ZK-F (Zero-Knowledge Forensics)
A 402T Labs SLU research initiative

Watermarks, provenance and cryptographic verification for generative AI.

ZK-F — Zero-Knowledge Forensics is a technical reference for understanding how large language models embed detectable signals in generated text, how those signals can be detected and verified, how robust they are to editing and transformation, and how statistical watermarking fits alongside signed provenance such as C2PA.

Current focus: Anthropic has now explained Claude's text-watermark mechanism at a high level: keyed randomness subtly influences token and word choices during generation, creating a statistical signal that can be checked with Anthropic's key. The exact proprietary construction and detector remain undisclosed.

AI watermark detectionClaude watermark guide
Deep Guides

Technologies and forensics — seven focused references

The homepage is the map. Technology guides explain how marking systems work. Forensics guides explain what detection and removal can actually prove.

01 · TECHNOLOGY · UPDATED 15 AUG 2026

Claude Watermark

Anthropic has confirmed a keyed statistical text watermark encoded through word/token choices — not hidden Unicode. What detection, code, editing and authorship claims actually mean.

Read the Claude guide → 02 · TECHNOLOGY

LLM Watermarking

The full technical taxonomy: token biasing, keyed sampling, distribution-preserving methods, semantic watermarks, detection statistics, security properties and attacks.

Read the technical primer → 03 · TECHNOLOGY

SynthID Text

Google DeepMind's production text watermark: Tournament Sampling, keyed context scores, Gemini deployment and how it differs from KGW.

Explore SynthID Text → 04 · TECHNOLOGY

Kirchenbauer / KGW

Green/red vocabulary partitions, logit bias, context hashing and the z-score detector that became the canonical LLM watermarking baseline.

Understand KGW → 05 · TECHNOLOGY

C2PA vs Watermarking

Why signed Content Credentials and statistical content watermarks solve different parts of the provenance problem — and why modern systems increasingly use both.

Compare provenance layers → 06 · FORENSICS

AI Watermark Detection

Generic AI classifiers, keyed watermark detectors and C2PA verifiers answer different questions. What each can verify — and what a result does not prove.

Understand detection → 07 · FORENSICS

AI Watermark Removal

A technical taxonomy of removal by mark class: Unicode marks, statistical watermarks, C2PA metadata, soft binding and pixel-domain signals — with honest residual-risk reporting.

Understand robustness →
Claude / Anthropic · August 2026

What is known about Claude's text watermark

Anthropic's August 2026 technical explanation confirms a keyed statistical word/token-choice mechanism. The exact proprietary algorithm, detector statistic and key hierarchy remain undisclosed.

Confirmed

Keyed word/token choices

Anthropic says watermarking changes the source of randomness used when Claude chooses among plausible next words, creating a statistical pattern checkable with Anthropic's key — not hidden Unicode.

Confirmed

Claude-specific detection

A detector with the key estimates evidence of Claude involvement. Longer, higher-choice passages provide more evidence; factual text and precise code offer less marking opportunity. A free API/tool is planned but not yet public.

Unknown

Exact proprietary construction

The exact sampling construction, detector statistic, thresholds, key hierarchy and cryptographic security parameters are still not public. Claude has not been established as KGW or SynthID's exact production system.

Do not confuse a watermark detector with a generic AI classifier. A provider watermark detector checks for an intentionally embedded keyed signal. A generic “AI detector” estimates whether prose resembles model output and may have unrelated error modes.

Read the full Claude watermark analysis →

From first principles

How generation-time LLM watermarking works

A language model already chooses among many plausible next tokens. A watermarking decoder uses a secret or pseudorandom rule to make some of those otherwise plausible choices slightly more likely, creating a pattern that a detector can reconstruct later.

01

Model distribution

The LLM produces probabilities over its vocabulary for the next token.

02

Keyed rule

A PRF, hash or secret random sequence maps the current context to watermark state.

03

Controlled choice

The decoder biases, ranks or couples token selection to that hidden state while trying to preserve quality.

