Anthropic published the mechanics of Claude's text watermark on Friday, and the method turns out to be a keyed nudge applied to ordinary word choice. At points in a sentence where several words would serve equally well, a secret key plus the handful of words already written decide which one Claude picks. Feed the finished passage back through that key and the pattern shows up. That single design choice explains both what the mark survives and why it is close to absent from code.
The watermark itself was announced earlier this month, and Anthropic applied it globally rather than only in the EU, where Article 50 of the AI Act made marking synthetic content a requirement on August 2. What landed Friday is the layer underneath: the sampling trick, the detection tooling Anthropic intends to ship, and a franker account of what does and does not scrub the mark out.
RelatedAnthropic watermarks every Claude output, worldwide
How does a watermark hide inside ordinary word choice?
Every time a language model writes a word, it samples from a set of candidates. Most of those decisions carry meaning the sentence needs. Some carry none. When Claude has written "the results were" and is choosing between striking, notable, marked and significant, all four are defensible and nothing downstream depends on which appears. Anthropic calls these low-stakes choices, and they are where the watermark lives.
Rather than drawing those picks from a plain random source, Claude derives them from a secret key combined with the preceding few words. The output still reads as random, and by Anthropic's account it genuinely is: "The words that Claude picks are still random, but one can check the sequence of words and see if it's consistent with the choices Claude would make if it was using the key." Anyone holding the key can score a passage for how closely it tracks the pattern that key would produce. Anyone without it sees nothing unusual, because there is nothing unusual to see.
The technique is not Anthropic's invention. It is a variant of SynthID-Text, published by Google DeepMind in Nature in 2024, which in turn traces back to a scheme Scott Aaronson proposed in 2022. A lab adopting a direct competitor's published method is worth noting on its own. Watermarking is converging on one shared approach instead of fragmenting into a dozen proprietary ones, and that convergence is the only reason cross-vendor detection is even plausible.
Four things in Friday's post were genuinely new:
- A detection API is coming. Anthropic says it will "soon be offering a watermark detection API" and is still working out the implementation, which would let third parties check text directly instead of asking Anthropic to.
- Confidence scales with length. A longer passage contains more keyed decisions, so the verdict firms up as the text grows. Short and fact-dense writing carries weak signal because there are fewer free choices to hide in.
- Quality is untouched, per Anthropic. The company states the watermark has no effect on the content, creativity or readability of the output, which follows directly from only touching decisions whose alternatives were interchangeable.
- Files use a different system. Images rely on C2PA signed metadata, an open industry standard, and leave the pixels alone.
Why does code barely carry the mark?
This is the part developers should care about, and it falls straight out of the mechanism. Watermarking needs arbitrary choices, and code offers very few. If the correct output is 2 + 2 = 4, there is no alternative token to choose between. Identifier names, ordering and structure are usually pinned by the request, the surrounding file, or the language itself. With almost no low-stakes decisions available, there is almost nothing to encode into.
Where code does carry the mark is in comments, which are prose and enjoy the same freedom any sentence does. Anthropic's framing is that watermarking "by definition, it will have a negligible effect on the actual code produced." Read plainly: the code Claude writes for you is not meaningfully marked, the comments around it partly are, and stripping comments would take out most of what little signal exists. If you were worried that shipping AI-assisted code meant shipping a detectable tag inside your logic, the technical detail does not support that worry.
| Content type | Free word choices | Watermark strength |
|---|---|---|
| Long-form prose | Many | Strong |
| Translation by Claude | Many, Claude picks every word | Strong |
| Short reply | Few | Weak |
| Fact-dense writing | Few, phrasing is pinned | Weak |
| Code comments | Some, comments are prose | Partial |
| Code itself | Almost none | Negligible |
| Images and files | Not applicable | C2PA metadata instead |
What actually removes the mark?
Anthropic's account here is sharper than the original announcement, and it corrects an assumption plenty of coverage made, our own included. Light editing does not clear the watermark. Changing a handful of words leaves most of the keyed decisions intact, and the detector is accumulating evidence across a passage rather than checking one fingerprint. What removes it is "a complete rewrite where every word is replaced," and Anthropic attaches the obvious caveat: at that point it is arguable whether the text can still be called AI-generated at all.
RelatedGoogle DeepMind Maps All 9 Billion Human DNA Mutations
Translation is the counterintuitive case. A translated passage keeps its watermark, because Claude is selecting every word in the target language and marking as it goes. The real failure modes run the other way: short passages, heavily factual writing with little room for phrasing, code, and text a person has genuinely rewritten.
The limits on a positive result matter just as much. A hit says Claude was likely involved. It does not say Claude wrote the piece rather than edited it, and it cannot tell you whether unmarked text came from a human or from a model that does not watermark. Treating a hit as proof of authorship, or a miss as proof of human writing, gets the tool wrong in both directions.
- Detection API terms. Whether it returns a calibrated confidence with the passage length that produced it, or a bare yes and no. The second option is where misuse starts.
- Cross-vendor compatibility. Other labs are shipping marks under the same EU Code of Practice. If they converge on SynthID-Text, one detector could cover several models.
- The first institutional misread. A school or employer treating an API hit as proof a person did not write something. The mechanism does not support that claim.
- Backfill to older models. Anthropic says earlier Claude models pick up watermarking over the coming months, which leaves a window where absence of a mark proves nothing at all.
Our take
The design is sound, and the candour about its limits is unusual for what is fundamentally a compliance announcement. The risk is not the mechanism. It is the distance between what the watermark measures and what people will reach for it to prove. A university or an employer holding a detection result will be tempted to read it as a verdict on a person. It is not one. It is a probabilistic signal that some text passed through one vendor's model, and it is weakest precisely where the stakes tend to be highest: short answers, factual writing, and anything substantially rewritten by hand.
The more useful reading is the one Anthropic implies without quite saying. This is provenance infrastructure for platforms, not an academic integrity tool. Detecting Claude output at scale across a content feed is a tractable statistical problem. Deciding whether one student wrote one essay is not, and no amount of keyed sampling changes that.
- OfficialAnthropic: how Claude's text watermark works the Friday post with the sampling mechanism, detection API plan and removal caveats
- ResearchScalable watermarking for identifying large language model outputs Google DeepMind's SynthID-Text paper in Nature, 2024, the method Anthropic adapted
- ReferenceAnthropic watermarks every Claude output, worldwide our coverage of the rollout itself, the EU AI Act trigger and the file provenance side
Original analysis by GenZTech, based on Anthropic's technical post published August 14, 2026. Source: Anthropic.