Claude’s Text Watermarking, Explained
Anthropic announced in August 2026 that new Claude models will mark their writing worldwide to meet European transparency rules in Article 50 of the EU AI Act and the EU Code of Practice on Transparency of AI-Generated Content, which require AI providers to mark text made by AI.
Anthropic says it can’t reliably limit the change to Europe, so every Claude user gets it. The idea predates Claude: Researchers published a similar method in 2023, and Google DeepMind has used its version, SynthID, to watermark text generated by Gemini since 2024.
This explainer shows how AI text watermarking works.
How language models choose the next token
Language models like Claude write one token at a time. A token may be a whole word, part of a word, or punctuation. At each step, the model gives each possible next token a chance of being picked, then picks one. Use the example below to see what happens once or across 1,000 tries.
Why doesn’t the model just choose the most likely word?
If it always chose the 55% option, “grey” and “sugary” would never appear; every sentence would use “overcast.” Sampling from the other possible words creates useful variation, which is why the same request can produce different wording each time.
Does the prompt change the odds?
Yes. Ask for an enthusiastic tone and “huge” might jump from a 15% chance to 70% in the same sentence. The model bases each new set of chances on your request and everything written so far. The watermark works within those chances; it does not override them.
Where a watermark can affect the text
The proposed watermark can only influence spots where several words could be used without substantially changing the meaning of the generated text. Eight of the 55 words in the paragraph below are likely spots where a similar word could have worked.
The key changes which words count as matches
A key is not a predetermined sequence of words. It is a secret value that combines with the recent text to decide which possible next words count as matches. Claude’s watermarking system uses the key to favor matches; the detector uses it later to count the pattern.
Generated with Key A
Written without watermarking
So could I learn to spot it myself?
No. Every word is one the model could normally have written. The pattern only becomes noticeable after checking many swappable words with the hidden key. It is designed to look ordinary to a reader.
Why not just add invisible characters?
One likely reason is that copy-paste and reformatting often remove invisible characters, and anyone who knows about them can delete them easily. Choosing among ordinary words leaves no extra character to find or strip out.
What if the prompt strongly favors one word?
Then the key has less room to choose, and it does not fight the model. If “huge” has a 70% chance, the key still chooses it about 70% of the time. A required answer such as “Principia” gives the check no evidence at all.
More text raises detection confidence
The checker needs a pattern across many keyed choices. One word proves nothing; a longer passage gives it more evidence to compare with chance.
Is a detector ever 100% sure?
No. It reports how strong the evidence is, not a final verdict. A high match count is strong evidence that Claude’s key shaped the word choices, but it is not absolute proof. Only someone with the key can run the check, because no one else knows which words should match.
How watermark checks differ from AI detectors
Claude’s watermark check looks for a hidden pattern in word choices. Conventional AI detectors estimate whether visible writing patterns sound like AI. Below, both checks examine the exact same paragraph:
Claude’s watermark check
AI detector (illustrative)
Illustration only: Real detectors score patterns across tokens and sentences; they do not check a fixed list of phrases like these. See GPTZero and Turnitin.
What the watermark check cannot prove
A watermark check estimates whether Claude helped produce a passage; it cannot identify a human author or another AI.
| Question | Can the watermark check answer it? |
|---|---|
| How likely is it that Claude helped produce this text? | It can estimate |
| Did a person write every word? | No A weak result does not prove human authorship |
| Did a different AI write it? | No The check only knows Claude’s key |
| Did Claude start from scratch or lightly edit a draft? | No Either can leave matching words |
| Which sentence came from AI? | Not reliably One sentence is usually too short for a reliable result |
How editing affects the watermark
Light edits leave some keyed choices in place; a full rewrite replaces them.
Does translating the text count as a rewrite?
Google says translation can greatly reduce SynthID-Text’s confidence. A 2024 study found the same general weakness across three other watermarking methods, sometimes bringing detection close to random guessing.
Isn’t that the same as Claude proofreading my own writing?
That is the opposite case. When Claude lightly edits your writing, most words were your choices, so there is little watermark to begin with. The few words Claude changes may still match its key. This slide starts with a reply Claude wrote and shows what happens when a person edits it.
What about code, or an exact factual answer?
The same rule applies. When there is one required answer, such as the number after “2 + 2 =” or the title after “Isaac Newton’s most famous work was called,” there is no real choice and no place for the watermark. Code has many exact choices, so it usually carries less of the mark than prose. Comments and names chosen by the model can still carry some.
What to remember
- Language models sample each next token from weighted choices. They do not always take the likeliest option, so the same request can produce different wording.
- The watermark only has room where several words would work. An exact answer leaves no meaningful choice and therefore no place for the mark.
- A hidden key resolves the random draw without rewriting the model’s odds. Across many choices, its selections form a pattern that only someone with the key can check.
- The checker needs many choices to build confidence. A longer passage adds more clues; it does not make the watermark itself stronger.
- A watermark checker and an AI detector look for different evidence. The checker looks for the hidden keyed pattern. A detector judges visible features of the writing.
- Editing can weaken the pattern, and the result has firm limits. Light editing leaves many choices intact; a full rewrite replaces them. The result cannot prove authorship or identify one exact sentence.