How Claude’s text watermark works 
anthropic.com
All major LLM providers will be required, by the AI Act of the European Union, to add watermarks to the generated content, including text. Anthropic, owner of Claude, explained its method:
Large language models like Claude work by generating one word at a time. Each time the model decides on the next word, it chooses among a list of potential candidates, ultimately selecting the most sensible or likely based on the preceding text. Take the sentence “The weather today was cold and…”. The next word is very unlikely to be “sugary.” But it is quite likely to be “overcast” or “grey.” Under most circumstances, it doesn’t matter much to the reader which of these latter two words the model ultimately chooses—the meaning of the sentence is largely the same either way. In cases like this, the choice is settled by a random number.
Watermarking uses low-stakes choices like these—which occur many times over a piece of generated text—to leave a pattern in Claude’s responses. That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it. When watermarking is used, choices are still made at random, but the source of the randomness is different. Instead of using an arbitrary random number generator to pick the next word, watermarking uses the key and a few words that come before to settle what word the model should pick. That is, the words that Claude picks are still random, but now, one can check the sequence of words and see if it’s consistent with the choices Claude would make if it was using the key. If it is, one can assign a probability that the text was generated by Claude.
The solution is the same one Google created and has used since 2024 in Gemini, called SynthID-Text.
Some people are freaking out over this change. As I’ve been saying for a while now, it doesn’t matter.
Besides, simple systems that swap out some words for synonyms are likely to show up (if they don’t exist already), which (in theory? someone correct me if that’s the case) would break SynthID-Text’s digital signature. Still in the realm of guesswork, I’d imagine that feeding the text into another LLM and asking it to swap out some words and structures would already do the trick.
Regardless of all that, isn’t it about time people who use generative AI to write text started owning up to their choices?
I think the first thing that comes to mind when this topic comes up is using the watermark to point fingers and shame whoever uses it. It’s possible to imagine other uses, though, such as helping triage requests sent to public agencies, which, as Ronaldo Lemos pointed out [pt_BR] in his column in Folha de S.Paulo this past Sunday (the 16th), are already swamping governments and courts in several countries.
