Anthropic Watermarking

September 2, 2026 · Brett · ai

Anthropic announced that it will begin watermarking Claude’s outputs. With the release of Fable 5.1, the watermarks are now live.

The scheme is based on Google’s SynthID-Text. There’s a 3rd-party analysis of the scheme here.

The Basic Idea

To get a sense of how you would watermark text, I’ll first describe a simplified scheme that works as follows. Imagine splitting the set of all words into two halves by assigning each word a (pseudo)random number, 0 or 1. So half the words in the language are 0-words, and half the words are 1-words. (In practice, the schemes work on tokens, not words, but we’ll say words throughout this post)

Because the assignment is random, in a normal text you would expect about half the words to be 0-words and half the words to be 1-words. So in an $n$-word text, you’d expect the sum of all the word tags to be $n/2$. A rule of thumb is that with very high probability the sum should be within $\frac{n}{2} \pm O(\sqrt{n})$. In fact, a basic concentration bound shows that

To create the watermarking scheme, the LLM will simply bias its word-choice towards the words tagged with a 1. If the LLM started with a completely unbiased text (sum $n/2$), and switched about $1.5 \cdot \sqrt{n}$ words from a tag-0 word to a tag-1 word, then the probability that a human would have produced a text with this level of watermark is only about 1%. For a 1000-word text, that means changing about 47 words. For a 5000-word text, that means changing about 106 words. The intuition is that if the LLM’s watermarking scheme can flip (asymptotically) more than $\sqrt{n}$ words, the watermarking scheme should be very effective.

Ars Technica reports that even having Claude proofread your text can result in Claude adding a watermark, and this basic analysis gives a simple rule-of-thumb to determine how many words Claude would need to change in order to add a detectable watermark.

The Secret

The effectiveness of this scheme relies on keeping the partition a secret. If you ever found out the word list, you could calculate your own document’s score and tweak it by modifying a few well-chosen words. In practice, for a scheme like this, the secret will not be a completely random partition as this would be very hard to write down. Instead it will be a pseudorandom method for assigning each word to a category. A simple scheme would be to choose a secret, and hash it together with the word and then choose the lowest order bit. So the tag would be

If you view the hash function as a random oracle, then this is a secure way to create a secret partition. It’s nice because the secret is now small (e.g. 256 bits) and you can easily calculate the tag of any word.

The Dynamic Variant

The problem with the basic scheme (outlined above) is that as you get to see a larger and larger corpus of watermarked text, you can start to infer which words have which tag. You can think of this as similar to the idea of cryptanalyzing a simple substitution cipher. To make the scheme more secure, you can have the tags be dynamic. Instead of assigning a fixed (pseudorandom) tag to each word, the tag can depend on the preceding words. So then you could calculate the tag using a scheme like this

Dynamic tagging was used in A Watermark for Large Language Models, as well as the SynthID-Text scheme used by Anthropic.

You can think of this as an analogue to the Enigma Machines of WWII, where the substitution changed with every letter you typed. The point of the dynamic variant is that it makes it much harder to identify and remove the watermark.

But whether you use the simple, static variant or the more robust dynamic scheme, the analysis below captures the key statistical ideas.

Maintaining Quality

If the LLM simply flipped some tag-0 words to other tag-1 words, the overall quality of the LLM’s output would degrade significantly. So that means Claude has to be smart about which words it switches. But this is actually fairly straightforward. You can think of LLMs as fancy next-word predictors, but before an LLM can predict the next word, it has to come up with a probability distribution over the possible words. If the sentence began “I ran to the” the next word could be “store” or “beach” but is unlikely to be “flavorful”. In some situations, two words will be almost equally probable, and if the LLM restricts its bias to exactly these cases, then the LLM can switch between tag-0 and tag-1 words without degrading output quality.

The LLM’s output is already stochastic, so it’s not too hard to introduce a small bias into the output. In fact, most LLMs have a “temperature” parameter that determines how willing the LLM is to choose words that are lower down in the probability distribution. With this intuition, it’s easier to add watermarks in high-temperature models.

Removing the Bias

The simplest way to add a watermark is to add a bias into the distribution, and to test for the watermark, you run a statistical test to see if the distribution of tags is biased away from random. A key feature of the SynthID-Text scheme (and earlier schemes from Scott Aaronson) is the nature of the bias. In the schemes we’ve described here, the watermark adds concrete bias into the distribution of words. The benefit of the production-level schemes (as opposed to the naive schemes discussed here) is that they introduce a distribution that is biased under a fixed key, but unbiased when you average over keys. This means that the detector (which holds the secret key) can reliably identify the bias, but an end user (who does not hold the private key) does not see a bias in the marginal token distribution. But a detailed dive into these optimizations is outside the scope of this post.

Detecting a Statistical Watermark

One way to think of the watermarking is to imagine that normal, unbiased text will choose tag-0 and tag-1 words with equal probability. So the sum of the tags in an $n$-word text will be distributed according to a binomial distribution with parameters $n$ and $1/2$. If the LLM is able to bias the distribution, so that tag-1 words appear with probability $1/2 + \epsilon$, then the LLM’s output will have tag sums distributed according to $\text{Bin}(n,1/2 + \epsilon)$. So we have two distributions:

So the question becomes, what is the probability you can distinguish one sample of $C$ from a sample of $H$? Given a sample $s$, we can calculate $\Pr [ s | H ]$ and $\Pr[ s | C ]$. Then Bayes’ Theorem tells us

Decomposing $\Pr[s] = \Pr[ s | H ] \cdot \Pr[H] + \Pr[ s|C ] \cdot \Pr[C]$. We can calculate $\Pr[s|H]$ and $\Pr[s|C]$ (since they’re both binomials). Now, we just need to know $\Pr[C]$ and $\Pr[H]$, i.e., we need to know the priors.

If you assume equal priors ($\Pr[C] = \Pr[H]$), and we approximate a binomial with a normal, then we get that the watermark works with high probability whenever $\epsilon$ is (asymptotically) bigger than $1/\sqrt{n}$.