Several investigation papers align intimately to Anthropic’s recently announced matter watermarking. One investigation insubstantial stands retired because it is simply a very adjacent lucifer to everything Claude has disclosed truthful far, including marque caller accusation precocious published connected Anthropic’s Transparency page.
Clues To Anthropic’s Watermarking
There are 2 pages connected Anthropic’s website that connection clues to what their watermarking algorithm is and really it works.
The first group of clues are connected the charismatic watermarking announcement which specifications six qualities of the watermarking technology. The 2nd page shares that the exertion was developed astatine a university. Together, some sets of clues thief place a beardown campaigner for the technology.
Six Qualities Of Anthropic’s Watermarking
Here are the six qualities of Anthropic’s watermarking:
- It’s embedded straight into the generated text
- It cannot beryllium perceived by looking astatine the text.
- The watermark does not alteration the “meaning, quality, aliases readability” of the generated text.
- The watermarking is generated astatine the exemplary level.
- It whitethorn beryllium detected aft the matter has been edited.
- Users and 3rd parties will beryllium capable to observe it.
Second Clue: Developed At A University
There’s different hint buried distant successful Anthropic’s transparency page. That web page was updated connected July 23rd. The caller type contains the pursuing marque caller clue:
“We person worked crossed manufacture and academia to research and enactment abreast of technological developments for watermarking and are preparing for compliance pinch applicable laws by the applicable ineligible deadlines.”
That wording did not beryllium anterior to July 23rd, arsenic tin beryllium verified connected Archive.org.
The erstwhile type of that conception utilized to opportunity that Anthropic did not supply watermarking.
Previous Version
“Transparency of AI Generation
Claude presently has multimodal input capabilities and text-based outputs, including text-based artifacts and text-to-speech sound output. While watermarking is astir commonly applied to image outputs, which we do not presently provide, we proceed to activity crossed manufacture and academia to research and enactment abreast of technological developments successful this area.”
Universities License Technology
Many group presume that exertion companies build and patent their ain technologies. But the reality is that assemblage researchers tin connection to licence the technologies they create and person royalty payments from it. And that’s what whitethorn beryllium happening present because Anthropic’s web transparency page says they’re moving pinch manufacture and academia. And successful the lawsuit of a exertion called MirrorMark, the researchers are members of some manufacture and academia.
Unbiased Watermarking
There is an attack to watermarking that’s called unbiased watermarking. An illustration is successful a investigation insubstantial from 2025 astir MCmark. MCmark is an unbiased watermarking method that embeds a hidden statistical awesome into AI-generated matter during token generation. It preserves the model’s original output distribution, truthful matter value stays mostly unchanged. The watermark tin later beryllium detected without entree to the original punctual aliases exemplary API, and it is designed to stay detectable aft immoderate matter modification.
MCmark is simply a beardown campaigner for Anthropic’s watermarking. If I’m going to complaint it connected a standard of 1 to 5 for likeliness of it being a match, I’d springiness it a people of 4.5. The logic I deduct a half constituent is that paraphrasing tin driblet the true-positive complaint (TPR) to 11% pinch a mendacious affirmative complaint (FPR) of 1%. Under GPT rephrasing it scored 48% TPR and 1% FPR.
There is different attack called MirrorMark that tin stay detectable pinch paraphrasing, though pinch dense paraphrasing the true-positive complaint tin driblet to astir 57.8% pinch a 1% mendacious affirmative rate. But that’s benignant of expected, fixed that paraphrasing rewrites the AI-generated text. The constituent is that MirrorMark whitethorn beryllium much resilient against adversarial tricks to conclusion the watermarking than MCmark, though it has to beryllium noted that the 2 papers did not usage precisely the aforesaid testing methods.
MirrorMark is simply a adjacent lucifer for what Anthropic described and is unique because it mirrors the LLM’s random sampling successful matter generation.
The investigation insubstantial explains:
“Experiments show that MirrorMark matches the matter value of non-watermarked procreation while achieving substantially stronger detectability: pinch 54 bits embedded successful 300 tokens, it improves spot accuracy by 8–12% and correctly identifies up to 11% much watermarked texts astatine 1% mendacious affirmative rate.”
MirrorMark: A Distortion-Free Multi-Bit Watermark for Large Language Models
A 2026 investigation insubstantial from George Mason University describes a unsocial attack called MirrorMark. The squad that published MirrorMark were besides responsible for a 2025 watermarking attack called StealthInk, which I investigated arsenic well, but discovered it made a tradeoff that made it little reliable successful short sequences of text.
InvisibleID And Commercialization
MirrorMark is simply a adjacent lucifer to Anthropic’s announcement because it matches Anthropic’s six watermarking qualities. And possibly not coincidentally, each 3 researchers progressive pinch MirrorMark are portion of George Mason’s InvisibleID, an entity for commercializing that technology. So that’s different hint that MirrorMark could beryllium disposable for licensing.
Overview Of How MirrorMark Works
MirrorMark is simply a exertion that inserts a watermark without disturbing the token prime patterns of the LLM. The generated matter remains indistinguishable from non-watermarked text. Surviving editing and paraphrasing (insertions, deletions, and substitutions), pinch the usage of what they telephone CABS, are 1 of the creation goals of MirrorMark. And, akin to what Anthropic described, the watermark is inserted astatine the constituent of matter generation.
