Why Anthropic’s Claude Watermark May Be A New Text-Marking Method via @sejournal, @martinibuster
All Paid Media PPC News Social MediaAdvertising Video Advertising Columns Ask A PPC ExpertNEW PPC Pulse Webinar Google Local Services Ads Are Moving To PMax: What To Check First Prepare for Google's LSA move into Performance Max with a before-and-after audit checklist from CallRail. Digital Marketing All Digital Marketing Analytics & Data Ecommerce Lead Generation Content Marketing Social Platforms Google YouTube Reddit LinkedIn TikTokNEW WordPress Other CMS Platforms Webinar Google Local Services Ads Are Moving To PMax: What To Check First Prepare for Google's LSA move into Performance Max with a before-and-after audit checklist from CallRail. SEJ Live Webinars Rundowns PodcastNEW Ebooks All Resources Rundown Why Your Brand Drops Out of AI Answers Five articles on the signals behind citation fluctuation, where models source citations, and how to audit your content for AI visibility gap Advertising On SEJ Case Study: B2B SaaS Banner Ads Webinar AI Cites Your Brand. Now What? Turn AI Visibility Data Into Actions Turn your AI visibility reports into a prioritized AEO action plan with practical guidance from Ahrefs. Claude's watermark is still a secret, but Anthropic has disclosed enough details to pin down how it might work. SEJ STAFF Roger Montti 3 seconds ago ⋅ 9 min read SEJ STAFF Roger Montti Owner - Martinibuster.com at Martinibuster.com Bio Follow Several research papers align closely to Anthropic’s newly announced text watermarking. One research paper stands out because it is a very close match to everything Claude has disclosed so far, including brand new information recently published on Anthropic’s Transparency page. There are two pages on Anthropic’s website that offer clues to what their watermarking algorithm is and how it works. The first set of clues are on the official watermarking announcement which details six qualities of the watermarking technology. The second page shares that the technology was developed at a university. Together, both sets of clues help identify a strong candidate for the technology. Here are the six qualities of Anthropic’s watermarking: There’s another clue buried away in Anthropic’s transparency page. That web page was updated on July 23rd. The new version contains the following brand new clue: “We have worked across industry and academia to explore and stay abreast of technological developments for watermarking and are preparing for compliance with applicable laws by the relevant legal deadlines.” That wording did not exist prior to July 23rd, as can be verified on Archive.org. The previous version of that section used to say that Anthropic did not provide watermarking. “Transparency of AI Generation Claude currently has multimodal input capabilities and text-based outputs, including text-based artifacts and text-to-speech voice output. While watermarking is most commonly applied to image outputs, which we do not currently provide, we continue to work across industry and academia to explore and stay abreast of technological developments in this area.” Many people assume that technology companies build and patent their own technologies. But the reality is that university researchers can offer to license the technologies they develop and receive royalty payments from it. And that’s what may be happening here because Anthropic’s web transparency page says they’re working with industry and academia. And in the case of a technology called MirrorMark, the researchers are members of both industry and academia. There is an approach to watermarking that’s called unbiased watermarking. An example is in a research paper from 2025 about MCmark. MCmark is an unbiased watermarking method that embeds a hidden statistical signal into AI-generated text during token generation. It preserves the model’s original output distribution, so text quality stays mostly unchanged. The watermark can later be detected without access to the original prompt or model API, and it is designed to remain detectable after some text modification. MCmark is a strong candidate for Anthropic’s watermarking. If I’m going to rate it on a scale of one to five for likeliness of it being a match, I’d give it a score of 4.5. The reason I deduct a half point is that paraphrasing can drop the true-positive rate (TPR) to 11% with a false positive rate (FPR) of 1%. Under GPT rephrasing it scored 48% TPR and 1% FPR. There is another approach called MirrorMark that can remain detectable with paraphrasing, although with heavy paraphrasing the true-positive rate can drop to about 57.8% with a 1% false positive rate. But that’s kind of expected, given that paraphrasing rewrites the AI-generated text. The point is that MirrorMark may be more resilient against adversarial tricks to defeat the