Advanced · Safety

Model-Level Invisible Watermarking

Visual diagram · (in preparation) · Math · Worked example · 3 difficulty levels.

TL;DR. A provenance technique — introduced by Anthropic for Claude — that embeds an unalterable, imperceptible watermark during token generation itself, surviving rewriting and copy-paste.

Technical Definition

A provenance technique — introduced by Anthropic for Claude — that embeds an unalterable, imperceptible watermark during token generation itself, surviving rewriting and copy-paste.

How it works

Traditional content provenance attaches metadata after generation — and metadata strips off the moment text is copied into a new document. Model-level watermarking instead biases the token sampling process itself according to a secret key, weaving a statistical signature into the word choices of the output. The text reads identically to a human, but a detector holding the key can verify origin with high confidence even after partial rewrites, translation, or paste-through. The technique gained urgency when the EU AI Act entered active enforcement on August 2, 2026, requiring machine-readable marking of AI-generated content. Open problems include robustness against paraphrase attacks and false-positive rates on human text.

Mathematical Notation

P'(xₜ) ∝ P(xₜ) · exp(λ · g(key, x<ₜ, xₜ))

At each step the model's token distribution P is tilted by a keyed pseudorandom function g of the preceding context, so 'green-listed' tokens are slightly favored. The bias λ is imperceptible per token but accumulates into a detectable signal over a passage.