Anthropic plans to apply watermarks to future text outputs from Claude.
This watermark is not something readers will see. It is not a label attached to the end of a text. It is not a hidden character or special symbol. It does not add extra tokens. Instead, it leaves a specific pattern in the low-level probabilistic choices Claude makes when selecting words.
Anthropic says this method can help determine, after the fact, whether Claude may have been involved in writing or editing a piece of text. Readers will not notice the difference. But a verifier with the watermark key can analyze the pattern of word choices and estimate the likelihood that Claude was involved.
This is not merely a technical update.
It points to the next phase of AI-generated content transparency. Until now, the question of how to distinguish AI-written text has often been framed around detection software, user disclosure or visible labels such as “written by AI.” Anthropic is taking a more structural approach. It is embedding a verifiable pattern into the model’s output process itself.
The background is the EU AI Act.
Anthropic said it has signed the EU Code of Practice on AI-generated content transparency along with several major AI providers. Under that framework, providers must adopt ways to identify AI-generated text. Because Anthropic currently cannot reliably apply the watermark only by region, it plans to apply it globally at launch.
In other words, Claude’s text watermark begins as a response to European regulation.
But its impact may reach users worldwide.
A Watermark Is Not a Hidden Character in the Text
When many people hear the word “watermark,” they imagine something visible.
A logo in the corner of an image. A faint mark in a document background. Metadata attached to a file. But Anthropic’s text watermark works differently. It does not insert a visible mark into the text. It does not add hidden characters or special codes.
The mechanism lies in word selection.
A large language model does not write an entire passage at once. It selects the next word or token step by step. In some cases, there is almost only one correct answer. After “2+2=,” for example, the answer must be 4. In those places, there is little room for watermarking.
But in many sentences, several options may be equally natural.
A phrase can continue in different ways without changing the meaning significantly. In these low-risk choice points, the watermark can operate. It does not remove randomness. It changes the source of randomness in a keyed way.
Anthropic compares this to playing a board game using digits of pi instead of dice.
To the players, the movement still looks random. But if someone later has the full record of the moves and knows the digits of pi, they can estimate whether the game likely used pi instead of dice. Claude’s text watermark works in a similar spirit.
To the reader, the text looks ordinary.
To the verifier, the pattern of word choices can reveal a probabilistic trace of Claude involvement.
A SynthID-Text-Style Approach
Anthropic describes Claude’s text watermark as a version of the SynthID-Text approach published by Google DeepMind in a 2024 Nature paper.
This approach is also connected to a family of ideas proposed by Scott Aaronson in 2022. The shared principle is not to make word choices look strange. Instead, it changes the source of randomness used in selecting words through a secret key.
The advantage is that output quality should remain largely unchanged.
Anthropic said its internal tests found that watermarking did not affect the content, creativity or readability of Claude’s text. Google DeepMind’s SynthID-Text paper also reported that watermarking was applied to part of Gemini traffic and compared through user evaluations, without meaningful differences in perceived quality. Human evaluators also did not observe meaningful quality differences when comparing watermarked and non-watermarked responses side by side.
This matters.
If AI-generated content labeling made outputs worse, made writing awkward or increased cost, users would resist it. Anthropic emphasizes that its watermark does not create those problems.
Users receive the same quality of answer.
But the answer carries a probabilistic trace that can be verified later.
What the Watermark Can and Cannot Say
Anthropic is also relatively clear about the watermark’s limits.
The watermark can help estimate how likely it is that Claude was involved in writing part of a text. But it does not prove that a human did not write it. It also cannot determine whether another AI wrote the text. Other AI providers may use different watermark keys or different methods.
It also does not work well on short text.
The watermark depends on accumulated patterns across many word choices. A short sample may not contain enough choice points. The longer the text, the stronger the confidence may become.
Fact-heavy sentences also limit watermarking.
When there is almost only one correct answer, the model has fewer safe alternatives. For example, when completing the title of a famous work by Isaac Newton, accuracy may require a specific word. Watermarking cannot interfere in a way that harms factual correctness.
Proofreading creates a similar issue.
If a user writes a passage and asks Claude only to fix grammar and punctuation, most words remain the user’s original words. Claude has few opportunities to make word choices. Therefore, the watermark may be weak or difficult to detect. If Claude rewrites more heavily or translates a passage, it chooses more words and leaves a stronger watermark.
The watermark is not an absolute AI detector.
It is a probabilistic tool for estimating Claude involvement.
Translation Leaves More Watermark. Light Proofreading Leaves Less.
Anthropic said watermarking applies to translation.
That is because Claude chooses all the words in the target language. Even if the user provides the source text, Claude constructs the translated sentence in the destination language. That process can leave a watermark.
Proofreading is different.
If a human-written text is mostly preserved and Claude only corrects commas, spelling or grammar, the model selects fewer new words. In that case, the watermark may not be detectable enough. The more Claude rewrites, the more words it chooses, and the more likely a watermark becomes detectable.
This distinction matters in real use.
