Future Claude models generate text that carries a watermark: invisible to readers, detectable by anyone holding the key — and mandatory under the EU AI Act.
Claude Text Watermark
Anthropic's announcement of how Claude's text watermark works, meshed with the URIBurner DaaS Weblog's interactive knowledge graph of the Kirchenbauer et al. scheme — green/red-list token selection, the z-statistic detection test, and the SynthID-Text lineage from Scott Aaronson's 2022 proposal.
Six headline facts: no practical output impact, indistinguishable text, nothing added to text, no extra tokens or cost, no identifying information, and not specific to Claude.
No practical impact
Watermarking does not change the quality or content of Claude's outputs.
Indistinguishable
Watermarked and unwatermarked text cannot be told apart by readers.
Nothing added
No hidden characters or extra content are inserted into the text.
No extra tokens
Watermarking requires no extra tokens and adds no cost.
No identification
The watermark carries no identifying information about a person, organization, or chat.
Not Claude-specific
Other major model developers signed the same Code of Practice and will implement their own watermarks.
LLMs pick the next word from candidate lists; low-stakes choices, settled by random numbers, are where a watermark leaves a detectable pattern.
Large language models like Claude generate one word at a time. Each time the model decides on the next word, it chooses among a list of candidate words, ultimately selecting the most sensible or likely given the preceding text. Take the sentence 'The weather today was cold and...'. The next word is very unlikely to be 'sugary', but quite likely to be 'overcast' or 'grey'. Under most circumstances it matters little to the reader which of these the model chooses, and the choice is settled by a random number.
Watermarking uses low-stakes choices like these, which occur many times over a piece of generated text, to leave a pattern in Claude's responses. The pattern is undetectable to the reader, but detectable to anyone who has the key that encodes it.
The source of randomness changes: the key and a few preceding words settle the word choice, so the sequence can be checked against the key.
When watermarking is used, choices are still made at random, but the source of the randomness is different. Instead of an arbitrary random number generator picking the next word, the watermark uses the key and a few words that come before to settle which word the model picks.
The words Claude picks are still random, but now one can check the sequence of words and see whether it is consistent with the choices Claude would make if it were using the key. If it is, one can assign a probability that the text was generated by Claude.
No impact on content, creativity, or readability in internal testing; SynthID-Text's Google DeepMind study found no statistically significant differences.
Watermarking does not impact the quality of Claude's output. To a reader, a watermarked response is indistinguishable from an unwatermarked one — unlike watermarks on banknotes or digital documents, which are visible to the naked eye.
In internal testing Anthropic has seen no impact on the content, level of creativity, or readability of Claude's text. In the SynthID-Text paper, which introduced the technique Claude uses, Google DeepMind served a watermarked model to a portion of Gemini traffic and compared thumbs-up and thumbs-down ratings, finding no statistically significant differences from the unwatermarked model. Human raters comparing watermarked and unwatermarked answers side by side saw no difference in quality.
Randomness from a book of pi digits is indistinguishable from dice rolls, yet the sequence reveals which source was used: the same logic applies to watermarked text.
Imagine playing Monopoly and, instead of rolling dice, using a book of the digits of pi, starting from a randomly chosen digit. For all intents and purposes the moves are still random — it makes no difference whether the randomness comes from pi or from dice. But if you could see the sequence of all the moves after the game, and you knew the value of pi, you could work out whether this was a game that likely used pi. That game is, in a sense, 'watermarked'.
It is the same for Claude-generated text: watermarking does not change the meaning or experience for the reader, but if you want to check after the fact whether the text was likely generated by Claude, the watermark allows you to do so.
Claude's watermark is a version of SynthID-Text, published by Google DeepMind in a Nature paper in 2024, from a family tracing to Scott Aaronson's 2022 proposal.
Claude's text watermark is a version of the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024. It belongs to a family of approaches that go back to a proposal by Scott Aaronson in 2022, all sharing the same design principle: the watermark only changes the source of the randomness used to pick among words.
The same principle underlies the Kirchenbauer et al. scheme of the ICML 2023 paper arXiv:2301.10226, covered in depth by the URIBurner DaaS Weblog post: a hash of the previous token seeds a pseudorandom partition of the vocabulary into a green list and a red list, and sampling is softly biased toward the green list.
