Claude's Invisible Watermark

Yes. Claude models launched on or after August 2, 2026 embed a statistical watermark in generated text, and Anthropic applies the policy worldwide rather than only in the EU. The mark covers the Claude apps, the Claude Platform API, Claude Code, Claude Cowork, and Claude Tag, including access through AWS, Google Cloud, and Microsoft Foundry. Models released before that date are being brought in over a transition period.

What the Mark Is

Nothing is added to the text and there are no hidden characters, in Anthropic's own description. It adds no tokens and costs nothing extra. The watermark carries no identifying information about the user or the organization. It says something about Claude's involvement and nothing about who typed the prompt.

Files work differently. When Claude produces a .png, .jpg, or .svg, it attaches a C2PA content credential, a cryptographically signed note in the file's metadata. That is a different security model from a statistical mark buried in prose. Re-saving the file or screenshotting it strips the credential.

The Rule That Set the Date

Article 50 of the EU AI Act requires machine-readable marking of AI-generated content. Anthropic signed the Code of Practice on Transparency of AI-Generated Content in July 2026, and the obligations became applicable on August 2. Forbes reports penalty exposure running to 15 million euros or 3% of annual turnover. Anthropic chose to apply the marking globally instead of building a European carve-out.

There Is No Detector Yet

As of August 15, 2026, no public detector has shipped. Anthropic's announcement says it will soon be offering a watermark detection API and that it is working out the details of the implementation. The help center article says detection mechanisms will appear in forthcoming technical documentation.

A compliance team cannot wire watermark checking into a pipeline today. The marks that do exist are unreadable outside Anthropic, and the coverage is still partial while older models move through the transition.

A generation-time watermark changes how the model picks words, not which words are available to it. A secret key plus the preceding few tokens seeds the choice at each step, and that seeded pattern shows up as a statistical bias across a long enough passage. A detector holding the same key recomputes the pattern and reports a probability. Readers see normal prose, because every individual choice is one the model would plausibly have made anyway.

The Green List, and Why It Teaches the Idea Best

Kirchenbauer and colleagues published the reference scheme at ICML in 2023. Before each token, a hash of the previous token splits the vocabulary into a randomized green list and everything else. Sampling then softly promotes the green tokens. Detection is a statistical test over green-token frequency that produces interpretable p-values, and it runs without access to the model or its API. Their framing: signals embedded in generated text that are invisible to humans but algorithmically detectable from a short span of tokens.

What Anthropic Says It Adapted

Anthropic names a version of the SynthID-Text approach published by Google DeepMind. SynthID-Text works differently from a logit bias. Candidate tokens get drawn from the model's own distribution and then run through Tournament sampling, a bracket of pairwise comparisons scored against the key. Anthropic describes the same idea in plain language. The watermark alters the source of randomness in word selection rather than the word choices themselves. Instead of an arbitrary random number generator picking the next word, the key and a few preceding words settle which candidate wins.

Both schemes share the property that matters here. A key plus recent context seeds a choice, many small choices accumulate, and a detector reads the accumulation. They differ in whether the model's output distribution gets disturbed at all. One is not a description of the other, and treating green-list results as SynthID results produces confident wrong answers.

Where the Signal Thins Out

Anthropic published a useful list of its own limits.

That last case is the clearest window into what the scheme measures. The watermark tracks how much of the token stream Claude chose. A document Claude wrote marks strongly. A human draft Claude tidied marks weakly or not at all. Authorship is a different question, and the watermark does not answer it.

Paraphrasing degrades statistical text watermarks, and the published attacks are strong enough that no watermark of this kind should be treated as tamper-proof. Whether a paraphrase destroys the signal or only weakens it depends on how much text the detector gets to look at. Short passages favor the attacker. Long documents leak enough of the original wording for detection to recover.

What the Attack Papers Established

Krishna and colleagues built DIPPER for NeurIPS 2023, an 11-billion-parameter paraphrase model that rewrites whole paragraphs with control over lexical diversity and content reordering. Running it over GPT-3.5 output dropped DetectGPT's accuracy from 70.3% to 4.6% at a fixed 1% false positive rate. Watermarking, GPTZero, and OpenAI's own classifier were evaded in the same experiments.

Sadasivan and colleagues went further in Transactions on Machine Learning Research. Recursive paraphrasing cut detection rates across watermarking, neural classifiers, zero-shot methods, and retrieval on 300-token passages, at modest cost to text quality. They also proved a bound. The AUROC of the best possible detector is tied to the total variation distance between the human and AI text distributions. As models get better at writing like people, the ceiling on any detector falls. That result constrains detection as a category. It says nothing about how well any one scheme was built.

