Anthropic Watermarked the Dice, Not the Words

Measured: 1.80 against a 1.50 chance baseline across 300 tokens.

Two paragraphs of Claude output sit side by side. One carries a watermark. Nothing has been inserted into it, no character has been swapped, and no reader can tell them apart. Anthropic can still put a number on which of the two its model wrote.

The reason that works is the piece most coverage skipped. The mark does not live in the model, and it does not live in the words. It lives in the coin flip that settles which of two equally good words comes next.

Every measurement below the mechanism section comes from that recorded run: a real model, a real sampler, and a scorer counting bits over 300 tokens.

Anthropic published its plan on August 11 and the mechanism explainer on August 14. Claude models launched on or after August 2, 2026 carry machine readable marking at launch. Models released before that date sit inside the transition period the EU AI Act allows, and marking for them is described as work in progress over the coming months.

Two techniques, not one. Generated text gets an imperceptible watermark woven into the text itself. Generated files of supported types such as .png, .jpg and .svg get signed provenance metadata using the C2PA standard, which is a label attached to the file rather than a change inside it. Metadata does not survive a screenshot or a format conversion. The text watermark travels with copy and paste.

Coverage of the rollout is wide: the Claude Platform API, Claude, Claude Code, Claude Cowork and Claude Tag, plus supported models reached through AWS, Google Cloud and Microsoft Foundry. Because marking is applied at the model level, no surface can opt out of it. Anthropic applies it globally rather than by region, stating it lacks a durable way to scope it geographically, and it drew a round of pushback from users who did not want their drafting to be detectable.

One thing has not shipped. A detection API is described as coming, with implementation details still being worked out. Today the key holder is the single party who can run the check.

A language model does not emit a word. It emits a score for every token in its vocabulary, those scores become shares of one, and a weighted die settles which one lands. The die is what makes the same prompt give different answers on different days.

Most of the time the die barely matters. Ask for the capital of Germany and one token dominates: sampled 10,000 times, Berlin came up 7,633 times, with the remainder scattered across 569 different tokens. The interesting case is the opposite one, where the model has no real preference.

Computers have no dice. They run a formula whose starting point is a seed, and a fixed seed makes the same run of random looking numbers come back every time. Fix the seed at that fork and the outcome stops being luck.

That last row is the whole design. Anthropic derives the seed from a private key it holds plus the few words preceding the fork. The candidate list is untouched, the scores are untouched, and a word the model would never have considered is still never picked. What changes is which of the acceptable words wins, at forks where the model had no preference to overrule.

This is also why nothing shows up on a factual passage. After the words Isaac Newton's most famous work was called Principia, the next token has one right answer, so there is no fork to mark. The same holds for code that has to be exact, which is why generated code carries less marking than prose, with comments as the exception.

A seed alone would be useless for checking text. Verifying by replay would require the original prompt, the exact model, and a full generation pass for every passage examined. Anthropic's method, a version of DeepMind's SynthID-Text published in Nature in 2024, solves that with a step that leaves a countable trace.

The key feeds a set of small functions. Each takes the key, the words before the fork, and one candidate, and returns a single bit. Same inputs, same bit, every time. Nothing is written into the text: the bits are recomputed on demand by anyone holding the key. Then the sampler runs a knockout tournament among candidates drawn in proportion to their shares, and each round is judged by one of those bit functions.

Repeat that at every fork across a passage and the words that survive carry a faint surplus of ones. Invisible in the text. Countable with the key.

Detection recomputes each word's bits from the key and its preceding words, then averages the ones per word. No prompt, no model, no generation pass, just arithmetic. With three bit functions, unmarked text should land near 1.50 by chance.

The edited row is the one to sit with. Anthropic's own wording is that "light editing probably won't remove the watermark completely", and a full rewrite will. The reason is mechanical: erasing the mark means changing the words at the forks, and finding the forks requires the model. Anyone editing by hand is editing blind and hoping to hit enough of them.

Which points at the likely workaround, and it is not a person with a thesaurus. It is a second model, small and local, answering to nobody's key, paraphrasing Claude's output before it ships. The predictable consequence of marking is a layer of text that was rewritten purely to be different, which is to say slightly worse.

Anthropic is unusually plain about the ceiling here. A detected mark says "the content may have been processed by Claude", and it cannot separate a passage Claude wrote from a passage Claude heavily edited. It says nothing about whether a human wrote it, nothing about a different AI with a different key, and nothing about ownership or liability.

Read that table as a whole and an uncomfortable shape appears. The signal is strongest on the person who used Claude openly and changed little, and weakest on the person who ran the output through a rewrite before passing it off. Marking is a transparency measure, not an enforcement one, and the two do not point the same way.

The quality worry has data behind it, which is rare for a claim of this kind. DeepMind's Nature paper served a watermarked model to a slice of live Gemini traffic and compared thumbs up and thumbs down ratings, finding no statistically significant difference, and a controlled study had human raters compare watermarked and unwatermarked answers side by side with the same result. Anthropic reports the same from internal testing.

Three more things are worth granting. The mark produces no extra tokens, so latency and price do not move. It carries no identifying information, so it cannot be traced to a person, an organisation, or a conversation. And it is not a Claude quirk: roughly 190 signatories put their names to the EU Code of Practice on Transparency of AI-Generated Content in July 2026, so other labs are building their own, each with a different key. A passage that fails Claude's check may still be marked by someone else's.

It is also a different instrument from the detectors already on the market. Those score style, looking for the tells that follow a model around, one being a fondness for the shape "this isn't X, it's Y". They are guessing from the outside. A watermark check is arithmetic against a key, and Anthropic says its detection endpoint is still being specified.

Everything here happens on the last line of the generation loop, the line that turns a list of scores into a word. The model is untouched. The vocabulary is untouched. A private key casts the deciding vote at the forks where nobody, including the model, had a preference to defend.

Which leaves the question the mark cannot answer. It can tell you Claude was in the room. It cannot tell you whose ideas were.