The investigation insubstantial explains:
“CABS not only reduces the consequence of quiet aliases highly imbalanced allocations but besides improves resilience to editing operations specified arsenic insertion, deletion, and substitution.”
MirrorMark influences the generative AI’s token choices truthful that the generated matter contains a hidden statistical shape that repeats, which is the watermark. The strategy useful successful 3 steps.
The watermark is not thing that is visible and it’s not a hidden character. It’s a statistical shape that’s inserted astatine the infinitesimal of token selection.
Step 1: Mirroring
LLMs don’t simply take the likeliest adjacent word. There’s a definite magnitude of random sampling that happens erstwhile the AI chooses the adjacent connection successful a sequence. MirrorMark takes advantage of this facet of really words are chosen by mirroring the random sampling successful bid to insert a circumstantial symbol, without noticeably changing the value aliases meaning of the text.
Step 2: Context-Anchored Balanced Scheduler (CABS)
CABS chooses which “symbol” is inserted astatine each measurement of the process of matter generation. The placement of the awesome is tied to the surrounding context, which makes the shape harder to disrupt.
Step 3: Detecting The Watermark
A decoder uses CABS to “replay” the process and retrieve the “token-to-position assignments,” and each the decoded values together are utilized to observe the watermark.
This is really the insubstantial describes the process:
“In this paper, we propose a multi-bit and distortion-free watermarking framework, MirrorMark, which combines 3 complementary components to embed and retrieve multi-bit messages without altering the output distribution of LLMs.
First, a mod-1 mirroring translator encodes an m-bit awesome by reflecting each u worth astir a message-specific pivot.
Next, the Context-Anchored Balanced Scheduler (CABS) determines which awesome is embedded astatine each procreation measurement by mapping tokens to connection positions successful a balanced and context-dependent manner.
Finally, during decoding, CABS is replayed to retrieve token-to-position assignments, each awesome is decoded from the mirrored u values utilizing the due people function, and each decoded values complete the tokens are aggregated to observe the watermark.”
How Closely Does MirrorMark Match Anthropic’s Six Watermarking Qualities?
1. It’s embedded straight into the generated text.
MirrorMark embeds the watermark astatine the token procreation point. As explained earlier, an LLM does not take the likeliest adjacent connection successful a series of words. It chooses the adjacent connection successful a series pinch a randomness facet (the sampling randomness). MirrorMark modifies the sampling randomness that is utilized to take each adjacent token. This is why it’s called MirrorMark: the insubstantial says the encoder mirrors the “sampling randomness.”
2. It cannot beryllium perceived by looking astatine the matter because it’s an “imperceptible watermark”
MirrorMark is simply a distortion-free watermark attack to text. Its main declare is that it embeds the watermark without changing the token probability distribution. The generated matter remains statistically the aforesaid arsenic the regular matter generation.
3. The watermark does not alteration the “meaning, quality, aliases readability” of the generated text.
MirrorMark powerfully matches this quality. The investigation insubstantial says MirrorMark “preserves earthy linguistic diversity.” This is by design.
4. The watermarking is “applied astatine the exemplary level”
MirrorMark does its activity during the matter procreation part, not afterward. It happens arsenic the matter is generated.
5. The watermark whitethorn still beryllium detected aft the matter has been edited.
MirrorMark was tested pinch copy-paste, deletion, insertion, paraphrasing, and substitution. The investigation insubstantial says “improves resilience” to deletion, insertion, and substitution. As for paraphrasing, it says that it “maintains beardown separability betwixt watermarked and non-watermarked samples …since paraphrasing changes the aboveground shape of sentences but often preserves underlying semantic and statistical patterns that still transportation anemic watermark signals. ” That intends that the watermark awesome is still location and tin beryllium detected.
6. Users and 3rd parties will beryllium capable to observe it.
The investigation insubstantial says that the watermark is detectable successful the matter erstwhile it’s decoded.
The insubstantial explains:
“Finally, during decoding, CABS is replayed to retrieve token-to-position assignments, each awesome is decoded from the mirrored u values utilizing the appropriate
score function, and each decoded values complete the tokens are aggregated to observe the watermark.”
There is an full conception of the investigation insubstantial that is devoted to decoding and discovery of the watermark (section 3.3), wherever it says:
“The matter is declared watermarked if the people exceeds a predefined threshold.”
Is This Claude’s Watermarking Solution?
Claude is understandably not explaining what the solution is that they’re using. The worth of knowing MirrorMark is that it shows that location are alternate methods of watermarking that spell beyond statistical patterns successful the generated matter and alternatively embed the watermark successful the randomness utilized to take each adjacent token.
It whitethorn very good beryllium that what Claude is utilizing is thing person to MCmark aliases thing other entirely. But MirrorMark is worthy looking into simply because of the measurement it goes astir watermarking.
The InvisibleID web page has accusation astir different watermarking approaches, too. The 2026 MirrorMark insubstantial tin beryllium accessed here. StealthInk, a 2025 insubstantial by the MirrorMark researchers, tin beryllium publication here. And the 2025 MCmark investigation tin beryllium publication here.
Featured Image by Shutterstock/Melinda Nagy
English (US) · 
Indonesian (ID) ·