Twenty years, a disguise, and an old woman washing his feet knew him by the scar
Odysseus comes home to Ithaca as a beggar. Nobody knows him: not his wife, not the men eating his food in his hall, not the servants. Penelope, being kind to a stranger, tells the old nurse Eurycleia to wash his feet. He turns toward the dark as she kneels, because he has just remembered something. Above his knee is a scar from a boar's tusk, earned on Parnassus as a boy, and this is the woman who nursed him. Her hands find it in the water. She knows him at once — her fingers open, his foot hits the basin, it rings on the floor — and he takes her by the throat and tells her to say nothing.
Notice what did the work. Not anything he said; he had been lying fluently for days. Not his clothes. A mark in how he was made, put there long ago, carried through everything since, invisible to everyone in the room except the one person who knew where to feel for it. That is a watermark, and this piece is about the version of it that lives in text: how a machine leaves a scar in the words it writes without adding a single character, how a hand that holds the key reads it back out, why light editing leaves it and a rewrite removes it, and — the part that matters most — what it proves, and what it does not.
Written for ages 12+, and for anyone who has heard that AI text can now be "detected" and wants to know what that could possibly mean. Every chapter has a Deeper into the maze box for anyone who wants the harder version, the real engineering words are all at the bottom, and every instrument on this page computes — there is a real language model here, a real mark, and a real detector, and you can edit against it.
the problem
Where do you hide a mark in a sentence?
Start with what will not work. You cannot hide it in the letters — anything you add, a reader can find and a program can strip. You cannot hide it in invisible characters, for the same reason, and because copying text into a plain box loses them. You cannot hide it in the meaning, because then it would change what was said. Wherever you put it, it has to survive being copied, pasted, read aloud and retyped, and it has to be undetectable to everyone who does not know to look.
There is exactly one place left, and piece two showed it to you. A machine writing a sentence does not write words; it looks at what is on the page so far and produces a scroll of maybes — every word it knows, each with a number saying how likely it is to come next — and then something has to choose. Most of the time several words are nearly as good as each other. "The road was long" and "the road was far"; "she said" and "she replied". Nobody reading the finished sentence can tell which one the coin would have landed on.
That is the hiding place. If you could quietly prefer one of the equally good words over the others — not always, just a little, in a pattern only you know — then the finished text would read exactly as well, and would carry, spread thinly across every choice, a preference that a person who knows the pattern could count. The mark is not in the words. It is in which of the good words got picked.
pick a language and a place in the sentence, then put the thumb on and watch the bars move
The scrolls here are real. They were read off one language model, Gemma 4, writing both languages, at points inside the passages you will meet below, and baked into this page with the model's own probabilities. The model does not run in your browser; its answers do. The bars show the twelve likeliest words the model was weighing, so the doubt figure is the doubt among those twelve.
Deeper into the maze
This is the soft watermark of Kirchenbauer et al. (2023). Before each token, the previous token and a secret key seed a pseudo-random split of the vocabulary into a green list of fraction γ and a red list of the rest; a constant δ is added to the logit of every green token before the softmax. The paper's main experiments use γ = 0.25, δ = 2, and so does this page.
The word "soft" is the engineering. A hard rule that bans red tokens would wreck the text where the next word is forced — the paper's own example is that "Barack" is followed by "Obama" almost deterministically, and a hard rule would ban "Obama" a quarter of the time. Adding δ instead of banning means that when one token's logit is far above the rest, δ cannot catch it up and the text is untouched; when several are close, δ tips the balance. The mark spends itself only where spending is free.
green list = hash(previous token, key) → first γ|V| of a shuffle · logit += δ if green · γ = 0.25, δ = 2
the same story twice
It reads the same
If the mark changed the text, it would be no good — a watermark that made the writing worse would be a watermark everyone could see. So the first thing to check is the thing the whole idea rests on: does a marked passage read like an unmarked one?
