In an older post we looked at how SynthID hides a watermark inside AI-generated images. Today, let us look at text watermarking and how it works. This week Anthropic says Claude models will use a version of Google DeepMind’s SynthID-Text for all text it generates.
So an LLM writes one token at a time. At each step it usually has several reasonable choices. For eg. “The regulator stayed stable even when the load suddenly _” Here changed, increased or jumped can all fit the line.

SynthID-Text uses this freedom to leave a statistical signature. A secret key, together with the recent text, generates hidden scores for possible next tokens. The sampler chooses from sensible options, and over many steps those choices become correlated with the secret pattern. These scores change with context, so there is no fixed list of “watermark words”. The same token can support the watermark in one sentence and not in another.
A detector with the matching key can later recreate the expected scores and check whether the chosen tokens match that pattern more often than chance. One sentence gives little evidence. Longer passages give more choices to test, so confidence improves. This can be added to many LLMs at the sampling stage without retraining. Each provider can use its own key and configuration. Claude’s detector would therefore look for Claude’s pattern, while another provider may use a different key or method.
The method works best when the model has freedom in wording. Creative writing offers many choices. Short factual answers and code don’t have that many options. Heavy rewriting can also weaken the signal, which is why watermark stealing(deducing patterns from text) is an active research area.
If widely adopted, text watermarking could make AI involvement easier to verify later. I am assuming this will be heavily used in academia and school work. A watermark can indicate that a compatible model likely contributed to the text, without identifying the person or chat behind it.

0 Comments