Students, writers and office workers may ask Claude to polish their writing. Whether the result may be judged as AI-generated depends partly on the intensity of the editing. Light proofreading may be difficult to detect. Heavy rewriting may leave stronger traces of Claude involvement.
Still, one point remains important.
A watermark does not automatically decide authorship, ownership or responsibility.
The possibility that Claude was involved is separate from who the author is, who owns the work and who is legally responsible for it.
Code Will Be Watermarked Less Densely
Anthropic also offered an important explanation about code.
Watermarking works best when there are several natural and correct choices. Code is different. In many cases, correctness is essential. A variable name, function name, syntax element, operator or library call can break the program if changed incorrectly.
For that reason, code is expected to contain less watermarking than ordinary prose.
There are still places in code where flexible choices exist, such as comments, some variable names or explanatory text. Watermarking may appear there. But Anthropic says it will not watermark in ways that harm functional correctness.
This matters for developers.
The fact that AI-generated code may carry a watermark does not mean the code will become strange, slower or broken. At the same time, watermark detection alone may not be enough to strongly conclude that “Claude wrote this code,” because code may contain sparse watermark signals.
Tracing the origin of AI-generated code remains a difficult problem.
It Does Not Contain Personal Identifiers
Anthropic emphasized that the watermark does not identify a user, organization or chat.
The watermark applies to Claude and its output. It does not contain information that can be used to reconstruct a specific person, company, account or conversation. What the key can indicate is whether Claude was likely involved in generating the text, not who used Claude.
This addresses an important privacy concern.
If users hear that invisible traces are placed in AI outputs, they may worry that the watermark is a tracking mechanism. Anthropic is trying to distinguish the watermark from user tracking. It is a model-involvement verification mechanism, not a personal identifier.
Anthropic also said the watermark does not add tokens, does not increase cost and has almost no effect on speed.
Its user-facing message is clear:
It is invisible.
It does not slow the model.
It does not make the model more expensive.
It does not track individuals.
It does not reduce quality.
But it leaves a way to verify possible AI involvement.
Images and Files Use C2PA Metadata
Images and files use a different approach.
Anthropic said that when Claude generates supported file formats such as .png, .jpg or .svg, it will attach a small cryptographically signed content credential in file metadata. This is based on C2PA, an open industry standard also used to record provenance in cameras and photo-editing software.
This metadata is different from a text watermark.
It does not alter the content itself or insert hidden information into the file. It provides signed provenance information indicating that the file was created or processed by Claude. Tools that recognize C2PA can read it, and Anthropic plans to provide its own tool for checking uploaded files.
This distinction is important.
Text is often copied and separated from metadata. That is why watermarking through word-choice patterns is useful. Images and files can carry provenance through metadata, although metadata can also be removed during file conversion or platform upload.
AI-content transparency requires different technologies for different formats.
Text may use probabilistic watermarking.
Images and files may use C2PA metadata.
Each method has strengths and limits.
Can Editing Remove the Watermark?
Anthropic acknowledges that editing can weaken or remove the watermark.
Light editing may not fully remove it. But a complete rewrite that changes every word can remove the watermark. Anthropic notes that, in such a case, whether the resulting text should still be considered AI-generated becomes debatable.
This is an inherent limitation.
Text is easy to copy and modify. Someone can take AI-written text and rewrite it manually, ask another AI to paraphrase it, translate it back and forth, or split it into shorter segments. The original pattern may weaken.
Malicious users will likely try to evade detection.
Tools designed to remove watermarks through paraphrasing may appear. Passing text through multiple models may also work. Short samples may be difficult to verify.
That does not make watermarking meaningless.
Not everyone will try to evade it. Large platforms, schools, publishers and companies may still need basic ways to verify AI involvement. Watermarks can become useful transparency infrastructure in such environments.
But they should not be marketed as a complete solution for AI detection.
How This Differs From Ordinary AI Detection Software
Anthropic also explains how Claude’s watermark differs from ordinary AI detection software.
AI detectors such as Pangram do not have Anthropic’s watermark key. They are not verifying a hidden generation pattern. Instead, they estimate authorship based on stylistic clues common in AI writing, such as repeated phrases, token distributions or word-frequency patterns.
That is different from watermark detection.
A general detector is an outside observer guessing from style.
Watermark detection checks a keyed pattern known to the generator.
In theory, watermarking can provide more direct evidence. But it works only for Claude, requires the key and needs enough text and enough watermarkable choice points.
General AI detectors can be applied more broadly across many models, but they are more vulnerable to false positives and false negatives. They may mistake human writing for AI writing or fail to detect AI-generated text.
The future of AI-content verification will likely include several approaches at once:
provider watermark verification;
third-party AI detection software;
file-metadata provenance;
platform-level labels;
and user disclosure policies.
No single method is enough.
Ownership and Responsibility Do Not Change
Anthropic said the watermark does not change ownership or legal responsibility for outputs.
The watermark helps test whether Claude may have been involved in generating or processing content. It does not decide who owns the copyright or who is the author. Anthropic also said user rights under its terms are not changed.