The instrument below writes the same passage twice, from the same starting point and the same roll of the dice, once with the thumb off and once with it on. They diverge, because the thumb does occasionally change a choice, and every changed choice changes the words that follow. But neither is worse. Each is what the machine would have written; the marked one has simply had its coin-flips leaned. The only visible difference is one you cannot see without the key: the marked passage is full of green.
Hold on to the ratio. Chance alone puts a quarter of any text's words on the green list — the list is a quarter of the vocabulary, dealt at random. The clean passage sits near that quarter. The marked passage sits well above it. That gap, and nothing else, is what a detector will later measure.
same seed, same start, two thumbs. deal a new pair and look at the two rates
The passages are written by real models, offline, with the mark laid into their sampling exactly as the paper describes, and every word's greenness recorded; the page recomputes it from the key when it loads and would shout if the two disagreed. The Amharic model was trained on a smaller pile than the English one and it shows — its passages are plainer — which is itself a fact about where these tools stand.
Deeper into the maze
Whether the mark is distortion-free is the central design question, and the two families answer it differently. The green-list scheme on this page does distort, slightly: δ moves probability from red to green, so the marked model's output distribution is not the original's. The paper measures the cost as a small rise in perplexity at δ = 2 and reports that raising δ buys detection at a rising price in text quality.
The scheme Claude uses avoids that trade. SynthID-Text (Dathathri et al., Nature 2024) draws several candidate tokens from the model's own distribution and holds a keyed knockout tournament between them; because every candidate came from the true distribution, the winner is a sample from the true distribution too, and the mark lives in which sample won. A live experiment across roughly 20 million Gemini responses found no measurable change in how people rated the text. That is the meaning of "reads the same" done properly: not a small cost, no cost.
green-list: shifts the distribution by δ · tournament: same distribution, keyed choice of sample
the hand
Eurycleia's hand
Here is what makes the scar useful rather than merely clever. To check a passage you do not need the machine that wrote it. You do not need the model at all. You need the text, and the key. That is everything, and it means the detector can run on a phone, or a laptop, or in the page in front of you, in a fraction of a second, over any text anyone hands you.
It works by asking one question of every word: given the word before you and the key, were you on the green list? Green lists are dealt from exactly that information, so anyone holding the key can re-deal them and check. Count the greens. Chance says a quarter. If a two-hundred-word passage has fifty green words, that is chance. If it has ninety, something leaned on the choices.
How sure can she be? That is arithmetic, and the number it produces is called a z-score: how many standard deviations the count sits above what chance would give. Above four, the odds that an unmarked text did this by luck are about three in a hundred thousand. She is not guessing. She is counting, and the count does not depend on the passage making sense.
paste anything. human writing sits near zero; the marked machine's writing does not
The English human sample is the recognition scene itself — Samuel Butler's 1900 translation, public domain, quoted exactly. The Amharic one is the ending of “The Four Brothers and the Hyena”, a folktale in which a king judges four men by what each says he trusts, quoted exactly — and the Amharic passages the machine writes on this page are its continuations of that same story's opening. Both human samples score as strangers, and so does anything you type, in any script: the detector is the real one from the paper, running in this page, and the counts, the z-score and the probability are recomputed from the box on every keystroke.
Deeper into the maze
Under the null hypothesis — no mark — each counted token is green with probability γ, so the green count |s|G over T tokens is Binomial(T, γ), with mean γT and variance Tγ(1−γ). The z-statistic is the standardised excess:
z = (|s|_G − γT) / √(T γ (1 − γ)) · z > 4 ⇔ one-sided false-positive rate ≈ 3 × 10⁻⁵
Two details carry the honesty. A repeated bigram is counted once, as the paper recommends, so a text cannot be made to look marked by writing the same green phrase twenty times. And the test is one-sided and grows with √T: a short text cannot reach z = 4 however green it is — at γ = 0.25 the minimum is about 16 entirely-green tokens — which is why Anthropic says detection "doesn't work well on small samples" and why the instrument refuses a verdict under twenty. The p-value readout is the normal tail at that z; the paper reports it as a one-sided test, and so does this page.
the edit
Change a word, and another, and watch the scar fade
Now the question everyone asks first: can you get rid of it? Yes — and the useful thing is to watch how it goes, because it does not go the way people expect. It does not snap off. There is no single word you can change that removes it. It fades, in proportion to how much you change, and there is a line on the chart below showing roughly where it is gone.
