Starting August 2, in line with the transparency obligations under the EU AI Act, Anthropic began applying machine-detectable markers to Claude models released from that date onward. Text outputs carry an invisible watermark, while supported file formats such as PNG, JPG, and SVG include provenance information in their metadata indicating that the file was “created or processed by Claude.” This information is also digitally signed so that any tampering or alteration can be detected.
The system is not limited to the EU. Anthropic explains that because it is difficult to reliably apply watermarking on a region-by-region basis, the marking system is being used worldwide. Models released before August 2 are also scheduled to receive the feature gradually over the coming months.
So how exactly can a watermark be left in text?
Photos have pixels, and videos have frames—physical units that can be subtly altered without drawing attention. Text is different. A sentence is ultimately an arrangement of words, and every word a reader sees is already out in the open.
There Are No Pixels to Hide in Text
Claude’s text watermark is a modified version of SynthID-Text, an AI-generated text identification technology introduced by Google DeepMind in a 2024 paper published in Nature. It does not work by inserting invisible special characters or hidden symbols into a sentence. Instead, it leaves a pattern in the process by which the model selects the next word.
To understand how this works, it helps to first look at how a language model generates text. A language model chooses the next word one step at a time based on what has already been written, and there is not always a single correct answer at each step. For example, after the phrase “The weather today was cold and…” a word like “sugary” would be highly unlikely, while “overcast” or “grey” would both sound natural. In ordinary sampling, the model calculates the probability of each candidate and introduces some randomness when selecting among them.
A text watermark adds one more rule to this selection process. It does not assign fixed scores to particular words in advance, nor does it force the model to repeatedly use a word such as “grey.” According to Anthropic, when the model chooses the next word, it combines the preceding words with a secret key known only to Anthropic to generate a value used in the selection process. This means that even the same word, such as “grey,” may have a different chance of being selected depending on the preceding context.
In the original SynthID-Text system, this process is described in more detail. Context and a secret key are used to generate a new value at each step, candidate words are assigned scores, and those scores are then incorporated into the selection process. Anthropic has not disclosed the detailed algorithm used in Claude’s modified version, but the underlying idea is the same: the secret key influences how the model chooses among otherwise natural candidates.
That is why the watermark is difficult to detect simply by reading the finished text. There is no fixed word or sentence pattern that visibly repeats. But someone with the same secret key can analyze the completed text and calculate how closely the actual sequence of words matches the choices that would be expected under that key.
In human-written text, such matches would generally fall within the range of chance. In watermarked text, the alignment between the expected choices under the secret key and the actual word sequence appears at a statistically higher rate. The longer the text, the more selections there are to compare, making the signal clearer and allowing Anthropic to estimate whether Claude was involved in generating the text.
Anthropic compares the idea to a game of Monopoly. Imagine moving a piece not by rolling dice, but by reading the digits of pi in sequence: 3, 1, 4, 1, 5. To the player, the movement might look entirely ordinary. But if someone later compared the full record of moves with the digits of pi, they could determine whether the sequence followed a particular rule. Text watermarking works in a similar way: the signal does not appear in any single word, but emerges from the accumulated record of many choices.
One advantage of this approach is that it can leave a watermark without substantially affecting the quality of the writing. Anthropic says its own internal testing found no impact on the content, creativity, or readability of Claude’s outputs, although it has not disclosed the size of those tests or detailed measurements.
More concrete public evidence is available for the original SynthID-Text system. Google DeepMind deployed watermarked and non-watermarked models in live Gemini traffic and compared roughly 20 million responses, finding no statistically significant difference in user ratings. A separate human evaluation also found no significant difference in grammar, relevance, accuracy, usefulness, or overall quality. At least in the published experiments, watermarking did not produce a measurable decline in response quality.
The technology itself is not entirely new. The broader family of techniques that includes SynthID-Text can be traced back at least to a 2022 proposal by Scott Aaronson for watermarking generated text. The specific algorithms differ, but the basic idea remains the same: introduce a secret-key-based rule into the model’s word-selection process and later verify the resulting pattern statistically.
Ultimately, the point of a text watermark is not to hide something inside the sentence, but to leave a statistical trace in the way words are selected.
The Traces Are Left in Different Places
Text watermarking leaves its trace in the process of choosing words, while supported formats such as PNG, JPG, and SVG store separate provenance information in their metadata. Both are meant to indicate that AI was involved, but they leave that evidence in different places and in different ways.
When a user creates or processes one of these files with Claude, the file contains provenance information in the C2PA format. This records that the file passed through Claude, and a digital signature is attached so that later tampering or modification can be detected.
C2PA is not a technology designed exclusively for AI. It is an open industry standard for recording where digital content came from and what processes it has gone through. Tools that support C2PA can verify the provenance information contained in the file and check whether the signature remains valid. Rather than hiding an invisible signal inside the pixels of an image, C2PA records provenance and processing history alongside the file.
The two methods behave very differently when it comes to durability. A text watermark travels with the text as long as the word sequence remains intact. Copying and pasting the same text into Word, Notion, or another document does not make the signal disappear. There is no separate character or marker to remove; the signal lies in the sequence of words that has already been chosen.
