Anthropic has published a detailed account of the watermarking system it will apply to Claude's text output, confirming that the method is a version of SynthID-Text, the approach Google DeepMind introduced in a 2024 Nature paper. The change is being made to satisfy the European Union's AI Act.
The technique inherits from a proposal Scott Aaronson floated in 2022, and its central idea is narrower than the word watermark suggests. Nothing is inserted into the text. No hidden characters are added, no extra tokens are consumed, and the model neither slows down nor costs more to run.
Changing the source of randomness
Language models emit one token at a time, choosing among candidates that would each fit. In a sentence beginning with a description of cold weather, a model might reasonably land on overcast or grey; the meaning survives either way, and ordinarily a random number settles it.
Watermarking replaces that arbitrary randomness with a value derived from a secret key and the immediately preceding words. The selections remain effectively random to a reader, but anyone holding the key can test whether a passage's word choices are consistent with what Claude would have produced under it, and assign a probability accordingly.
Crucially, the system does not push the model toward vocabulary it would otherwise avoid. Anthropic notes it would not induce Claude to reach for an obscure synonym like nubilous, because the nudge operates only among candidates already in contention. In internal testing and in DeepMind's own controlled study, raters comparing watermarked and unwatermarked answers side by side found no difference in quality.
Where the watermark thins out
The company is unusually direct about the limits. Detection answers one question only: how likely is it that Claude was partly involved. It cannot establish that text is human-written, and it cannot identify output from a different model, which would carry a different key or a different scheme entirely.
Signal strength also scales with length, so short samples offer too few decision points to be conclusive. Factual passages are watermarked sparsely, because accuracy leaves little room for interchangeable wording; once a sentence commits to naming Isaac Newton's Principia, only one continuation is correct. Code is similarly resistant, since exactness is usually required, and comments within code are one of the few places the mark can settle.
Editing behaves the same way. Proofreading a human draft leaves almost nothing for the watermark to attach to, because nearly every word remains the author's. Translation, by contrast, is fully watermarked, since Claude chooses every word. Light editing will not reliably strip a mark, though a complete rewrite will, at which point the label arguably no longer applies.
Regulation is the driver
Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026, one of roughly 190 signatories, and the marking obligation took effect on August 2. Other major model developers signed the same code and will deploy their own watermarks.
Notably, Anthropic is applying watermarking globally rather than to European traffic alone, saying it lacks a durable way to scope the behavior by region for now. Models released before August 2, 2026 fall under a transition period and will receive watermarking over the coming months.
For files rather than text, Claude attaches a C2PA content credential, a cryptographically signed note in the metadata using the same open standard camera makers and photo editors already rely on. That is a label rather than a watermark: nothing in the file itself changes, and it disappears with anything that discards metadata.
A detection API is planned but not yet specified. Until it ships, the practical effect for most users is nil. The marking is invisible, carries no information about the person or organization that prompted it, and changes nothing about ownership of or responsibility for the output.
