How Claude's watermark works: it only changes the source of randomness

Future Claude models will produce text carrying a watermark based on SynthID-Text, the method Google DeepMind published in Nature in 2024. Anthropic says it is implementing the mark to comply with the EU AI Act and is applying it globally at launch.

At a glance

• Instead of an ordinary random number generator, the model settles low-stakes word choices with a key combined with a few preceding words, leaving a pattern that only a key holder can check.
• Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026 alongside roughly 190 other signatories; the EU has required marking of AI-generated content since August 2.
• Detection weakens on short samples, factual statements and code, where a single correct token leaves the watermark nothing to act on, and proofreading of human text may not register at all.

Why it matters Compliance with the EU AI Act now reaches into how tokens are chosen, and the decision to ship globally rather than by market means the mark travels with output regardless of where a request originates. For developers the harder part is the asymmetry: the absence of a watermark says nothing, and its presence appears to say only that Claude touched the text at some point. That gap will matter wherever the check is treated as evidence.

The watermark changes the source of randomness, not the words Claude picks

Large language models pick one word at a time, and many of those picks are between options that read the same. After “The weather today was cold and”, both “overcast” and “grey” fit, and normally a random number settles the choice. Watermarking replaces that generator with a key and a few of the preceding words.

Because the words are still random, the model is not biased toward “overcast” or “grey” across a text, and it is not pushed toward a word it would otherwise avoid, such as the obscure synonym “nubilous”. Nothing is added to the output and there are no hidden characters.

Anyone holding the key can compare the sequence of words in a given passage against the choices that key would produce, and assign a probability that the text was generated by Claude; to a reader, a watermarked response is indistinguishable from an unwatermarked one.

Google DeepMind found no statistically significant rating difference on a portion of Gemini traffic

The SynthID-Text paper describes serving a watermarked model to part of Gemini's traffic and comparing thumbs-up and thumbs-down ratings; no statistically significant difference from the unwatermarked model appeared. A controlled study with human raters comparing answers side by side also found no quality difference.

Anthropic reports the same from internal testing, with no effect on content, creativity or readability. The approach belongs to a family that goes back to a 2022 proposal by Scott Aaronson, all sharing the principle that only the source of randomness changes.

Watermarking produces no extra tokens, so the model costs the same to serve and use, and the speed impact is negligible. The mark carries no identifying information: neither it nor the key exposes the user, the organization or the conversation, and it does not change ownership or rights under Anthropic's terms.

Code and factual statements leave the watermark less to act on

Watermarking is sparser where the text has to be exact. Once the model has written “Isaac Newton’s most famous work was called Principia”, only “Mathematica” fits, and the nudge is not applied; code, which in many cases has to be exact, generally carries less watermarking than prose, though comments inside it can hold the pattern.

The same limit applies to edits: when Claude only fixes grammar and punctuation in a person's text, there may be too few chosen words to register. A translation, where every word is chosen by Claude, carries the mark. Light editing probably will not remove a watermark; replacing every word will.

Detection only estimates the likelihood that Claude was partly involved and works poorly on short samples; it cannot show a text was human-written or identify another model's output. Anthropic contrasts this with detection services such as Pangram, which lack the key and instead read stylistic tells in phrasing.

What's next

A watermark detection API is planned, with implementation details still being worked out. Files of supported types such as .png, .jpg and .svg will instead carry a C2PA content credential in their metadata, and Anthropic plans its own tool for checking them.

Models launched before August 2, 2026 fall under a transition period, and Anthropic says watermarking will reach them over the coming months. The company has no durable way to scope the mark by region and says it will keep evaluating approaches.