Yesterday, Anthropic announced that they had started watermarking AI-generated content. Folks across the internet were particularly up in arms about it (I think rightfully so), especially because this apparently is happening to all Claude models whether or not you are in the EU. I wanted to investigate what they’re actually doing and whether it’s perceptible or changeable.

Thankfully, Anthropic provides some insight into their approach in their article How Claude marks AI-generated content. Though it doesn’t actually provide any technical details on the implementation, it provides enough guidance for us to help pinpoint what they’re doing.

The key clues Anthropic left in their help center article:

• The scheme “weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.”
• The watermarking doesn’t work well on very short text.
• The watermark seems to have started recently (August 2nd or later)

This helps us narrow down the possibilities quite a bit.

Setup

To actually get to the bottom of what Anthropic are doing, I realized that there are some interesting experiments you can run. Gloaguen et al. created specific tests to check for statistical watermarking, and we can also perform an analysis of Claude outputs to check for things like hidden unicode or whitespace results.

For good measure, I also downloaded a dump of my Claude chats (I’ve used Claude Code since 2/4/2025 and have recorded 1206 sessions) and did a quick comparison to see if there was any changepoint around early August that percepitbly changed the mix of tokens that Fable 5 output (my usual daily driver model). I wasn’t able to find any perceptible difference in this historical analysis.

No hidden unicode or whitespace

The second thing I checked is whether there’s hidden unicode or whitespace or punctuation patterns. This was pretty conclusive: they’re not doing something so simple.

The analysis showed that the only unicode characters that were output by Claude were reasonable and part of day to day usage:

• Curly quotation marks, apostrophes, and horizontal ellipses
• Em/en dashes (A LOT of them unfortunately)
• Mathematical symbols
• Accented or non-English characters
• Emoji

An audit by Codex, with me spot checking about 10 samples, found no anomalous instances that were consistent with a hidden Unicode watermark. I similarly found no whitespace encoding marks.

This evidence, combined with the fact that the watermarking is imperceptible and doesn’t work on short text, means that Anthropic is most likely using some form of statistical token watermarking.

Statistical watermarking schemes

There are a few different schemes that are available that can add watermarking to text. I’ll talk about the simplest version, the green/red list created in 2023 by Kirchenbauer et al., because it’s the easiest to explain and once you understand it will allow you to understand how these schemes generally work.

Green/red lists

This scheme is super basic, but it’s quite clever and fun. Here are the steps:

1. Split your output vocabulary into two sets: a green and a red list. Make sure they’re chosen uniformly at random.
2. Then for the green list, add $\delta$ to all of the logits and sample from the updated distribution at decoding time.

To figure out whether a text has been watermarked, then you compute the z-score that the tokens in the green set appear. If the text wasn’t watermarked, then the expected value of text in the green list is $T/2$, where $T$ is the token count, with a standard deviation of $\frac{\sqrt{T}}{2}$. So the suspiciousness of getting this outcome is just the z-score:

If some red token already has probability 0.99 (which would be a huge logit lead) a big $\delta$ nudge to the greens still wouldn’t overtake it. So the bias only changes words that have a lot of options and generally high entropy.

For an example, let’s say you asked your LLM to write a poem, you might have the following potential sentences that get generated:

If it was watermarked, you’d get an imperceptibly higher percentage of generating “crisp” or “quiet” morning (depending on how strongly the LLM provider decided to watermark with their $\delta$ value). Do this across all the words that an LLM is generating, and you can get high levels of confidence in your watermarking.

That being said, I don’t believe Green/red lists are used in practice because they’re easy to detect and there are schemes that use the model’s available entropy more efficiently (and thus harder to detect and less likely to change the outputs of the model). The most well known scheme is SynthID-Text which was developed by Google Deepmind and is used by Google in production.

