How Anthropic plans to watermark Claude's AI-generated text

It could soon become easier to identify AI-generated content, even if it's not the usual "It's Not X, it's Y" type of post you'd come across on LinkedIn and other socials.

As you may be aware, the EU now requires AI companies serving its market to mark their AI-generated content so it's easier to identify.

Anthropic and several other major AI providers have agreed to comply with the EU's Code of Practice, with Anthropic becoming one of the first companies to share details about how it will implement watermarking across Claude.

Anthropic has also confirmed that a regular user won't be able to see the watermark.

According to the company, it has no practical impact on the quality or content of Claude's output, including creativity and readability.

For those unaware, invisible watermarking and provenance systems are already being used for some AI-generated images, and text-based output will now follow a similar concept, although the underlying implementation is different.

While the change is being introduced to comply with the EU AI Act, Anthropic says the watermark will initially be applied to Claude-generated text worldwide.

"We’re applying watermarking globally at launch because we don't yet have a durable way to scope it by region," Anthropic explained in a blog post.

Anthropic says future Claude models will generate watermarked text. Models launched before August 2, 2026, are covered by the EU's transition period, and Anthropic says it is working to add watermarking to those models over the coming months.

Claude's watermark doesn't add hidden characters

Anthropic says its implementation is based on Google DeepMind's SynthID-Text approach and explained that it works during generation, with certain exceptions.

As you may be aware, AI models generate text by repeatedly choosing which token could reasonably come next. Instead of adding characters or modifying the finished response afterward, Claude's watermark changes the source of randomness used when making some of those choices.

"Watermarking uses low-stakes choices like these—which occur many times over a piece of generated text—to leave a pattern in Claude’s responses. That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it," Anthropic explained.

"When watermarking is used, choices are still made at random, but the source of the randomness is different. Instead of using an arbitrary random number generator to pick the next word, watermaking uses the key and a few words that come before to settle what word the model should pick."

"That is, the words that Claude picks are still random, but now, one can check the sequence of words and see if it’s consistent with the choices Claude would make if it was using the key. If it is, one can assign a probability that the text was generated by Claude."

I also read the research paper on the topic, and here's an excerpt that explains how generative watermarking works:

Generative watermarking works by carefully modifying the next-token sampling procedure to inject subtle, context-specific modifications into the generated text distribution. Such modifications introduce a statistical signature into the generated text; during the watermark detection phase, the signature can be measured to determine whether the text was indeed generated by the watermarked LLM. A key benefit of the approach is that the detection process does not require performing computationally expensive operations or even access to the underlying LLM (which is often proprietary).

The paper goes in depth and has more examples, but the important part is that Anthropic is not adding a visible marker or hidden characters to Claude's response.

Instead, when Claude has multiple reasonable choices for what to generate next, the watermarking system uses a secret key and some of the preceding words as part of the randomness used to make that choice.

Those individual choices should look completely normal to a reader, but across a sufficiently long piece of text, they leave behind a statistical pattern.

A detector that has Anthropic's key can examine the sequence of words and determine how consistent it is with the choices Claude would have made while using the watermark, allowing it to estimate the likelihood that Claude was involved in writing the text.

According to Anthropic, internal testing found no impact on creativity, readability, or the content of Claude's responses.

The company also says watermarking requires no additional tokens and has a negligible impact on generation speed.

"Nothing is added to the text and there are no hidden characters," Anthropic noted. "Watermarking doesn’t require extra tokens, and will not be more expensive."

Code and factual answers may carry less watermarking

As I mentioned, there are certain exceptions to watermarking, and they're for good reasons.

For factual statements where only one answer is correct, Anthropic says the watermark does not interfere with the choice.

Likewise, the same principle applies to code, where replacing one term with another could break the output.

"Where an exact output is required—where there isn’t a choice, and something would be factually wrong or a piece of code would break if a different term was chosen—the watermark isn’t applied."

"For example, once the model has written “2 + 2 =”, there is a very clear best choice for the next token (if the model is completing the sum, there isn’t an answer that’s equally as good as “4”; if it’s talking about George Orwell’s Nineteen Eighty-Four, there isn’t an answer that’s equally as good as “5”)," the company noted.

"The “nudge” of the watermark wouldn’t be applied here. For the same reason, code—which in very many cases has to be exact—has generally less watermarking than some other forms of text."

Anthropic notes that watermarking can still be used in parts of code where arbitrary choices exist, such as comments, but says it should have a negligible effect on the actual code produced.

This aligns with Google's SynthID-Text paper, which notes:

There are two primary factors that affect the detection performance of the scoring function. The first is the length of the text x: longer texts contain more watermarking evidence, and so we have more statistical certainty when making a decision. The second is the amount of entropy in the LLM distribution when it generates the watermarked text x. For example, if the LLM distribution is very low entropy, meaning it almost always returns the exact same response to the given prompt, then Tournament sampling cannot choose tokens that score more highly under the g functions. In short, like other generative watermarks, Tournament sampling performs better when there is more entropy in the LLM distribution, and is less effective when there is less entropy.

It is also worth noting that light proofreading of human-written text may leave too little Claude-generated material for reliable detection.

Anthropic says the watermark only applies to words Claude actually chooses, so a few grammar or punctuation changes might not provide enough evidence.

Anthropic says a translation produced by Claude carries a watermark because Claude chooses every word in the translated output.

Anthropic is building an API to detect Claude watermarks

It turns out that there'll be an easier way to detect the watermarks, as Anthropic plans to offer a watermark detection API.

The API will be able to estimate the likelihood that Claude was involved in writing a piece of text, but Anthropic stresses that this is not the same as proving who wrote it.

A Claude watermark also cannot identify whether the text was written by another AI model, since other providers may use different watermarking methods and different keys.

"A watermark can only determine that Claude was likely involved with the content at some point. It cannot distinguish “Claude wrote this” from “Claude heavily edited this.”

"Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will."

Detection also becomes less reliable with small samples because there are fewer word choices for the detector to analyze.

For generated PNG, JPG, and SVG files, Anthropic is taking a different approach.

Claude will attach cryptographically signed C2PA provenance metadata indicating that the file was created or processed with Claude, rather than modifying the file itself with an embedded watermark.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report