Claude's Invisible Watermark Bakes a Statistical Fingerprint Into Every Sentence It Writes
Hello, I'm Wai Wai.
A few days ago while browsing X, I saw people discussing the topic of "embedding invisible digital watermarks in AI-generated text":
In the future, a sentence you copy from an AI might carry an invisible "ID card" from the moment you copy it.
Following this topic, I found an official announcement from Claude:
This official announcement explicitly states that after August 2, all text output from Claude's entire product line globally will support embedded watermarks:
What exactly is this embedded watermark?
The official explanation is as follows:
Pay special attention to this sentence:
Because the watermark is part of the text, it propagates when the text is copied and pasted elsewhere.
In other words: the text is the watermark, and the watermark is the text; they share a symbiotic relationship.
It's not about inserting invisible characters into the text, or explicitly labeling at the end that this text was generated by AI — those are low-level methods.
Rather, when you ask it to generate a piece of text, the watermark is already inside that text.
For example, in the case below, if it were Claude, the text it replies with would carry an "embedded watermark," but you wouldn't notice it at all:
This is what the official announcement means by: you can't see it, and it doesn't change the meaning, quality, or readability of Claude's response.
Oh, right.
The example above is actually ChatGPT. Why not use Claude?
Don't ask; my account got "clamped."
Anyway, you get the idea.
How It Works
So the question is, how exactly does this embedded watermark work?
A big name on X did a breakdown, and I'll excerpt the key parts for you:
Before understanding this passage, I looked into this person.
He says he is the CTO of GPTZero.
GPTZero is an AI content detection tool, mainly used to judge whether a piece of text "looks like it was generated by AI."
This is their official website:
They also built an interesting website that detects the proportion of AI-generated content across various platforms:
For example, on X, 12.3% of the content it scanned was 100% AI-generated.
This website also has a prediction that in five years, 100% of content on LinkedIn will be AI-generated:
So, although the official source hasn't disclosed the core principle of the "embedded watermark," the technical analysis done by GPTZero's CTO should be pretty close.
Let's look again at what this guy said:
Just a few words, but it's essentially the complete technical principle.
To put it simply: when using AI to generate text, each time it chooses the next word, it slightly increases the weight of a subset of words. The watermark detector also knows this "weight adjustment rule."
When you run AI detection on a piece of text, if you find that the AI particularly favors a certain set of words, and the weights of this set have been adjusted, you can conclude that the text likely comes from a watermarked model.
It's okay if you don't understand; I'll give you an example shortly.
You just need to know that the "embedded watermark" doesn't stuff special characters into the text, nor does it change the intended meaning of the sentence. Instead, it hides the watermark in the "word selection pattern," and the detection mechanism statistically analyzes this "pattern."
Let me give a simple example.
Suppose the vocabulary only has 10 words:
Apple, Banana, Orange, Grape, Car, Airplane, Train, Computer, Phone, Novel
Then we have a secret rule that divides these words into two parts.
One part is:
Apple, Orange, Car, Computer, Novel — let's call this the "Green Set."
The other part is:
Banana, Grape, Airplane, Train, Phone — let's call this the "Red Set."
So, the Green Set and Red Set each account for 50%.
The names Green Set and Red Set are just labels with no special meaning. If you prefer, you can call them Set A and Set B, or Upper Set and Lower Set.
Normally, if the AI chooses words randomly, the probability of picking from the Green Set or Red Set is 50-50.
For example, let it randomly choose 100 fruits.
Following the 50-50 logic, the result might be:
- 25 Apples from the Green Set
- 25 Oranges from the Green Set
- 25 Bananas from the Red Set
- 25 Grapes from the Red Set
The Green Set and Red Set each account for half.
But, if I secretly add a rule to the AI: each time it chooses a word, slightly increase the sampling probability of tokens from the Green Set.
Then the result might be:
- 35 Apples from the Green Set
- 35 Oranges from the Green Set
- 15 Bananas from the Red Set
- 15 Grapes from the Red Set
The Green Set's proportion rises to 70%, while the Red Set's drops to 30%.
If we feed this result to the detector, the detector will have a question:
If this were completely random text, why does the Green Set appear 70% of the time, instead of close to 50%?
This deviation is too large to likely be caused by random fluctuation.
Something is very, very off.
There can only be one answer: the model that generated this text did it intentionally.
The purpose is to let the detector perceive that the proportion of Green Set words in this text is problematic.
And this "problematic proportion" is the watermark left by the large model.
So the question arises.
If the Green Set is always "Apple, Orange, Car, Computer, Novel," wouldn't various experts easily discover it after some analysis?
If you also had this question, you've hit the nail on the head.
Look at what the expert said:
This means that for every token generated, the Green Set changes.
And what determines how the Green Set changes is "preceding text + secret key."
Let me give another simple example.
Suppose the AI has already output: "The article written by Wai Wai"
Now it needs to generate the next token.
The algorithm takes the previously generated tokens and a secret key, and performs a hash calculation:
Hash(preceding text + secret key)
Suppose the hash result is 856746212.
This number can serve as a "random seed."
Then, using this random seed, the vocabulary is shuffled.
Suppose the original vocabulary is:
Not bad, Very good, Good-looking, Extremely awesome, So-so, Really good, Okay, Passable.
After shuffling, it becomes:
Extremely awesome, So-so, Really good, Not bad, Okay, Passable, Very good, Good-looking.
