This paper details the implementation of a watermarking system for Claude, designed to satisfy transparency requirements under the EU AI Act. The technology, based on Google DeepMind’s SynthID-Text, enables the detection of AI-generated content by modifying the source of randomness during the token generation process.

Core Methodology

Large language models operate by predicting the next token from a set of candidates, where the selection is typically influenced by a probability distribution and a random number generator. In scenarios where multiple high-probability candidates exist (e.g., choosing between "overcast" or "grey"), the model traditionally relies on an arbitrary random seed.

The watermarking approach replaces this arbitrary randomness with a deterministic process derived from a secret key and the preceding context (the prompt and prior tokens). By using the key $K$ and a sequence of previous tokens $T_{<i}$, the model calculates a pseudo-random value $r = f(K, T_{<i})$. This value dictates which token is selected from the set of equally sensible candidates. While the resulting text remains statistically indistinguishable from unwatermarked output to a human reader, it contains a subtle, detectable pattern. A verifier possessing the secret key $K$ can analyze a sequence of tokens to calculate the likelihood that the pattern matches the expected output of Claude, thereby verifying its origin.

Key Characteristics and Limitations

• Performance and Quality: The watermark does not consume extra tokens, impact latency, or alter the quality, creativity, or readability of the output. It acts as a nudge on tokens where multiple valid choices exist rather than forcing sub-optimal, obscure word choices.
• Scope and Detectability: The watermark is ineffective on short passages or highly factual content where the model has little to no flexibility in token selection. It is also significantly less effective when Claude is used only for light editing of human-authored text, as the watermark can only be embedded in the limited number of tokens Claude actually changes.
• Distinction from AI Detectors: Unlike third-party AI detection services that rely on heuristic "tells" or linguistic patterns, this watermarking technique is a proactive, cryptographically-linked method that requires Anthropic’s specific key to verify the source.
• Privacy and Scope: The watermark is not tied to individual users or organizations, ensuring that the detection process cannot reveal the identity or specific chat history of a user.
• Non-textual Media: For files (e.g., .png, .jpg), the system uses C2PA, an industry-standard metadata protocol that attaches a cryptographically signed credential rather than embedding a watermark directly into the content.

The paper concludes that while the watermark provides a mechanism to identify Claude’s involvement, it does not function as an absolute proof of authorship, as heavy post-generation editing or complete rewrites can neutralize the signal.