Codon usage bias for prose
Anthropic is now watermarking Claude's output. The mechanism is statistical (not lexical) and a detection hit doesn't mean what most people will assume.
Anthropic now marks Claude’s output. Models now embed an imperceptible watermark in generated text. Marking happens at the model level, covering the API, Claude Code, Cowork, and the chat window. Older models are being retrofitted. This follows Anthropic signing the EU AI Act’s Article 50(2) Code of Practice on transparency of AI-generated content, but it’s in place worldwide, not just in the EU.
Anthropic hasn’t published its algorithm. As I understand it: Before each token, a hash of the preceding token or two plus a secret key seeds a random number generator that splits the vocabulary into a green list and a red list. Green tokens get a constant added to their logits, biasing sampling toward green without forbidding red. Detection counts green tokens and runs a prop test (z). A widely shared explainer from GPTZero’s CTO was pretty informative to me.
Codon bias is the closest biological analog. Third position wobble lets you encode the same protein many ways, and a bias toward particular synonymous codons is invisible in the translated product but obvious in a chi-square test over a couple hundred codons. Except in AI text watermarking the preferred set gets redrawn at every position from the preceding context, so there is no fixed table of watermark words and no synonym swap that reverses it. So if you think you can quietly shake a watermark by removing the load-bearing em dashes and it’s not X it’s Y — the honest thing is I don’t think this is going to work.
Most of the reaction on Hacker News defends against a different mechanism than the one Anthropic described. Commenters assumed the mark has to be zero-width Unicode or nonstandard space characters, then proposed grep and git hooks to strip it. Neither touches a statistical watermark, because nothing anomalous appears in the character stream. Simon Willison raised a bigger concern that I share. When he asks Claude to refactor a specific function he knows exactly what he wants, and he doesn’t want a pattern baked into the result to satisfy a some voluntary EU commitment.
A detected mark means less than what I think most people will assume. Anthropic’s documentation says it indicates content was processed by Claude, and lists proofreading, translation, and summarizing as cases where the words came from a person. This probably hits some groups harder than others, namely non-native English speakers, or even writers with dyslexia who run their own drafts through an LLM before sending them. Paste your paragraph in for a grammar check and what comes back is marked, statistically indistinguishable from a paragraph the model wrote from nothing. You didn’t add the mark, you can’t inspect it, and stripping it means changing roughly a quarter of the tokens. Ian Miers, a co-author on the original green-list paper, posted that a watermark can’t separate a human writing with assistance from a machine writing alone, and that in 2026 “pure human text” feels like a relic.
The failure modes cut both ways. Content Claude touched at any point can return positive, content that returns negative can still have come from Claude, and fully human-written text can in principle be flagged. Anthropic’s documentation acknowledges the first two.
After aborting AI Dry July I landed on a rule: prose I’ll have to defend is mine to write, and anything with an “I” in it gets no LLM assistance, ever. Watermarking doesn’t change what I do. A detector firing on a document says nothing about which sentences came from where, and the institutions most likely to run one, journals and funders among them, are probably the least equipped to read the result. Anthropic is explicit that absence proves nothing and presence isn’t conclusive, but I’m afraid this caveat will get memory-holed by next week.