Think about why. The mark is not in any one word; it is a lean spread across a hundred choices. Change one word and you have removed one green from the count, and perhaps turned the word after it red too, since that word's list was dealt from the one you changed. Two greens gone out of seventy. The z-score barely moves. Change ten words and it moves a little. To bring a marked passage back to chance, you have to change so much of it that you are no longer editing — you are rewriting.
Anthropic's own account of their mark says the same in fewer words: light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will. That is not a weakness they are confessing. It is the design. A mark that survived a rewrite would have to be in the meaning, and a mark in the meaning would be a mark you could read.
edit the passage. every keystroke adds a point to the chart. try to get below the line
"Changed" here is counted plainly: the fraction of word positions that differ from the original. Real attackers paraphrase rather than swap, and paraphrase is cheaper per word than this instrument's random swaps — but the shape of the curve is the same, and the paper's arithmetic in the box below is the reason.
Deeper into the maze
The paper works the attacker's best case exactly. Take T = 1,000 marked tokens with every one green. Flip 200 of them to red. Each flip can also poison the token after it, since that token's list was dealt from the flipped one — so 200 flips make at most 400 violations, leaving 600 greens. The z-statistic is still (600 − 250)/√(1000 · 0.25 · 0.75) ≈ 25 under this page's γ, and even under the paper's hard-rule arithmetic comes out at 6.3, p ≈ 10⁻¹⁰ — "readily detectable with extremely high confidence." Their conclusion, which the instrument's dashed line draws: removing the mark from a long text needs roughly a quarter of the tokens or more changed, adversarially.
Two things make real life harder for the attacker than that. They do not have the key, so they cannot see which words are green and must change words blind. And the mark is redundant across the whole text, so it survives proportionally — a passage that lost half its z-score is still a passage with a z-score. The thing that does work is paraphrase: rewrite every sentence in your own words and there is nothing left to count. Which is, again, the design: the mark has been removed by the act of writing the text yourself.
200 flips of 1,000 → ≤ 400 violations → 600 green → z ≈ 6.3, p ≈ 10⁻¹⁰ · gone at ~¼ changed
where the scar cannot go
A mark needs a choice to hide in
Go back to where the mark lives: in choices between words that are equally good. That sentence has a consequence people miss. Where there is no choice — where the next word is forced — there is nowhere for the mark to go. "Seven times eight is" must be followed by "fifty-six". A name must be spelled the way it is spelled. A line of code must have the semicolon. The thumb presses on the scroll and nothing moves, because the scroll had one entry with all the weight on it.
So the mark is thin exactly where text is most factual. A recipe, a list of dates, a table, a passage of arithmetic, a program: all of these give the machine almost no room, and a mark laid into them is faint. Anthropic says this outright — their mark isn't applied where an exact output is required, and is sparser on factual passages. A page like this one, full of numbers and technical terms, is close to the worst case. The watermark grips the storytelling and slides off the arithmetic.
There is a second, stranger case. When a machine is handed a person's writing to tidy — fix the commas, shorten a sentence — nearly every word in the result was chosen by the person, not the machine. There is very little for the mark to attach to. Anthropic's wording: very little, if anything. Which will matter when we get to what the scar proves.
every word sorted by how much doubt the machine had. watch the green climb with the doubt
Deeper into the maze
The bands are entropy of the model's next-token distribution, in bits — the honest measure of how much choice there was. δ on the logits moves the green share by an amount that depends on how flat the distribution already is: for a near-one-hot distribution the shift is close to zero, and the paper bounds the expected green fraction from below in terms of a spike entropy of the sequence. Measured on this page over some five thousand positions: words chosen with under half a bit of doubt landed green 5% of the time; words chosen with over six bits, 61%. Chance is 25%, and the bands in between climb monotonically. Below the lowest band the rate is not merely at chance but under it, because a forced token is red three times in four and δ = 2 cannot overturn a favourite holding nine-tenths of the mass.
