Last week's post covered the basics of Claude's new watermarking system, but the most common misconception deserves its own explanation. When people hear "AI watermark," many assume it means invisible Unicode characters, zero width spaces, or some kind of hidden code stitched into the text. That is not how Claude's watermark works, and Anthropic went out of its way to say so directly. Nothing is added to the text, and there are no hidden characters at all.
Instead, the watermark lives entirely in the words Claude was already going to choose. Every time a language model generates a sentence, it builds the next word from a list of reasonable candidates and picks one. Take a sentence like "The weather today was cold and..." The next word is very unlikely to be something like "sugary," but "overcast" and "grey" are both perfectly reasonable choices. Normally, a random number decides which one wins. Watermarking swaps that random number for one derived from a secret key combined with the words that came before it. The output still looks completely natural, but the specific pattern of choices becomes something a keyholder can check statistically across a long enough passage.
Anthropic compares this to a game of Monopoly where players move around the board using digits pulled from a known sequence of pi instead of rolling dice. The moves still look random to anyone watching the game, and nothing about how the game plays changes. But if you knew where in the sequence the players started, you could later verify that the moves matched what that sequence would have produced. Claude's text works the same way. The words are still effectively random to a reader, but they are consistent with a pattern only someone holding Anthropic's key can confirm.
This is also why watermarking runs into trouble with code. The whole method depends on there being more than one equally good option at a given point in a sentence. Code frequently does not offer that luxury. If Claude writes "2 + 2 =," there is exactly one correct next token, and forcing a different one would just make the answer wrong. The same logic applies to most working code, where swapping one valid term for another can break a function entirely. Because of that, Anthropic has said code will generally carry a much thinner watermark than ordinary prose. The pattern can still show up in places with real flexibility, like the wording of a comment, but it will have essentially no effect on the code itself.
The practical upshot is that this system is much harder to spot, and much harder to strip out, than people assume. There is no invisible character to delete and no metadata tag to scrub. The signal is baked into ordinary word choice, which means it travels along even when text is copied and pasted elsewhere. It also means short passages, factual writing, and machine generated code will always be tougher to detect than long, freeform prose, simply because there are fewer real choices along the way for the pattern to attach to.