My initial speculation was that maybe they\u2019d hide invisible non-printing Unicode characters in the text. Just spitballing. Turns out that\u2019s not what they\u2019re going to do. What they\u2019re going to do is apply a form of steganography, where the choice of words (or other token output) at inference time will leave fingerprints that can later, maybe, be detected probabilistically.<\/p>\n
I initially guessed \u201cinvisible characters\u201d not because I didn\u2019t think of the semantic word-choice technique, but because I was a fool who took Anthropic at its word in their description of what they would do. Their original support document claims:<\/p>\n
When a supported Claude model generates text, it weaves an
\nimperceptible watermark directly into the text itself. You won\u2019t
\nsee it, and it doesn\u2019t change the meaning, quality, or readability
\nof Claude\u2019s response.<\/p>\n
They say \u201cimperceptible\u201d and \u201cdoesn\u2019t change the meaning, quality, or readability\u201d. Their words. Not almost imperceptible. Not slightly changes the meaning, quality, or readability. That made sense to me, because that\u2019s absolutely what I want\u2009\u2014\u2009nay, demand\u2009\u2014\u2009from any tools I use personally. It\u2019s unacceptable for a tool to sacrifice an iota of clarity, coherence, meaning, quality, etc. for the purpose of embedding hidden clues within the text to suggest its provenance. That\u2019s what I would and will demand. And Anthropic\u2019s (original) support document unambiguously claims that\u2019s what their system will enable. So if that were true, I couldn\u2019t see what was left other than hiding invisible characters within the text.<\/p>\n
My error was believing Anthropic that their system wouldn\u2019t adulterate and corrupt the semantics of the text their models generate. That is in fact exactly what they plan to do. I should have my head examined for believing a single word of a document titled \u201cHow Claude Marks AI-Generated Content\u201d that doesn\u2019t explain, at all, how Claude marks (or will mark) AI-generated content.<\/p>\n
How It\u2019s Actually Going to Work<\/p>\n
Yesterday, on an entirely different website than the original<\/a> \u201cHow Claude marks AI-generated content\u201d article (the one that didn\u2019t explain anything at all about it works), Anthropic published \u201cHow Claude\u2019s Text Watermark Works<\/a>\u201d, which does actually explain in layman-accessible terms how it\u2019s going to work. I will return to Anthropic\u2019s new highly euphemistic and slightly misleading description below.<\/p>\n There\u2019s a bunch of research on this topic, some of which I have also linked to below. But the very best description of the general idea behind the technique is an interactive essay by James Padolsey, \u201cHow AI Text Watermarking Works\u201d<\/a>. It\u2019s a wonderfully cogent read, and the interactive elements splendidly illustrate the main concepts. A+ work. If you have any interest in this at all, I dare say you must read\u2009\u2014\u2009and play with\u2009\u2014\u2009Padolsey\u2019s piece.<\/p>\n But here\u2019s my stab at a layman\u2019s high-level summary. If you toss a coin N times and note the results, you can determine with a degree of certainty whether the coin is fair or biased. LLMs are, in their popular incarnations, non-deterministic. Ask the same question of the same model and you often get at least slightly different answers. Maybe the same meaning, but different phrasing. At each decision point for generating the next token, the model makes a choice. With these semantic watermarking techniques, they make different choices for some tokens based on word lists that could be called \u201cgreen\u201d and \u201cred\u201d. At each decision point, they\u2019re a little more likely to pick a word from the green list than the red list. That doesn\u2019t mean they never choose words from the red list. Just that they\u2019re less likely to than they would if the adulterated marking technique weren\u2019t in place. (Same way that a crooked 51-49 coin will still land \u201cwrong\u201d side up 49 times out of 100 on average.)<\/p>\n Words or word phrases are sorted into the green and red lists deterministically on the fly, at each \u201cnext token\u201d generation point. So sometimes a specific word will be on the green list, and other times it will be on the red list. Someone with the secret key can determine which list a word will be on at each token generation point (which is how the watermarking is detected); those without the secret key cannot. This means there will never be a list of words that Claude prefers or eschews.