Then the first 4 become the Green Set, and the last 4 become the Red Set.
It's worth noting that for the sake of writing this article, I used Chinese phrases in the vocabulary. In practice, these would likely be specific tokens.
Earlier we agreed to make the model prefer the Green Set, so the model ultimately chooses "Extremely awesome."
Put together, it becomes: The article written by Wai Wai is extremely awesome.
When the AI generates the next token again.
The "preceding text" in the Hash algorithm has changed, the hash value has changed, and the shuffling logic of the vocabulary will also change due to the change in hash value.
Therefore, at each token position, there could be a completely different Green Set and Red Set.
Additionally, there is a very crucial element here: the "secret key."
Think about it, what would happen without the secret key?
Everyone would know the calculation rule: "preceding text → Hash → Green Set."
Then an attacker could calculate the Green Set for each position themselves and specifically avoid those words.
The watermark would naturally be easy to destroy.
But with the secret key, the situation is completely different.
When the AI generates text, it uses this secret key to decide which tokens belong to the Green Set for the current round.
When it's time for detection, the detector uses the same secret key to recalculate the Green Set at that time, and then statistically analyzes whether this text significantly favors the Green Set.
So what's truly important isn't the "Green Set" itself, but that only those who possess the secret key can know which words belonged to the Green Set at a specific position.
Throughout the process, the Green Set is dynamic, and the secret key determines how the Green Set changes.
The secret key — since it's called a secret key — is definitely hidden, well-protected, and not easily compromised.
Under this mechanism, the Green Set and Red Set are very difficult to reverse-engineer.
If you still don't understand at all, let me give you a plain-language version.
What is an embedded watermark?
You can simply and crudely understand it as: put half of all words on List A, and half on List B. Under normal circumstances, after writing an article, the total word count statistics would show that List A and List B should each account for about half, with no significant deviation in proportion.
However, if it's Claude after supporting "embedded watermarks," the article it writes might have 70% of its vocabulary belonging to Set A.
During detection, if the proportion of Set A and Set B deviates too much from 50%, you can highly suspect that this text comes from a large model using the corresponding watermarking mechanism.
And during the writing process, it will randomly re-divide the sets based on the preceding words and a secret key.
This explanation is very crude, but it lets you grasp the essence that "the watermark is the word selection pattern."
So, based on the various explanations above, you should understand that operations like manually retyping Claude's output or running it through OCR image recognition will not remove the watermark.
At this point, you should probably get a sense of it.
Look again at what I said earlier: the text is the watermark, and the watermark is the text; they share a symbiotic relationship.
Now you know I wasn't just making things up.
Ways to Break It
After understanding the underlying principle, you should actually know that this thing is not easy to break.
The most easily thought-of way to break it is to change a few words in the AI-generated text — wouldn't that destroy the watermark?
Rewriting can indeed achieve the effect of destroying the watermark, but the effect isn't as good as you might imagine.
Because the watermark isn't a few specific words, but a probability.
For example, if AI-generated text has a Green Set proportion of 75%, and after you modify a few places, the proportion becomes 66%.
Then the AI text watermark can still be detected.
Of course, if you completely rewrite it, causing the Green Set to drop to around 50%, then the AI detection will pass.
But the workload for that is not small.
Currently, Claude's official side has not yet released a detection tool for text embedded watermarks.
When such detection tools are released to the internet, they might be reverse-engineered to some extent.
However, on GitHub, a quick-handed guy has already cobbled together a "watermark remover":
But the description of this tool also explicitly states:
Since the official side hasn't provided a dedicated checking tool yet, he can only do his best to destroy the watermark through methods like rewriting and translation:
When the official detection tool is released, it will be another exciting battle of attack and defense.
This Is a Good Thing
Regarding the matter of AI adding embedded watermarks to text, my personal view is:
Overall, I think adding such embedded watermarks to AI-generated content is a good thing.
I even feel that this might just be the beginning.
Previously, when we judged whether a piece of text was written by AI, we relied more on a "feeling" of whether it seemed like it, purely relying on personal intuition to detect an "AI vibe."
Now, with embedded watermarks, the corresponding verification tools might soon be available to the public.
When verification tools are available to the public, someone will definitely study how to attack them.
But "attack and defense" is the normal state of technological development.
When you have a new attack method, the watermark scheme will also continue to upgrade.
This is destined to be a long-term battle of attack and defense.
Who attacks and who defends, I actually don't care.
What I truly look forward to is that it can go a step further in this process.
In the future, don't just tell me: this is content with traces of AI.
Instead, tell me: approximately 30% of this content was generated or modified by AI.
Or even directly tell me: which parts were generated by AI, which parts were written by a human, and which parts were modified by AI.
Because this is what truly solves the problems we might face in the future.
For example, suppose I write an article.
The article is written by me, but after finishing it, I throw it to the AI and ask it to check for typos, adjust awkward sentences, and polish a few expressions.
If the final detector tells me: this article is AI-generated.
Then I would definitely feel wronged.
So I think what AI text embedded watermarks should truly solve is not simply and crudely distinguishing "AI" from "human," but making the content production process more transparent.
Who wrote it.
Who modified it.
How much did the AI participate.
How much did the human participate.
If this information can be reliably recorded in the future, then when we face AI-generated content, we won't need to rely on guesswork anymore.
This might be where the true value of AI watermarks lies.
Because after entering the AI era, what we lack has never been content.
What we truly lack is trust in content.