A hands-on explainer with a toy vocabulary and sliders.
A language model is a next-word predictor. Given the text so far (the context), it does one thing: estimate for every possible word how likely it is to come next.
The words it can choose from form the vocabulary. Real models have around 200,000 entries called tokens, which are words and pieces of words. For simplicity purposes, on this page every token is a whole word and the vocabulary is at most 100 words.
One step produces a probability distribution. Something like: mango 50%, lychee 30%, papaya 15%, everything else near zero. The model does not always pick the most likely word. It samples: mango wins about half the time, lychee about a third.
Writing text is just repeating this. Predict, sample one word, append it to the context, predict again. Hundreds of times per answer.
That sampling step is the only thing the watermark touches. Everything below builds on this.
Since August 2026, text generated by Claude carries an invisible watermark. The trigger was Article 50 of the EU AI Act, which requires AI-generated content to be machine-readable as such; Anthropic decided to roll it out worldwide rather than only in the EU.
The interesting part is how it works: nothing is added to the text. No hidden characters, no metadata. The watermark sits in which words get picked. A language model writes one word at a time, and at every step it has several plausible options. The watermark biases which option wins, using a secret key.
This page explains the mechanism with a toy model: a vocabulary of at most 100 words, where every token is exactly one word. The method is a simplified version of Google DeepMind's SynthID-Text (published in Nature, 2024), which Anthropic states its watermark is based on. Two parts of this page are interactive, so you can check the claims yourself instead of taking my word for them.
The diagram below shows the five steps for a single word. The model has written “my favourite fruit is” and needs to pick the next word. It considers mango (50%), lychee (30%) and papaya (15%) as the main options:
Detection runs the process in reverse. Given a text and the secret key, the detector recomputes the tag for every word (the context is right there in the text) and counts the tagged fraction. Human text lands near 50% tagged words, because without the key the tags behave like coin flips. Watermarked text lands clearly above 50%. Over a few hundred words, that gap is statistically impossible to hit by chance.
A tag (a g-value in the SynthID paper) is a hash of three inputs: the word itself, the last few words before it (the context), and the secret key. The output is a single bit: tagged or not. Three properties matter:
1. Roughly half the vocabulary is tagged at any given position, because the hash behaves like a fair coin per word.
2. The tagged half re-deals at every position, because the context feeds the hash. There is no fixed list of watermarked words.
3. Without the key, tags are unpredictable, so no writing style can accidentally (or deliberately) hit them more than half the time.
Try switching contexts: the split stays close to half, but different words are tagged each time. This re-dealing is why detection works: your own writing can only hit tagged words by chance.
A real text is not one check repeated a hundred times. Every position is different: the context has moved, the model proposes different candidates with different probabilities, and the tags have re-dealt. Some positions offer no choice at all. After “my favourite” the word “fruit” may be effectively forced, and a forced word carries no watermark signal.
The simulator below makes that concrete by writing an actual (toy) text about fruit. Setup:
· Sentences are built from choice slots (fruit, adjectives, foods — each with its own options and probabilities) and forced words in between (the model has no alternative there)
· At every choice slot, two candidates are drawn from that slot's distribution, tags are computed from the actual preceding words, and the higher tag wins
· Forced words are simply written; their tag is a pure coin flip
· The detector cannot see which words were choices. It counts the tags of all words
Move a slider and the whole text regenerates with fresh draws and fresh tags. In the text, underlined words are choice slots and highlighted words are tagged. Hover (or tap) any word to see what happened at that position: the options, the two drawn candidates with their tags, and the winner.
| group | words | tagged |
|---|
Three things to verify: (1) Words with a real choice come out tagged around 70% of the time, while forced words sit at ~50%. The overall share lands in between, because the detector counts everything. (2) Slide down to a few words: the verdict stays at “no idea” or “inconclusive”. A short answer simply does not contain enough evidence, whether it is watermarked or not. (3) The more forced words a text has (think code, or strict facts), the more words you need before the verdict flips. That is the dilution Anthropic describes for constrained output.
Tags are only labels: half the vocabulary has one, including words with 0.001% probability. Picking directly from the tagged set would regularly produce nonsense.
The tournament avoids that by choosing its two candidates the way the model normally picks its one word: two random samples, weighted by probability. Not the top-2 words. Mango (50%) lands in the pair often, durian (5%) rarely, and sometimes both samples are the same word.
Since roughly half the vocabulary is tagged, the pair itself is luck of the draw, and there are three cases:
· One tagged, one untagged (about half the pairs): the tagged word wins. This is the only case where the watermark does anything.
· Both tagged (about a quarter): the tags cannot separate them, so it is a normal coin flip. The winner happens to be tagged.
· Both untagged (about a quarter): also a normal coin flip. The winner is untagged.
Add it up and when the two draws differ, the written word is tagged about 75% of the time instead of 50%. There is one more case: both draws are the same word, which happens more often when one option dominates. Then the tournament changes nothing and the tag is a plain coin flip. That is why the choice slots in the simulator land closer to 70% than 75%, and why a nearly forced word carries almost no signal. Nothing unlikely ever gets promoted, every word keeps its normal share, and the bias comes in without breaking the text.
At one position, yes: if lychee (30%) is tagged and mango (50%) is not, lychee is favoured there. But tags re-deal every position, so next time mango is just as likely to be the tagged one. Across a whole text it cancels exactly: a word with probability p is written when drawn twice (p²) or drawn against another word and winning what is, averaged over tags, a fair coin: p² + p(1−p) = p. The totals do not move. Watch it happen in the simulator above. DeepMind confirmed it on ~20 million real responses: users rated watermarked and unwatermarked answers identically.
Because the tag has nothing to do with meaning or preference. It is a keyed hash of the word plus its context, so roughly half of all possible words are tagged at every position, and which half reshuffles each time. Writing without the key, you hit a tagged word on a coin flip, whatever your style.
Only whoever holds the key. For Claude, that is Anthropic. Detection recomputes each word's tag and counts. A detection API is announced but not yet public. Also worth knowing: heavy rewriting replaces the tournament-chosen words and washes the mark out. So it proves “this came from Claude”, not “this person did no work”.
Disclaimer. This is a toy model built for intuition, not a reproduction of the production system. The real thing uses a ~200k-token vocabulary, around 30 tag layers instead of one, and multi-round tournaments. It is the same mechanism with bigger numbers, and a stronger signal per word.
References. Dathathri et al., Scalable watermarking for identifying large language model outputs, Nature 634 (2024) · Anthropic, How Claude's text watermarking works (2026)
© Sebastian Panman de Wit