<\/p>\n With coin flipping, the higher N is\u2009\u2014\u2009the more times you flip\u2009\u2014\u2009the more confident you can be that the coin is fair or biased. So too with this semantic watermarking. The more words in the text, the more accurate the analysis will be that the text was generated by a specific AI model or not. With too few coin flips, you can\u2019t achieve any confidence at all regarding a coin\u2019s fairness. With too few words (or tokens), there\u2019s no way to achieve any confidence whether a string of text was AI-generated or not.<\/p>\n Given a string of text to examine for signs of a specific watermarking system, if there are more words tagged as green and fewer tagged as red than would otherwise be expected, the text can be flagged\u2009\u2014\u2009with some degree of confidence\u2009\u2014\u2009as having been generated, or merely modified, by the AI system that applies the specific secret-key watermarking system. The amount of confidence in the determination will obviously vary, significantly, based on the size of the text string and randomized weights given to words on the green and red lists. But only Anthropic will be able to determine if text was seemingly generated by Claude, and Anthropic will only be able to detect the watermarks that are applied by Claude. Claude can\u2019t detect the hidden watermark signals generated by, say, Gemini, and Gemini can\u2019t detect the hidden watermark signals created by Claude, because each implementation is predicated on secret keys held only by the LLM provider.<\/p>\n Objections to the Technical Premise<\/p>\n One of my fundamental problem with this is that no two synonyms carry the exact same meaning. \u201cHe leaped at the chance\u201d and \u201cHe jumped at the opportunity\u201d are very similar sentences expressing the same general sentiment, but they are not the same. The exact words we choose when writing matter. I want any LLM I use to choose the very best, most precise words at every single decision point. An obvious constraint that I accept is time and computation. Within the constraint of executing inference quickly, and at a certain cost per token, I want the best words. This constraint matches human writing. I could surely write a better column by taking longer to write it. I write with a sense of how much care I should put into every word and punctuation choice I make. I take more time with certain paragraphs, sentences, or even individual word choices when my gut feeling says I should.<\/p>\n In other words, these are necessary trade-offs. These factors are all in my interest: speed, cost, quality. Ideally I would like perfect writing, at instantaneous generation speed, at zero cost. None of those things are possible. Computation is not free of charge (and cloud-based LLM inference with leading models is actually expensive). Inference is not instantaneous. And great writing, whether natural or artificial, can only approach perfection.<\/p>\n The idea that anything other than my needs should factor into the generation of text for me is patently offensive.<\/p>\n This isn\u2019t just about text one might generate with the intention of passing it off as their own natural work. This isn\u2019t even about LLM proofreading of work written by hand. Anthropic is saying that all new Claude models are going to adulterate every single bit of text longer than 200 tokens (~150 words) they generate, including everything it presents to its users to read. So even in a private conversation between a user and Claude, which will never be read by anyone other than the user, Claude will begin making word choices in the name of marking its output in statistically predictable ways rather than maximizing clarity and precision.<\/p>\n Even today\u2019s so-called frontier models are already decidedly lacking in lucidity<\/a>. Claude, ChatGPT, Grok, et al. are \u201cbetter writers\u201d than most humans and produce better prose than the median human. But: no shit. Most people are terrible writers. The \u201caverage person\u201d is pretty stupid and half of all people are stupider than that<\/a>. And there are many smart, interesting people who are miserable writers. So as impressive as LLMs are, the bar is low. The best writing I see come out of these models is worse than anything I would choose to read for pleasure. And now Anthropic is saying they\u2019re going to make it worse, on purpose, for purposes that do not benefit me in any way? Even if only slightly worse?<\/p>\n Get fucked.