Text Watermarking

Text watermarking makes a model's own token choices carry a hidden signal. It is an intervention in token-sampling: instead of drawing the next token from an arbitrary random source, the sampler derives its randomness from a secret key plus the preceding few tokens, so the emitted sequence is statistically consistent with that key and can be tested for afterwards claude-text-watermark.

Detection asks whether a passage looks like the choices the model would have made with that key. It is a likelihood test, not a signature — and only the key holder can run it.

Where it sits in the pipeline

At the selection step of decode, after logits and softmax, alongside temperature and the top-k / top-p truncation token-sampling describes. It does not touch the attention compute, the kv-cache or continuous-batching — the same position the wiki has always given sampling: cheap, last, and downstream of everything expensive.

Anthropic reports that it "has a negligible impact on the speed of models, and because it produces no extra tokens, the model is the same price to serve and use" claude-text-watermark. That is a vendor claim with no published measurement behind it.

What it needs to work: room to choose

The signal rides on positions where several tokens would do equally well — the source's example is picking between "overcast" and "grey" after "the weather was cold and…". Where the next token is nearly forced, there is nothing to encode. Two consequences the source states outright:

• Factual and constrained prose carries a sparse watermark.
• Code carries almost none, "which in very many cases has to be exact." Comments can carry it; the executable text mostly cannot.
• Short passages cannot be judged — too few choices to accumulate evidence.

So watermark strength is a function of how much freedom the distribution leaves at each step, which is the same quantity token-sampling's temperature and top-p knobs control. The source does not follow that through, and neither can this page yet: whether greedy or low-temperature decoding weakens or removes the mark is unstated and unmeasured.

The family

Anthropic's version is "a version of the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024," which "belongs to a family of approaches that go back to a proposal by Scott Aaronson in 2022" claude-text-watermark. Neither primary has been read into this wiki — everything above is Anthropic's account of its own implementation, at one remove from the method it descends from.

What it does not establish

• It reports likelihood, not authorship. "Claude wrote this" and "Claude heavily edited this" are the same reading.
• Editing degrades it gradually. Light editing "probably won't remove the watermark completely; a complete rewrite where every word is replaced will."
• Translation is not laundering when Claude does the translating: the translated output is generated text and carries its own watermark.
• Third parties cannot check. Commercial AI-detection tools "use a different method, because the companies that provide it don't have our key."

Related

• token-sampling — the step this modifies.
• llm-inference — the pipeline it sits in.
• kv-cache-isolation — the wiki's other non-performance mechanism at serve time.