How Claude Embeds an Invisible Text Watermark: SynthID Explained

From its newer models onward, Claude embeds a hidden statistical signature in what it generates. Nobody can see it. No characters are added and quality doesn't measurably change. Its one function is to let a person holding a secret key estimate how likely Claude was to have written, or substantially edited, a given passage.

The scheme is based on the SynthID-Text work from Google DeepMind, published in Nature in 2024 and validated on close to 20 million live responses. Anthropic and some 190 other signatories are adopting it to satisfy the EU AI Act, which has demanded that providers mark AI-generated content since August 2, 2026. The mechanism is elegant enough to deserve a close look, and its limits matter as much if you write, teach or manage writers.

Why detection needed a different approach

Spotting AI text has relied on two families of tools. Retrieval-based detection stores everything a model has ever produced and compares new text against that archive, which means a provider must log every interaction and creates both coordination and privacy trouble. Post-hoc detection, used by most commercial products, trains a classifier or relies on statistical features to separate human from machine writing.

Post-hoc detection has three structural weaknesses. It does badly on text from domains it wasn't trained on. It produces more false positives for certain groups, notably non-native English writers, whose careful and slightly formal prose looks machine-made to a classifier. And it depends on a gap that keeps closing, since it only works while AI text is statistically distinguishable from human text, and newer models narrow that distance quickly.

The practical consequence is ugly. A writer whose work gets flagged has nothing to point to: no signature, no cryptographic proof, no way to show a human wrote it. Guilt is assumed until proven otherwise, and the tools to prove anything don't exist.

Watermarking inverts the setup. Rather than inspecting finished text for AI-like patterns, the signal is built in during generation and checked later with a key. The trade-off, covered below, is that it only works when the model provider cooperates.

Where the watermark lives

Everything hinges on how Claude produces text. It works autoregressively, emitting a single token at a time (a word or part of one). Before each token it weighs everything written so far and assigns a probability to every entry in its vocabulary.

Consider the sentence "The weather today was cold and ___." The blank won't be "sugary", but "grey", "overcast" or "damp" would all pass, and the reader can't tell the difference since the meaning holds. The model resolves the tie by sampling from its distribution, and in a normal run that sampling uses an ordinary random number.

The sampler is where the signature gets planted. A watermarking scheme leaves the vocabulary alone and changes the randomness source: the draw is computed from a secret key mixed with the handful of tokens that precede it. To a reader, the choices still seem arbitrary, with "grey" in one place and "overcast" a few sentences later. Statistically, though, the whole chain of choices now lines up with the key. Detection tests for that alignment. Feed the text and the key to a scoring function and it asks whether the tokens are what the key would have picked, and over enough words the verdict stops being a coin flip.

Notice what doesn't change. The watermark doesn't restrict which words Claude will use and doesn't push it toward rarer or worse ones. It only swaps the source of randomness among equally good options. Same vocabulary, same quality, different dice.

The seed idea

Some steps have no real contest. After "The capital of Germany is" the model puts nearly all its confidence on "Berlin", so any tie-breaking method yields "Berlin". With "The weather today is cold and", several words fit equally well: grey, overcast, gloomy, cloudy. A random draw decides, which is why one prompt can give slightly different answers on different tries.

A random number generator started from the same seed produces the same sequence every time. To anyone without the seed it looks random, and to anyone with the seed it's fully reproducible. Apply that to the weather example. With one seed the model always lands on "overcast", with another on "grey". The choice is still arbitrary, only pinned. Watermarking replaces a hardcoded seed with one computed on the fly from a secret key. Vocabulary and quality stay put, but the whole run of tie-breaks is locked to the key.

One slot proves nothing, but slots multiply. A single paragraph can hold many interchangeable spots: overcast or grey, a light breeze or a gentle one, moving through the trees or blowing through them, quiet or still. Just four of those give sixteen equally good paragraphs, and each additional slot doubles that. A seedless model lands on one version by chance. A keyed model follows one particular route through every fork, and that route is the fingerprint.

Detection without the model

A plain keyed draw would watermark the text fine, but checking it would be a problem. To test a random piece of text found online you'd need to know which model wrote it, know the original prompt and rerun the model to see whether its choices match the key. The prompt is rarely available, so this can't scale. The method from the SynthID-Text paper is built so that checking never needs the model again.

A toy version helps. Imagine three functions derived from the key, G1, G2 and G3. Each looks at a candidate word together with the nearby context and the secret key, and assigns it a pseudorandom bit, either 0 or 1. Put the four weather candidates through all three and each gets a short three-bit signature.