The same paper describes spoofing. An adversary can infer a hidden signature without white-box access to the detection method, then produce text that carries it. The failure mode there is a false accusation.

The Result That Keeps the Story Honest

Kirchenbauer's group returned to the question in a follow-up on watermark reliability and did not find a clean kill. Watermarks remain detectable even after human and machine paraphrasing, they reported. The explanation is mechanical. A paraphrase is statistically likely to leak n-grams or longer fragments of the original, which is enough for high-confidence detection once enough tokens are observed. Their headline number: after strong human paraphrasing, the watermark was detectable after observing 800 tokens on average, at a 1e-5 false positive rate.

Eight hundred tokens is roughly 600 words, about the length of one section of a report. Below that threshold the attacker usually wins. Above it the detector often still works. The literature disagrees less about whether paraphrase hurts and more about how much text is on the table when someone goes looking.

What Is Actually Known About Anthropic's Implementation

Very little, in both directions. Anthropic has published no parameters and no accuracy figures. No detection threshold, no stated false positive rate, no dispute procedure for contested results. What the company will say about robustness is one sentence: light editing probably will not remove the watermark completely, and a complete rewrite where every word is replaced will.

Academic probes of the SynthID-Text family do exist. Jovanović, Gloaguen, and Vechev at ETH Zurich published a study of the scheme reporting high removal rates under paraphrase across the configurations they tested. Those are research configurations. Anthropic's deployed configuration is not public, so how that result maps onto this product is unknown. Reading the published probes as a verdict on Claude's watermark would be wrong. So would reading Anthropic's silence as evidence of strength.

The honest summary: this class of watermark is known to degrade under paraphrase, this particular deployment is two weeks old, and there is no public detector to test it with.

The interesting failures are not the ones people expect. A watermark can be missing from AI text and present on human text, and both errors land on somebody.

A Missing Mark Proves Nothing

Anthropic's help center lists the reasons text may carry no detectable mark: heavy editing, paraphrasing, translation, very short passages, stripped metadata, unsupported file types. Add the models released before August 2 that are still being brought into the program. For anyone hoping to enforce a policy, a negative result carries almost no information. You cannot fail a document for lacking a mark.

A Present Mark Proves Less Than People Will Assume

Anthropic is explicit that a detected mark indicates content may have been processed by Claude, and calls the result not fully conclusive. Claude may not be the original author. Someone who wrote a document themselves and asked Claude to fix the grammar can end up with a marked file. Someone who wrote none of it and paraphrased Claude's draft by hand can end up with a clean one. A policy that reads "watermark present" as "AI wrote this" punishes the first person and clears the second.

Spoofing turns the same weakness adversarial. If an attacker can produce text carrying a signature, a mark can be planted on somebody's work. Anthropic has disclosed no dispute procedure for a contested result.

The Last Time Institutions Trusted a Detector

Liang and colleagues ran 91 TOEFL essays written by non-native English speakers through a set of widely used GPT detectors. More than half were flagged as AI-generated. One detector flagged about 98% of them. Essays written by US eighth graders were correctly classified as human more than 90% of the time. The mechanism was perplexity: writers working in a second language produce more predictable text, and predictable text looked machine-made.

Those detectors worked on perplexity rather than a keyed watermark, so the numbers do not transfer to what Anthropic shipped. The institutional behavior will. Schools and employers adopted the previous generation of tools faster than the tools had earned, and the cost landed on the people least equipped to argue about it. A watermark detection API will arrive with better math attached to the same reflex.

Watermark detection keeps disappointing because it asks one artifact to answer a question about a process. A finished document holds no memory of how it was made. Any signal you can read out of it is residue, and residue washes off or gets planted.

Krishna's paper made this point with a working system, and it is the half of that paper people skip. After showing DIPPER breaking detectors, the authors built a retrieval defense: keep a database of what the model actually generated, then compare a candidate document against it by semantic similarity. The method never looks for a hidden signal at all. Against a corpus of 15 million generations, retrieval caught 80% to 97% of paraphrased text at a 1% false positive rate. The paraphrase survived. The record did not care.

That is a provenance system. Its strength comes from having been present at generation time, so forensics after the fact never enters into it. Most teams can get the same property without a 15-million-row index.