04

Statistical test

The detector recomputes the rule over observed text and measures whether the correlation is too strong to be chance.

Entropy is the watermarking resource

Watermarking is easiest when many next tokens are plausible. Open-ended prose gives the decoder freedom to steer among near-equivalent choices. Code, names, quotations, equations and exact factual completions are harder: choosing a watermark-preferred token may be unacceptable when there is only one correct continuation.

This is why detection power depends on more than length. Two passages with the same token count can contain very different amounts of usable watermark signal.

Detection mathematics

The canonical green-list detector in one equation

Kirchenbauer et al.'s soft watermark is the best-known baseline. The generator designates a pseudorandom fraction γ of the vocabulary as “green” for each context and biases those tokens. The detector counts green tokens.

z = (NG − γT) / √(Tγ(1−γ))

Here T is the number of scored token positions and NG is the number that fall in the context-specific green set. Under a simplified null model, an unwatermarked sequence should hit green tokens near the base rate γ. Watermarked text should show a statistically significant excess.

Educational z-score calculator

This demonstrates the KGW-style statistic only. It does not detect Claude, Gemini or any production watermark.

z-score: 3.54 — unusually high under the simplified null.

Why false-positive calibration matters

A false-positive rate that sounds tiny can produce large numbers of incorrect flags at internet scale. Production evaluation should therefore report true-positive rate at very low false-positive rates, sequence length, entropy, language, domain and attack strength — not just a single “accuracy” number.

State of the art

Major text-watermarking families

The frontier is no longer one algorithm. Modern systems make different choices about distortion, secret keys, synchronization, semantics, payloads and public verification.

FamilyCore mechanismStrengthMain weakness
KGW / green-listContext-derived token partition + logit biasSimple, interpretable, cheapDistribution distortion and rewrite sensitivity
Cryptographic samplingSecret PRF/randomness guides token samplingCan offer strong secrecy/undetectability definitionsSynchronization and key management
Distribution-preservingReweighting or sampling preserves target marginal distributionLow detectable distortionDetection/robustness design is more complex
SynthID TextKeyed context scores + Tournament SamplingProduction-scale evidenceStrong rewriting still weakens signal
Semantic watermarkSentence meaning/embedding regions carry signalBetter lexical paraphrase toleranceHigher generation cost and semantic attack surface
Post-hoc rewritingRewrite existing text to embed a watermarkWorks without controlling original generationFidelity and compute tradeoffs

See the complete taxonomy and security properties →

Adversarial robustness

How text watermarks fail

The important question is not whether a watermark is “unremovable.” Strong results show that universal removal resistance is unrealistic under natural threat models. The practical objective is to make removal costly while preserving low false positives and high quality.

SubstitutionChanges watermark-bearing token choices and may disturb downstream context hashes.
Insertion / deletionCreates synchronization problems unless the detector uses alignment or resynchronization techniques.
ParaphrasingCapable LLM rewriters can replace enough lexical choices to dilute a token watermark substantially.
TranslationRe-encodes almost every token and is one of the strongest natural attacks against lexical watermarks.
SummarizationCombines rewriting with shortening, destroying signal while reducing the detector's sample size.
MixingHuman + AI or multi-model documents lower watermark density and require segment-level localization.
Watermark stealingRepeated queries may let an adversary learn a surrogate of the secret marking behavior.
Detector-guided scrubbingA public detector can become an oracle for iterative paraphrasing until the score falls below threshold.
SpoofingAttackers may try to forge a provider's mark, making unforgeability critical for high-stakes attribution.
Watermarking + provenance

Why C2PA and statistical watermarks are complementary

A watermark tries to make a signal survive inside the content. C2PA binds cryptographically signed provenance claims to an asset. Neither subsumes the other.

Embedded text watermarkC2PA / Content Credentials
Question answeredDoes this content carry a hidden signal consistent with key/system k?Does this asset carry a valid signed claim about origin/edit history?
EvidenceProbabilistic/statisticalCryptographic signature verification
Copy/paste textCan surviveUsually loses the manifest binding
Heavy rewriteCan be weakened or erasedProduces a new asset/history rather than preserving the old claim automatically
Rich provenanceLimited unless multi-bit payloads are usedDesigned for rich assertions and history

Claude illustrates the layered architecture. Anthropic says generated text uses an embedded watermark, while supported image/file outputs use signed provenance following C2PA. The two signals cover different failure modes.

