When people hear “AI watermark,” they often imagine something visible: a hidden character, a special symbol, or metadata embedded inside every sentence.
Text watermarking works differently.
The basic idea is to make tiny statistical changes to the model's token-selection process while keeping the generated text natural.
It generates text one token at a time.
Suppose Claude has generated:
“The company launched a new…”
At this point, the model calculates probabilities for possible next tokens:
Token Probability
product 31%
platform 24%
service 15%
system 9%
technology 6%
other 15%
Normally, the model samples from this probability distribution.
The watermarking mechanism can modify that selection process without changing the overall meaning of the response.
If there is only one sensible continuation, there is almost nothing to manipulate.
For example:
2 + 2 =
The model is overwhelmingly likely to produce:
4
There isn't much statistical freedom here.
But consider:
“The new system provides…”
Possible continuations might include:
“better performance”
“improved security”
“greater flexibility”
“significant benefits”
There are many reasonable choices.
This is where a statistical watermark has room to operate.
Imagine the candidate tokens are divided into two groups:
Preferred group
product, secure, efficient, scalable
Other group
platform, powerful, flexible, advanced
The actual grouping would be generated algorithmically rather than manually.
The model still considers all the candidate tokens.
But when several candidates have similar probabilities, the watermark can slightly favor tokens belonging to the preferred group.
The result still looks normal to a human reader.
The important part is that the pattern is statistically unusual.
A watermark isn't:
“Whenever Claude writes 'important', that's the watermark.”
Instead, the signal is distributed across many generation decisions.
Think of each token choice as a tiny statistical vote.
One choice tells you almost nothing.
Thousands of choices can reveal a pattern.
Conceptually:
Token 1 → slight watermark preference
Token 2 → no useful preference
Token 3 → watermark preference
Token 4 → watermark preference
Token 5 → forced choice
Token 6 → no useful preference
Token 7 → watermark preference
...
The individual decisions are practically invisible.
The aggregate statistical pattern is what matters.
A detector can therefore examine a piece of text and ask:
“Do the words selected by this model contain the statistical pattern expected from the watermark?”
It doesn't need to find a magic word.
Instead, it calculates something closer to:
Observed pattern vs. expected random pattern
If the observed pattern is sufficiently unlikely under ordinary generation, the detector gains confidence that the watermark is present. This is fundamentally a statistical hypothesis-testing problem.
Conceptually:
TEXT
│
▼
Tokenize the text
│
▼
Analyze generation choices
│
▼
Apply watermark/key test
│
┌────────┴────────┐
▼ ▼
Signal detected Signal too weak
│ │
▼ ▼
Likely AI-origin Inconclusive
The exact production detection algorithm and thresholds are not publicly specified by Anthropic.
With 20 tokens, random chance can easily overwhelm that signal.
With 2,000 tokens, the detector has many more observations.
This is similar to flipping a slightly biased coin.
If a coin is 51% likely to land heads: 10 flips: The result could easily look random.
10,000 flips: The bias becomes much easier to distinguish from chance.
AI watermarking works on a similar statistical principle.
That means:
More generated text → more observations → stronger potential detection signal.
This is why very short AI-generated answers can be difficult to classify reliably.