Anthropic reveals how Claude secretly watermarks AI-written text

Google and OpenAI have adopted SynthID watermarks for images generated by their AI models. This allows people to find out whether that shared image is the real deal. Generated text is a different story, though. However, Anthropic announced last week that Claude can add watermarks to generated text, and it’s now revealed more details about the system.

Anthropic explained in a blog post that Claude’s text watermark system is based on the SynthID-Text solution published by Google DeepMind. It adds that the watermark system isn’t visible to readers, doesn’t have a “practical” impact on content or quality of generated text, doesn’t have hidden characters, doesn’t require extra tokens, and can’t be traced to a specific person/organization/chat.

The company says AI models typically generate a word at a time and decide on the next word based on the preceding text. It uses the example of “The weather today was cold and…” It notes that the next word is unlikely to be “sugary” but likely to be “overcast” or “grey.”

Anthropic adds that the choice of “overcast” or “grey” doesn’t matter much to readers, so it uses a random number to choose which word will be generated:

Watermarking uses low-stakes choices like these — which occur many times over a piece of generated text — to leave a pattern in Claude’s responses. That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it. When watermarking is used, choices are still made at random, but the source of the randomness is different.

It’s worth noting that Claude won’t lean towards a specific word, while the firm adds that the watermarking system won’t force the AI model to consider a word it wouldn’t have considered before.

The company also says its text watermarking system isn’t a silver bullet for detecting generated text:

Using our key, one can only answer the question “What is the likelihood this was partly written by Claude?” It doesn’t confirm whether the text was human-written, and it can’t tell whether the text was written by a different AI (even if that other AI uses watermarking, it would have a different key; it might also use a different watermarking method altogether). Detecting a watermark also doesn’t work well on small samples, where there are fewer word choices and thus less information to go on. As a passage increases in length, confidence about Claude’s involvement increases too.

In other words, this system doesn’t support other AI models but works best on longer text passages. Anthropic also confirmed that watermarking is reduced for factual passages, where there aren’t as many opportunities for low-stakes word choices (and therefore the insertion of watermark patterns). It uses the example of the sentence “Isaac Newton’s most famous work was called Principia…”. The only accurate choice here is “Mathematica.”

The company says the same holds true when you ask Claude to proof-read your own text, as the watermarks will only reside in the corrections (e.g., punctuation, grammar, etc). Furthermore, generated code has less scope for watermarking due to its “exact” requirements in many cases.

Anthropic says it will “soon” offer a watermark detection API so you can check whether text was generated by Claude. Either way, I really hope Gemini, ChatGPT, and other prominent AI models/platforms embrace text watermarking sooner rather than later. SynthID has already proven to be an indispensable tool for detecting AI images, so we hope text watermarking like this becomes similarly useful.