# Popular AI Jailbreaker Account Pliny The Liberator Describes How Anthropic’s New AI Watermark Could Work > Source: > Published: 2026-08-15 10:06:07+00:00 Anthropic has said that the text outputs of its models going forward will carry a “watermark” to show that they were created by AI, but hasn’t given a lot of details on how this watermark would work. A popular X account has now speculated on how Anthropic could be watermarking its outputs. [Pliny the Liberator](https://officechai.com/ai/how-a-jailbreaker-got-grok-to-give-a-wrong-answer-on-accounts-with-the-highest-x-followers/), the account best known for publicly jailbreaking nearly every major AI model the day it launches, took to X to break down the mechanics behind Anthropic’s watermarking system after the company published an FAQ on the subject. Pliny’s read is that most people had the wrong mental model going in, assuming the watermark would work the way older AI detection tricks have worked in the past — hidden Unicode characters slipped into a block of text, or some invisible tag appended at the end. What Anthropic is describing, according to Pliny, is a fair bit stranger than that. “Normal Claude: context → probability cloud + random sampling → token,” Pliny [wrote](https://x.com/elder_plinius/status/2088410519766278488?s=20), laying out the contrast. “Watermarked Claude: context → probability cloud + key/context-derived sampling → token.” In his telling, Anthropic isn’t attaching anything to the output at all. Instead, the company has changed how the model rolls the dice at every single step of generation. ## The mechanism, as Pliny describes it Anthropic confirmed in its FAQ that it is using a version of Google DeepMind’s SynthID-Text, a technique the DeepMind team published in Nature in 2024. Every time a language model generates text, it isn’t just producing one predetermined answer — at each word, there’s a cloud of plausible next tokens, and the model picks one somewhat randomly from among the best candidates. Under normal circumstances, that pick is made using an arbitrary random number generator. With SynthID-Text, the source of that randomness changes. It gets tied to a cryptographic key combined with the words that came just before, so the “random” pick is no longer quite so random — it’s derivable from the key. Pliny’s framing is that the watermark isn’t a thing bolted onto Claude’s output after the fact — it’s woven into how the output gets produced in the first place. “The watermark isn’t attached to Claude’s output,” he wrote. “The output IS the watermark.” That’s also his explanation for why copying and pasting the text elsewhere doesn’t strip the mark out the way deleting invisible characters would. There’s nothing extra sitting in the text to delete. The pattern lives in which words got picked, not in any additional content layered on top. Do enough of this — thousands of these low-stakes word choices across a passage — and a person holding the key can compare the actual sequence of choices against what the key would have predicted, and assign a probability that Claude was behind the text. Anthropic’s own explanation, using a Monopoly analogy involving die rolls swapped out for [digits of pi](https://officechai.com/ai/anthropic-to-watermark-content-so-people-can-tell-it-was-processed-by-claude/), makes roughly the same point: the outcome looks equally random either way, but someone who knows the substitution can work backward and tell whether pi was involved. ## Where Pliny sees the interesting questions Having laid out the mechanism, Pliny moved to what he sees as the more consequential parts of Anthropic’s disclosure. The first is a distinction he thinks is easy to gloss over: Anthropic says watermarking has “no practical impact” on quality or content, and that SynthID doesn’t push Claude toward a special set of words it wouldn’t otherwise use. But the source of randomness used to settle on the exact sequence of words has still changed. Pliny’s point is that “no measurable impact on quality” and “the generation process is identical” are two different claims, and only the first one is really being made. The second issue he raises is that Claude-detected does not mean Claude-authored. Anthropic’s own FAQ concedes this directly: the detector can establish a likelihood that Claude was involved with a piece of text, but by the company’s own admission it “cannot distinguish ‘Claude wrote this’ from ‘Claude heavily edited this.'” A document that a person wrote entirely themselves and then ran past Claude for a light grammar pass could, in theory, register as watermarked, even though the vast majority of the words are the human’s own. Anthropic’s FAQ actually walks through why — the watermark only has material to work with where there’s a genuine choice between equally good words, and a light copyedit or a factual passage with one correct answer leaves it almost nothing to attach to. Pliny flags translations as a related wrinkle, since Anthropic confirms that any Claude-translated text is fully watermarked because every single word in the output was chosen by the model. None of that undermines watermarking as a compliance exercise. But Pliny’s underlying worry is about what happens once the detector leaves Anthropic’s hands and gets used as evidence elsewhere — by a school checking a paper, an employer reviewing a work sample, a publisher scanning a submission, or eventually a court. A binary “watermark detected” result is a very different thing from “this person wrote none of this,” and Pliny is essentially arguing that the gap between those two claims is where all the real-world disputes are going to happen. ## Why Anthropic is doing this now The rollout itself isn’t optional for Anthropic. The company’s FAQ ties it directly to the EU AI Act, which as of August 2 requires AI providers serving the European market to mark AI-generated content in some detectable way. Anthropic is one of roughly 190 signatories to the EU’s Code of Practice on Transparency of AI-Generated Content, alongside the other major model developers, all of whom are rolling out their own watermarking schemes around the same requirement. Anthropic has said it’s applying the watermark globally rather than restricting it to EU traffic, since it doesn’t yet have a reliable way to scope the feature by region. The company has separately detailed how the [rollout extends beyond plain text](https://officechai.com/ai/anthropic-to-watermark-content-so-people-can-tell-it-was-processed-by-claude/), covering supported file types like images through a different mechanism — signed metadata under the C2PA standard, rather than anything embedded in the pixels themselves — and applying across every surface Claude is available on, from the API and Claude.ai to Claude Code, Cowork, and cloud platforms like AWS and Google Cloud. Anthropic says a public detection API is still being built out, so for now there’s no way for an outside party to actually test any of this against real Claude output. Until that exists, accounts like Pliny’s are likely to keep filling in the gaps with their own reverse-engineering of how the system is meant to work.