How Does AI Text Watermarking Actually Work? A Technical Explainer

An AI text watermark is not hidden characters, and it is not metadata. It is a statistical fingerprint left in which ordinary words the model chose. That single distinction explains almost everything else — why you cannot strip it with a text editor, why it survives copy-paste, why it dies to paraphrasing, and why it barely works on code.

With Anthropic marking all Claude text output since August 2026 and Google having run SynthID for years, this mechanism went from a research curiosity to something that affects text you generate every day. This guide explains how it works, at the level of detail where the tradeoffs actually become visible. If the generation side is unfamiliar, our complete guide to generative AI covers how these models produce text in the first place — the watermark is a modification to the final step of that process.

TL;DR — the mechanism in one table

First, what it is not

Three wrong models of watermarking circulate constantly, and each leads to a wrong conclusion.

"It's hidden Unicode characters." Zero-width spaces, non-breaking variants, and unusual apostrophes do appear in LLM output — but as artifacts of training data, not as deliberate marks. Any serious scheme avoids them for an obvious reason: sed removes them in one pass. If a mark can be stripped by a script anyone can write in thirty seconds, it is not a provenance system.

"It's metadata attached to the response." That is how C2PA works for files, and it is a genuinely useful system — but as we covered in detecting Claude watermarks, file metadata does not survive a re-save, let alone copy-pasting text out of a chat window. Text watermarks exist precisely because metadata cannot follow text.

"It's a stylistic tell the model was trained to produce." Stylometric signals are real — our analysis of load-bearing Claudisms catalogues them — but they are not watermarks. They are emergent, unkeyed, and detectable by anyone with a good ear. A watermark is deliberate, keyed, and statistically measurable.

The actual mechanism is stranger and more elegant than any of these.

How the mark gets in: keyed token bias

To follow this you need one fact about how language models generate text: at every step, the model outputs a probability distribution over the entire vocabulary, and a component called the sampler picks one token from it. Generation is that loop, repeated.

Watermarking modifies the sampler. Here is the canonical scheme, from the published research literature:

Step 1 — Hash to get a pseudorandom split. Take the previous token (or the last few) and combine it with a secret key. Hash the result and use it to seed a pseudorandom number generator. Use that generator to split the entire vocabulary into two sets — conventionally called the green list (roughly half the vocabulary) and the red list (the other half).

Step 2 — Nudge the distribution. Before sampling, add a small constant bias to the logits of every green-list token. Not a huge one — enough to tilt the outcome when several tokens are nearly tied, not enough to override a token the model strongly prefers.

Step 3 — Sample normally. The sampler picks a token from the tilted distribution. Green tokens win slightly more often than they otherwise would.

Step 4 — Repeat, with a new split every time. Because the split is seeded from the preceding token, it changes at every position. The green list at token 40 is unrelated to the green list at token 41.

That last property is what makes the mark invisible. There is no fixed set of "AI words." A word that is green in one sentence is red two words later. No amount of reading the text reveals the pattern, because the pattern only exists relative to a key you do not have.

A worked intuition

Suppose the model is generating and the next token could reasonably be large, big, substantial, or considerable — all fine, all nearly equally probable. Ordinary sampling picks among them according to their probabilities. Watermarked sampling checks which of those four happen to be green at this position, and tilts toward those.

Over one token, that tells you nothing — a green token appears about half the time by pure chance. Over 300 tokens, if 62% landed green instead of the expected 50%, that is a statistical event that does not happen by accident.

How detection works

The detector never sees the original text, the prompt, or the model. It needs exactly two things: the text and the same secret key.

1. Tokenize the passage the same way the generator did.
2. At each position, re-derive the green/red split from the preceding token and the key — the same deterministic hash, so it reproduces exactly.
3. Count how many tokens actually landed in their position's green list. Call it G out of T total tokens.
4. Compare G against the ~T/2 you would expect from unwatermarked text, and normalize into a z-score.

The z-score is the whole output. A high z-score means the green-token count is far above chance, and the probability of that happening in text that was never watermarked is vanishingly small. That probability is the false-positive rate, and it is tunable — you pick a z threshold, and it fixes your false-positive rate mathematically rather than empirically.

This is worth dwelling on, because it is the genuine advantage over the previous generation of AI detectors. Classifier-based detection produced false-positive rates you had to measure on a test set and hope generalized. Watermark detection produces a false-positive rate you can derive, because you know the null distribution exactly. That is a real improvement in kind, not just degree.

What it does not fix: the false-negative rate, which depends entirely on how much the text was altered after generation, and is not derivable at all.

The entropy constraint — why code breaks it

Everything above depends on one assumption: that multiple acceptable tokens exist at each step.

The bias only changes the outcome when the top candidates are close in probability. If the model assigns 99.7% probability to a single token, a small green-list bias will not dislodge it — and it should not, because doing so would break the output.

That gives a clean rule: watermark signal is proportional to the entropy of the text.