Detection is weaker on small samples and factual passages, cannot confirm human authorship, and cannot identify a different AI's output.
Using the key, one can only answer the question 'What is the likelihood this was partly written by Claude?'. The watermark does not confirm whether the text was human-written, and it cannot tell whether the text was written by a different AI — even a watermarked one, since a different AI would use a different key and possibly a different method.
Detection does not work well on small samples, where there are fewer word choices and thus less information. As a passage increases in length, confidence about Claude's involvement increases. Watermarking is also sparser on factual passages where fewer choices can be made without decreasing accuracy — for 'Isaac Newton's most famous work was called Principia...', 'Mathematica' is the only right answer, so the watermark has nothing to act on.
The watermark attaches only to words Claude chooses; lightly edited human text carries little or no detectable signal.
The watermark only applies to words Claude chooses. When Claude proofreads text written by a person, what it gives back has generally only been lightly edited; because nearly all the words are the person's, there is very little for the watermark to attach to.
Depending on the length of the text and how heavily Claude has edited it, those changes might not be enough to make Claude's involvement detectable. The more Claude writes, the more decisions it makes, and the more space there is for a watermark.
Where an exact output is required the watermark is not applied; code has less watermarking, with a negligible effect where arbitrary terms occur, such as comments.
AI watermarking takes advantage of decisions where either choice of a word would be equally good. Where an exact output is required — where there is no choice, and a different term would be factually wrong or break the code — the watermark is not applied. Once the model has written '2 + 2 =', there is a very clear best choice for the next token.
For the same reason, code, which in very many cases has to be exact, generally carries less watermarking than other forms of text. In areas where there is an arbitrary choice within the code, such as comments, the watermark can be used — with, by definition, a negligible effect on the actual code produced.
No slowdown and no extra cost; the watermark and its key carry no information about individual users, organizations, or chats.
Watermarking has a negligible impact on the speed of models, and because it produces no extra tokens, the model is the same price to serve and use.
The watermark applies to Claude and its outputs. It does not identify individual users: there is nothing in the watermark or its key that would allow anyone to recover information about the user, their organization, or their chats with Claude.
Compliance with the EU AI Act; Anthropic and around 190 signatories signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026.
Anthropic is implementing watermarking to comply with the EU AI Act, which as of August 2, 2026 requires AI providers serving the EU market to mark AI-generated content. Anthropic, along with several other major AI model providers and around 190 total signatories, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026, which requires AI system providers to use methods of marking AI-generated text.
Anthropic is applying watermarking globally at launch because there is no durable way yet to scope it by region, and will continue to evaluate different approaches and share updates.
Detection API, C2PA content credentials for images and files, editing attacks, translations, older models, AI detection software such as Pangram, and ownership.
Detection API. Anthropic will soon offer a watermark detection API for checking whether a piece of text was written by Claude, and is working out the details of its implementation.
Images and files. When Claude produces a supported file type (such as .png, .jpg, or .svg), it attaches a content credential — a small, cryptographically signed note in the file's metadata — using the open industry standard C2PA, the same used by camera manufacturers and photo-editing software. Nothing in the file changes; the credential only says Claude was involved.
Editing attacks. Light editing probably will not remove the watermark completely; a complete rewrite where every word is replaced will — in which case it is arguable whether the text can still be described as AI-generated.
Translations and older models. Translations produced by Claude carry a watermark, because every word is chosen by Claude. The EU law includes a transition period for models launched before August 2, 2026, and Anthropic is working to add watermarking for those models over the coming months.
AI detection software. Services like Pangram use a different method, because they do not have the key. They look at subtle tells in AI phrasing — for example the construction 'this isn't [X], it's [Y]' or frequent use of the word 'quietly' — which is fundamentally different from checking for a watermark.
Ownership. A watermark only helps test whether Claude might have produced or processed the content. It says nothing about ownership or authorship, and does not change a user's rights under the terms of service.
The method Claude deploys is the production form of a research lineage: Scott Aaronson's 2022 proposal, formalized by Kirchenbauer et al. (ICML 2023) with green/red-list token selection and a z-statistic detection test, then industrialized by Google DeepMind as SynthID-Text (Nature, 2024). The URIBurner DaaS Weblog post turns that ICML paper into an interactive knowledge graph.
