Anthropic explains how Claude's text watermark works, and where it barely registers

Anthropic published a technical explanation on 14 August of how the invisible watermark it is applying to Claude's text output actually works. The commitment itself was not new: the company said earlier in the month that it would start marking Claude-generated text, and the European transparency rules driving the change took effect on 2 August. What landed today is the mechanism, together with something more useful than the mechanism, which is Anthropic's own account of the cases where the mark barely registers.

Changing where the randomness comes from

Watermarking text is harder than watermarking an image. An image carries redundant detail you can perturb without a viewer noticing. A paragraph does not: change the words and you have changed the content. Anthropic's approach adds nothing to the text at all. It changes the source of the randomness the model uses while it writes.

At each step a language model narrows the next word down to a set of candidates it considers plausible, then samples one of them. That sampling normally draws on an ordinary random number generator. Anthropic swaps it for a function of a secret cryptographic key and the handful of words immediately preceding. The pick is still spread across candidates the model already judged acceptable, so the prose reads the same, but it is now reproducible by anyone holding the key. In Anthropic's phrasing, the words Claude picks are still random, but one can check the sequence of words and see whether it is consistent with the choices Claude would make if it were using the key.

Detection is therefore statistical and cumulative. A single word proves nothing; a long enough run of words whose choices line up with what the key would have produced is the signal. Which sets up the limitation that matters most: the watermark is only ever as strong as the amount of genuine choice the model had while writing.

Where Anthropic says the mark is weak

The company is unusually direct about this. Its own list of weak cases:

• Short passages. Too few word choices for a signal to accumulate.
• Factual writing. Where one specific term is the only correct one, there is no freedom left to encode anything, so the watermark comes out sparse.
• Code, for the same reason, and proofreading, where Claude leaves most of the author's words in place and the marked words are a small minority.
• Heavy editing after the fact. Light edits probably will not clear the mark; a rewrite that replaces every word will.
• Attribution itself. A positive result means Claude likely took part in producing the text. It cannot separate 'Claude wrote this' from 'Claude edited this', it cannot establish that a human did not write something, and it says nothing about whether a different AI system was involved.

What this means if you build on Claude

For anyone using Claude as a coding assistant, very little changes. Anthropic says code carries minimal watermarking, because the set of acceptable next tokens inside a function body is narrow, and the same holds for editing and cleanup passes over your own writing. The strongest signal lands on long discursive prose generated from scratch, which is where detection anxiety is concentrated. The design is coherent, but the mark is thinnest across most day-to-day developer use.

Two things are not yet available. Anthropic says a watermark detection API is coming and that it is still working out the details of its implementation, so for now nobody outside the company can check a passage. And no accuracy figures have been published: there is no stated false-positive rate, no false-negative rate, and no minimum text length at which the detector becomes reliable. Until those exist, treating a watermark result as evidence in an academic or employment dispute would be premature, and Anthropic's own framing, which is likelihood rather than proof, argues against it.

Files are handled differently. Images and other supported file types get a C2PA content credential instead: a cryptographically signed note in the file's metadata rather than anything hidden inside the content. Anthropic also states that neither the watermark nor its key carries information that could identify a user, an organisation or a conversation.

The regulatory clock behind it

The driver is regulatory. The European Commission began enforcing the AI Act on 2 August 2026, and on the same date transparency obligations started to apply: interactive systems have to disclose that they are AI, deepfakes have to be labelled, and AI-generated or altered content has to carry machine-readable marks so it can be detected. The Commission's press release of 31 July put more than 180 organisations on its first list of signatories to the Code of Practice on transparency of AI-generated content, which operationalises those rules. Anthropic, which says it signed in July, puts the count at roughly 190.

Coverage follows launch dates. Models released on or after 2 August are watermarked from launch, while earlier Claude models fall under a transition period and will be covered over the coming months. Reporting on the initial announcement said the marking spans the API, Claude, Claude Code, Claude Cowork and Claude Tag.

The honest summary is that this is a provenance signal built to satisfy a specific legal requirement, described candidly by the company shipping it, and not yet checkable by anyone else. That is better than a vendor asserting detection accuracy nobody can audit. It still means the only current evidence for how well any of this works is Anthropic's own.