This is the strongest technical objection developers raised to Claude Code being included in the marking policy, and it is correct. If your function must call getUserById, there is no synonym. The variable name must match its declaration. The closing brace is the closing brace. There is very little room to encode anything, and a formatter pass rewrites what little there was — whitespace, quote style, trailing commas are exactly the low-stakes choices a watermark could have used.

So when an Anthropic engineer suggested you "could check if a PR was generated by Claude Code," the honest reading is: the PR description will mark well; the diff will not. Prose the agent writes about the code is ordinary high-entropy text. The code itself is close to the worst case for this technique. We go further into that gap in will every AI model watermark its output?.

Distortion: does watermarking make output worse?

Slightly, and honestly, yes — by construction. The sampler is no longer drawing from the model's unmodified distribution. It is drawing from a tilted one.

Whether that matters depends on the scheme:

• Biased schemes (the green-list approach above) measurably shift the output distribution. The shift is small and concentrated in near-ties, which is why quality evaluations find negligible differences, but "negligible" is not "zero."
• Distortion-free schemes exist in the literature. They use the key to drive the randomness source of sampling rather than to bias the logits — so any single output is distributed identically to unwatermarked sampling, while still being detectable with the key. Google's SynthID text approach uses a tournament-style sampling procedure in this family, which is why it can claim to preserve output quality.

Anthropic has not published which family its scheme belongs to. Its engineers pointed to SynthID as the reference for how the technology works, which is suggestive but not a specification. Treat quality claims as unverified either way until someone publishes a controlled comparison.

Four attacks, ranked by effectiveness

There is a fifth item worth naming that is not an attack at all: use an open-weight model. The watermark is applied by the sampler, and whoever runs the weights owns the sampler. No mark is ever created. This is not a bypass so much as an architectural exemption, and it is why universal watermarking is not achievable.

A subtler risk runs the other way — spoofing. If an attacker can learn enough about the green-list pattern by probing a detector repeatedly, they could in principle craft text that falsely trips it, attributing human writing to an AI. This is one of the real arguments against an unrestricted public detection endpoint, and it is why the pricing and access questions around Anthropic's announced detection API are security decisions as much as commercial ones.

Why the key has to stay secret

The detector's power comes entirely from holding a secret the writer does not. Publish the key and three things happen at once: anyone can strip the mark by re-sampling to avoid green tokens, anyone can forge it by deliberately picking green tokens, and the detector's output becomes meaningless in both directions.

That is the permanent tension in this whole design. Secrecy is required for the scheme to work, and secrecy is what makes independent verification impossible. Regulation — the EU AI Act's Article 50 transparency obligations that triggered this rollout — asks providers to support third-party detection, which means giving others detection capability without giving them the key. The only structural answer is a provider-operated detection service, which is exactly what every lab has converged on, and exactly what makes the provider unauditable.

What to take away

• The mark is in which words were chosen, so it survives every transformation that preserves the words and dies to every transformation that changes them.
• Detection is statistical, keyed, and length-dependent — it produces a confidence score, never a verdict.
• A positive result means "these token choices are very unlikely by chance," which supports "an AI system produced this text" and does not support "an AI authored these ideas."
• A negative result means almost nothing. Unmarked model, short passage, paraphrased text, low-entropy content, and human authorship all produce the same non-detection.
• Code is close to the worst case for the technique, and any policy that screens code contributions this way is running ahead of the mechanism.

That is not a reason to dismiss it. Watermarking is a genuine improvement over stylometric guessing, with a derivable false-positive rate, and it is useful for filtering volume at platform scale — the same role provenance plays when Spotify demotes AI-generated artist profiles. It is just a filter, not a forensic instrument, and the difference matters most to the people who will be judged by it.

Related on explainx.ai

• Anthropic is watermarking Claude text — the policy that made this mechanism everyone's problem
• How to detect a Claude watermark — what you can actually verify today
• Will every AI model watermark its output? — the convergence, and why open weights escape it
• Are AI watermarks monetisable? — why detector access is a security decision, not just a pricing one
• LLM text detection with classical ML — the classifier era this replaces, and its false-positive problem
• "Load-bearing": Claude Opus 5's writing tells — stylometric signals, which are not watermarks
• LinkedIn's C2PA Content Credentials — the metadata approach, and its opposite failure mode
• Spotify labels AI artists — provenance used as a distribution filter
• What are LLM tokens? — the unit everything above operates on
• EU AI Act and US policy: complete guide — the transparency obligations behind the rollout
• What actually changes after the EU AI Act — what changed once those obligations became enforceable

Primary sources: Published research on statistical watermarking for language models (green-list token biasing and distortion-free tournament sampling) · Google SynthID documentation · Anthropic Help Center, "How Claude marks AI-generated content" (August 11, 2026) · Anthropic engineering commentary on X (August 11–12, 2026)

Accurate as of August 12, 2026. This explainer describes the general published approach to text watermarking; neither Anthropic nor most providers have published their exact scheme, parameters, or thresholds, so specifics of any individual implementation may differ. Follow @explainx_ai for updates.