At each step the previous token is hashed with a secret key to seed a pseudorandom partition of the vocabulary into a green list and a red list; sampling is then biased toward the green list. Three variants are described: the hard red-list baseline, the hash-seeded green-list watermark, and the soft watermark with a logit-bias hardness parameter (delta).
Detection recomputes the green list at each position with the same hash function and key, counts observed green tokens, and computes a one-proportion z-statistic against the null hypothesis of no watermark, yielding an interpretable p-value — with no access to the model API or parameters.
The paper derives an information-theoretic framework, including a spike entropy measure, to analyze how the watermark's detectability depends on the entropy of the token distribution at each generation step.
The watermark was tested on a multi-billion parameter model from Meta AI's Open Pretrained Transformer (OPT) family, measuring detectability and text-quality impact.
The paper discusses robustness to text modification and paraphrasing, plus security scenarios where an adversary without the secret key attempts to spoof or remove the watermark.
The authors published the embedding and detection algorithms as the open-source lm-watermarking repository — the same key-based detection philosophy Anthropic's forthcoming detection API will expose.
Nine dimensions, three approaches: Anthropic's Claude deployment, Google DeepMind's SynthID-Text, and the Kirchenbauer et al. method. Every dimension is a first-class entity in the companion RDF.
The green-list/red-list watermarking scheme of the ICML 2023 paper arXiv:2301.10226, with a z-statistic detection test and an open-source reference implementation.
OriginUniversity of Maryland, ICML 2023 paper arXiv:2301.10226.
Embedding mechanismHash of the previous token seeds a green/red vocabulary partition; green tokens are softly promoted by a logit bias delta.
Detection approachOne-proportion z-statistic on the observed green-token count versus the null hypothesis, yielding an interpretable p-value.
Deployment statusResearch prototype with an open-source reference implementation (lm-watermarking).
Regulatory driverNone: an academic proposal from 2023, before the regulatory regime.
Privacy propertiesKey-based; no user-level information is embedded in the signal.
Text quality impactNegligible impact on text quality, with a weaker signal at low-entropy positions.
Robustness to editingThe paper analyzes robustness to text modification and paraphrasing attacks.
AvailabilityOpen-source detection algorithm and reference implementation on GitHub.
Computer scientist whose 2022 proposal that watermarking only change the source of randomness used to pick among words anchors the family of approaches Claude's watermark belongs to.
Interactive graph visualization derived from the companion RDF. Click nodes to resolve, drag to explore. Graph data embedded from companion RDF at generation time.
Claude Text Watermark — Knowledge Graph Meshup
Nodes: 0Links: 0
KG Settings
Predicate Filters
Node Types
Literal Filter
Click SVG to activate zoom, click outside to release | Drag nodes to pin, double-click to unpin
Query this knowledge graph on URIBurner. The editor opens on the canonical SAMPLE entity-type summary (DAV named graph). Pick a recipe, edit freely, then run live or copy.
Sample Queries
Reproduced from the meshup graph. Execute loads the query into the workbench below and runs it live.
Gather the passage you want to check. Remember that watermark confidence grows with passage length: small samples carry fewer word choices and thus less information to go on.
Use Anthropic's forthcoming watermark detection API, or any detector that holds Anthropic's key. Detection requires the key plus the candidate text, not access to the model itself.
For each position, the detector combines the key with the preceding words to re-derive the token-choice pattern that a watermarked model would have produced.
Count how consistently the observed tokens match the key-derived pattern and compute a statistical score, in the same spirit as the one-proportion z-statistic over observed green tokens.
Convert the score into an interpretable probability: the likelihood that this text was partly written by Claude. Larger passages produce stronger confidence.
Factor in that the watermark is sparser on factual passages, near-deterministic outputs, proofread human text, and most code, where there are few choices for the watermark to act on.
A positive signal indicates Claude was likely involved at some point; it cannot distinguish 'Claude wrote this' from 'Claude heavily edited this', and it cannot confirm human authorship or identify a different AI.
The watermark carries no identifying information about the user, organization, or chat, and a detection result says nothing about ownership or legal responsibility for the content.