This is the reason detection thresholds are stated per token count and per entropy, and why the same 400 tokens of open-ended writing and of source code give very different z-scores under the same key. The paper's own example of forced text is the "Barack → Obama" pair; every technical field has thousands of such pairs, and a page of them is a page the scar mostly misses.
green share ≈ γ + (a term that → 0 as the distribution → one-hot) · this page: 5% under ½ bit → 61% over 6 bits
the suitors
Other hands washed his feet and felt nothing
Odysseus had been in that hall for days. Other servants had handled him. The suitors had thrown a stool at him. Nobody else found the scar, and not because it was small: it was above his knee and the width of a tusk. They did not find it because they did not know it was there to find. Eurycleia did. The mark was in plain sight, and it was invisible to everyone who was not looking for it.
The key is what turns a mark into a scar only one person can read. The green lists are dealt from the key; without it, you cannot deal them, so you cannot check them. Hand the basin to someone with the wrong key and they will re-deal the lists wrongly, count the greens, and find — a quarter. Chance. The text that scored nine with the right key scores zero with the wrong one. Nothing about the text changed. Only the hand did.
This is why a watermark is a statement about provenance, and not the other things people want it to be. It does not tell a reader anything. It does not tell a rival company anything. It tells the one party holding the key that this text was, at some point, shaped by their machine — and it tells them nothing else. Not who asked for it, not why, not whether a person then rewrote half of it. Anthropic's version, they say, carries nothing about the customer at all. A scar proves that this is Odysseus. It does not say what he did on the way home.
the same passage, the same count, two keys. one of them is the nurse's
Deeper into the maze
The key is a secret held by the operator and never shipped; detection is therefore something only the key-holder can do, or delegate. That is a deliberate asymmetry: a public detector would be a public oracle that an attacker could query while editing, and would also let anyone forge the mark onto text the model never touched. Anthropic's detector is accordingly a private-preview API, open at launch to organisations with an obligation to verify — regulators, fact-checkers, educational and research bodies — by application, with access to widen over time.
Seeding from the previous token, as this page does, is the simplest version. Claude's mark, following SynthID-Text, seeds from "the key and a few words that come before" — a short context window of H previous tokens hashed together with the key. A longer window makes the mark harder to reverse-engineer from outputs and less robust to edits, since one changed word poisons H positions instead of one; the choice of H is a trade the operator makes and does not publish.
seed_t = hash(x_{t−H}, …, x_{t−1}, key) · no key → the lists cannot be re-dealt → the count is chance
the last thing
This page has the scar
Everything above — the story of the basin, the six instruments, the boxes with the harder version — was written by a machine, one of the ones this series has been describing. Its name is Claude, the model is called Fable 5.1, and since the second of August 2026 every model of that family has carried Anthropic's mark in the text it writes, everywhere it writes it: in the chat window, through the interface programmers use, inside the tools that wrote this page. Nothing was done to make that happen. It is in how the machine was made.
Read the previous paragraph again with the chapters in mind. The mark is a SynthID-Text variant, so it is the tournament kind, not the green-list kind, and it does not change how the writing reads. It is sparse on this page's arithmetic and thick in its storytelling. It has survived the editing that turned a draft into what you are reading, because that editing did not replace every word. And the one thing it proves, to the one party who can check, is that Claude was involved. Not that Claude is the author. Not who asked. Not what was kept and what was cut.
Only Anthropic holds the key, so only Anthropic can check this page. Their public checker reads signed credentials on images, video and audio; it does not read text. Text detection is by application, to organisations with a reason to verify, and Phonetico has one: this series is educational, and this page is a test case. If access is granted, the numbers go here — the real z-score for this page, and for the two versions below.
Two edited versions of this page's prose are coming: one lightly edited by hand, the way anyone touches up a draft, and one heavily rewritten. Instrument 04 shows what should happen to them. The point of putting them here is not to show the mark surviving. It is to show, with the real detector and the real numbers, exactly where it stops.