This is critical.
A label or watermark showing AI involvement does not automatically resolve copyright. Claude’s involvement does not make Anthropic the author. It also does not remove the user’s responsibility. Conversely, the absence of a watermark does not prove that a human wrote the text.
A watermark is one piece of evidence.
Legal judgment is separate.
Copyright may depend on human creativity, contractual terms and jurisdiction.
Responsibility may depend on use, distribution, falsity and infringement.
Watermarks must not be overinterpreted.
The EU AI Act Is Changing Global Products
The most important background to the announcement is the EU AI Act.
Anthropic said it is introducing watermarking to meet requirements for providers serving the EU market to identify AI-generated content. In July 2026, Anthropic and other major AI model providers joined roughly 190 signatories in the EU’s Code of Practice on AI-generated content transparency.
The interesting part is the scope.
Anthropic said that because it currently cannot reliably apply or exclude the watermark by region, it will apply watermarking globally at launch. This is a familiar pattern: European regulation changes global product design.
The EU transparency requirement will not affect only European users.
If global AI providers find it difficult or inefficient to run different product behavior by region, the European standard can become the global default. The GDPR did this in privacy. The EU AI Act may do something similar for AI-generated content transparency.
Claude’s watermark is a signal of that shift.
Questions Users Will Still Have
Even with Anthropic’s explanation, users will have questions.
First, who will be able to use the watermark detection API? Anthropic said it plans to provide one, but the implementation details are still being finalized. It matters whether the API will be open to ordinary users, limited to platforms and institutions, or controlled to prevent misuse.
Second, how will results be expressed? A probability score such as “80% likely Claude-assisted” would have different social consequences from a simple positive or negative label.
Third, how will schools, publishers, media companies and corporate document systems interpret results? Detection of a watermark should not automatically be treated as misconduct. Translation, proofreading, editing and drafting involve different levels of AI assistance.
Fourth, could users be disadvantaged after using Claude for light editing? Anthropic says light proofreading may leave little detectable watermark, but real-world policies may still create misunderstandings.
Fifth, how will Claude’s watermark interoperate with watermarks from other AI providers? If each company uses different keys and methods, platforms may need to manage many verification systems at once.
AI watermarking may be harder as an operational-policy problem than as a technical one.
What This Means for Korea
Korea will also face growing debates over AI-generated content labeling and detection.
Schools want to know whether students used AI in assignments. Media and publishers need policies for labeling AI-written content. Companies want to track AI involvement in reports, proposals, code and marketing copy. Public institutions may be asked to disclose AI use in civil-service responses and policy documents.
Claude’s watermark offers several lessons.
First, AI detection is probabilistic. Even watermarking is not absolute proof.
Second, the level of AI involvement matters. Translation, drafting, rewriting, polishing and proofreading are not the same.
Third, the goal should not be to ban AI use automatically, but to define transparent and responsible use.
Fourth, detection results should not be the sole basis for punishment or disadvantage. Short text, fact-heavy text and lightly proofread text may produce unstable results.
Fifth, companies and institutions need AI-use policies before detection tools arrive. They should decide which uses are allowed, when disclosure is required and how external submissions should be labeled.
Sixth, watermarks should be understood as model-involvement signals, not personal tracking tools.
In Korea, the question “Was this written by AI?” may easily become a moral judgment.
But the more important question is how AI was used.
For what purpose?
To what extent?
Under whose responsibility?
AI involvement itself is not the issue.
Unclear use, hidden responsibility and careless interpretation are the real risks.
AI Transparency Will Not Be Solved by Visible Labels Alone
Claude’s text watermark shows the next stage of AI-generated content transparency.
Anthropic says future Claude models will generate text with a watermark. This watermark is not a hidden character or visible label. It leaves a probabilistic pattern at low-risk points in word selection. Readers will not notice it, but verifiers with the key can estimate whether Claude was involved.
Anthropic says this should have little effect on quality, speed or cost. It does not identify a person, organization or specific chat. It may apply more strongly to translation, where Claude chooses every word, and less strongly to light proofreading, where most human wording remains. Code may contain less watermarking because correctness is more constrained.
The move is connected to the EU AI Act and the EU Code of Practice on AI-generated content transparency.
But the effect is not limited to Europe. Anthropic plans global application because regional separation is difficult. This is another example of European AI regulation changing global product design.
Still, watermarking is not a magic solution.
It can be weakened by editing. It is less reliable for short text. It cannot tell whether another AI wrote the text. It does not prove that a human did not write the text. It does not decide copyright or legal responsibility.
Even so, it matters.
In the age of AI-generated content, society needs infrastructure that can help answer not only “Who wrote this?” but “How much did AI participate?”
Claude’s text watermark is one attempt to build that infrastructure invisibly.
AI transparency is no longer only about visible labels.
It is becoming a layered system of probabilistic text patterns, file metadata, platform policies, detection APIs and user disclosure.
The important question will not be only whether watermarks are adopted.
It will be how carefully their results are interpreted and how responsibly they are used.
