From 2 August 2026 the EU requires AI generated text to be machine detectable. Anthropic's answer adds nothing to Claude's words at all. There are no invisible characters and no hidden metadata. The mark lives somewhere stranger: inside the dice rolls that chose the words.
Illustration only. The colours show a pattern a detector holding the key could compute. They are not in the text.
Ask Claude for a few paragraphs and paste them into an email. Read them back as closely as you like. There is nothing odd there: no strange spacing, no hidden symbols, no tag buried in the file. It reads exactly like something a person could have typed. Yet a detector holding the right secret key can look at that same text and find statistical evidence that it came from Claude.
So where is the mark?
Start with what any watermark needs. It has to leave the content looking exactly as it would have, survive being copied around, and still be findable by whoever holds the key. All three depend on one thing: freedom, somewhere the content can change without changing what it means.
The word watermark makes us picture a faint logo on a photograph, and photographs are the easy case. They have freedom to spare. A photograph carries millions of pixels, and a change spread thinly across them can survive cropping and recompression while staying below the threshold most viewers would notice.
Finished text has almost none. A paragraph carries a few hundred tokens, and every one of them is load bearing. Change a word and you may change the meaning. "The capital of France is Paris" cannot quietly become "The capital of France is Lyon" just to carry a signature.
You could hide characters that do not print: zero width joiners, unusual spaces, lookalike letters borrowed from another alphabet. But normalisation and cleanup tools strip those routinely, often without anyone asking them to, so character based marks are fragile in ordinary use. Anything that survives has to live somewhere a copy and paste cannot reach.
Which leaves an odd question. How do you mark a piece of writing without putting anything into it? You look for the freedom somewhere else. Most sentences can be written in more than one acceptable way: an evening can be warm, pleasant or lovely. Before the words were final, something had to choose between them. The freedom is not in the finished words. It is in the choosing. To find it, we need to slow down and watch a model choose a single word.
02 / Choosing a word
Give a language model the start of a sentence and ask it to continue.
The model does not see words. It breaks the text into tokens, small units it can score. Tokens are often fragments of words, but here every token is one full word.
It then scores every token in its vocabulary. Those raw scores are logits, and a softmax turns them into a probability distribution: how plausible is each token as the next one.
Six candidates shown. A real vocabulary holds tens of thousands.
Here is the part most people never see. The model does not simply take the top one. It draws from this distribution, like rolling a weighted die, so dog at 0.18 really does win roughly two times in ten.
Press sample and watch the observed counts converge on the probabilities.
How much freedom exists at a given position has a name: entropy. Spread out probabilities mean high entropy and real choice.
Change the context and the freedom vanishes. After the capital of France is one token takes almost all the mass. Nothing can be encoded there without breaking the sentence.
So the raw material for a watermark is not the text. It is the leftover freedom at each position, and how much exists depends entirely on what is being said.
Everything that follows is about spending that freedom without spending the quality.
That leftover freedom is what the first serious attempt set out to spend. In 2023 a University of Maryland group, with John Kirchenbauer as first author and Tom Goldstein as senior author, published the scheme that started this field. Before each token is chosen, split the whole vocabulary pseudorandomly into a green list and a red list, then push the model towards green.
The trick that makes it recoverable later is the seed. Computers cannot produce true randomness on demand, so the split comes from a seed, and the same seed always gives the same split. Build that seed from something a detector will also have, namely the last few tokens, combined with a secret key. Now the colouring can be replayed after the fact by anyone holding the key, and looks like noise to everyone else.
Why would a colour help anyone? Because nobody writing without the key has any reason to favour green. With an even split, ordinary text lands on the green list about half the time, the way a fair coin lands heads. Text that keeps landing on green well over half the time is showing the key's fingerprint, and counting is enough to see it.
The paper offers two variants, and the difference between them is the whole argument.
03 / Red list, green list
The seed is a hash of the recent context plus a secret key. Same inputs, same colours, every time. This is the replay mechanism the detector depends on.
That seed splits the vocabulary into green and red. An even split in this example, though the share is a parameter you can turn.
A toy vocabulary of 32. The colouring shown is invented, not derived from a real key.
The hard variant
The hard variant simply bans red. Detection becomes trivial, because watermarked text is then entirely green.
Try the switch, then send it to the low entropy case.
And there is the failure. Ban the only correct token and the model must write something false. This is a deliberately restrictive teaching example, not a deployed method.
