After announcing plans to introduce a watermark for AI-generated text, Anthropic waited a few days before revealing further details, perhaps giving its customers time to digest the news. The company has now provided more information about how its watermarking system works. Details published on Anthropic’s website show that the technology is based on SynthID-Text, developed by Google DeepMind, and is intended to help the company meet the requirements of the European Union’s AI Act.
To understand how the system works, it is first necessary to look at how Claude and other large language models generate text. When producing a response, the model generates one word at a time. For each new word, it selects from a range of possible candidates based on what has already been written.
Take the sentence: “Today the weather was cold and…” The AI could choose between words such as “grey” and “cloudy”, both of which would make sense in context. It would be highly unlikely to consider options such as “sugary” or other unrelated words.
For the user, the choice between two sensible alternatives makes little difference as long as the overall meaning remains unchanged. The decision is therefore influenced by a random number. This is where watermarking comes into play.
How the watermarking technique works
Anthropic’s system establishes a rule based on these low-risk choices and applies it repeatedly throughout AI-generated text. Over time, this creates a particular pattern in the model’s responses.
The pattern is invisible to the reader, but it can be detected by someone who has the appropriate key to decode it.
The watermark does not eliminate the randomness involved in selecting words. Instead, it changes the source of that randomness. Rather than relying on an arbitrary random-number generator to determine the next word, the system uses a specific key together with some of the words that have already been generated. This information helps determine which candidate word the model should select.
By examining the resulting sequence, it is then possible to assess whether the choices are consistent with those the model would have made using the same key. Based on that analysis, the system can assign a probability that the text was generated, either entirely or partially, by Claude.
An analogy may help.
Imagine a board game in which the number of spaces a player moves is determined by rolling dice. Normally, the result is random. But imagine that, instead of rolling the dice, the player followed a predetermined sequence, such as the digits of pi or the sequence 123456789. By examining the moves at the end of the game, someone might conclude that a predetermined pattern had been used instead of random dice rolls.
When the watermark does not work
The watermark will not always be effective. The key can only indicate the probability that a text was written by Claude; it cannot provide definitive proof that a piece of writing was generated by AI rather than by a human.
Detection is also less reliable with short texts because there are fewer word choices and less information available for analysis. The longer the text, the more decisions Claude has to make and, consequently, the more opportunities there are for the watermark to become detectable.
Anthropic also says the watermark does not apply in the same way to factual passages where changing a word could compromise accuracy. For example, if Claude reproduces a quotation from a book, song or poem, the model must follow the original wording rather than choosing alternative words. In such cases, there is little room for the watermarking mechanism to operate.
The same principle applies when Claude is used to proofread a draft. If the model only corrects grammar and punctuation, the watermark may be present in just a small number of changes, which may not provide enough information to determine whether the text was produced by AI.
What happens if the text is edited or translated?
Modifying AI-generated text could reduce the effectiveness of the watermark, although Anthropic says it is unlikely to remove it completely.
Only a complete rewrite in which every word is replaced would effectively eliminate the watermark. At that point, however, Anthropic argues that the resulting text should no longer be considered AI-generated in the same sense.
Translations are different. Because the translated wording is generated by Claude, the watermark can still be applied to the resulting text.
What about images?
For images, Anthropic uses a different approach. When an image is generated, the AI attaches a cryptographically signed credential to the file’s metadata. This information can indicate that the image was artificially generated.
The technology is based on C2PA, an open industry standard also used by camera manufacturers and image-editing software to document the provenance of digital content.
Strictly speaking, this should not be called a watermark. It is instead a metadata-based label that can be read by tools compatible with the C2PA standard.
When will the watermark be detectable?
Anthropic is still working on the detection system and says a solution will be available “soon”. The company is currently finalising the details of how the technology will be implemented.
It plans to provide a tool that will allow users to upload content and check whether the watermark can be detected.
What will change?
Anthropic says the watermark will have no impact on the quality or content of the text generated by Claude. Text produced with or without the watermark should also look identical to readers.
Detection will not be able to establish with certainty whether an entire text was written by Claude or whether the AI only contributed partially to the final version.
There will be no hidden characters or unnecessary additions, and applying the watermark will not consume additional tokens — the basic unit used to measure generative AI usage. As a result, Anthropic says the system will not increase generation costs.
For users concerned about being identified through the watermark, Anthropic also offers reassurance: the system will not reveal the identity of a specific organisation, individual or conversation.
Understanding how an LLM chooses words
To fully understand how the watermark works, it helps to have at least a basic understanding of how a large language model selects words when generating text.
Claude does not write an entire sentence or paragraph in one step. Instead, it continuously evaluates possible next words or tokens and assigns probabilities to them based on the preceding context.
Anthropic’s watermarking system works within that process, subtly influencing the selection of otherwise suitable alternatives according to a predefined pattern. That pattern remains invisible to the reader but can later be analysed with the appropriate detection key.
Be First to Comment