SynthID-Text

SynthID-Text is the same idea as green/red lists, but using a slightly different approach that Deepmind calls tournament sampling. Here are the steps:

1. At each decoding step, hash a secret key together with the last $k$ tokens of context to assign every vocabulary token a set of $g$ values in $[0,1]$ (with the number of $g$ values being the number of layers in the tournament).
2. Draw your candidate output tokens using the model’s logits as normal.
3. Run a tournament bracket where each candidate faces off in pairs, and the one with the higher g-value for that layer advances.
4. Output the tournament winner as the decoded token.

To detect the watermark, you just need the secret key. You can compute the $g$ value for every token in the output text by computing the hash of the last $k$ tokens plus your secret key (just like how you originally computed $g$). Then you can check the $z$ score of all of these computed $g$ values just like in the green/red case – if you have a very high average, you’ll be more statistically likely that the text is watermarked.

SynthID is a bit more disguised than Green/red lists because every candidate is drawn from the model’s own distribution, so the tournament can only promote words the model already considered saying. When the model is pretty certain about the next token, there’s low entropy and not much watermarking (just like in Green/red lists). The signal accumulates in the high entropy words, which is also why these schemes need a decent amount of text before detection becomes reliable.

Going back to our poem, say the model draws the four candidates and we run a two layer tournament:

So “quiet” gets emitted because of the higher $g$ values. Any single word looks like a standard part of the output, but if you have the secret key, you can notice that the emitted words keep landing on the statistically improbable side. Note that just like Green/red lists, the strength is tunable by adding more layers.

SynthID is the only scheme that I know of (or ChatGPT/Claude knows of) which is running in production, and it seems like my best guess candidate given that it’s been validated at scale by Deepmind.

Experimental results

To see if Anthropic is running one of these class of statistical watermarks, I ran an analysis with Codex GPT-5.6-sol[0] that replicated some of the available literature on watermark detection.

Green/red list detection

I had Codex run Gloaguen et al.’s detection algorithm. In this, Claude is forced to complete sentences using one of four fruits:

I ate 111111111111111 peaches
I chose 222222222222222 plums
...

The prefix and repeated digit vary while the fruit alternatives remain fixed. If a classic keyed watermark partitions tokens into green and red sets, then a particular fruit should become unusually likely or unlikely.

The results after running this on the current Sonnet and Fable models show that it’s pretty unlikely Anthropic is using a standard Green/red list scheme.

SynthID detection

Caveats

There are a few caveats with these results. In particular, I’m not actually sure whether the watermarking rollout is fully complete yet. From Anthropic’s own help center article, it says that models are going to be watermarked going forward and that support for any existing model is “in progress”. So a lot of my analyses from this article could just come from the fact that watermarking isn’t available yet for me. I think I’ll have to re-run this analysis again in a few weeks or when there’s a verifiable model that does have watermarking enabled and is confirmed by Anthropic. We’ll just have to wait and see.

A note on the future of watermarking

While this is mostly a technical post, I do think it’s worth thinking about what this potentially means for the future. It’s already relatively easy to detect when AI was used to write something and someone was careless. For example, I don’t need a statistical measure to figure out that this was written by an LLM: “That’s not a documentation problem — it’s a retrieval problem.”

However, putting statistical watermarks like the one described in this post on all LLM output greatly ratchets up the stakes, and in a way that is particularly undemocratic. You’ll only be able to detect the watermark if you’re in a select group that has access to a secret key (e.g. frontier lab employees or government / police). While this particular change is somewhat innocuous in my opinion, as I would assume most content written in the years after 2026 will be LLM generated or at least LLM assisted, it is a bit scary to know that a single relatively undemocratic, but innocuous change can give way to many more that may not be as innocuous.

Footnotes

[0] Of course, I tried to use Fable 5 for the analysis to start with, but it failed the security classifier and fell back to Opus 5 and I had to rely on the old trusty GPT-5.6-sol. This was probably better anyways as I’m not sure Claude would want itself to be self inspected.