What is AI watermarking? Explained with a banknote
AI watermarking hides an invisible pattern in AI-made content so a checker with a secret key can tell the AI was likely involved. Explained with the hidden security marks in a banknote.
- Author
Umair Mateen- Published
- Updated
- Reading time
- 5 min
- Category
- AI
Today's Claude API update extended Anthropic's text watermark to three older Claude models, so here is what an AI watermark actually is.
In one sentence: AI watermarking hides a pattern inside content as an AI creates it, invisible to readers, so that someone holding a secret key can later check whether that AI was likely involved.
The everyday picture
Think of a banknote. Its security marks are built into the paper itself, not stuck on top. You don't notice them when you pay for coffee. The note looks and works like any other piece of money.
But a bank's checking machine knows exactly what to look for. Feed it a note and it tells you, in seconds, whether the marks are there. Only the people who designed the pattern know its details, which makes it hard to copy.
AI watermarking works the same way. The AI is the printing works. The text is the banknote. The hidden pattern sits in the words themselves, and a checker with the right key can read it.
The AI picks each word with help from a secret key, leaving a pattern no reader can see. Later, a checker holding the same key scores how well the text fits that pattern.
How it works, step by step
- You ask the AI for something (an order arrives at the printing works). A language model writes one word at a time. For each word it has several reasonable options, and it picks one with a bit of chance.
- A secret key steers those choices (the printing press adds the security pattern). Anthropic explains that instead of an ordinary random number, Claude's choice uses a key plus the words written so far. Each choice is still a sensible word, but together they form a pattern.
- The text goes out looking normal (the note is spent and passes from hand to hand). Nothing is added: no hidden characters, no extra words. The mark travels with the text when it is copied and pasted.
- A checker with the key tests the text (the bank's checking machine). It looks at the word choices and asks: do these fit the pattern more than chance would allow?
- The answer is a likelihood, not a yes or no (the machine says "very probably genuine"). Longer passages give a more confident answer, because there are more choices to check.
Try it · Myth or fact
AI watermarks: myth or fact?
Decide for yourself first, then tap each statement to check it.
0 of 3 checked
Where the picture stops
- A banknote's marks are fixed in paper. Text is easy to change. Light edits usually leave enough of the pattern, but a full rewrite, or a paraphrase by a different tool, can wash it out.
- Anyone can buy a note-checking machine. Text watermark checkers need the secret key, so usually only the AI company, or groups it gives access to, can run the check.
- A genuine note was printed in full by the bank. A watermarked text might only have been edited, translated or summarised by the AI. The mark suggests the AI was involved at some point, not who did the thinking.
Why it matters for your business
- Trust and transparency. Watermarks help platforms, publishers and regulators label AI content without relying on people to admit it.
- Risk. A watermark is evidence, not proof. Anthropic's help centre says a detected mark does not confirm the full origin of content, and a missing mark does not rule out AI.
- Settings can matter. Anthropic notes that on Claude Sonnet 4.6, changing
temperature,top_portop_kfrom the defaults may stop the mark being applied. If you rely on labelling, ask your developers to check. - Privacy. Anthropic says its text watermark carries no information about you or your organisation. It points to the model, not the user.
An example
Imagine a 30-person marketing agency that uses AI to draft client newsletters. A client asks whether AI-written content is labelled. The agency checks which models it uses, confirms they carry a watermark, and leaves the sampling settings at their defaults. It also adds its own plain label, because the watermark is invisible to readers and only a key holder can check it.
Frequently asked questions
Can I see an AI watermark in the text?
No. A text watermark lives in which words were chosen, not in extra characters. The text reads exactly the same; only a checker with the key can find the pattern.
Can anyone check if text was written by Claude?
Not yet. Anthropic's text watermark detection is in private preview for eligible groups, such as regulators, researchers, media and enterprises checking their own output. Anthropic says it plans to widen access.
Can a watermark be removed?
Often, with enough effort. NIST's guidance on synthetic content notes that paraphrasing with another model can strip text watermarks. Light editing usually leaves enough of the mark.
Does a watermark work on short text?
Poorly. A short reply has too few word choices to show a clear pattern, so detection is much more confident on longer passages.
Related explainers
- What is an LLM? Explained with a new hire who read the whole library
- What is human-in-the-loop? Explained with a manager signing cheques
- What is robots.txt? Explained with a sign in an office lobby
Sources
Could you explain this to a colleague now?
Mark it and posts that mention it will show a tick. Saved in this browser only.