an interactive explainer (~15 minutes)
by Lawrence Feng and Claude Design
In August 2026 Anthropic announced that future Claude models will carry a watermark in their text.
This sort of watermark is unlike the image watermarks which you might be familiar with. LLM watermarks involve no shift in style or planting of hidden characters1. So then, how is it possible? This method relies on the particular way in which LLMs work, and it's surprisingly intuitive!
This explainer requires no prior knowledge about language models!
In this explainer, I'll explain Google's SynthID watermarking method. Google has been quietly running it in Gemini since 2024, serving millions of users. Anthropic has stated that their watermarking algorithm is based on this same technique.
Let's get started!
First, we'll want to understand how LLMs generate normal, unwatermarked text.
A typical language model generates one word2 at a time. To generate the next word, the model reads all words written down already, then provides guesses for the next potential word.
Those guesses come in the form of probabilities. Often there are many reasonable continuations. Here the model considers overcast to be the best continuation, though the model considers grey and wet to be reasonable too.
Every word in the model's vocabulary gets a probability. Most words will get assigned a probability near zero because they don't make any sense.
In all, the job of LLMs is to generate probability distributions over all possible words in its vocabulary!
What next? Does the model finalize its guess for us? Actually no.
The model is finished doing any work. It's now up to whoever is running the model (e.g. Anthropic) to pick a word.
Then they'll write that choice down, the model will read all words written down, generate guesses for the next word, and repeat.
Picking the word is referred to as sampling from the model's probability distribution.
Let's see how that works...
Sometimes the choice is made for us. If the model puts 99% on the word the, then we'll write the. Easy!
Sometimes the choice is ambiguous. Here, the model puts 50% on happy and 50% on sad. Well then, let's decide by flipping a coin!
But what if there are more than two options? Say the model splits its guess evenly across four words…
We can pair the words off and flip a coin for each pair…
…and flip once more between the winners. Like a tournament! Every word still has an equal chance of coming out on top.
This method can be used to sample from any general distribution, not just uniform ones where every word has equal chance.
Let's convert the guesses into lottery tickets. If the model assigns overcast a 40% probability, then we'll give overcast 4 out of 10 available tickets.
Now forget the axes and line the tickets up. Pair them off at random and flip a coin for each pair. The winner move up to the next level of the bracket. Keep going until a single ticket reaches the top.
Each word wins the tournament with exactly its probability. We've simply devised a way of making a choice from the model's guesses via a sequence of coin flips.
How does a computer flip a coin? You might've heard of random number generators. Random number generators are not truly random; they are pseudorandom! They appear to generate random numbers, but are actually deterministic.
If you've ever played Minecraft, you'll recall that creating a world starts with a random seed. These random seeds can be used to produce infinite worlds, but if you gave me the same seed, I could produce the same exact infinite world.
Perhaps you can see where we're going with this...
In practice, every coin we flipped in the section above is done using pseudorandomness. This is how normal LLM generation works; we haven't yet gotten to watermarking!
Given the seed, we can reproduce the same coin flip.
Watermarking makes a small change. To implement watermarking, the model developer will seed the flips deliberately, with a secret key and a few other parameters. With the secret key, only they can reproduce the coin flips.
And to everyone else? Without the key, the outputs are provably indistinguishable from fair coin flips.
Pseudorandomness underlies LLM watermarking. When watermarking is used, every token is chosen from the model's guesses in a way indistinguishable from unwatermarked generation3.
We finally have all the ingredients we need.
The watermarking procedure begins, like before, by drawing a few words from the model's distribution. Again, a likely word will have more tickets and will be drawn more often.
Now, let's run the tournament.
Let's flip!
We'll provide the appropriate inputs to our pseudorandom flip function. Other than the secret key, those other parameters include the word under consideration, and the round of the tournament.
Here, the candidate word is grey, and we're on round 1. The flip function returns heads! Again, the flip function is deterministic yet gives us 50/50 odds!
…and now we flip a coin for each of the rest of the candidate words.
But wait... why are we flipping a coin for every word now?
Let me explain.
To enable watermarking, we'll have to make a slight change to our tournament procedure.
Instead of flipping one coin to decide between two words, we'll flip a coin for every word. Then, the winner between the two words is the one that lands heads. If both land tails or both heads, we'll break the tie arbitrarily.
The chance that either tokens wins is still 50/50! But the chance that the winner is heads is 75%. .
It's important that each word at every round of the tournament gets a heads or tails. We'll see why.
The champion has been chosen!
Here it is grey. Notice what it took to get there. The winning word had to beat out every other word.
That means that the watermarked word is the one is the one that repeatedly flipped heads (except for ties between tail flips).
Under the secret key, the champion word carries better than a 1 in 2 chance of heads across all rounds of the tournament.
In fact, as we increase the number of tournament rounds, which we can do by drawing more tickets from the model's token distribution, then the champion word would have to had survived more coin flip battles. This packs more watermark evidence per token.
Someone hands the model developer a piece of text. They want to know whether or not one of their models generated it.