Read the C2PA vs watermarking guide →

Policy context

Why machine-readable marking moved from research to deployment

EU AI Act Article 50 transparency obligations became applicable on 2 August 2026. The European Commission's transparency work emphasizes marking AI-generated or manipulated content in machine-readable ways that are effective, interoperable, robust and reliable as technically feasible.

This regulatory context helps explain the timing of new provider provenance systems. Technical marking is no longer merely an academic benchmark: providers must think about deployment coverage, interoperability, detection access, false positives, robustness, documentation and governance.

ZK-F is a technical reference, not legal advice. Compliance obligations depend on provider/deployer role, modality, placement date and use case.

Primary sources

The essential research lineage

ZK-F prioritizes original papers, provider documentation and standards rather than secondary summaries.

01Anthropic — How Claude's text watermark worksOfficial technical explanation, 14 Aug 2026↗ 02Anthropic — How Claude marks AI-generated contentOfficial 2026 deployment documentation↗ 03Kirchenbauer et al. — A Watermark for Large Language ModelsCanonical green/red-list construction↗ 04Kirchenbauer et al. — On the Reliability of Watermarks for Large Language ModelsRobustness, paraphrasing and detection reliability↗ 05Dathathri et al. — Scalable watermarking for identifying LLM outputsSynthID Text / Tournament Sampling · Nature 2024↗ 06Kuditipudi et al. — Robust Distortion-free Watermarks for Language ModelsDistribution preservation and alignment↗ 07Christ, Gunn & Zamir — Undetectable Watermarks for Language ModelsCryptographic undetectability↗ 08Hou et al. — SemStampSemantic watermarking and paraphrase robustness↗ 09Zhang et al. — Watermarks in the SandImpossibility results and removal attacks↗ 10C2PA SpecificationsSigned content provenance and Content Credentials↗ 11European Commission — Transparency of AI-Generated ContentArticle 50 implementation context↗
402T Labs logo

Published by 402T Labs SLUZK-F is a 402T Labs research initiative focused on technical provenance, watermark security and privacy-preserving verification for generative AI. Visit 402T.com ↗

Frequently asked questions

LLM watermarking FAQ

Does Claude watermark AI-generated text?

Yes. Anthropic says supported Claude models embed an imperceptible watermark through keyed word/token choices during generation. Anthropic has explained the mechanism class but has not published the exact proprietary algorithm or a public third-party detector.

Is Claude's watermark based on Kirchenbauer et al.?

Not established. Claude's disclosed mechanism is a keyed statistical token-choice watermark in the same broad family as KGW and SynthID Text, but Anthropic has not said Claude uses the Kirchenbauer green-list construction.

Can I detect Claude's watermark myself?

Anthropic plans a free detection API/tool for users and third parties, but public access is not yet available as of 15 August 2026. Unofficial AI-text classifiers should not be assumed to detect Anthropic's actual watermark.

Can paraphrasing remove an LLM watermark?

Strong paraphrasing can substantially weaken token-level signals, especially when another capable LLM regenerates most of the text. Some schemes survive partial edits better than others, and sufficient surviving text can remain detectable.

Why are short passages harder to detect?

Watermark detection usually aggregates many small statistical events. Short text provides fewer observations, so the detector has less evidence and must trade false positives against false negatives more aggressively.

Does a negative watermark result prove the text is human-written?

No. The text may come from an unwatermarked model, an unsupported model version, a short generation, or a watermark that was weakened by editing, translation, summarization or mixing.

Is C2PA better than watermarking?

They solve different problems. C2PA can provide strong signed provenance while the asset and manifest stay associated. An embedded watermark can survive ordinary copy/paste that strips metadata. Defense in depth uses both when appropriate.