Build1 publisher2 min readPublished
Anthropic watermarks Claude's output by steering token choice with a secret key
Anthropic now watermarks Claude's text with a version of Google DeepMind's SynthID-Text to meet the EU AI Act's transparency rules. Only a holder of the secret key can measure the mark, a lean in token choice that says little until it spans many tokens.
The Engineer · Build desk
What happened
- Anthropic set out the design in August 2026 in a post titled "How Claude's text watermark works."
- The watermark leaves the model's weights and its initial token probabilities untouched and changes only which candidate token gets selected.
- Because the mark is carried by the token sequence itself, it can survive the text being pasted into a plain editor such as Notepad.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure Claude text a team ships stays checkable after it leaves the product that generated it, by anyone who holds the matching key and runs the detector.
- constraint Detection strength depends on length, so short strings such as subject lines or interface labels give a key holder only weak evidence of a watermark.
- cost If Anthropic runs SynthID-Text's stronger setting, every product built on Claude pays for the firmer mark in output quality.
Follow one token through it. Claude has written "The cat" and, in the explainer's invented odds, rates "sits" at 50%, "sat" at 30% and "lies" at 20% [9]. The watermarked sampler draws four candidates from those odds, repeats allowed, and one draw comes out sits, sat, sits, lies [10].
A two-round knockout follows. Each round has its own scoring function, computed from the key and the preceding tokens, and it gives every candidate a 0 or a 1 [11]. Copies of the same token score alike within a round. The higher score advances, and ties are broken at random [11]. In the worked example "sat" wins and both copies of "sits" lose [12]. At 50% per draw, "sits" gets into a four-slot bracket about 94% of the time [1]. The model's probabilities decide how likely a token is to enter. The key's scores decide which entrants advance [13].
I think that split is good engineering. Candidates still come from the model's own distribution, so likely continuations stay well represented, though the explainer adds that this alone does not guarantee good writing [14].
Detection runs on the same statistics. One "sat" is weak evidence, because an unwatermarked model could have picked it too [15]. The detector measures a tendency: across many tokens, watermarked text scores higher than chance would predict [15]. A hit is a statement about token statistics under one key. Scores also depend on context. Changing the preceding tokens can change the scores [8], so a human edit alters the scoring context for every token after it.
The quality evidence belongs to Google. SynthID-Text comes from a paper Google DeepMind published in Nature in 2024, and Anthropic describes what it runs as a version of it [2]. The method has a quality-preserving configuration and a stronger one that costs quality [16]. Google tested the quality-preserving setting on nearly 20 million Gemini responses [17].
The test measured Gemini's outputs on Gemini's traffic. For the result to transfer, Anthropic's version would have to run the same configuration. Claude's token distributions would also have to respond to tournament selection the way Gemini's did. The explainer does not say which configuration Claude uses or who holds the detection key.
What to watch
- Anthropic stating which SynthID-Text configuration Claude runs, with quality measurements taken on Claude output rather than Gemini's.
- Whether detection with the Claude key is offered beyond Anthropic, for instance to regulators or platforms enforcing the EU AI Act.
- Published detection rates for Claude text after human editing or paraphrase.