C2PA information, by contrast, is metadata. It can disappear if the file format is changed, if the image is resaved in software that does not preserve the metadata, or if the screen is captured and a new image is created. Anthropic itself cites format conversion, resaving, and screenshots as examples of situations in which C2PA information may be lost.
If a text watermark is an invisible production pattern left in the process of creating content, C2PA is more like a signed résumé or provenance record that travels alongside the content.
How Much Editing Does It Take to Make It Disappear?
Of course, a text watermark does not survive every kind of change. If the word sequence stays intact, as it does with simple copying and pasting, the signal follows the text. Once the sentences themselves are edited, however, the watermark’s statistical pattern can also be affected.
Anthropic acknowledges this limitation. It says that the watermark may still be detectable after minor edits, but if every word is changed in a complete rewrite, the signal can disappear. Anthropic then raises a question of its own: if a text has been rewritten to that extent, should it still be considered AI-generated?
Detectability also depends not only on how much the text has been edited, but on its length and nature. In a short passage, there may simply be too few word-selection events to provide enough statistical evidence. As the text grows longer, there are more choices to examine, making it easier to determine whether a pattern exceeds what would be expected by chance.
The signal is not equally strong in every sentence either. In passages where factual constraints sharply limit the available wording, there is less room for the watermark to influence the choice. Anthropic gives the example of Newton’s best-known work. After the sentence “Isaac Newton’s most famous work was called Principia…,” the word “Mathematica” is effectively the correct answer. Choosing something else would change the meaning, leaving little room for the watermark to intervene.
The difference becomes even clearer when comparing proofreading and translation. If a person writes a passage and asks Claude only to correct spelling or grammar, most of the final words may still be the ones originally chosen by the human author, leaving too little signal to detect. Translation is different. Even when the ideas and content originate with a human, Claude is the system choosing the actual words in the translated text. For the same source material, the amount of detectable signal can therefore vary depending on how extensively Claude participates in the final word selection.
For this reason, the absence of a watermark does not necessarily mean a text was written entirely by a human. The passage may be too short, heavily factual, lightly edited by Claude, or generated by another AI system. Conversely, detecting a watermark does not mean Claude wrote the text from beginning to end. A human-written draft may have been substantially edited or translated by Claude.
Ultimately, what the watermark reveals is not who the author is, but how much Claude was involved in choosing the words of the final text.
How Can a Text Watermark Be Detected?
Services that attempt to identify AI-written text already exist. They are commonly referred to as “AI detectors.” These tools analyze statistical features of writing or expressions that AI models tend to use frequently and estimate the likelihood that a passage was AI-generated. Anthropic itself notes, for example, that AI models tend to favor constructions such as “this isn’t X, it’s Y” and may use the word “quietly” more often than expected.
Claude’s watermark is verified differently. Rather than looking at the style of the writing and guessing whether it “sounds like AI,” the verification process reapplies the secret key used during generation and calculates how closely the actual word sequence matches the choices that would be expected under that key. As described earlier, the watermark leaves a statistical trace across many word-selection events, and someone with the same key can analyze the finished text to determine whether that trace occurs more often than chance would suggest.
This means existing AI detection services cannot verify Claude’s watermark in the same way. They do not possess Anthropic’s secret key. Estimating that a passage “looks AI-written” based on stylistic features and verifying a watermark signal left during generation are fundamentally different methods.
At present, Anthropic is the party that holds the key. Ordinary users, however, do not yet have access to a tool that allows them to directly test their own text. In an official explanation published on August 14, Anthropic said it plans to provide a watermark detection API soon, but it has not announced a specific release date.
This is also connected to the intent of the EU AI Act. Article 50(2) requires providers not only to mark AI-generated or AI-manipulated text, audio, images, and video in a machine-readable way, but also to ensure that such content can be detected as AI-generated or manipulated. The EU code of practice likewise calls for technical measures that address both marking and detection of generated content.
A text watermark, then, does not end with leaving a signal. It only becomes a verification mechanism once that signal can actually be read.
The Watermark Is There, but You Cannot See It
The problem is that the watermark is already being applied, while ordinary users still cannot directly check whether the signal remains in their own text. Anthropic has said it plans to provide a detection API, but it has not yet announced even a specific release date.
This creates a gap between the existence of a watermark and the ability to verify it. Claude may have left a signal in a text it helped produce, but the user cannot independently determine whether that signal is still present, whether it survived subsequent editing, or whether it has already weakened beyond the point of reliable detection.
This issue goes to the heart of transparency. Leaving a trace of AI involvement in a piece of content is only one step. For that trace to function as a meaningful transparency mechanism, users also need a way to verify it and a clear standard for interpreting the result.
There are no pixels to hide in text.
While explaining its watermark, Anthropic posed a question of its own: if every word has been rewritten, can the result still be called AI-generated?
The question can also be turned around.
If a mark has been left, but the user cannot actually read it, can that really be called sufficient transparency?
