Ask a language model the same thing twice and you get two different answers. That's not sloppiness — it's the design. And it turns out the same randomness that makes outputs vary is exactly the opening that lets a lab watermark its text invisibly: not by changing what the model writes, but by changing where its randomness comes from. We built an interactive explainer that lets you regenerate an answer, watch where the path forks, and see the watermark at work; this post is the ideas behind it — since updated with Anthropic's own August 14 explanation of how Claude's watermark works, which confirms the mechanism below isn't a generic description but the literal one Claude uses.
First idea: generation is a chain of dice rolls
A model writes one token at a time. At each step it produces a probability distribution over possible next tokens; often one candidate dominates (after "the Eiffel" there is essentially only "Tower"), but frequently several continuations are near-equally good — a high-entropy choice — and a random number picks among them. The critical part is what happens next: the chosen token becomes context for every later step. Two runs of the same prompt don't just swap synonyms — one early fork can steer the entire rest of the answer down a different road. Sampling is a path through a branching tree, and the dice choose the path.
Second idea: the watermark only swaps the dice
Every high-entropy choice consumes one random number. Normally it comes from an ordinary random generator. With watermarking, it comes from a secret key combined with the words already written — and that is the entire change. The candidate tokens at every fork stay the same. Their probabilities stay the same. A watermarked answer is one of the paths the model could always have taken; over many prompts, watermarked and unwatermarked outputs are statistically indistinguishable to anyone without the key. This is the "distortion-free" family of schemes — the design behind Scott Aaronson's proposal at OpenAI and, in deployed form, Google DeepMind's SynthID-Text, published in Nature and running in production on Gemini. No quality tax, because nothing about the distribution changed — only the source of the randomness did.
Whoever holds the key can later replay the derivation: given the text, recompute what the keyed pseudo-random numbers would have been at each step, and check whether the choices actually made keep agreeing with them. Text the model never wrote agrees only at chance level.
Third idea: detection is a probability, never a verdict
A watermark check does not answer yes or no. Each high-entropy fork that matches the key is one more piece of evidence, and confidence compounds with how many such forks the text contains. That has a sharp corollary: the watermark lives only where the model had real choices. A long, discursive answer carries hundreds of forks and yields overwhelming statistical confidence. A short answer, a list of facts, or code — where at most steps there was only one reasonable token — leaves almost nowhere for the signal to live, no matter how the dice were rolled. Same mechanism, wildly different detectability, which is why any honest detector reports likelihood rather than delivering a verdict.
Why now: the EU AI Act, not a research whim
Anthropic's own explainer, published August 14, confirms Claude's watermark is a version of SynthID-Text and states the driver plainly: since August 2, 2026, the EU requires AI providers serving its market to mark AI-generated content, and Anthropic — along with roughly 190 other signatories — signed the EU's Code of Practice on Transparency of AI-Generated Content in July 2026. Every major lab implementing a watermark right now is doing it for the same regulatory reason, on the same underlying design principle, with different keys. Anthropic is rolling watermarking out globally at launch, not scoped to the EU, because it says it doesn't yet have a durable way to region-lock the feature — worth noting as a case where compliance with one jurisdiction's law changes the product everywhere, not just where the law applies.
What Anthropic's own numbers confirm
The announcement fills in exactly the operational questions the mechanism raises. No cost or speed impact: watermarking adds no extra tokens, so serving is the same price. No traceability to a person, org, or chat: the key encodes nothing about the user, only whether the model was likely involved. A detection API is coming, details still being worked out — right now, verifying a watermark requires being Anthropic. And Anthropic reports what you'd expect from a distortion-free scheme actually holding up under use: in Google DeepMind's own SynthID-Text evaluation, watermarked Gemini traffic showed no statistically significant difference in thumbs-up/thumbs-down ratings against unwatermarked traffic, and Anthropic's internal testing plus a controlled side-by-side human study found no detectable quality difference either.
Three specifics sharpen the "low-entropy text has nowhere for the signal to live" point from above. Code carries little watermark, because so much of code has exactly one correct token at each step — 2 + 2 = has no equally-good alternative to 4 — though arbitrary choices within code, like comment wording, can still carry it. Proofreading is watermark-resistant almost by design: if Claude only lightly edits human text, nearly every word in the output is still the human's, leaving the model too few of its own choices to leave a detectable trace. Translations, by contrast, are fully watermarked — every output word is Claude's choice, so a translation carries the same signal density as original writing.
Anthropic is also direct about what a positive detection doesn't prove: it can't distinguish "Claude wrote this" from "Claude heavily edited this," it says nothing about authorship or ownership, and it can't identify a different AI's output even if that AI also watermarks — different provider, different key, no shared coverage. That's a materially different question from what commercial AI-detection tools like Pangram answer: those tools have no key and instead pattern-match on stylistic tells (Anthropic singles out the "this isn't X, it's Y" construction and overuse of "quietly"), which is a fundamentally weaker signal than checking a cryptographic derivation. Watermark detection with the key is closer to verification; detection without it is closer to a guess. Older Claude models, launched before the August 2 EU deadline, get a transition period — Anthropic says watermarking is being added to them "over the coming months," so a Claude-written passage from before this rollout, or from an unwatermarked older model still in production, won't carry the signal at all.
The other kind of provenance: C2PA on files
Text watermarking has a sibling for images and other files, and the two are easy to conflate but work completely differently. When Claude produces a supported file type (.png, .jpg, .svg), it attaches a C2PA content credential — a small, cryptographically signed metadata note, the same open standard camera manufacturers and photo-editing tools already use to record image provenance. Unlike a watermark, nothing in the file's actual content changes and nothing is hidden; any C2PA-aware tool can read the credential directly, no key or detection API required. It's a label, not a fingerprint embedded in the choices Claude made.
The caveats that come with the elegance
Three limits worth stating as plainly as the mechanism. Detection requires the key, so each lab can recognize only its own text — this is provenance infrastructure for whoever holds the secret, not a public "was this AI?" oracle, and a third-party detector without key access is guessing from style. Paraphrasing erodes the signal, and a full rewrite removes it: Anthropic's own framing is that light editing probably won't fully strip a watermark, but replacing every word will — at which point, they note, it's fair to ask whether the result still counts as AI-generated at all. And the signal thins exactly where the stakes are often highest — short answers and low-entropy formats like code, exactly as confirmed above. Watermarking is real, deployed, and mathematically elegant; it is one layer of provenance, not the end of the "did an AI write this?" question.
What to expect next
- Watch for the detection API's actual terms. Anthropic says one is coming but hasn't specified access, pricing, or rate limits — those details determine whether verification is a public utility or a gated enterprise tool.
- Watch the older-model rollout. Watermarking pre-August-2 Claude models is promised "over the coming months," which is a real gap in coverage until it lands — and worth checking which models remain unwatermarked as that timeline plays out.
- Watch for cross-lab standardization. Per-lab keys mean per-lab detection; roughly 190 Code of Practice signatories are each shipping their own scheme, and whether the industry converges on shared verification infrastructure determines if watermarking stays siloed or becomes public provenance.
- Watch the paraphrase arms race. Every deployed watermark invites laundering tools; the durability of the signal under adversarial rewriting, not under clean-room evaluation, is the number that matters.
References: Interactive explainer — watch the fork, swap the dice · Anthropic — How Claude's text watermark works · Dathathri et al. — Scalable watermarking for identifying LLM outputs (SynthID-Text, Nature 2024) · Scott Aaronson — watermarking scheme discussion · Kirchenbauer et al. — A Watermark for Large Language Models · related coverage: Understanding AI Model Quantization · SigLIP, Explained