How Claude's Watermark Works: 5 Steps From Coin Flip to Detection

Understanding how Claude's watermark works starts with a weighted coin. Bend a coin very slightly, and it still lands on either side, but one side comes up a little more often. On a single flip nobody could tell. On five hundred flips the bias is obvious to anyone who knows to look for it. That is the whole mechanism behind the Claude watermark, applied to word choice rather than coins, and the five steps below are what it takes to get from there to a working detector.

Key takeaways

Watermarking changes where the randomness comes from, not which words are available to the model.
Detection needs the key and the scoring functions, never the original model or the original prompt.
Clean text agrees with the key about half the time. Marked text agrees noticeably more often.
A threshold quoted without its calibration means nothing. One researcher's believed 1 percent setting turned out to produce about 5 percent false alarms.

Step One, the Moment Where a Choice Exists#

Every time a language model generates text, it picks the next word from a set of candidates ranked by probability. Anthropic's own example is the phrase "The weather today was cold and", where several continuations are roughly equally good.

Bar chart of candidate next words after the prompt the weather today was cold and, with gray at 50 percent, overcast at 30 percent, gloomy at 15 percent and cloudy at 5 percent — Figure: the candidate list at one position, using the worked example from Sebastian Raschka's lecture. Source: Sebastian Raschka, "How Claude Watermarks AI-Generated Text," 22 August 2026.

Notice how little separates "gray" from "overcast". Either word leaves the sentence meaning the same thing, which is exactly the condition the watermark needs. Where a word is forced, such as the answer to "2 + 2 =", there is no choice to bias and the nudge is simply not applied.

Step Two, Swapping the Source of the Randomness#

In ordinary generation, a close call like gray versus overcast is settled by an arbitrary random number. Watermarking replaces that number with one derived from a secret key plus a handful of the preceding words. The choice remains random from a reader's point of view, and Anthropic reports no measurable effect on quality, creativity or readability. This is a different claim from the one made by AI hallucination research, where output quality genuinely does move.

This is the part people misread most often. The watermark does not give Claude a global preference for particular words. It does not make "gray" more common than "overcast" across the internet, and it will not push the model toward a word it would never have considered. It only makes the choice at one specific position agree with what the key would have picked, and only slightly more often than chance.

Anthropic offers a useful analogy for this. Imagine a board game where players stop rolling dice and instead read successive digits of pi, starting from a randomly chosen point. The moves are still random as far as the game is concerned, and nothing about play changes. Anyone who later sees the full sequence, and knows the digits of pi, can work out which source the game used.

Step Three, Tournament Sampling#

A naive version of this idea would force Anthropic to rerun the original prompt through the original model just to check a piece of text, which is far too expensive to do at scale. According to Raschka (2026), the SynthID Text scheme avoids that with a technique called tournament sampling.

Several scoring functions are derived from the secret key, and each one turns a candidate word into a simple value. The candidates then compete in elimination rounds, exactly like a knockout bracket, and the winner of the bracket becomes the next word.

Diagram of tournament sampling, showing four candidate words competing across three elimination rounds scored by functions G1, G2 and G3 — Figure: a simplified three function bracket over the words gray, overcast, gloomy and cloudy. Source: Sebastian Raschka, "How Claude Watermarks AI-Generated Text," 22 August 2026, slides 30 to 40.

The bracket is what makes the scheme cheap on both ends. Generation costs almost nothing extra, and Anthropic confirms that watermarking produces no additional tokens, so the model is no slower and no more expensive to serve.

Step Four, How Claude's Watermark Works at Detection Time#

The payoff arrives at detection time. Checking a passage requires the secret key and the same scoring functions, and nothing else. Neither the original prompt nor the original model is needed, which is why one company can audit text it has never seen before.

The detector walks through the text, recomputes the score at each position, and averages across the passage. Clean text agrees with the key about half the time, because a writer with no knowledge of the key is effectively guessing. Marked text agrees noticeably more often, and if the average sits above a calibrated threshold the passage is flagged.

Threshold calibration is where this gets delicate, and it is worth naming. Balakhonov (2026), reproducing the published scheme, calibrated against a hundred thousand random key tables per text to reach a threshold where clean text triggers falsely in one case out of a hundred. An earlier threshold he believed to be a one percent setting turned out to produce roughly five percent false alarms. Any detector quoting a threshold without describing its calibration is quoting a number that means nothing.

Step Five, What Survives and What Wipes It#

Two consequences fall straight out of this design, and both matter more in practice than the mechanism does.

The first is that the mark cannot attach itself where only one answer is correct. Anthropic's example is "Isaac Newton's most famous work was called Principia", where the next word has no equally good alternative. The same logic applies to code, which frequently breaks if a plausible substitute is swapped in, so code carries much less signal than ordinary prose. Comments inside code are the exception, since the wording there is genuinely free.

Chart of relative watermark signal strength across creative prose, ordinary prose, factual writing and code — Figure: the signal follows the freedom of the wording, not the length of the text. Shape rather than measured production data, since Anthropic has published no per-genre figures. Source: Anthropic, "How Claude's text watermark works."

Chart of how much Claude watermark signal survives copy and paste, light editing and a full rewrite — Figure: the mark travels with the words, so it survives everything that keeps the words and dies with anything that replaces them. Source: Anthropic, "How Claude's text watermark works."

The second is that heavy rewriting genuinely erases the pattern, because the word choices carrying it get replaced by a new set derived from something unrelated to the key. Copying and pasting changes nothing at all. Light editing usually leaves the signal alive. A full paraphrase by a different, unmarked model destroys nearly all of it, a result later tested directly against a reproduced version of the scheme.

The mechanism, in the end, is not mysterious, and calling it mysterious is how bad claims get made about it. It is a coin flip with a secret bias, repeated a few thousand times across a piece of writing, readable only by someone who already knows which way the coin was bent. Everything else people say about the Claude watermark is downstream of what that signal can actually establish.

Common questions#

Why does the model not just always pick the same word?

Because the key is combined with the words immediately before it. The same candidate wins in one sentence and loses in the next, which is why the output still reads as ordinary random variation.

Could the watermark push Claude toward strange words?

No. Anthropic notes the method does not make the model choose a word it would not have considered anyway, and gives nubilous as an example of an obscure synonym it would not reach for.

Does the watermark work on code?

Barely. Where an exact token is required, so that a different choice would break the program, the nudge is not applied at all. Anthropic notes the exception is comments inside code, where the wording is genuinely free.

Sources#

Last reviewed: 3 September 2026. Anthropic has published the design principle but not its production parameters, so the tournament details here come from the published SynthID Text scheme rather than from Anthropic's implementation. Re-checked quarterly.