<\/p>\n Objections to the EU Regulation<\/p>\n Speaking of objections, the relevant EU regulation motivating all of this, \u201cCode of Practice on Transparency of AI-Generated Content<\/a>\u201d, is red-tape nanny-state pipe-dream nonsense. Here\u2019s Ben Thompson\u2019s summary from a paywalled Stratechery update this week<\/a>:<\/p>\n The regulation applies to text longer than 200 tokens. Taken literally, compliant LLM terms of service must forbid users from rephrasing the output from models that comply with this regulation, because the word choices are the marks. But it\u2019s not the European Union that is trying to impose their absurd, impractical, witch-hunt-fueling regulation on the entire world. That falls on Anthropic.<\/p>\n Complying with this, particularly with regard to text, is only going to create problems for honest users. Dishonest users attempting to pass off AI-generated text as their own writing (students, employees, whoever) will simply circumvent detection through non-compliant AI paraphrasing tools.<\/p>\n James Padolsey\u2009\u2014\u2009whose interactive visual explanation of how these schemes work I linked to above\u2009\u2014\u2009explains this in a post titled \u201cAnthropic\u2019s Weak Watermarks Appease a Weak Law<\/a>\u201d (which, if it rings a bell, I linked to in a standalone post<\/a> earlier today):<\/p>\n The same thought that led to this law could have applied to Anthropic has nevertheless chosen a blanket, model-level Padolsey is the creator of Declaude<\/a>, a delightfully simple web app that allows you to \u201cPaste in AI-flavored text and get the same content back as plain prose\u201d. Declaude\u2019s original purpose is cleaning the saccharine Claude personality stink from text (whether it was created by Claude or any other LLM), but, if Anthropic persists in its stated plan to begin adulterating all text Claude generates, Declaude will also serve as a copy-paste single-extra-step way to eliminates those marks. Declaude is interesting and useful already, but it exemplifies how ill-considered and futile this EU regulation is when it comes to prose.<\/p>\n Google SynthID<\/p>\n Google has a watermarking system in place that they call SynthID, which they apply to AI-generated images, video, audio, and text. I\u2019m concerned in this article only with text. With multimedia, embedded watermarks can be metadata within files, and truly not affect the experiential quality of the work when viewed or listened to. With text, we are talking about the actual words that are chosen. From the \u201cAI-generated text\u201d section of Google DeepMind\u2019s own description of SynthID<\/a>:<\/p>\n We\u2019ve expanded SynthID to watermarking and identifying text In a group chat, a friend of mine quoted the above, and I responded that if a chatbot wrote \u201cMy favorite tropical fruits are mango and airplanes\u201d, I\u2019m pretty sure I\u2019d fucking notice. Another friend then responded with this:<\/p>\n Days later, that still cracks me up.<\/p>\n But Google\u2019s absurd description puts the lie to their own claim that it isn\u2019t noticeable, and it serves to show just how little regard the people behind these generated-text fingerprinting schemes have for the actual craft of writing. Of course bananas has a higher probability score than airplanes, because airplanes aren\u2019t fruit. But what about pineapple? Should the sentence complete to \u201cmango and bananas\u201d or \u201cmango and pineapple\u201d? That\u2019s a good question, and the only acceptable answer for why an LLM should choose bananas instead of pineapple (or coconut, or guava, or papaya…) is that it has determined that it\u2019s the best fit for the intended meaning, tone, and sentiment of the text. Not because bananas is on the watermarking \u201cgreen\u201d list and pineapple is on the \u201cred\u201d list, even though pineapple might be the better fit. Google\u2019s own supposedly jocular description of how SynthID works in fact captures how the scheme perverts the text it generates.<\/p>\n They\u2019re saying you won\u2019t notice because if it only chooses bananas over pineapple for these fingerprinting purposes, well, they\u2019re both tropical fruits and who cares. But it\u2019s utter nonsense that the difference is \u201cnot noticeable to the human eye\u201d. The semantic difference between banana and pineapple is just as noticeable to the human eye as the as the taste of the two are to the human tongue.<\/p>\n If it did produce \u201cMy favorite tropical fruits are mango and airplanes\u201d, it\u2019d be incredibly stupid, but it wouldn\u2019t be offensive because we\u2019d all recognize that something completely off-key happened. What\u2019s offensive is that with a system like SynthId in place, where the fingerprinting decisions are motivated by a secret key, we have no idea whether it completed to \u201cmangos and bananas\u201d because bananas was determined to be the best next token, or because bananas is in the \u201cgreen\u201d bucket of words. It calls every single word choice into question.<\/p>\n Here\u2019s a paper published in Nature<\/a> where Google\u2019s team behind SynthID published their work, after putting it into production with Gemini (n\u00e9e Bard):<\/p>\n We analysed approximately 20 million watermarked and unwatermarked From this experiment, we conclude that over a wide variety of real To this I say:<\/p>\n Gemini\/Bard\u2019s thumbs-up\/thumbs-down buttons are not a good experiment for evaluating the effect on quality. If a chatbot tells me \u201cMy favorite tropical fruits are mango and bananas\u201d instead of \u201cmango and pineapple\u201d, I\u2019m not going to give the response a thumbs down because of the fruit it chose. I\u2019d give it a thumbs down if said \u201cairplanes\u201d, yes, but that\u2019s a strawman. (The paper in Nature even uses the \u201cMy favorite tropical fruits are mango and …\u201d example as an illustration, but in the paper, the only four next tokens considered are, in order of probability distribution, mango, lychee, papaya, and durian. No airplanes. And, conveniently, in the paper\u2019s example, the \u201cwinner\u201d of the watermarking \u201ctournament\u201d just happens to be mango, the one that would have been selected as the best if the watermarking weren\u2019t in place.)<\/p>\n A \u201cdifference in response quality and utility, as judged by humans\u201d that is \u201cnegligible\u201d does not mean imperceptible. What they really mean is that it\u2019s only slightly worse and that everyone is either too stupid to notice or too indifferent to care.<\/p>\n It\u2019s widely considered that Gemini is behind ChatGPT and Claude in quality. Perhaps the fact that they\u2019ve put SynthID-text into production is one of many reasons why. I personally agree that Gemini\u2019s prose is inferior. Maybe the use of SynthID has nothing to do with the fact that I, along with the general public consensus, consider Gemini to be a second-rate chatbot\u2009\u2014\u2009but in that case, maybe it\u2019s the fact that Gemini is a second-rate chatbot that makes the difference \u201cnegligible\u201d when Google started mixing in SynthID-motivated tokens in its results. It\u2019s a lot more likely that your restaurant customers won\u2019t notice that you replaced your regular coffee with Folgers Crystals<\/a> if your regular coffee is second-rate to start with.<\/p>\n Anthropic<\/p>\n Now, finally, back to Anthropic\u2019s new \u201cHow Claude\u2019s Text Watermark Works<\/a>\u201d published yesterday. I have some comments.<\/p>\n To summarize:<\/p>\n We use a method of watermarking that does not have any practical The difference between watermarked and un-watermarked text will Translation: Specific words do not matter and we don\u2019t think anyone reads anything closely.<\/p>\n Nothing is added to the text and there are no hidden characters;<\/p>\n This would have been worth clarifying at the outset.<\/p>\n Watermarking won\u2019t be specific to Claude. As of August 2, the EU No other AI provider has stated that they will apply such marking, adulterating all generated text, outside the EU.<\/p>\n Take the sentence \u201cThe weather today was cold and\u2026\u201d. The next word Arguing that grey vs. overcast \u201cdoesn\u2019t matter much to the reader\u201d is the crux of my argument that this entire endeavor is a perverse adulteration of what it means to write\u2009\u2014\u2009or to read. That it\u2019s subtle in some ways makes it more perverse, because it\u2019s sneaky.<\/p>\n In internal testing, we\u2019ve seen no impact of watermarking on the See above for my argument that this thumbs-up\/thumbs-down data is absolutely worthless in evaluating whether the SynthID-style word-bias watermarking makes text worse. By definition it must make text worse, unless the underlying LLM model\u2019s scoring is wrong, because the nature of the watermarking algorithm requires it to sometimes increase the probability of selecting a worse word choice and decrease the probability of selecting the model\u2019s best choice. It\u2019s only a question of how much worse. What Google\u2019s thumb-counting data shows is only that it isn\u2019t so much worse as to make Gemini users click the thumbs-down button.<\/p>\n Watermarking doesn\u2019t change the meaning or experience for the No, it does not. Because the entire scheme is tied to secret keys held only by the AI provider, it only allows Anthropic, not \u201cyou\u201d, to check anything.<\/p>\n When Claude proofreads text written by a person, what it gives Translation: No one can ever again use Claude for proofreading their own prose unless they\u2019re willing to risk that the whole thing might be flagged as having been generated by Claude.<\/p>\n For example, once the model has written \u201c2 + 2 =\u201d, there is a very Having said that, in areas where there is an arbitrary choice Translation: We value precision in programming code; we do not in prose.<\/p>\n And it is exceedingly rich to cite George Orwell\u2019s Nineteen Eighty-Four, approvingly, in the context of justifying a text adulteration scheme premised on the notion that specific words do not matter. I mean what the actual fuck? Orwell!<\/p>\n Lastly, as to why they\u2019re doing this:<\/p>\n We\u2019re implementing watermarking to comply with the EU AI Act. This, from a company that the Financial Times just reported<\/a> is weeks away from an IPO with an intended valuation of $2 trillion, which would make it one of the 10 highest-valued companies in the world\u2009\u2014\u2009as of today<\/a>, placing it at #7, between TSMC ($2.2T) and Broadcom ($1.9T).<\/p>\n This leaves us to believe that one of the following must be true:<\/p>\n It\u2019s perfectly reasonable that a technology company valued on par with Amazon and TSMC is technically incapable of complying with an EU regional law only within the EU itself.1<\/a> Not a cause for concern at all.<\/p>\n Anthropic is in over their heads, wields shockingly little control over their own tech stack, and their imminent IPO is likely to be remembered only as a new high-water mark in the manic global AI bubble.<\/p>\n Also, what happens if another major global market makes it unlawful for AI to secretly watermark generated text?<\/p>\n OpenAI<\/p>\n From an OpenAI support document titled \u201cProvenance Signals (Content Credentials, SynthID) in OpenAI-Generated Content<\/a>\u201d:<\/p>\n Consistent with our commitments<\/a> under the European There\u2019s a lot of wiggle room in this brief statement, and it could just as well mean that OpenAI models will only adulterate text with fingerprint markers when users or developers ask for it. Or that it will only be mandatory for users in the EU. If I were at OpenAI I\u2019d go hard on this and publicly say that ChatGPT will never watermark text it generates unless you ask it to, and that if you want tools that secretly work behind your back without telling you how they work to flag your words in ways you can\u2019t see, go ahead and use Claude.<\/p>\n Further Reading<\/p>\n Three papers on ArXiv:<\/p>\n I will admit that while I\u2019m profoundly offended by the idea of personally using tools that attempt to leave such watermarks in text they produce or touch, the mathematics behind it are fascinating.<\/p>\n Michael Lopp, at Rands in Repose, \u201cRIP Claude<\/a>\u201d:<\/p>\n As a human who has had to wrangle with EU regulations in the past, My writing is my work, and Anthropic\u2019s current strategy is
\nThe provider must mandate in their terms-of-service that users
\nnot remove the watermarking.
\nThe solution should be robust in terms of evading \u201ctypical
\nprocessing solutions\u201d like screen shots, scanning and OCR,
\ncopy-and-pasting, translations, etc.<\/p>\n
\ncalculators at the time of their inception, had their outputs
\nrevealed themselves through artefacts. Thankfully, a sum borne of
\nthe brain is treated no differently from one produced by a
\ncalculator. Likewise with spellcheckers. To make assistance
\nsuspect only once the tool becomes capable enough to compose a
\nwhole sentence is not a principled boundary. It is a moral premium
\nplaced on difficulty itself.<\/p>\n
\nimplementation that appears broader than the law\u2019s minimum
\nrequirement. That may be convenient compliance engineering, but it
\ndiscards distinctions the law expressly attempted to preserve. The
\nresult is a signal broad enough to implicate harmless and
\nassistive use, yet fragile enough to be removed by a motivated
\nperson through substantial recomposition. It risks concentrating
\nsuspicion on ordinary and assistive users while remaining weakest
\nagainst deliberate deception.<\/p>\n
\ngenerated by the Gemini app and web experience. Large language
\nmodels generate text one word (token) at a time. Each word is
\nassigned a probability score, based on how likely it is to be
\ngenerated next. So for a sentence like \u201cMy favorite tropical
\nfruits are mango and\u2026\u201d, the word \u201cbananas\u201d would have a higher
\nprobability score than the word \u201cairplanes\u201d. SynthID adjusts these
\nprobability scores to generate a watermark. It\u2019s not noticeable to
\nthe human eye, and doesn\u2019t affect the quality of the output.<\/p>\n
\n![\"AI-generated](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2026\/08\/tropical-fruit-airplane.jpeg\")
<\/a><\/p>\n
\nresponses and computed the thumbs-up and thumbs-down rates (both
\nas a fraction of the total number of thumbs-up and thumbs-down
\nfeedback received). We found that the thumbs-up rate for the two
\nmodels differed by 0.01% (with the watermarked model being
\nhigher); and the thumbs-down rate differed by 0.02% (with the
\nwatermarked model being lower). We found both of these differences
\nto be statistically insignificant, and well within the 95%
\nconfidence intervals.<\/p>\n
\nchatbot interactions, the difference in response quality and
\nutility, as judged by humans, is negligible. Subsequently,
\nnon-distortionary SynthID-Text has been productionized and is
\ncurrently watermarking responses in Gemini and Gemini Advanced. To
\nthe best of our knowledge, this evaluation represents the first
\nsystematic watermarking investigation of its kind within a
\nlarge-scale production system.<\/p>\n
\nimpact on the quality or content of Claude\u2019s outputs;<\/p>\n
\nnot be distinguishable to readers;<\/p>\n
\nrequires AI providers serving its market to mark AI-generated
\ncontent. Other major model developers have signed the same Code of
\nPractice and will be implementing their own watermarks.<\/p>\n
\nis very unlikely to be \u201csugary.\u201d But it is quite likely to be
\n\u201covercast\u201d or \u201cgrey.\u201d Under most circumstances, it doesn\u2019t matter
\nmuch to the reader which of these latter two words the model
\nultimately chooses\u2009\u2014\u2009the meaning of the sentence is largely the
\nsame either way. In cases like this, the choice is settled by a
\nrandom number.<\/p>\n
\ncontent, level of creativity, or readability of Claude\u2019s text. In
\nthe SynthID-Text paper<\/a>, which introduced the technique we
\nuse, Google DeepMind tested this impact by serving a model that
\nused watermarking to a portion of their Gemini traffic and
\ncomparing thumbs-up and thumbs-down ratings. They found no
\nstatistically significant differences from the unwatermarked
\nmodel. And in a controlled study, human raters comparing
\nwatermarked and unwatermarked answers side-by-side saw no
\ndifference in quality.<\/p>\n
\nperson reading it, but if you wanted to check after the fact
\nwhether the text was likely generated by Claude, the watermark
\nallows you to do so.<\/p>\n
\nback has generally only been lightly edited; because nearly all
\nthe words are the person\u2019s, there\u2019s very little (if anything) for
\nthe watermark to attach to. Depending on the length of the text
\nand how heavily Claude has edited it, those changes might not be
\nenough to make Claude\u2019s involvement detectable. The more Claude
\nwrites, the more decisions it has to make, and the more space
\nthere is for a watermark.<\/p>\n
\nclear best choice for the next token (if the model is completing
\nthe sum, there isn\u2019t an answer that\u2019s equally as good as \u201c4\u201d; if
\nit\u2019s talking about George Orwell\u2019s Nineteen Eighty-Four, there
\nisn\u2019t an answer that\u2019s equally as good as \u201c5\u201d). The \u201cnudge\u201d of the
\nwatermark wouldn\u2019t be applied here. For the same reason, code\u2009\u2014\u2009which in very many cases has to be exact\u2009\u2014\u2009has generally less
\nwatermarking than some other forms of text.<\/p>\n
\nbetween particular words or terms within the code, the watermark
\ncan be used, such as comments within code. But by definition, it
\nwill have a negligible effect on the actual code produced.<\/p>\n
\nAnthropic, along with several other major AI model providers and
\naround 190 total signatories<\/a>, signed the EU Code of
\nPractice on Transparency of AI-Generated Content in July 2026.
\nThis requires AI system providers to use methods of \u201cmarking\u201d
\nAI-generated text. We\u2019re applying watermarking globally at launch
\nbecause we don\u2019t yet have a durable way to scope it by region.<\/p>\n
\nCommission\u2019s Code of Practice on Transparency of AI-generated
\ncontent, our goal is to expand provenance signals to all
\nmodalities including text, so customers and developers have
\nclear ways to meet their own transparency obligations as
\nstandards and tooling continue to mature.<\/p>\n
\nI am abundantly clear what\u2019s involved in the laborious
\nbureaucratic process. I can guess what threats Anthropic is
\nfacing. However, this is a tone-deaf, clumsy, and alarming opening
\nsalvo in their watermark strategy. […]<\/p>\n
\naggressively writer-hostile.<\/p>\n