Until then, the claim stands as a claim, made plainly: this text is watermarked, and you cannot tell. Neither can we. That is what a scar is.
the glossary
The words the engineers use
| the scar | a text watermark, or statistical watermark |
| the scroll of maybes | the next-token distribution |
| a thumb on the scroll | biasing the sampling step |
| tonight's green list | the green list — a keyed, context-seeded subset of the vocabulary, fraction γ |
| the rest of the words | the red list |
| the number a word starts with | a logit, before the softmax |
| the lean | δ, the bias added to green logits |
| a lean that costs nothing where the choice is forced | the soft watermark (Kirchenbauer et al. 2023) |
| the mark that does not change how it reads | a distortion-free watermark |
| a keyed knockout between good candidates | tournament sampling — SynthID-Text (Dathathri et al. 2024) |
| how well the text reads, measured | perplexity |
| how far above chance the count sits | the z-statistic, z = (|s|_G − γT) / √(Tγ(1−γ)) |
| the odds a stranger did this by luck | the p-value; one-sided |
| above four, she knows him | the detection threshold z > 4, false-positive rate ≈ 3 × 10⁻⁵ |
| mistaking a stranger for him | a false positive |
| how much choice there was | entropy, in bits |
| a word that was forced | a low-entropy position |
| the paper's measure of a text's total choice | spike entropy |
| rewriting it in your own words | paraphrase — the attack that works |
| the nurse's secret | the key |
| a few words before, hashed with the key | the context window H of the seed |
| whose hands this text has passed through | provenance |
| the signed stamp on a picture or a sound | C2PA Content Credentials |
One sentence to take away
A text watermark is a quiet lean on the machine's coin-flips, laid where it costs nothing and counted by the one hand that holds the key; it fades with editing, vanishes under a rewrite, misses facts and code, and proves only that the machine was involved — a scar, which tells you who this is, and nothing about what he did.
Eurycleia knew him, and he made her keep it to herself. That is roughly the arrangement: the mark exists so that the one who put it there can know, and it was never designed to tell anyone else anything.
the sources
Where these ideas come from
The scar is Homer's, Book 19, from line 392. The machinery is from these. Each note says what the source actually established.
- J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers & T. Goldstein, “A Watermark for Large Language Models”, ICML (2023). The scheme running on this page: the keyed green list, the soft bias δ, the z-test with its 3 × 10⁻⁵ threshold, the low-entropy analysis, and the attacker's arithmetic — 200 flips in 1,000 tokens still leaves z ≈ 6.3, and removal needs about a quarter of the tokens changed.
- S. Dathathri, A. See, S. Ghaisas et al., “Scalable watermarking for identifying large language model outputs”, Nature 634, 818–823 (2024). SynthID-Text: tournament sampling, which marks without changing the output distribution; detection at 85% true positives against 73% for the prior state of the art at a 1% false-positive rate; and the live experiment across roughly 20 million Gemini responses finding no change in rated quality.
- Anthropic, “How Claude's text watermarking works” (2026). The source for everything this page says about the mark it carries: that it is a SynthID-Text variant in a family going back to a 2022 proposal by Scott Aaronson; that it uses the key and a few preceding words; that it is applied only where there is a choice and is sparser on factual text; that light editing probably leaves it and a full rewrite removes it; and that it proves involvement, not authorship.
- Anthropic, “How Claude marks AI-generated content” (2026). Which models and surfaces carry the mark — Fable 5.1 and Mythos 5.1, on every platform — the boundary between the text mark and signed C2PA credentials on media, the public file checker, and the detector access form for text.
- “The Four Brothers and the Hyena”, an Amharic folktale, at Ethiopian Folktales. The human-written Amharic on this page — the hyena king's judgement, quoted exactly in instrument 03 — and the story whose opening the Amharic model continues in every machine-written Amharic passage here. A king asks four men what each one trusts and spares three of them; the fourth, who trusts the hyenas, is eaten. Not a bad fable for a page about who gets to say what a mark means.