How can we detect watermarked text? Well, we said that the tokens chosen by the watermarking algorithm are the ones that tend to flip heads according to our secretly seeded pseudorandom coin flipper.
So, what if we just flipped the same seeded pseudorandom coin for every word in our piece of text?
And remember, the flip function required us to provide a candidate word, a round number, and the secret key. Let's start with the first word, The, and flip its coin for rounds 1, 2, and 3.
We're basically simulating what would have been The's journey through the tournament.
Our detection algorithm doesn't actually need to know how the tournament played out during the watermarking process. But if The was written down, it must have survived every round, all the way from the bottom to the top.
Now, let's flip coins for all our words and all rounds.
If the text is watermarked, then these coins should flip heads a suspicious number of times.
Now, gather every coin into two piles, heads and tails. Our score is simply the fraction of all flips that landed heads.
As you might infer, the more text we have, the more coins we can flip, and the more evidence we can gather for and against the text having been LLM generated.
Mathematically, the score function looks like this, where T is the number of tokens and m is the number of rounds in the tournament of words. We count the number of heads that show up, and divide by the total number of flips4.
If we process unwatermarked text, the score falls around 50%. Each dot here corresponds to the score of an ordinary, unwatermarked document. That document could be human or machine-generated, from a different developer or from a locally-hosted model. They pile up around one half.
But when we score watermarked text, the fraction of heads indeed shows up significantly more than 50% of the time.
We can compute the scores across tons of text, and determine what a reasonable boundary is so as to not falsely label unwatermarked text.
And that's it! Now we know how to generate watermarked text and how to detect it!
Nope! Indeed, there are other watermarking schemes that secretly boost some words and suppress others.
But remember what happened above. SynthID never changes the probability distribution produced by the language model.
Actually, no.
There is one subtlety. Even though the watermark doesn't systematically push the model toward particular words, it can still make different responses slightly more alike.
Remember that the secret coin flips are reproducible. If the same context appears in two different responses, the watermark will make the same secret coin-flip assignments again. As a result, watermarked responses can be slightly more similar to one another than they otherwise would be.
The original SynthID work discusses ways of removing these correlations and obtaining stronger forms of non-distortion. The version we've explained here focuses on the simpler guarantee.
No. As we've seen, there is nothing hidden between the words, no invisible Unicode, and no added metadata.
Exactly!
Flipping a fair coin four times and getting three heads is completely unremarkable. On the other hand, flipping it 1,000 times and getting heads 75% of the time is very suspicious.
This is why, in practice, the detection threshold depends on how much text you have. The detector accounts for how much evidence it has when deciding what counts as suspicious.
Not necessarily. Remember our pile of lottery tickets. If you ask Claude to reproduce text you wrote, word for word, nearly every ticket in the tournament will correspond with the same word, because the model, being competent at the task, will put 100% of its guess on the word you've given and requested it to say back to you.
The tournament then has no real choice to make. Every battle is a tie. Remember, flip returns heads or tails based on three inputs: the secret key, the round, and the candidate word. Within a round, identical tickets all flip the same way, so every faceoff is a draw.
So the winning words aren't being selected because they got heads. Their flips stay roughly 50/50, just like unwatermarked text.
If Claude substantially rewrites the text, however, the tournament begins to 'make' choices, and evidence of the watermark will begin to accumulate. Intuitively, the less the writing is yours, the more the detector will flag it.
There are a lot of opinions on this, so I'll provide mine briefly :). I might share more at a later time.
First, the internet is becoming filled with AI writing. It would be great to know if text came from (a particular) AI. If the writing was autonomously generated, we should give attribution to the AI that wrote it. If human ideas were 'translated'5 by AI, then AI should be credited as a translator, just like how we credit human translators.
Second, just because something was generated by AI, doesn't mean it is not worth our time. Suppose someone uses Gemini or Claude for translation. It is likely that this will result in watermarked text; however, readers should not automatically dismiss the intent and meaning of the text. Further, AIs may one day be capable of substantial original and compelling thought, if they aren't starting to already (in the form of novel proofs).
So, then. What is the point of knowing if something is AI if you have to read it to find out if it is slop?
Simply because it is a form of verifying authorship or coauthorship. In any case, LLM use should be disclosed openly. Watermarking prevents stolen authorship. It prevents students from claiming ownership over work that was co-authored at best. If an AI was used for language translation, there should be no shame in acknowledging that an AI was used; this criticism of shame and shaming applies to writers and readers, respectively. Translation of any sort, language translation or synthesis of dictated ramblings, involve interpretation and misinterpretation. The structure, voice, style, and diction of a text are intertwined with the ideas themselves. We should acknowledge that.
It's true that public opinion about AI is quite negative, and thus AI-use disclosure is often met with backlash or dismissal. This is something that we should all work to overcome, though I acknowledge that AI content often ranges from uninteresting to wrong to malicious.
Numbers in the demonstrations above are illustrative. Real vocabularies have around 100,000 entries and real tournaments run more layers. The mechanism is shown faithfully.