How Claude's text watermarking works
TL;DR Highlight
Claude swaps only the randomness source in word choice to embed an invisible text watermark.
Who Should Read
Backend developers using Claude API output who want to know whether watermarking affects quality, cost, or code output.
Core Mechanics
- Only the randomness source changes
- Instead of a plain random number, a key plus a few preceding words decides the next word.
- The pattern lives in equal-value choices like 'overcast' vs 'grey'.
- It does not push Claude toward words it would not normally pick, like 'nubilous'.
- No claimed impact on quality, cost, or speed
- No extra tokens are produced, so serving and usage price stay the same.
- Speed impact is described as negligible.
- No hidden characters are added to the text.
- Method is a variant of Google DeepMind's SynthID-Text
- It comes from a 2024 Nature paper.
- The lineage goes back to a 2022 proposal by Scott Aaronson.
- A test on part of Gemini traffic found no statistically significant difference in thumbs up/down ratings.
- Code and factual text get little watermark
- Where only one answer is right (e.g. 'Mathematica' after 'Principia', '4' after '2 + 2 =') no watermark is applied.
Community Reactions
- Opinion that it is easy to bypass
- Commenters said repeatedly rewriting with another LLM would remove it.
- Another asked whether having Claude write in reverse and then reordering by script would work.
- Some said it is pointless because open models exist.
- Opinions on limits of verification
- One commenter argued you can never be 100% sure text is AI-written, only that it could have been a Claude output.
- Another wanted to know the minimum text length and guessed over 1000 words.
- Doubts about the privacy promise
- One commenter worried they could add user IDs to the key in the future.
- Another complained there is no opt-out for non-EU users.
- Worry from an editing-only user
- A grant writer who uses Claude to polish paragraphs said they do not want to be accused of using AI wholesale.
- Law text and testing critique
How to Apply
- Classify which of your outputs can carry a watermark
- Today, split Claude outputs into free-form prose, code, and fixed-answer values.
- Mark only free-form prose as potentially watermarked.
- Treat code bodies and fixed facts as nearly unaffected.
- Lower detection expectations for proofreading features
- Document that grammar-only edit features are unlikely to be detectable.
- Tell users that translation and long drafting can be detected.
- Check API access with your compliance owner
- Confirm whether your organization has the EU obligation.
- If so, register interest for the detection API via the link in the article.
- Check how C2PA metadata is handled for image and file output
- Verify that Claude-made .png, .jpg, and .svg files carry the metadata.
- Check whether your conversion or compression pipeline strips it.
Try It
# Paste into Claude or ChatGPT (simplified version of the article's idea: scoping watermark impact on your outputs)
I'm a developer using LLM output in a service. Classify my feature list using the rules below.
Rules: A text watermark is likely to remain where word choice is free (prose, code comments) and rarely where only one answer is right (code bodies, math, fixed facts). Short text and light proofreading are hard to detect. Translation and long drafting are likely to carry it since the model chooses every word.
My feature list:
{{feature list}}
For each feature, give a table with 'watermark likelihood: high/medium/low' and a one-line reason.
Next step: for features rated high, ask whether a user-facing disclosure is needed.Terminology
Related Papers
The Judge Can Debias Itself: Awareness and Self-Debiasing for Reliable LLM-as-a-Judge
Warning an LLM judge about bias or letting it self-critique improved 20 of 21 model–bias combinations.
90% of US working hours are spent on tasks not covered well by AI benchmarks
Mapping 29 benchmarks to job tasks shows 90% of US working hours lack good coverage
Postgres 19 delayed after AI reviewers find more bugs than humans can fix
LLM code review surfaced so many bugs that Postgres 19 slipped to November and 8-10 features were reverted
Show HN: Gemini 4 Argon plays StarCraft
LLMs wrote StarCraft bots in one hour; GPT-6 Astra scored highest.
A Plausible Explanation Is Enough to Mislead Multimodal Judges
Adding plausible explanations to fixed answers cut MLLM judges' wrong-answer rejection by 12.7–13.8 points.
Neural networks are clean
Looking at neurons directly shows most have one main job, challenging superposition.