Anthropic says future Claude models will place an invisible statistical watermark in generated text, giving the company a way to estimate whether Claude helped write a passage. The change matters because the mark is not metadata that disappears when text is copied. It is a pattern in the words themselves, introduced while the model generates them.
The company is adopting a version of Google DeepMind's SynthID-Text method and plans to apply it globally at launch, Anthropic said in its technical explanation. It is doing so to meet transparency obligations under the European Union's AI Act. The mark will not identify a user, organization, or conversation, and Anthropic says it will not add tokens or raise prices.
That still leaves a consequential shift for anyone who uses Claude to draft, translate, edit, or comment code. A positive result will be evidence of Claude's involvement, not proof that Claude authored an entire document. Detection will also be probabilistic, weaker on short or tightly constrained text, and controlled by a key held by Anthropic.
The watermark is a pattern, not a tag
A language model produces text by repeatedly assigning probabilities to possible next tokens and sampling from those possibilities. Often there is one clearly correct continuation. In other places, several words can make a plausible continuation without materially changing the answer.
Anthropic's example begins with the sentence, "The weather today was cold and..." The model might reasonably continue with "overcast" or "grey," but not "sugary." Normally, random sampling helps settle a choice among plausible candidates. Under the planned system, a secret key and the preceding words will shape that randomness. Across a sufficiently long response, those keyed choices form a pattern that a detector can score.
Nothing is appended to the output, and there are no hidden characters to strip. Copying the passage into a plain-text editor therefore does not automatically remove the signal. The detector instead asks whether the sequence is unusually consistent with choices generated under Claude's key.
This is based on SynthID-Text, a method published by Google DeepMind and described in a 2024 Nature paper. The system modifies token sampling rather than model training. DeepMind calls its production configuration non-distortionary: averaged over the watermark's random seeds, it is designed to preserve the model's original output distribution. Google has already used SynthID-Text for Gemini and Gemini Advanced.
Detection answers a narrow question
Anthropic is explicit about the proposed detector's limits. With its key, the company can estimate the likelihood that Claude partly wrote a passage. It cannot establish that a human did not write it, identify which person requested it, or determine whether another model produced the text. A different provider would use another key and could choose another marking method.
Length matters because every flexible word choice contributes only a small amount of evidence. Long passages supply more observations and allow greater statistical confidence. Short samples give the detector little to work with. Low-entropy text, where the next token is strongly constrained by fact, syntax, or context, also offers fewer places to carry a mark.
The result is closer to a signal with a confidence score than a forensic signature. That distinction will be important if schools, publishers, employers, or platforms use detection results to make decisions. Even Anthropic's detector will not be able to separate "Claude wrote this" from "Claude substantially edited this." A positive result should not be represented as proof of authorship.
Anthropic says it will offer a watermark-detection API and is still working out the implementation details. Until those details arrive, important operational questions remain open: who can query it, whether results will expose a calibrated probability or a simple label, what false-positive thresholds it will use, and how disputes will be handled.
Code, proofreading, and translation behave differently
The mark needs room for choice, so it will not be equally strong in every Claude output. If only one token correctly completes a fact or keeps a program valid, Anthropic says the watermark's "nudge" will not apply there. Code should therefore contain less watermarking than ordinary prose, although flexible names or comments can still carry the pattern.
Light proofreading is another weak case. If Claude changes only punctuation and a few grammatical errors, most words remain the user's, leaving little space for a detectable signal. Heavy rewriting creates more model-selected words and more evidence. Translation sits at the other end of the spectrum: Claude chooses every output word, so translated text will be watermarked.
These boundaries make the eventual API more nuanced than familiar AI-writing detectors. A lightly corrected human document may remain undetectable; a thoroughly recast one may register Claude's involvement. Neither outcome, by itself, establishes who formed the ideas or held editorial responsibility.
Editing can also weaken the mark. Anthropic says light changes probably will not erase it completely, while a full rewrite can. That is an inherent tension in text watermarking: a signal that survives ordinary handling may still be removable by someone determined to replace enough of the wording.
The quality claim has evidence and critics
Anthropic says its internal tests found no effect on content, creativity, or readability. Its strongest outside evidence comes from DeepMind's SynthID-Text research. The Nature paper reports standard benchmark and side-by-side human evaluations with no measured loss in model capability, plus a live experiment covering nearly 20 million Gemini responses. User feedback in that deployment showed no statistically significant quality difference between watermarked and unwatermarked output.
The design nevertheless creates an intuitive concern: if a secret signal participates in selecting words, is the model still choosing the best wording for the reader? John Gruber made that case sharply in a widely discussed Daring Fireball critique, arguing that even near-synonyms are not perfectly interchangeable and that prose should not be bent for provenance. The essay became a major community-buzz signal, drawing hundreds of comments on Hacker News, but it is an argument about the trade-off rather than independent evidence of degraded Claude output.
The research offers a more precise account than either "the words are changed" or "nothing changes." DeepMind's non-distortionary configuration is built to preserve the overall probability distribution, while detection relies on correlations that appear across a sequence. The paper also describes a stronger, distortionary configuration that improves detectability at the cost of some text quality. Anthropic says it is using a version of the SynthID-Text approach but has not published enough implementation detail to reproduce or independently audit Claude's exact balance.
That makes evaluation after launch essential. Aggregate thumbs-up and thumbs-down rates can reveal broad regressions, but they may miss subtle effects in legal drafting, literary prose, technical documentation, or languages with fewer evaluation samples. Controlled comparisons across those uses would provide a better test of the claim that readers cannot distinguish the marked output.
EU rules are pushing provenance into model output
The policy driver is Article 50 of the EU AI Act. The European Commission's transparency guidance says obligations applying from August 2, 2026 require providers to make generated audio, images, video, and text machine-readable and detectable as artificial or manipulated, as far as technically feasible. A voluntary Code of Practice supplies a recognized compliance route; the underlying transparency duties are legal obligations. About 190 companies and organizations had signed the code by the end of July, according to the Commission.
Anthropic says it cannot yet scope the watermark durably by region, so the initial rollout will be worldwide. It will keep evaluating other approaches. Older Claude models have a transition period, and Anthropic says it plans to add marking to them over the coming months.
Files follow a different path. For supported image formats such as PNG, JPG, and SVG, Claude will attach a cryptographically signed C2PA content credential in metadata. A compatible tool can read that note, and the pixels themselves do not need to change. Text has no stable file container once it is pasted into a message, document, or form, which is why the provenance mechanism has moved into token selection. The Verge's report highlighted that contrast and noted that other large providers serving the EU face the same rules.
The next things to watch are concrete rather than speculative: which Claude models turn the system on, the detection API's access and error-rate documentation, and independent tests across languages and specialized writing. The central test will be whether the watermark remains useful after normal editing without encouraging institutions to treat a probability as a verdict. Until Anthropic publishes those operational details and outside researchers can measure real outputs, the mechanism is technically credible but its social use is unsettled.