1.0 Executive Summary: How Claude Implements Text Watermarking
Claude embeds statistical text watermarks directly during autoregressive token generation using cryptographic context-seeded tournament sampling (Anthropic, 2026; DeepMind SynthID-Text, Nature 2024). The system operates through an integrated three-stage pipeline:
-
Context-Seeded Pseudo-Random Generation:At each generation step t, the model takes a sliding window of the preceding h tokens (typically h=3) and hashes them alongside a 256-bit secret master key using HMAC-SHA256. This derives a deterministic pseudo-random seed s_t that is completely unpredictable to observers lacking the secret key.
-
Multi-Hash Tournament Selection:The derived seed instantiates m independent pseudo-random hash functions (m=3) that assign binary bit values {0, 1} to every token in the vocabulary. Candidate tokens generated by the model’s Softmax distribution are organized into a balanced binary elimination tournament tree. In each pairwise match, tokens with higher hash bit signatures defeat lower ones, while ties are resolved probabilistically in direct proportion to the model’s Softmax probabilities. This tournament selection guarantees that the expected winning probability of any token equals its exact model probability—preserving 100% distributional fidelity with zero perplexity increase.
-
Zero-LLM Fast Verification:Text provenance is audited without loading model weights or evaluating neural networks. An auditing service equipped with the secret key and BPE tokenizer replays the sliding context windows across the document, extracts the observed bit values, and computes a standard Normal Z-score. For sequences between 50 and 100 tokens, the accumulated bit bias provides overwhelming statistical separation (Z >= 4.75, p < 10^{-20}) against unwatermarked human or third-party text, evaluating over 50,000 tokens per second per CPU core.
This whitepaper specifies the end-to-end mathematical formulation, tournament execution logic, zero-LLM statistical hypothesis tests, adversarial perturbation resilience, and production reference implementations.
2.0 Foundations of Autoregressive LLM Sampling
Autoregressive language models generate text sequentially by predicting one token at a time. At step t, given an input context sequence of preceding tokens x_1 through x_{t-1}, the transformer layers compute a vector of unnormalized logits z_t across the vocabulary V. The model transforms these logits into a normalized probability distribution P(x_t | x_{<t}) through the Softmax function:
[ PYTHON REFERENCE IMPLEMENTATION ]
# Normalized next-token probability distribution over vocabulary V
P(x_t == v | x_<t) = exp(z_t[v] / Temperature) / sum(exp(z_t[j] / Temperature) for j in V)
In standard unwatermarked inference, sampling draws random numbers from an unseeded system entropy source. Common sampling strategies (such as temperature scaling, top-k filtering, or top-p nucleus sampling) truncate or reshape this distribution before drawing a uniform random float to select the final token. Because these random draws are unkeyed and independent of the text history, the resulting text carries no intrinsic signature of its origin.
Figure 1 contrasts this standard sampling path with Claude’s context-seeded watermarking architecture, highlighting the integration of the HMAC-SHA256 seed generator and tournament sampler.
Figure 1: Comparison of Standard Autoregressive Generation versus Cryptographic Context-Seeded Watermark Sampling
As shown in Figure 1, the watermarking architecture replaces the unseeded stochastic sampler with a deterministic cryptographic PRF. By hashing the preceding context tokens with a secret key, the model derives a dedicated pseudo-random seed for each step. This seed drives a set of binary hash functions that guide candidate selection without distorting the underlying token probabilities.
3.0 The SynthID-Text & Claude Watermarking Mechanics
The watermarking engine builds on three core primitives: the Secret Master Key, the Sliding Context PRF, and the Multi-Hash Signature Vector.
3.1 Secret Key Governance & Context Hashing
System security rests on a 256-bit master symmetric key, Key K, stored in Hardware Security Modules (HSMs) or enterprise Key Management Services (NIST, 2023). The key is never exposed in client prompts, model outputs, or inference logs.
At generation step t, the sampler inspects a sliding window of the preceding h tokens:
[ VERIFICATION TELEMETRY ]
Context Window Payload: W_t = [x_{t-h}, x_{t-h+1}, ..., x_{t-1}]
In production deployments, the history length h is set between 3 and 4 tokens. A window of h=3 provides strong statistical power while retaining resilience against localized edits. The engine derives a 256-bit seed s_t via Hash-based Message Authentication Code (HMAC-SHA256):
[ VERIFICATION TELEMETRY ]
s_t = HMAC_SHA256(Key K, BPE_Encode(W_t))
Because HMAC-SHA256 functions as a cryptographically strong PRF, third parties without Key K cannot predict s_t or distinguish the generated output stream from unwatermarked text, preventing adversaries from reverse-engineering the watermark signature.
3.2 Multi-Hash Signature Functions
Using the derived seed s_t, the engine evaluates m independent pseudo-random hash functions, g_1, g_2, ..., g_m. Each function maps any candidate vocabulary token v in V to a binary bit value:
[ VERIFICATION TELEMETRY ]
g_k(s_t, v) -> {0, 1}, where k in {1, 2, ..., m}
For a standard configuration with m=3 hash functions, every candidate token receives a 3-bit signature vector:
[ VERIFICATION TELEMETRY ]
Signature(v) = [ g_1(s_t, v), g_2(s_t, v), ..., g_m(s_t, v) ]
Bit_Score(v) = sum(g_k(s_t, v) for k in 1..m) in {0, 1, ..., m}
Under the null hypothesis (human writing or unwatermarked text), token selections are independent of the seed, yielding an expected bit score of exactly m / 2 (1.5 bits for m=3). The goal of tournament sampling is to favor tokens with higher bit scores (e.g., scores of 2 or 3) while preserving the exact probability distribution of the model.
4.0 The Tournament Sampling Algorithm: Unbiased Distortion-Free Generation
Earlier watermarking methods, such as the Green-Red list scheme (Kirchenbauer et al., 2023), bias generation by adding a fixed constant delta to the raw logits of green-listed tokens before computing the Softmax. While straightforward, logit shifting distorts the distribution tails, increases perplexity, breaks syntax formatting in code generation, and degrades reasoning on technical benchmarks.
Claude uses Tournament Sampling (DeepMind SynthID-Text; Nature, 2024) to eliminate this distortion. Tournament sampling constructs a balanced binary tree across candidate tokens, executing pairwise matches that prioritize watermark bit signatures while maintaining exact probability weights.
4.1 Binary Tournament Tree Execution
Consider an engineering prediction step where the model assigns probabilities to four candidate tokens following the context ”The distributed consensus protocol coordinates state replication across all ...”:
•“replicas”: Probability = 0.52 | Hash Signature = [1, 0, 1] | Bit Score = 2
•“nodes”: Probability = 0.28 | Hash Signature = [0, 1, 0] | Bit Score = 1
•“members”: Probability = 0.12 | Hash Signature = [0, 0, 1] | Bit Score = 1
•“validators”: Probability = 0.08 | Hash Signature = [1, 0, 0] | Bit Score = 1
Figure 2 illustrates the pairwise tournament bracket structure, demonstrating how probability masses combine and how bit signatures resolve match ties.
