Anthropic's Claude watermark follows SynthID

Anthropic has announced watermarking for Claude outputs, using a method related to Google’s SynthID and to the Gumbel Softmax scheme Scott Aaronson proposed at OpenAI in 2022. Aaronson described the deployment in a post on ScottAaronson, while Anthropic’s detection API remains under development.

At a glance

• The signal changes token selection through pseudorandom preferences, allowing later statistical detection from the text and a generator key alone.
• Translation, emoji insertion followed by deletion, and paraphrasing with an open model can remove token-level watermarks with additional processing.
• Anthropic says detection will eventually be available to anyone, broadening access beyond Google’s more restricted SynthID detector.

Watermarking is becoming a practical layer in the provenance debate around generated text. It does not identify the prompt or expose the model’s sampling probabilities, but can provide statistical evidence that a particular model produced a sequence. The approach is likely attractive because ordinary outputs already occupy a large space of similarly acceptable continuations, leaving room for constrained token choices without an obvious quality penalty.

Claude’s watermark uses randomness that already exists in model output

Large language models normally generate text by sampling among many possible token sequences. A watermark replaces part of that randomness with pseudorandom structure, favoring selected word combinations according to a secret key. The resulting text should remain natural, while the same key allows a detector to test whether the observed token sequence contains the expected statistical pattern.

A detector needs only the sequence of tokens and the pseudorandom generator’s key. It does not need the original prompt, the model’s token probabilities, or access to the generation process. Google’s SynthID uses a related design, and Aaronson credits later work by Christ, Gunn, and Zamir with improving the original proposal to achieve true cryptographic indistinguishability.

Token-level watermarks remain vulnerable to simple transformations

The main technical weakness is that the signal is attached to the token sequence rather than directly to the meaning of the passage. Aaronson lists translation between English and French, asking a model to intersperse emojis and then deleting them, and paraphrasing through an open model as ways to disrupt the detectable pattern.

Recent work on what Aaronson calls semantic watermarking attempts to place the signal at the level of underlying concept vectors instead. He writes that the method appears to work, although it has no theoretical guarantees. A result by Barak and co-authors also suggests that, under plausible assumptions, no watermarking system will be completely foolproof.

Anthropic follows Google and may widen public access to detection

Aaronson says he developed the original scheme in fall 2022, presented it at multiple talks including one at Anthropic, and worked with Hendrik Kirchner at OpenAI, who implemented and tested it. OpenAI leadership later decided against deployment because customers might dislike watermarking and move to a competing model.

Google DeepMind eventually implemented a similar system in all of its Gemini text models, but restricted detector access. Aaronson says this limited its usefulness to academics seeking evidence of student use of generated text, and currently points them toward Pangram, an AI detector that does not use watermarking.

California considered addressing the industry’s collective-action problem through a watermarking mandate, but the adopted measure covered audiovisual content and exempted text. Anthropic now says its Claude scheme will be detectable by anyone, apparently in response to European Union regulations, although the company’s FAQ says the detection API is still being developed.

Public detection is still unfinished

The immediate open issue is access to a working detector, not the basic presence of the watermark in Claude outputs. Anthropic has announced the approach, but has not yet supplied a finished detection API in the source material. Aaronson also says OpenAI suggests it plans to follow the same path, leaving broader deployment and real-world resistance to watermark removal unresolved.