How Claude's Watermark Works: A Technical Deep Dive

The Basics of Language Model Sampling

Before understanding watermarks, you need to understand how language models generate text. At each step of generation, a model like Claude computes a probability distribution over its entire vocabulary of tokens. The model then samples from this distribution to select the next token. Temperature and top-p parameters control how this sampling works: lower temperature concentrates probability on the most likely tokens, while higher temperature spreads probability more evenly across alternatives.

In standard generation without watermarking, the sampling process is straightforward. The model outputs logits (raw scores) for each token in the vocabulary, these logits are converted to probabilities via the softmax function, and a token is randomly selected according to those probabilities. The key insight is that this process is inherently stochastic. Running the same prompt twice produces different outputs because different random samples are drawn each time. This stochasticity is what makes watermarking possible.

Distributional Watermarking: The Core Mechanism

Distributional watermarking works by subtly biasing the token selection process in a way that is statistically detectable but imperceptible to human readers. The technique, first formalized by researchers at the University of Maryland and subsequently adopted in various forms by AI labs, divides the vocabulary into two groups at each generation step using a pseudorandom function seeded by the preceding tokens.

These two groups are commonly called the "green list" and "red list." Before sampling, the model adds a small bias term (delta) to the logits of all tokens in the green list. This makes green list tokens slightly more likely to be selected than they would be under the natural distribution. The bias is small enough that no individual token choice looks suspicious, but over hundreds or thousands of tokens, the statistical signal accumulates to become reliably detectable.

The pseudorandom function that determines group membership typically uses a hash of the preceding context (one or more tokens) as its seed. This means the green/red partition changes at every position in the generated text, making the watermark robust against simple word substitution. You cannot defeat it by changing a few words because the group assignments for all downstream tokens shift accordingly, and the overall statistical bias remains present throughout the text.

Detection: The Statistical Test

Detecting a watermark requires knowing (or reverse-engineering) the hash function used to partition the vocabulary at each position. Given a candidate text and the partitioning function, a detector counts how many tokens fall into their respective green lists. Under the null hypothesis that the text was written by a human (or generated without watermarking), approximately 50% of tokens should be in the green list at each position, by construction of the random partition.

If the text was watermarked, significantly more than 50% of tokens will fall in the green list. The detector applies a one-proportion z-test to evaluate the statistical significance of this deviation. The test statistic is calculated as z = (observed_green_fraction - 0.5) / sqrt(0.25 / n), where n is the number of tokens tested. For a watermarked text of sufficient length (typically 200+ tokens), this z-score will be large enough to reject the null hypothesis with high confidence.

The detection threshold is a tradeoff between sensitivity and specificity. A lower threshold catches more watermarked text but produces more false positives on human-written text. In practice, a z-score threshold of 4.0 provides excellent separation between watermarked and non-watermarked text, corresponding to a false positive rate below 0.003% on human-written content. Anthropic's implementation likely uses a similar threshold, though the exact value is not public.

Why Simple Paraphrasing Does Not Work

A common misconception is that paraphrasing or rewording AI-generated text will remove the watermark. While replacing individual words does change their green/red classification at that position, it also shifts the context that seeds the hash function for subsequent positions. The net effect on the global green fraction is typically minimal unless you rewrite a substantial portion of the text. Studies have shown that light paraphrasing (changing fewer than 20% of tokens) reduces the z-score by less than 15%, which is usually insufficient to bring it below the detection threshold.

More aggressive paraphrasing (40%+ token modification) can reduce the watermark signal enough to evade detection, but at that level of modification, the output is effectively a new text rather than the original. The semantic content may also drift significantly, making this approach impractical for most real-world use cases where the original meaning must be preserved precisely.

Removal via Distribution Normalization

Effective watermark removal requires a fundamentally different approach than simple paraphrasing. The Claude Watermark Remover API uses a technique called distribution normalization, which identifies tokens that were likely selected due to the green list bias and replaces them with semantically equivalent alternatives that would have been selected under the natural (unbiased) distribution.

The process works in three phases. First, the system estimates the original token probability distributions at each position using a reference language model. Second, it identifies positions where the selected token's probability under the natural distribution is significantly lower than expected given its probability under the watermarked distribution. These positions are flagged as likely watermark-influenced. Third, it samples replacement tokens from the natural distribution, filtered to maintain semantic and grammatical equivalence with the original choice. The result is text that reads identically to the original but has a green fraction consistent with unwatermarked content.

This approach is significantly more effective than paraphrasing because it targets the statistical mechanism directly rather than relying on surface-level text changes. By normalizing the green/red token distribution, the removal process eliminates the detectable signal regardless of the specific hash function used for partitioning. Empirical testing shows that distribution normalization reduces the z-score to below 2.0 (well under any reasonable detection threshold) while modifying fewer than 3% of tokens in the original text.

Implications and Limitations

Distributional watermarking represents the current state of the art in invisible text watermarking, but it has inherent limitations that affect both detection and removal. Short texts (under 100 tokens) produce weak statistical signals that are difficult to detect reliably. Highly constrained outputs (code, formatted data, lists of specific facts) leave fewer opportunities for the watermark bias to manifest because many token positions have a single dominant choice regardless of green list membership. Translation into another language and back typically destroys the watermark entirely because the token-level structure is completely rebuilt by the translation model.

For developers building tools in this space, understanding these mechanics is essential for designing effective systems. The Claude Watermark Remover API handles these edge cases by adapting its removal strategy based on content type, length, and estimated watermark strength. Short texts receive more conservative processing to avoid false modifications, while long documents benefit from stronger statistical normalization across a larger token sample.