considerably more interesting. 

In the next article, I will examine the secret watermarking key in more detail. 

Anthropic has not publicly disclosed the size or value of Claude’s production key which makes claims about how difficult that specific key would be to break impossible to verify from the information currently available.  The wider question is much more interesting. 

How secure does a watermarking key actually need to be ? Could somebody reconstruct or attack the hidden watermarking process without having the key ?  And could future computing methods, including quantum computing, change that ?  I will look at what the published research actually tells us, what remains private and where the limits of those claims lie.