AI Programming · AIGC · Frontend

Anthropic's Invisible AI Text Watermarking and the KGW Algorithm Behind It

By 李剑一 · Aug 13, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Platform-level AI text watermarking is shifting from research to product. If Anthropic ships KGW-style statistical watermarking, every Claude output carries a detectable provenance signal that persists through copy-paste — but the same technique breaks under heavy editing or short snippets, and a removal industry is already forming.

Summary

Anthropic plans to embed an invisible, machine-only watermark into text generated by Claude models released after August 2. The watermark survives copy-paste and light editing without degrading readability. The company's description closely matches two existing approaches: zero-width character watermarks and LLM statistical semantic watermarks.

The more sophisticated method, detailed in the Kirchenbauer 2023 KGW algorithm, never modifies literal text. Instead, it splits the model's vocabulary into a Green List and a Red List at each generation step using a hashed seed, then adds a small bias to Green List token scores. This nudges the model toward Green words, creating a statistical fingerprint detectable via a Z-test without any human-perceptible change in output quality.

A Python demo included in the post simulates the KGW algorithm end-to-end, showing how a Z-score above 3 reliably flags watermarked text while human rewrites of just a few tokens collapse the signal. The technique struggles with very short text, heavily edited passages, and languages with complex semantics like Chinese, where synonym substitution can subtly distort meaning.

Takeaways

— Anthropic will embed watermarks into Claude-generated text starting with models released on or after August 2, 2025.

— The watermark is invisible to humans, survives copy-paste, and resists light editing.

— Two candidate techniques fit the description: zero-width character watermarks and LLM statistical semantic watermarks.

— The KGW algorithm biases token selection toward a hashed Green List at each generation step, creating a statistical fingerprint.

— Detection uses a Z-test on Green token frequency; a Z-score above 3 signals high-confidence AI generation.

— Statistical watermarking cannot detect AI text that was written before the watermark was applied.

— Heavy editing, synonym replacement, and very short text all degrade or destroy the watermark signal.

— Chinese text is especially vulnerable to semantic distortion from token-level bias because of its context-dependent meanings.

— A Python demo in the post reproduces the full KGW generation and detection pipeline with a 16-word simulated vocabulary.

— An industry for removing Anthropic watermarks is reportedly already emerging in the US.

Conclusions

Anthropic's announcement validates statistical watermarking as the likely production path over zero-width characters, since it requires no text modification and leaves no visible artifacts.

The KGW approach creates an inherent tension: stronger watermark signals (higher DELTA) improve detection but risk degrading output quality, especially in languages where synonym choices carry different connotations.

Watermarking only future outputs means the entire corpus of pre-August-2025 AI text remains unmarked, limiting the technique's usefulness for historical provenance.

A removal industry springing up before the watermark even ships suggests the detection arms race will follow the same pattern as ad-blocking and CAPTCHA solving.

Concepts & terms

KGW Red-Green List Algorithm

A statistical watermarking method that splits a language model's vocabulary into a Green List and Red List at each generation step using a hashed seed. A small bias is added to Green token scores, making them more likely to be selected. Detection counts Green tokens and applies a Z-test to determine if the bias is statistically significant.

Zero-Width Character Watermark

An invisible watermarking technique that inserts Unicode zero-width characters (like zero-width space or zero-width joiner) into text. These characters are invisible to human readers but can be extracted programmatically. Unlike statistical watermarking, this method modifies the actual character stream.

Z-test in Watermark Detection

A statistical hypothesis test used to determine whether the observed proportion of Green List tokens in a text deviates significantly from the expected random proportion (typically 50%). A high Z-score (commonly >3) indicates the text was likely generated with watermark intervention rather than by chance or a human.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