Next the candidates compete in a knockout bracket, like a sports tournament. Words are matched in pairs, and the one with the higher bit for the round moves on, with the key breaking any tie. The first round uses G1, the second G2, and onward. Since the bracket keeps rewarding higher bits, the surviving word usually scored well on most functions. In this example "grey" wins and becomes the next word. Switch to another key and every signature shifts, so a different word takes the title.

Because winners carry higher bits, a finished watermarked text is faintly tilted toward the key's pattern, in a way that can be measured from the text alone.

Checking a suspect text

Suppose you find a passage online and want to know whether Claude wrote it. With the key and the same functions you walk through the text word by word and add up each word's bits across G1, G2 and G3.

Text produced under the watermark averages high, perhaps 2.2 on this scale, because its words were selected for high bits. Now imagine an editor swapping a few words for guesses, like "today" to "now" or "grey" to "overcast". Those swaps ignore the key and drag the mean down, maybe to 1.7. A threshold between the two values, say 2.0, separates the cases: above it the text probably came from Claude, below it probably not.

What makes it easier or harder to catch

Two factors decide how confident any detection can be.

Length. Every word choice leaves a mark, so a longer passage collects more marks and gives a stronger verdict. That's why a detector reports a confidence level or range and not a flat yes or no.

Entropy. This is a measure of how much genuine choice the model had. Where several next words are equally good, there's slack to steer toward the key, and the mark sticks. Where just one word fits, nothing can be steered and nothing gets marked.

Bigger, stronger models are usually more certain about the correct next word, which leaves fewer open choices. Fine-tuning on human feedback has a similar effect and can leave a model reaching for nearly the same phrasing every time. Generation settings count as well: temperature near zero, or a candidate pool cut too tightly, leaves the watermark no room to work.

Accuracy and cost

One simple way to rate a detector: how many watermarked texts does it catch while rarely accusing a person? Researchers fix false alarms at 1 percent and then count the share of true watermarked text found. In comparison with the best alternatives in each category, SynthID-Text's tournament sampling finds more. Its largest advantage appears in low-entropy writing, where there's little choice to work with and detection normally struggles most.

Overhead is negligible. The paper measured 15.527 ms per generated token without the watermark and 15.615 ms with all of the machinery running, about half a percent more. The cost stays roughly constant as models scale, so it vanishes into the noise at frontier size.

Does it hurt the writing?

Evidence is strongest on this point, and it says no. The Nature team ran a live test inside Gemini, routing a random share of real queries to a watermarked model and the rest to the normal one, then compared thumbs-up and thumbs-down rates over roughly 20 million responses. Positive votes differed by 0.01% and negative votes by 0.02%, both statistically insignificant and inside the 95% confidence intervals.

In a separate controlled study, people compared watermarked and plain answers side by side, scoring grammar and coherence, relevance, correctness, helpfulness and overall quality. None of the five showed a significant difference. Perplexity and standard benchmark checks agreed, and Anthropic's own internal Claude testing reports the same outcome.

What a detected watermark means

It means it's statistically likely that Claude was involved in producing the text at some point. It doesn't tell you:

• Who used Claude. The signature carries no user, organization or chat information, and neither the signature nor the key can be traced back to a person.
• Whether Claude wrote or only edited. Drafting and heavy rewriting look identical to the detector.
• That another AI wrote it. A different model would use a different key or another watermarking method, so no match for Claude's key doesn't imply a human wrote the text.
• That a human wrote it. A missing watermark isn't proof of human authorship, since short, factual or heavily edited texts can all come back quiet.

It isn't unbreakable. Small edits probably leave it intact, but replacing every token in a full rewrite wipes it out, and then the question is whether the result still counts as AI text at all. Running the passage through another model for paraphrasing weakens the signal too. The paper itself admits that stealing, spoofing and scrubbing attacks against generative watermarks are still being researched.

Why now

Companies didn't add this as a feature on a whim. It's a legal duty. Anthropic and about 190 other signatories put their names in July 2026 to the EU Code of Practice on Transparency of AI-Generated Content, and since August 2, 2026 anyone offering AI text in the EU market has to mark it. Claude isn't special here. Other leading developers signed the same pledge and are building their own marks with their own keys. Anthropic says it applies the watermark worldwide from launch, since a clean regional switch doesn't exist yet, and that an API for detecting it is being built.

What to take from it

Until now, the answer to "is this AI?" came from tools guessing off style, and they penalize writing that is careful, formal or in a second language for looking too tidy. Watermarking bets on something else: a faint, invisible, key-dependent pattern put in while the text is generated and tested for afterward. The power is deliberately narrow. It says Claude was likely involved. It can't say who used it, can't distinguish writing from editing, can't clear a person of suspicion and doesn't survive a complete rewrite. It's more honest than guessing, and users of it need to match that honesty.