The watermark you can't see

On August 14, Anthropic posted a short note saying that future Claude models will write text that carries a watermark. Google has done this in Gemini since 2024. The reason is a European law that, from this August, requires text from these systems to be marked in a way software can detect. The odd part is that nobody can point at the mark. Copy a paragraph out of Claude and read it as many times as you like; there is nothing there.

The mark lives in a decision you never see. A language model does not write words the way a person types them. At every step it gives a score to every token it knows, about 150,000 pieces of words for the models on this page, and then something has to pick one from the top of that list. Usually the pick is the highest score, and sometimes, on purpose, it is the second or third, because a model that always takes the top word repeats itself. How far down the list the pick can wander is a setting called temperature.

Try it below. Give the model an opening, set a temperature, and start it. The sentence grows one word at a time, and the list beside it is the model's top eight for the next word, with the one it took. Temperature is how chaotic that choice is. At 0 the model always takes #1 and the sentence comes out the same every time; turn it up and the pick wanders further down the list, so the words get more surprising and, past a point, worse.

Most of the time the list has an obvious winner. When it does not, when the top two or three words score about the same, the model is free to take any of them and the sentence reads the same either way. Those free choices are the hiding places, and there are a lot of them in any paragraph.

Anthropic's version, which is a variant of Google DeepMind's SynthID-Text, uses a secret number, the key. At each free choice, the key and the few words before it decide which of the near-equal words the model should prefer, a preference so slight that the text is not worse for it. Later, a detector holding the same key walks through the text, works out at each word which candidate the key would have preferred, and counts how often the text agrees. Unmarked text agrees about half the time, by chance. Marked text agrees far more often than that. The detector reports that likelihood and nothing else: not who wrote it, not what it says, only how likely it is that Claude was involved.

The key has two consequences, the first being that the detector is theirs alone: it does not even need the model to run, only the key and the words. What you cannot see from outside is which choices were free and how the model ranked them, because only the company that runs the model has those scores. The second consequence is that the detector counts agreement rather than decoding a message, so it still works on text that has been edited, since the words that survive still agree far above chance.

You cannot see inside Claude, but you can see inside an open model, and that is enough to build the same idea without a key. This page runs Qwen3, an open model from Alibaba, entirely in your browser. At every free choice, first place means a 0 and second place means a 1, and that is the whole channel. Around your message goes a frame, which opens with a fixed pattern of bits to knock with, so a reader can find the start anywhere in the text. Then come a label with the message length and a short fingerprint of the model, the message itself, a checksum to seal it, and a little repair data.

I designed this version and directed the AI coding agents that built it, mostly to find out how far the idea goes without a key. Further than I expected, with one honest difference from the labs' schemes that section five gets to.

Try it. The opening line is yours to change, and so is the message. The smallest model is the default because it writes in about a minute; the bigger ones are slower and surer of themselves, which leaves fewer free choices to hide in. Then watch the two columns: the words as they are written, and the frame's bits leaving the strip for the words that carry them, each in the color of the part of the frame it belongs to.

Temperature has a second job here. At any one step it does not change which words are free choices, because the gate looks at the model's own scores before the dial is applied. But a hotter model takes stranger words, stranger words lead into sentences it cannot predict, and those have more free choices in them. A higher temperature makes more room for bits and worse text; a cold model settles into stock phrases and runs out of places to hide anything. The default of 0.7 is about where the small model stops repeating itself without talking nonsense.

Reading is the same walk in reverse. The reader runs the same model over the same words and asks, at each one, where that word stood in the model's list. At a free choice, first place reads as 0 and second place as 1. The bits go into the strip in the order they come until the knock, the label and the checksum line up, and the checksum decides whether a frame is really there.

Read back what you just wrote, and watch the words stay where they are while the bits come out of them.

What if someone changes the text? Delete a sentence, swap a few words, cut the end. The full message often does not come back: a checksum needs every bit. But that is not the question a detector answers. A detector asks how many of the surviving bits agree with what was planted, and even a mangled paragraph keeps most of its evidence. Fifty percent agreement is chance, and ninety percent over a hundred bits is not what an unmarked text does.

The meter below lines up what the reader recovered against what the writer planted, edit by edit. One honest difference shows up here. This demo scores each word against the whole text before it, so cutting the start changes every later score and the evidence after the cut is gone. The labs score each word against only the last few words, so an edit costs them a few words of evidence rather than the rest of the page. The counting is the same; the window is different.

Every model ranks its near ties its own way. Give this paragraph to a different model and ask for the bits, and it agrees with the writer on about six bits in ten, where a coin gets five and the writer gets all of them. That gap is enough to say which model wrote a text, and it is why this page calls the model the key: nothing secret, just the one set of scores that lines up.

The bars below are measured on the laptop this was built on: each model's text, read back by the others.

A key buys two properties this page does not have. Nobody can plant Claude's mark without the key, while anyone with Qwen's weights can plant this one. And because the labs count agreement over the last few words, an edit anywhere costs them little, while this demo loses everything after an edit. What the keyless version has instead is that anyone can check it, because the verification and the model are both public. The same trick also names which open model wrote a text, which a keyed scheme cannot do for models it does not own.