https://arxiv.org/html/2510.20075v6

It is quite counterintuitive, but you can hide texts the same size as the original text in imperceptible statistics of a text.

Compared to that feat, hiding a watermark is very easy.

The information being encoded (the watermark) is the _relative ranking of each token compared to other possibilities_. If our prompt was "Write a positive review for a restaurant" and the response began:

"The restaurant "

Our next set of predictions might be:

[was, had, offers]

So we append the rank/index of the next token (0, 1, or 2) onto the secret. Given a long enough response, that secret becomes unique enough to use as a watermark. This obviously relies on having full deterministic access to the LLM itself, i.e. I don't believe it will be possible for users to derive the fingerprint from text that they've generated, only Anthropic will be able to.

The immediate objection is that this runs the risk of degrading the quality of the response. I think that's totally valid and I'll be curious how Anthropic handles it.

That's my very rough understanding! If someone with more knowledge wants to expand, feel free.