How Claude's Invisible Text Watermark Works

Starting August 2, 2026, Anthropic began enabling a major capability for newly released Claude models: generated text is watermarked at the model level. That means whether you use Claude on the web, Claude Code, the API, or other Claude surfaces, the output can carry the same mark. Older models are also expected to gain marking support gradually during the transition period.

Anthropic help article: How Claude marks AI-generated content
Figure: Screenshot from Anthropic's official help article on how Claude marks AI-generated content.

This watermark is very different from the watermarks people usually notice. It does not insert special characters, does not hurt readability, and is effectively invisible to humans. Only a machine that knows the right key and detection method can reliably find it.

Anthropic's public write-up is deliberately restrained and does not disclose the exact algorithm. But from the behavioral properties it does disclose, the system looks a lot like a classic statistical / token-level watermark applied during generation — the same family of methods we have been working on as well.

What Anthropic explicitly said

A few points from the official disclosure matter most:

The watermark is woven directly into the text itself, and it is added at the model level. So it can appear across Claude, the API, Claude Code, Cowork, and related surfaces.
The watermark travels with copy-paste, and may persist through some editing.
By contrast, heavy rewriting, paraphrasing, translation, or mixing into other writing may make detection fail. Very short passages may also lack enough signal.

Those properties line up closely with classic LLM token-probability watermarking.

How it most likely works

When a normal LLM generates the next token, it first produces a probability distribution over candidates, for example:

today     0.20
weather   0.15
very      0.12
good      0.08
nice      0.07
...

A watermarking algorithm does not insert weird characters. Instead, at each generation step, it uses a secret key + previous tokens (context) to randomly split the vocabulary into two sets:

Green List

weather
very
nice
...

Red List

today
good
because
...

It does not force Claude to pick only from the Green List. It quietly boosts the logits of green tokens by a small bias:

original logits:
weather   2.7
very      2.5
nice      2.3
good      2.2

watermarked logits:
weather   2.7 + δ
very      2.5 + δ
nice      2.3 + δ
good      2.2

Mathematically, this is roughly:

G_t = PRF(secret_key, context_t)

logit'(v) =
    logit(v) + δ    if v ∈ G_t
    logit(v)        otherwise

Then sampling continues as usual.

What you see is still ordinary text, for example:

Recent progress in large language models has been remarkably fast, and one direction worth watching is...

Visually and in Unicode, everything looks normal. Statistically, though, Claude chooses the "correct" group of tokens unusually often.

That is exactly the classic LLM watermark idea: randomly create a green token set at generation time, slightly raise those tokens' sampling probability, then detect the bias with a statistical test.

How detection works

The detector holds the same secret key.

Suppose it receives an article of about 1000 tokens:

token1 token2 token3 token4 ...

It replays the process token by token:

context1 → GreenList1  → chosen token: Green ✓
context2 → GreenList2  → chosen token: Green ✓
context3 → GreenList3  → chosen token: Red
context4 → GreenList4  → chosen token: Green ✓
...

For ordinary human text, the green-hit rate should be around:

~50%

But if detection finds:

Green tokens: 650 / 1000  →  65%

that rate is already highly suspicious.

When the test statistic satisfies:

z > threshold

the detector concludes:

Watermark detected

So the question is not:

Is there a special hidden string?

It is:

Does this long token sequence show an abnormal pattern that only someone with the secret key could have produced?

That framing also explains several of Anthropic's carefully worded claims.

Why copy-paste keeps the watermark

The pipeline looks like this:

Claude output
↓
token sequence
↓
paste into Word / chat / web / TXT
↓
the words stay the same
↓
the token sequence stays essentially the same
↓
the watermark remains

Anthropic explicitly says copy-paste carries the watermark. That is not because hidden characters were added. It is because the token-choice pattern inside the text itself did not change.

Why light editing may still be detectable

Suppose the original text has 1000 tokens:

650 green

After you edit 100 tokens:

900 tokens remain
maybe ~580 of them are still green

The statistical signal can still be strong. That is why Anthropic's wording is precise:

may persist through some editing

In other words, after light edits, the watermark may still survive.

Why full paraphrasing can erase it

The green list likely depends on:

secret key + previous tokens / context

Take this sentence:

Artificial intelligence is developing rapidly.

Rewrite it as:

AI technology has advanced at an extraordinary pace.

Not only are the current tokens all different — the previous-token context also changes:

previous token changes
↓
PRF input changes
↓
all later green lists change

The whole statistical structure breaks. Anthropic also lists these cases as ones that may make the watermark undetectable:

heavily edited
paraphrased
translated
mixed into other writing

Why short text is hard to detect

This is one of the strongest clues that the mark is statistical.

With only 10 tokens:

7 / 10 green

that can easily be random chance.

But:

650 / 1000 green

is extremely unlikely under a fair coin.

That is why Anthropic notes that when a

passage is very short, leaving too little text for a reliable signal

detection may fail. That matches statistical watermarking closely: signal strength depends on sample size.

Bottom line

What Claude shipped is not a human-visible label. It is a statistical fingerprint woven into the sampling process:

To humans: nearly invisible, and it does not hurt reading
To machines: detectable when the text is long enough and not rewritten too aggressively
Across products: because it is added at the model level, web, API, Claude Code, and related surfaces can all carry it

Anthropic has not published the full algorithm. But the behavioral boundaries it disclosed already look a lot like classic LLM token watermarking. Understanding that helps set realistic expectations for provenance, academic integrity, and platform governance: the method is powerful, but not magic. It can survive copy-paste and light editing, and it can still fail under heavy rewriting, translation, or very short text.