Anthropic's Text Watermarking in Claude: Semantic Steganography Explained

Anthropic's plan to watermark all Claude text output isn't what they initially implied. According to a detailed analysis by John Gruber at Daring Fireball, the technique is a form of semantic steganography that alters word choices at inference time—contradicting their earlier claim that it would be 'imperceptible' and wouldn't change 'meaning, quality, or readability.'

How the Watermark Actually Works

The method involves biasing token selection using 'green' and 'red' lists:

• At each token generation step, words are split into green and red lists deterministically, based on a secret key.
• The model is slightly more likely to choose a word from the green list than the red list (think of a biased 51-49 coin).
• This introduces a statistical pattern that can be detected probabilistically, but it deviates from truly natural text generation.

The original support document claimed the watermark would be 'imperceptible' and wouldn't affect readability—Gruber argues this is misleading because the process inherently modifies token choices, which can degrade semantic quality.

Where to Learn More

Gruber points to an interactive essay by James Padolsey, 'How AI Text Watermarking Works', as the best explanation of the general technique. Anthropic also published a follow-up article titled 'How Claude's Text Watermark Works' that explains the method, though Gruber criticizes it as euphemistic.

For developers using AI agents, this matters: watermarking can subtly change output, so test your workflows accordingly.