Claude AI Text Watermarking Explained: How It Works, Detection, and the Arms Race to Remove It
How Claude embeds invisible statistical watermarks in generated text — and why they're hard to make bulletproof.
AI text watermarking works by splitting the token vocabulary into green and red lists during sampling, subtly boosting green-list token probabilities to leave a hidden statistical fingerprint. Detectors reproduce the same hash-based split and compute a z-score over green-list token frequency to flag watermarked text. However, the technique faces serious robustness challenges — paraphrasing with another LLM can largely erase the signal. The inherent tension between watermark strength and output quality, combined with an ongoing arms race against removal attacks, means watermarking is best treated as one layer of a broader governance strategy rather than a definitive solution.
Why AI-Generated Text Needs Watermarks
As text produced by large language models becomes increasingly indistinguishable from human writing, identifying whether a given passage was AI-generated has become a central challenge for both academia and industry. From preventing academic fraud and curbing misinformation to protecting the health of content platforms, AI text watermarking technology is being looked to as a key solution.
Recently, a 48-minute in-depth video analysis systematically broke down how large models like Claude embed invisible watermarks during text generation, and further explored the technical details of watermark detection and removal. This article, based on that material, outlines the core logic and real-world challenges behind AI text watermarking.
Text watermarking doesn't mean adding visible marks to the surface of the text. Instead, during the model's generation process, subtle adjustments to token selection leave a statistical "fingerprint" in the output. This fingerprint is completely imperceptible to ordinary readers, yet can be precisely identified by dedicated detection algorithms.
Understanding Watermarking Through Token Sampling
To understand how AI text watermarking works, you first need to understand how large language models generate text. At each step, when predicting the next token, the model computes a probability distribution over every candidate token in its vocabulary, then selects one via a sampling strategy (such as top-k, top-p, or temperature sampling).
The Green List / Red List Mechanism
The classic approach to watermarking is to randomly split the vocabulary into a "Green List" and a "Red List" before sampling. This split is typically determined by a hash function applied to the previous token, making it pseudorandom. During generation, the model applies a small upward weight to the probabilities of green-list tokens, making them slightly more likely to be selected.
As a result, AI-generated text will statistically tend to use more green-list tokens. For human-written text, since the author has no knowledge of this partitioning rule, the proportion of green-list tokens should be close to random (roughly 50%). In AI-watermarked text, however, the green-list proportion will be noticeably higher — and that deviation is the key detection signal.
The Trade-off Between Watermark Strength and Text Quality
The video emphasizes a core tension: the larger the weighting boost applied to green-list tokens, the easier it is to detect the watermark — but the more it degrades text quality. If the model is pushed too heavily toward green-list tokens, it may be forced to select suboptimal tokens, resulting in stilted or unnatural output. In practice, deployments must find a careful balance between detectability and generation quality.
The Statistical Foundations of Watermark Detection
Detecting an AI text watermark is fundamentally a statistical hypothesis testing problem. A detector iterates through the text under examination, reproduces the green-list / red-list partitioning process, and counts the number of green-list tokens that actually appear.
If a text was written entirely by a human, the green-list token count should follow a binomial distribution, with an expected value of roughly half the total token count. Watermarked AI text, by contrast, will have a green-list token count that clearly exceeds this expectation. By computing a z-score or p-value, the detector can quantify "how far this text deviates from random" and determine whether a watermark is present.
One thing worth noting: the longer the text, the higher the detection confidence. For short texts of only a few dozen tokens, statistical noise is significant and the risk of false positives rises considerably. For texts of several hundred tokens or more, detection accuracy can reach quite reliable levels.
Watermark Vulnerabilities and Removal Attacks
The second half of the video digs into the robustness problem — which is also the most serious challenge currently facing AI text watermarking.
Common Watermark Removal Techniques
The most straightforward attack is paraphrasing. An attacker can use another language model to rewrite the original text using synonymous phrasing, scrambling the existing token sequence and breaking the hash-based dependency between tokens and list membership. After a single round of paraphrasing, the watermark signal often degrades substantially or disappears entirely.
Simple editing operations — such as swapping synonyms, reordering sentences, or inserting and deleting words — can also weaken watermarks to some extent. An attacker need only modify a sufficient proportion of the tokens to bring the green-list statistics back toward a near-random level.
The Ongoing Cat-and-Mouse Game
This exposes a fundamental dilemma for watermarking: it is an ongoing adversarial arms race. Researchers continue to design more robust watermarking schemes — for example, watermarks based on semantics rather than surface-level tokens, or more sophisticated hash-window strategies — while attackers keep finding new ways to circumvent them. No single scheme has yet managed to resist all known removal attacks while also preserving text quality.
Practical Considerations Beyond the Technology
The value of watermarking should not be judged solely by whether it can be broken. For the vast majority of ordinary users, who have no motivation to remove watermarks, the technology still offers genuine practical value in governing large-scale, low-effort AI misuse — such as bulk generation of spam content or automated academic cheating.
However, for adversaries with strong motivation and technical capability, watermarks are unlikely to form a reliable line of defense. This means we cannot place all our hopes for AI content attribution on watermarking alone. Instead, it should be treated as one layer within a multi-tiered defense system, combined with behavioral analysis at the platform level, account reputation mechanisms, and other complementary measures.
For AI companies like Anthropic, whether and how to deploy text watermarking also involves complex commercial and ethical considerations: a watermark that's too strong may harm the user experience, while deploying no watermark at all may invite regulatory pressure. This tug-of-war between technology and governance is sure to continue for a long time to come.
Related articles
DeepSeek V4 Pro Burning Through Credits Too Fast? The Hidden Logic Behind AI Model Pricing
Why does DeepSeek V4 Pro drain credits so fast while Flash barely moves? A deep dive into AI token billing, Pro vs. Flash pricing differences, and cost optimization tips.
RealPDE Competition Breakdown: The Frontier Challenge of AI-Powered Real-World Fluid Dynamics PDE Solving
A deep dive into the NeurIPS 2026 RealPDE Competition, covering the Sim2Real and LTTTA tracks, and how neural operators tackle real-world PIV and CFD fluid PDE challenges.
Building a Production-Grade 3DGS Training Library from Scratch: A Deep Dive into Full-GPU Residency and the Vulkan Stack
A veteran graphics engineer builds a production-grade 3DGS training library from scratch using C++23, CUDA, and Vulkan, achieving 60fps with 5M splats. Deep dive into its architecture and design.