Claude Watermark Playground

1 · Introduction

Since August 2026, Claude watermarks the text it generates: models launched after 2 August 2026 do it from day one, and older models are being updated over the coming months. The trigger was Article 50 of the EU AI Act, which requires AI-generated content to be machine-readable as such; Anthropic decided to roll it out worldwide rather than only in the EU.

The interesting part is how it works: nothing is added to the text. No hidden characters, no metadata. The watermark sits in which words get picked. A language model writes one word at a time, and at every step it has several plausible options. The watermark biases which option wins, using a secret key.

This page explains the mechanism with a toy model: a vocabulary of at most 100 words, where every token is exactly one word. The method is a simplified version of Google DeepMind’s SynthID-Text (published in Nature, 2024), which Anthropic states its watermark is based on. Two parts of this page are interactive, so you can check the claims yourself instead of taking my word for them.

2 · The process

The diagram below shows the five steps for a single word. The model has written “my favourite fruit is” and needs to pick the next word. It considers mango (50%), lychee (30%) and papaya (15%) as the main options:

Detection runs the process in reverse. Given a text and the secret key, the detector recomputes the tag for every word (the context is right there in the text) and counts the tagged fraction. Human text lands near 50% tagged words, because without the key the tags behave like coin flips. Watermarked text lands clearly above 50%. Over a few hundred words, that gap becomes statistically extremely unlikely to occur by chance.

3 · The tagging process

A tag (a g-value in the SynthID paper) is a hash of three inputs: the word itself, the last few words before it (the context), and the secret key. The output is a single bit: tagged or not. Three properties matter:

1. Roughly half the vocabulary is tagged at any given position, because the hash behaves like a fair coin per word.
2. The tagged half re-deals at every position, because the context feeds the hash. There is no fixed list of watermarked words.
3. Without the key, tags are unpredictable, so no writing style can accidentally hit them more than half the time.

Try switching contexts: the split stays close to half, but different words are tagged each time. This re-dealing is why detection works: your own writing can only hit tagged words by chance.

4 · A whole text, word by word

A real text is not one check repeated a hundred times. Every position is different: the context has moved, the model proposes different candidates with different probabilities, and the tags have re-dealt. Some positions offer no choice at all. After “my favourite” the word “fruit” may be effectively forced, and a forced word carries no watermark signal.

The simulator below makes that concrete by writing an actual (toy) text about fruit. Setup:

· Sentences are built from choice slots (fruit, adjectives, foods — each with its own options and probabilities) and forced words in between (the model has no alternative there)
· At every choice slot, two candidates are drawn from that slot’s distribution, tags are computed from the actual preceding words, and the higher tag wins
· Forced words are simply written; their tag is a pure coin flip
· The detector cannot see which words were choices. It counts the tags of all words

Move a slider and the whole text regenerates with fresh draws and fresh tags. In the text, underlined words are choice slots and highlighted words are tagged. Hover (or tap) any word to see what happened at that position: the options, the two drawn candidates with their tags, and the winner.

5 · FAQ