How text watermarking generally works algorithmically
This isn't unique to Anthropic — Google (SynthID for text) and others use variants of the same basic idea, which comes out of LLM research from the last few years. The core trick exploits the fact that at each step, a language model doesn't output one deterministic next token — it outputs a
probability distribution over possible next tokens, and there's usually a lot of freedom in which plausible token gets picked.
A common approach (e.g., the "green-red list" method):
- Pseudorandom split at each token position. Before sampling the next token, use a hash of the preceding token(s) (plus a secret key) as a seed to pseudorandomly split the entire vocabulary into a "green" list and a "red" list.
- Bias sampling toward green. Instead of sampling normally, boost the probability of green-list tokens slightly (or restrict sampling to green tokens when plausible). Done carefully, this barely changes fluency or quality.
- Repeat per token, with the green/red split changing each time based on context — so the "pattern" is spread invisibly across the whole text rather than living in any single word.
- Detection: given a piece of text, a detector re-derives the same green/red split at each position (using the same secret key) and checks whether green-list tokens appear far more often than random chance would predict. A statistically significant excess of green tokens implies the text came from the watermarked model.
Other approaches use a
Gumbel-softmax / exponential-minimum sampling trick that reshapes
which token is chosen (based on a pseudorandom sequence) without changing the overall output distribution at all — this preserves quality even better and is harder to detect visually, but the statistical signature is still recoverable if you know the key.
