Anthropic has confirmed that the Claude text watermark is a version of SynthID-Text, published by Google DeepMind in Nature in 2024. It steers the model’s token sampling with a secret key instead of hiding anything in the finished text, which is why it survives copy and paste but fades under paraphrase. Detection is a statistical score, and it shows that a passage was processed by Claude, not authored by it.
Since 2 August 2026, text from newly launched Claude models carries a mark you cannot see, cannot search for, and cannot remove with find and replace. Nothing is added to the output; the signal is simply which words the model picked. Most coverage has described the effect and skipped the machinery, so here is the machinery.
Why it exists
Anthropic is direct about the reason: “We’re implementing watermarking to comply with the EU AI Act.” Article 50(2) requires providers of generative systems to ensure outputs are “marked in a machine-readable format and detectable as artificially generated or manipulated”, and it became applicable on 2 August 2026. Claude models launched on or after that date mark from launch, while earlier models sit in a transition period with no published completion date.
The rollout is worldwide rather than EU-only, and the stated reason is practical rather than principled: “We’re applying watermarking globally at launch because we don’t yet have a durable way to scope it by region.”
The mark is word choice, not a hidden character
There is no zero-width space, no invisible Unicode, and no metadata riding alongside the sentence. Anthropic weaves “an imperceptible watermark directly into the text itself”, and because the mark is part of the text, it “will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing”. Paste it into a plain text editor and it survives. Retype it by hand and it survives, because the mark is the words.
The signal comes from the one genuinely free part of generation. Each time the model picks a token, several candidates are roughly equally good, and the choice among them carries nothing the reader would miss. As Anthropic puts it: “instead of using an arbitrary random number generator to pick the next word, watermarking uses the key and a few words that come before to settle what word the model should pick.”
Tournament sampling
The scheme is SynthID-Text, and three things happen at every generation step.
- Seed. The most recent H tokens, where the paper uses H = 4, are hashed together with the watermarking key to produce a seed that is fully determined by the key and the preceding words.
- Candidates. A set of tokens is drawn from the model’s own probability distribution, independently and with possible repeats, so every candidate is a word the model was already willing to produce.
- Tournament. The candidates are paired at random; in each layer the token scoring higher under a function tied to the seed wins and the other is discarded, survivors regroup, and after the final layer one token remains. That is what the model emits.
Because the candidates come from the model’s own distribution, the non-distortionary configuration preserves that distribution on average over the random seed. Note the precision of that claim. Individual token choices genuinely are steered; what survives untouched is the statistical shape of the output, not any single response.
What it costs, and what a hit proves
Very little, on the evidence. Across roughly 20 million live Gemini responses, the thumbs-up rate differed by 0.01% and the thumbs-down rate by 0.02%, both statistically insignificant. Latency went from 15.527 to 15.615 milliseconds per token, an increase of 0.57%, and Anthropic notes that watermarking “produces no extra tokens”, so serving costs are unchanged.
Detection reverses the process: it recomputes the seed at each position, scores the token that actually appeared, and averages across the passage, with the threshold set for a chosen false-positive rate. It needs the key but not the model. Today only Anthropic can run it, and a detection API is promised with no date attached. A hit is also narrower than the headlines suggest, since it means the text “may have been processed by Claude”. Ask Claude to translate your own paragraph and the output is watermarked.
Where it fails
The watermark needs choices to hide in, so it weakens wherever the model has fewer of them. Factual passages carry a sparser mark, code carries less still because it “in very many cases has to be exact”, and short passages are unreliable. No source publishes a minimum length, so treat any specific number you see quoted with suspicion. Proofreading yields almost nothing, because nearly all the words are yours.
Editing follows the same logic: “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.” Anyone motivated can strip it by rewriting, or by running the text through a different model. It works against accidents, not against adversaries.
Files take a different path entirely. Claude attaches C2PA provenance metadata to supported types such as .svg, .png and .jpg, a signed manifest that also reveals whether the file has been tampered with. However, metadata rides alongside the file, so re-saving, converting the format or taking a screenshot removes it. The text watermark cannot be stripped that way, because it was never attached to the text. It is the text.
Who should care
If you were hoping to catch AI-written submissions, this will not do it: it misses short text, code, anything paraphrased or rewritten, and everything produced by any provider other than Anthropic. If you build on the Claude API, the marking is applied at model level so no surface can opt out, and it costs no tokens and roughly half a percent of latency. The people who should act on it are compliance owners placing generative systems on the EU market, where anything already on the market faces a 2 December 2026 deadline.