How Claude's Invisible AI Watermark Hides in Plain Text

Anthropic has announced that all text generated by Claude will carry invisible watermarks.

Many people’s first thought: plain text is just a string of discrete characters. There are no hidden pixels like in images, nor embedded metadata. Copy and paste it into a notepad, and all you get is plain black text on a white background.

So how do you apply an indelible invisible watermark to a block of text with no embedded markers at all? Is it sneaking zero-width invisible spaces into the content, or hiding secret signals inside formatting? If you run a script to strip all invisible characters in one go, will the watermark still survive?

Digging down to the underlying mechanism, we find a precise system hidden inside the probability gaps of large language models: tournament sampling.

This technique was published in Nature by Google DeepMind back in 2024, named SynthID‑Text.

To understand it, let’s first break down what a large model actually does while generating output. When a model writes a passage, it essentially predicts token probabilities one by one. Every time it produces a word, the model calculates a probability distribution over candidate tokens in its vocabulary.

After filtering via Top‑K and Top‑P, several grammatically valid candidates with nearly identical likelihoods remain. Choosing “immediately” versus “right away”, or “however” versus “but” — these substitutions make no difference to human readers.

A regular large language model simply picks one randomly using weighted probabilities at this stage. But a watermarked model inserts a mathematical lock here. Reading the preceding context and using a non-public cryptographic private key held by the developer, the model generates a pseudo-random seed in real time. A dedicated g-function silently assigns an invisible score to every candidate token. These candidates then enter a pairwise knockout tournament.

Without breaking fluency or readability, the candidate favored by the private key gets a slightly boosted chance of being selected. A single token choice looks completely normal; the text still reads naturally, with no extra spaces or altered punctuation. Once the text reaches dozens of tokens long, however, all these tiny biased choices hidden in probability gaps combine to form a statistical fingerprint that is hard to erase.

For anyone without the private key, it just looks like ordinary natural text. When scanned by detection software holding the private key, the statistical bias that deviates from natural random distribution becomes instantly visible. Even if a few words are deleted, modified, or sentences reordered, the statistical signature remains difficult to remove as long as the core wording stays intact.

Anthropic rolling this out widely ties to the compliance countdown for Article 50 of the EU AI Act. The regulation mandates machine-readable identification for all outputs from generative AI systems.

Most people search for anti-counterfeit labels on the surface of text. The real technical solution never touches raw characters. Instead, it engraves the marker directly into the probability distribution of language generation itself.