We’ve written about the watermark in Claude’s text twice already: when Anthropic announced it, and when users got annoyed about it. Now Anthropic has followed up with an official piece that answers the obvious question – how does the thing actually work?
Not which word, but where the randomness comes from
A language model writes one word at a time. At each step it picks from several plausible candidates. Take the sentence “The weather today was cold and…”. Whether the next word is “grey” or “overcast” barely changes the meaning – normally that choice is settled by a random number.
That’s exactly where the watermark comes in. It doesn’t swap out the words, it swaps out the source of the randomness. Instead of an arbitrary random number, Claude uses a key plus the few preceding words to decide the next one. The words stay random – but anyone with the key can check whether the sequence matches the choices Claude would have made with that key. Important: this doesn’t push Claude toward words it would never use. No sudden “nubilous” instead of “overcast.”
The Monopoly comparison
Anthropic explains it through a board game. Imagine you’re playing Monopoly, but instead of rolling dice you read the moves off the digits of pi – starting from a randomly chosen digit and taking the next one each turn. For the players, nothing changes; the moves are as random as before. But anyone who later knows the full sequence of moves and knows pi can reconstruct that pi was used to “roll.” In a sense, the game carries a watermark. Claude’s text works the same way.
Where the watermark gets weak
The method – a variant of Google DeepMind’s SynthID-Text – has clear limits. It only tells you how likely Claude was involved, not whether a human wrote it. On short texts it barely holds, because there are too few word choices. On facts and code it’s thin: if the only right thing after “2 + 2 =” is “4”, there’s nothing to mark. And if you only have Claude lightly correct a text, it leaves almost no trace, because barely any words are Claude’s. A complete rewrite removes the watermark entirely.
My take
I like that Anthropic doesn’t lead with marketing here, but with an explanation you can actually follow, pi analogy included. The reason for all of this is sober, by the way: the EU AI Act, which since August 2 requires AI text to be marked. Other providers signed the same code and are building their own watermarks.
Two points strike me as practically important. First: there’s no information about you, your company, or your chat sitting in the watermark. Second: a detection API is still coming, and for images there’s the C2PA metadata label. In the end the watermark proves only one thing – that Claude was probably involved. No more, no less.
Sources: