Anthropic Rolls Out Statistical Watermarks for Future Claude Models
Anthropic is preparing to watermark future Claude output by subtly biasing its word choices, creating a statistical pattern that authorized detectors can identify even though readers cannot see it, according to Two Minute Papers host Károly Zsolnai-Fehér. He says the signal survives copying and limited editing but can be removed through wholesale rewriting; Anthropic’s own materials say detection indicates likely Claude involvement, not a particular user, chat, or degree of authorship.
The watermark is a statistical bias, not a hidden character
Károly Zsolnai-Fehér says Anthropic is rolling out text watermarking in future Claude models globally. The Anthropic announcement shown on screen describes it as a way to determine the likelihood that Claude was involved in writing a passage—not a visible mark on the page.
The source describes the mechanism as a fingerprint created during word selection, rather than as hidden characters in the resulting text. A language model chooses each next word from a set of candidates with different probabilities. Given the prompt, “Looking out across the yard, I saw a ___,” candidates might include “dog,” “puppy,” “cat,” “animal,” and “house,” each with its own likelihood.
Watermarking changes that selection process slightly. The system secretly divides candidate words into a preferred “green” set and a disfavored “red” set, then nudges the probabilities upward for green words. In the example shown, “dog” rises from 30% to 38%, while “cat” and “animal” also receive an eight-point boost. The model can still produce ordinary-sounding prose; it has simply been tilted, repeatedly, toward choices known to the detector.
| Stage | What the system does |
|---|---|
| Candidate generation | The model assigns probabilities to plausible next words. |
| Secret partition | Words are classified as preferred green or non-preferred red candidates. |
| Probability adjustment | Green candidates receive a small advantage in sampling. |
| Detection | A party with the secret scheme counts whether green words occur unusually often. |
The result is detectable across a body of text. Someone who knows which words were favored can count the green words and assess whether their frequency would be extremely unlikely in human text. Zsolnai-Fehér’s example is deliberately stark: 21 green words in a paragraph could make the probability of human authorship “less than winning the lottery,” he says.
The words themselves need not look suspicious. They can be mundane and inconspicuous, and the preferred set can change over time. That is why a reader cannot simply inspect a Claude passage and identify the watermark by eye.
Copying preserves the signal; wholesale rewriting can remove it
Zsolnai-Fehér calls the basic green-red scheme a simplification. He says Claude is likely using a SynthID-style variant with context-dependent probabilities and a “tournament” system. In the bracket shown on screen, candidate words compete through rounds under a secret key and the preceding text; “mango” ultimately wins over pineapple, durian, and banana.
Some words are preferred and are given a slight edge in the generation, creating a unique fingerprint.
The signal is carried by the generated wording itself. Copy-pasting leaves that wording unchanged, so it leaves the watermark intact. Changing a few terms does not necessarily erase the distributional pattern accumulated across the rest of a passage.
The source illustrates the distinction with a cover letter: light editing still triggers “WATERMARK FOUND,” while a version rephrased throughout returns “NO WATERMARK.” Zsolnai-Fehér says rewriting the whole text—effectively exchanging every word—can remove the fingerprint, and that an open-weights language model can assist with such rewriting.
Detection can establish involvement, but not authorship or identity
The Anthropic material displayed in the source says watermarking “carries no identifying information” and cannot be traced to a specific person, organization, or chat. Zsolnai-Fehér emphasizes that a detected watermark is therefore not a way to trace text to a particular Claude user.
Nor does detection settle what Claude did. Anthropic says a watermark can determine only that Claude was likely involved with content “at some point.” It cannot distinguish “Claude wrote this” from “Claude heavily edited this.” For an organization using the detector, the output is evidence of model involvement rather than evidence of a particular person’s use or a particular division of labor between writer and model.
Detection is also not presented as a public tool. The displayed Anthropic text says watermark detection is in private preview for eligible organizations: regulators, law enforcement, media, fact-checkers, independent researchers, and educational organizations. The ability to test text is therefore restricted even as the watermarking rollout is described as global.
You can't get rid of it so easily.
Zsolnai-Fehér rejects the idea that replacing a handful of words will reliably clean a passage. In his example, limited editing leaves a detectable signal. His recommendation is to use free, open-weights systems and run them locally; in his framing, those systems work for the user rather than placing a provider-controlled detection mechanism in their generated text.