watermarking than MCmark, although it has to be noted that the two papers did not use exactly the same testing methods. MirrorMark is a close match for what Anthropic described and is distinctive because it mirrors the LLM’s random sampling in text generation. “Experiments show that MirrorMark matches the text quality of non-watermarked generation while achieving substantially stronger detectability: with 54 bits embedded in 300 tokens, it improves bit accuracy by 8–12% and correctly identifies up to 11% more watermarked texts at 1% false positive rate.” A 2026 research paper from George Mason University describes a unique approach called MirrorMark. The team that published MirrorMark were also responsible for a 2025 watermarking approach called StealthInk, which I investigated as well, but discovered it made a tradeoff that made it less reliable in short sequences of text. MirrorMark is a close match to Anthropic’s announcement because it matches Anthropic’s six watermarking qualities. And perhaps not coincidentally, all three researchers involved with MirrorMark are part of George Mason’s InvisibleID, an entity for commercializing that technology. So that’s another clue that MirrorMark could be available for licensing. MirrorMark is a technology that inserts a watermark without disturbing the token choice patterns of the LLM. The generated text remains indistinguishable from non-watermarked text. Surviving editing and paraphrasing (insertions, deletions, and substitutions), with the use of what they call CABS, are one of the design goals of MirrorMark. And, similar to what Anthropic described, the watermark is inserted at the point of text generation. “CABS not only reduces the risk of empty or highly imbalanced allocations but also improves resilience to editing operations such as insertion, deletion, and substitution.” MirrorMark influences the generative AI’s token choices so that the generated text contains a hidden statistical pattern that repeats, which is the watermark. The system works in three steps. The watermark is not something that is visible and it’s not a hidden character. It’s a statistical pattern that’s inserted at the moment of token selection. Step 1: Mirroring LLMs don’t simply choose the likeliest next word. There’s a certain amount of random sampling that happens when the AI chooses the next word in a sequence. MirrorMark takes advantage of this aspect of how words are chosen by mirroring the random sampling in order to insert a specific symbol, without noticeably changing the quality or meaning of the text. Step 2: Context-Anchored Balanced Scheduler (CABS) CABS chooses which “symbol” is inserted at each step of the process of text generation. The placement of the symbol is tied to the surrounding context, which makes the pattern harder to disrupt. Step 3: Detecting The Watermark A decoder uses CABS to “replay” the process and recover the “token-to-position assignments,” and all the decoded values together are used to detect the watermark. “In this paper, we propose a multi-bit and distortion-free watermarking framework, MirrorMark, which combines three complementary components to embed and recover multi-bit messages without altering the output distribution of LLMs. First, a mod-1 mirroring transformation encodes an m-bit symbol by reflecting each u value around a message-specific pivot. Next, the Context-Anchored Balanced Scheduler (CABS) determines which symbol is embedded at each generation step by mapping tokens to message positions in a balanced and context-dependent manner. Finally, during decoding, CABS is replayed to recover token-to-position assignments, each symbol is decoded from the mirrored u values using the appropriate score function, and all decoded values over the tokens are aggregated to detect the watermark.” 1. It’s embedded directly into the generated text. MirrorMark embeds the watermark at the token generation point. As explained earlier, an LLM does not choose the likeliest next word in a sequence of words. It chooses the next word in a sequence with a randomness factor (the sampling randomness). MirrorMark modifies the sampling randomness that is used to choose each next token. This is why it’s called MirrorMark: the paper says the encoder mirrors the “sampling randomness.” 2. It cannot be perceived by looking at the text because it’s an “imperceptible watermark” MirrorMark is a distortion-free watermark approach to text. Its main claim is that it embeds the watermark without changing the token probability distribution. The generated text remains statistically the same as the regular text generation.
Source: Search Engine Journal
This article has been carefully curated and reformatted for educational and informational purposes. Full credit goes to the original publisher.
📚 Visit more helpful articles on Joab Peters Blog
No comments