How Claude's watermarking (probably) works | John Wang<br>How Claude’s watermarking (probably) works<br>August 12, 2026<br>Yesterday, Anthropic announced that they had started watermarking AI-generated content. Folks across the internet were particularly up in arms about it (I think rightfully so), especially because this apparently is happening to all Claude models whether or not you are in the EU. I wanted to investigate what they’re actually doing and whether it’s perceptible or changeable.<br>Anthropic provides some insight into their approach in their article How Claude marks AI-generated content. Though it doesn’t actually provide any technical details on the implementation, it provides some guidance to help draw a wide net around the scheme they’re using. The key clues Anthropic left in their help center article:<br>The scheme “weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.”<br>The watermarking doesn’t work well on very short text.<br>The watermark seems to have started recently (August 2nd or later)<br>This helps us narrow down the possibilities quite a bit.<br>Setup<br>To actually get to the bottom of what Anthropic are doing, I realized that there are some interesting experiments you can run. Gloaguen et al. created specific tests to check for statistical watermarking, and we can also perform an analysis of Claude outputs to check for things like hidden unicode or whitespace results.<br>For good measure, I also downloaded a dump of my Claude chats (I’ve used Claude Code since 2/4/2025 and have recorded 1206 sessions) and did a quick comparison to see if there was any changepoint around early August that percepitbly changed the mix of tokens that Fable 5 output (my usual daily driver model). I wasn’t able to find any perceptible difference in this historical analysis, which confirms Anthropic’s claim that the watermarking is generally imperceptible unless using more specific tests.<br>No hidden unicode or whitespace<br>The second thing I checked is whether there’s hidden unicode or whitespace or punctuation patterns. This was pretty conclusive: they’re not doing something so simple.<br>An analysis across 7.2 million extracted prose characters (both on historical Claude Code text as well as generated Claude Code text on August 11) showed that the only unicode characters that were output by Claude were reasonable and part of day to day usage:<br>Curly quotation marks, apostrophes, and horizontal ellipses<br>Em/en dashes (A LOT of them unfortunately)<br>Mathematical symbols<br>Accented or non-English characters<br>Emoji<br>An audit by Codex, with me spot checking about 10 samples, found no anomalous instances that were consistent with a hidden Unicode watermark. I similarly found no whitespace encoding marks.<br>This evidence, combined with the fact that the watermarking is imperceptible and doesn’t work on short text, means that Anthropic is most likely using some form of statistical token watermarking.<br>Statistical watermarking schemes<br>There are a few different schemes that are available that can add watermarking to text. I’ll talk about the simplest version, the green/red list created in 2023 by Kirchenbauer et al., because it’s the easiest to explain and once you understand it will allow you to understand how these schemes generally work.<br>Green/red lists<br>This scheme is super basic, but it’s quite clever and fun. Here are the steps:<br>Split your output vocabulary into two sets: a green and a red list. Make sure they’re chosen uniformly at random.<br>Then for the green list, add $\delta$ to all of the logits and sample from the updated distribution at decoding time.<br>To figure out whether a text has been watermarked, then you compute the z-score that the tokens in the green set appear. If the text wasn’t watermarked, then the expected value of text in the green list is $T/2$, where $T$ is the token count, with a standard deviation of $\frac{\sqrt{T}}{2}$. So the suspiciousness of getting this outcome is just the z-score:<br>$$<br>z = \frac{2G-T}{\sqrt{T}}.<br>$$If some red token already has probability 0.99 (which would be a huge logit lead) a big $\delta$ nudge to the greens still wouldn’t overtake it. So the bias only changes words that have a lot of options and generally high entropy.<br>For an example, let’s say you asked your LLM to write a poem, you might have the following potential sentences that get generated:<br>WordListSentencecrispGreenIt was a crisp morningquietGreenIt was a quiet morningfoggyRedIt was a foggy morningcoldRedIt was a cold morningIf it was watermarked, you’d get an imperceptibly higher percentage of generating “crisp” or “quiet” morning (depending on how strongly the LLM provider decided to watermark with their $\delta$ value). Do this across all the words that an LLM is generating, and...