The Corruption of Prose: Anthropic’s ‘Watermarking’ in Claude

By rewriting the essence of John Gruber's critique, we examine the troubling implications of Anthropic's decision to "mark" AI-generated text.

The Vague Beginning

When Anthropic first announced that all Claude models globally would implement "watermarking" to satisfy optional EU regulations, the community was left guessing. The announcement was titled "How Claude Marks AI-Generated Content," yet it provided virtually no technical explanation.

Initially, one might have assumed the method involved non-printing Unicode characters—invisible markers tucked between letters.

"When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response." — Anthropic Support Document

Based on these claims of "imperceptibility," the invisible character theory seemed logical. After all, any professional tool should maintain absolute clarity and coherence without sacrificing quality for the sake of provenance tracking.

The Reality: Semantic Adulteration

It turns out that Anthropic is not using invisible characters. Instead, they are employing a form of steganography that manipulates the actual word choices (tokens) during the inference process.

I believed Anthropic's claims about quality. I was naive to believe a document that claimed to explain "how" it worked while remaining silent on the mechanics.

How the System Actually Functions

Anthropic eventually released a second, more transparent guide. For a deeper dive, James Padolsey’s interactive essay, "How AI Text Watermarking Works," is the gold standard for understanding this concept.

The process can be visualized as a biased coin flip. In a fair system, the model chooses the most probable next token. In a watermarked system, the model introduces a subtle bias.

The "Green" and "Red" List Logic

At every single point where a token is generated, the available vocabulary is split into two categories:

1. Green List: Words the model is slightly more likely to pick.
2. Red List: Words the model is slightly less likely to pick.

This isn't a static list of "forbidden" or "preferred" words. Instead, the lists are generated deterministically on the fly using a secret key.

# Conceptual Pseudo-code for Watermarking
def select_next_token(candidates, secret_key):
    green_list, red_list = partition_tokens(candidates, secret_key)
    # Apply a slight probabilistic bias toward the green list
    biased_probabilities = apply_bias(candidates, green_list, red_list)
    return sample(biased_probabilities)

Visualizing the Token Selection Flow

The Statistical Nature of Detection

The detection of these watermarks is probabilistic, not binary. It relies on the sample size $N$ (the number of tokens).

Mathematically, the detector looks for a distribution where: $P(\text{green tokens}) > P(\text{expected random distribution})$

If the frequency of "green" words exceeds what would occur by chance, the text is flagged as AI-generated.

Summary of Requirements for Detection

• Access to the Secret Key used during generation.
• A sufficient volume of text (high $N$).
• A statistical analysis of token distribution.

The Final Verdict

This approach is a "perversion of writing" because it intentionally adulterates the semantic choice of the model. It is no longer about the best word for the context, but the best word that fits the watermark.

Furthermore, this system is a closed loop:

• Anthropic can detect Claude.
• Anthropic cannot detect Gemini.
• Google cannot detect Claude.

By prioritizing provenance over purity, Anthropic has traded the integrity of the written word for a probabilistic fingerprint.