Prove what the machine wrote.

What this playground shows

Everything runs in your browser on the real @claude-flow/watermark WebAssembly core — no server, nothing leaves the page. The "tokens" are a synthetic stand-in for a language model's per-step candidate distribution, so you can watch generation and detection without wiring up a model. In production you feed the watermarker your model's real candidates (or logits, via the proxy).

The one idea

At most steps several next words are equally good. The watermark rides that tie — a secret key plus the preceding tokens decide which tied word wins, so the odds are unchanged but the choice is reproducible. A detector with the key re-walks the text and counts how often it matched; enough matches and coincidence is ruled out. Confidence grows with length and entropy (number of ties), which is why the sliders matter.

Reading the panels

Generation capabilities — throughput + how many positions actually carried the mark. Detection — four detectors, including a wrong-key row that reads ~0 (proving key-specificity) and an alarm threshold α you can move. Secret message — a hidden multi-bit payload (see below). Robustness — drag the edit slider and watch confidence hold, then fade.

Install

# JavaScript / TypeScript
npm install @claude-flow/watermark
# Rust
cargo add ruflo-watermark

Generate & detect (Node)

const { Watermarker, detect } = require('@claude-flow/watermark');
const wm = new Watermarker({ key: 'my-secret', scheme: 'gumbel' });
const out = candidatesPerStep.map((c, i) => c[wm.step(c, probs[i])]);
detect(out, { key: 'my-secret', scheme: 'gumbel' }).isWatermarked(1e-6); // true

Ultra-low-latency proxy (logits in → token out)

Drop StreamProxy into a decode loop: it takes raw logits (or a truncated top-k (ids, logprobs) set from an OpenAI-style API), applies temperature + top-k/top-p to match your sampler, and returns the watermarked token id — allocation-free after warmup.

const { StreamProxy } = require('@claude-flow/watermark');
const p = new StreamProxy({ key: 'my-secret', temperature: 0.9, topK: 40, topP: 0.95 });
for (const logits of decodeSteps) out.push(p.pushLogits(logits));

Schemes & detectors

scheme	property
gumbel	Provably distortion-free — the model's word odds are unchanged (default).
tournament	SynthID-Text tournament — a stronger mark for a whisper of bias.
tournament_nd	Non-distortionary on average (key-averaged).

detector	for
detect	the scheme's standard test
detectSelfSync	indel-robust — survives edits/deletions/reordering
detectExact	short text — exact p-values where the normal approximation misleads

Secret message (multi-bit)

Each message bit is carried by which of two key-derived streams watermarks a block of tokens; extraction detects each block under both keys and takes the stronger. So the same text, read with the key, spells out a short payload (a model id, a run tag). Capacity trades off against robustness — roughly ~90 tokens per bit for a clean read.

Honest limits

Short or factual text carries almost no mark (few ties). A wrong key sees nothing, and the mark holds no information about you — it answers only "was a keyed model likely involved?". This toolkit only writes and checks marks — there is deliberately no removal / laundering tool.

Method: SynthID-Text (Dathathri et al., Nature 2024) and the Aaronson (2022) / Kuditipudi et al. (2024) distortion-free family. MIT © rUv.