The soft variant
The soft variant adds a fixed boost to green logits instead of banning red. With a modest boost a strongly preferred token stays overwhelmingly likely, so facts survive.
Drag the boost. Push it far enough and it will still overturn the leader, so this is a dial, not a guarantee.
Soft marking buys back quality but concedes something real: it reshapes the distribution everywhere, including where the model was already certain. And the size of the boost is a judgement call with no principled value.
That is the opening Google set out to close.
Deterministic, so it replays exactly. Unpredictable, because the key is secret. Anyone without the key reconstructs a different, meaningless colouring.
The answer came in October 2024, when Google DeepMind published SynthID-Text in Nature. Anthropic says Claude uses a version of this approach. Its move is to stop editing the distribution altogether. Instead of reweighting anything, it draws several honest candidates from the model's own probabilities and runs a knockout tournament between them, refereeing each match with the secret key.
Watch what the survivors do below. They are not all the same token, ties are resolved by coin flip, and every round is refereed by a different function.
04 / The tournament
Draw 2m candidates from the model's real distribution. Here m is 3, so eight seats. They are drawn independently, so tokens repeat roughly in proportion to their probability.
Round one is refereed by g1, a fresh green or red colouring drawn from the seed: green scores 1, red scores 0. In each pair the higher score wins. Equal scores are a genuine tie, broken at random.
Four survivors, and they are a mix: fox, dog, cat, fox. Round two uses a different function g2, because the round index is folded into the hash. Fox scored 1 a moment ago and scores 0 now, so both foxes are knocked out.
Two survivors, then the final under g3. Cat scores 1, dog scores 0, so cat is emitted, even though fox was the likeliest token.
That is the watermark doing its work, and the next section shows why it does not bias the odds overall.
Now the low entropy case, and the reason this design matters. When one token takes essentially all the probability mass, nearly every seat fills with that token and it wins whatever the referee says.
At p = 0.99, all eight seats match about 92 percent of the time. Only at p = 1 is it certain.
The paper generally uses m = 30 layers in its experiments. That is a large bracket, though the implementation does not literally build a billion leaves.
More layers add evidence per token, but not without limit. Each layer consumes some of the available entropy, so deeper layers carry a weaker mark.
Go back to that bracket for a moment. Fox was the likeliest word, and cat won. If the referee can overturn the model's favourite, isn't the watermark quietly changing what gets written?
Here is the part that is usually asserted and rarely shown. It is tempting to say every candidate was an honest sample, so the output must be honest too. That does not follow. Under any single key the tournament genuinely does bend the selection probabilities, and green tokens really are more likely to win.
What actually holds is subtler and more interesting. Averaged over the key's possible colourings, the original probability comes back exactly. Two tokens, one round and four colourings are enough to see it, and each colouring is equally likely because the key assigns colours like a fair coin.
05 / Preserving the odds
Take two tokens. A has probability 0.6, B has 0.4. Draw two candidates independently and play one match.
If A is green and B is red, A wins unless both draws came up B. That is 1 − 0.42 = 0.84. A is strongly favoured.
Flip the colouring and A wins only when both draws are A: 0.62 = 0.36. A is now badly hurt. So yes, a particular key really does distort the odds.
When both tokens share a colour there is no preference at all, and the tie is broken at random, which returns A its original 0.6. That happens in two of the four colourings.
Average the four equally likely colourings and the distortions cancel exactly: 0.6, the probability we started with.
That is the real claim. Not that any single output is unbiased, but that the scheme is unbiased in expectation over the key.
The paper is careful here and so should we be. This two competitor configuration is single token non distortionary. Preserving whole sequences additionally needs repeated context masking, and stronger non distortion trades against detectability.
Exact arithmetic for this two token, one round case. It does not by itself establish sequence level guarantees.
| A | B | A wins when | P(A wins) |
|---|---|---|---|
| A | B | at least one draw is A | 1 − 0.4² = 0.84 |
| A | B | both draws are A | 0.6² = 0.36 |
| A | B | tie, broken at random | 0.60 |
| A | B | tie, broken at random | 0.60 |
| Mean over the four colourings | 0.60 | ||
That is the balance the whole scheme rests on. Averaged over every possible key, the odds come back intact. But for the one key actually in use, green tokens keep winning a little more often than chance would allow. That small, consistent lean is the mark, and it is exactly what a detector goes looking for.