LLMs generate one word at a time, choosing among candidate words and settling low-stakes choices by a random number. Watermarking uses those low-stakes choices, which occur many times, to leave a pattern in the response: undetectable to readers but detectable to anyone holding the key that encodes it.
No. Anthropic reports no practical impact on the content, level of creativity, or readability of Claude's text. In the SynthID-Text paper, Google DeepMind served a watermarked model to part of its Gemini traffic and found no statistically significant differences in thumbs-up and thumbs-down ratings, and human raters saw no difference in quality.
No. To a reader, a watermarked response is indistinguishable from an unwatermarked one. Nothing is added to the text, there are no hidden characters, and the difference is not perceivable to the naked eye.
Claude's text watermark is a version of the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024. It belongs to a family of approaches going back to a proposal by Scott Aaronson in 2022, all sharing the same design principle: the watermark only changes the source of the randomness used to pick among words.
Choices are still made at random, but the source of randomness differs: instead of an arbitrary random number generator, the watermark uses the key and a few preceding words to settle the next word. One can then check the sequence of words against the key and assign a probability that the text was generated by Claude.
From the Kirchenbauer et al. scheme, the model vocabulary is partitioned at each position into a green subset favored during sampling and a red subset that is not, using a pseudorandom split seeded by hashing the previous token with a secret key.
A detector recomputes the green list at each position using the same hash function and secret key, counts observed green tokens, and computes a one-proportion z-statistic against the null hypothesis of no watermark, yielding an interpretable p-value. No access to the language model API or parameters is required.
Using the key, one can only estimate the likelihood that a passage was partly written by Claude. It does not confirm whether text was human-written, and it cannot tell whether text was written by a different AI. Detection is weak on small samples and sparser on factual passages where few choices exist.
The watermark only applies to words Claude chooses. When Claude lightly edits a person's writing, nearly all the words remain the person's, so there is very little for the watermark to attach to; the changes may not be enough to make Claude's involvement detectable.
Where an exact output is required, the watermark is not applied. Code, which in many cases has to be exact, generally carries less watermarking; the technique can apply where arbitrary choices exist, such as comments within code, with a negligible effect on the code produced.
No. Watermarking has a negligible impact on the speed of models, and because it produces no extra tokens, the model is the same price to serve and use.
No. The watermark applies to Claude and its outputs; it does not identify individual users. Nothing in the watermark or its key allows anyone to recover information about the user, their organization, or their chats with Claude.
To comply with the EU AI Act, which as of August 2, 2026 requires AI providers serving the EU market to mark AI-generated content. Anthropic, along with other major providers and around 190 total signatories, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. Watermarking is applied globally at launch because there is no durable way to scope it by region.
Anthropic will soon offer a watermark detection API; the details of its implementation are still being worked out. The API will let a key holder estimate the likelihood that Claude was involved in producing a given text.
When Claude produces a supported file type, it attaches a content credential: a small, cryptographically signed note in the file's metadata stating the file was made or processed with Claude. This follows the open industry standard C2PA, the same used by camera manufacturers and photo-editing software. It is very different from a watermark: nothing in the file changes.
To some extent, yes. Light editing probably will not remove the watermark completely; a complete rewrite in which every word is replaced will. In the latter case it is arguable whether the text can still be described as AI-generated.
AI detection software lacks the provider's key, so it looks at aspects of the text such as subtle tells in AI phrasing, e.g. the construction 'this isn't [X], it's [Y]' or frequent use of the word 'quietly'. Picking up on statistical patterns is fundamentally different from checking for a watermark.
No. A watermark only helps test whether Claude might have produced or processed the content. It says nothing about ownership or authorship and does not change a user's rights under the terms of service.
The value that, combined with preceding words, settles token choices under watermarking; it makes the pattern reproducible for the holder and unpredictable for everyone else.
A one-proportion statistical test comparing the observed green-token count in a candidate text against the count expected under the null hypothesis of no watermark.
A measure from the paper's information-theoretic framework capturing how concentrated a token probability distribution is, used to analyze watermark detectability.
Services such as Pangram that lack the provider key and instead look for statistical tells in AI phrasing, a fundamentally different approach from key-based watermark detection.