The detector never sees the bracket. It cannot know which candidates were drawn, which matches were ties, or who won a coin flip. It sees the finished text and it holds the key, and that turns out to be enough, because it can ask a statistical question instead of a forensic one.
Retokenise the passage. At each position rebuild the seed from the preceding context and the key, replay all the scoring functions, and record what the token that actually appeared scored. Average those values across the passage.
06 / Finding it
Every token contributes a set of replayed verdicts. Under the simplified null model each has an expected value of 0.5, the same coin-flip baseline as the green list, so an unwatermarked passage averages near a half.
A watermarked passage drifts above it, because its tokens kept winning matches where green was favoured. Not to 1: ties, low entropy positions and deeper layers all pull it back.
Dot patterns are authored for illustration. They are not a replay of the bracket shown earlier.
Compare the observed mean against the unwatermarked baseline, scaled by the spread. Kirchenbauer's paper uses a z score with a threshold of 4.
Under an ideal null, z above 4 corresponds to roughly one false alarm in 30,000 passages. That is a property of the normal tail, not a measured production rate.
Two things must be counted honestly. Only generated tokens carry evidence, so a prompt pasted in front of the text is not evidence. And the passage must be long enough: short answers, yes or no replies and rigid formats do not contain enough decisions.
Which leaves the interpretation, and this is where most coverage goes wrong. The result is provider specific statistical evidence, not a verdict on authorship.
Both error directions are real, and the absence of a mark proves nothing at all.
A p value answers "how surprising is this score if the text were unwatermarked". It is not the probability that a given person wrote it.
Everything above, assembled. The left column runs once per token as the text is written. The right column runs once, later, over the finished passage. The secret key is the only thing they share.
Those are the headlines. Here is how the mark holds up in the situations people actually meet.
| Situation | What happens to the mark |
|---|---|
| Long discursive prose | Strongest case. Many high entropy positions, plenty of evidence. |
| Short or rigid replies | Too few decisions. Anthropic notes the mark is sparser on factual passages with fewer choices. |
| Code | Weak. Syntax is near deterministic, and the freedom sits mostly in comments and names. |
| Light editing | Survives, with the score degrading in proportion to how much changed. |
| Paraphrase through another model | Effectively erased. The context that seeds every colouring is gone. |
| Locally run open models | No provider's mark. Nothing is in the sampling loop unless whoever runs the model adds a watermarking sampler. |
Anthropic states the mark does not identify a person, an organisation or a conversation. It is evidence about which system produced the text, not about who prompted it.
The Nature study compared roughly 20 million watermarked and unwatermarked Gemini responses on user feedback and found differences of 0.01 percent on thumbs up and 0.02 percent on thumbs down, described as statistically insignificant. That is strong evidence from one large deployment, not a universal guarantee for every output.
The score is an average across the passage, so mixed authorship lands between the two distributions. A long generated section with light human editing still reads clearly. A few generated paragraphs inside a mostly human document dilute towards the baseline and can fall under the threshold. The test also cannot point at which sentences carried the mark, only at the passage as a whole, so it does not tell you where the machine writing sits.
Translation regenerates every token in a different language, a different tokenizer and a different context, so the seeds that produced every colouring are gone. Expect the mark to be destroyed, in the same way paraphrasing through a second model destroys it. This follows from the mechanism rather than from a published measurement. One catch: if a watermarking model does the translating, the new text carries that model's own mark instead.
Weakly. Syntax is close to deterministic, so most positions offer no freedom to encode anything. What freedom exists sits in comments, names and the ordering of independent statements, which is also the first thing to disappear when the code is cleaned up. Anthropic describes minimal application to code where exact outputs are required.
No, and the difference matters. A classifier guesses from style and is wrong often. This checks for a specific provider's keyed statistical mark. It answers a narrow question well rather than a broad question badly.
EU AI Act Article 50 transparency obligations took effect on 2 August 2026, requiring providers to mark synthetic content in a machine readable way. Anthropic's rollout note uses that same date as the dividing line for existing models.
Go back to those paragraphs in the email. Nothing was hidden in them and nothing was added. Every word was an ordinary choice. The signature was never in the words themselves, but in thousands of tiny dice rolls that all leaned, ever so slightly, the same way. So the next time someone claims they can spot AI writing by its em dashes, you will know where the real mark sits.