How Claude's watermark hides in random word picks

Anthropic will build a text watermark into future Claude models, a version of the SynthID-Text method that Google DeepMind published in Nature in 2024. According to Anthropic, the change implements the EU AI Act's requirement that providers mark AI-generated content, in force since August 2.

At a glance

• Where two words fit equally well, such as "overcast" and "grey", the key and a few preceding words settle the pick, leaving a pattern that only a key holder can score.
• Nothing is added to the text, there are no hidden characters and no extra tokens, so Anthropic says serving and using a watermarked model costs the same and runs at effectively the same speed.
• Coverage is uneven: factual passages, code and lightly proofread human text give the watermark few free choices to occupy, while a Claude translation carries it because every word is chosen by the model.

Why it matters The EU Code of Practice turns provenance from a research topic into shipping infrastructure across the industry, and Anthropic's decision to apply the watermark globally rather than to EU traffic alone reads as an admission that per-region routing is harder than the marking itself. For practitioners, the practical shift is not detection accuracy but scope: the signal appears in prose and evaporates in code and short edits, which is likely where most disputes will land.

Claude still picks words at random, but the randomness now comes from a key

A language model generates one word at a time, choosing among candidates that fit the preceding text. After "The weather today was cold and", "sugary" is very unlikely while "overcast" and "grey" are both plausible, and under normal conditions a random number settles which one appears.

Watermarking replaces that generator with the key and a few preceding words, so the picks stay random but follow a pattern a key holder can test for. Anthropic says the model is not permanently biased toward one option and is not pushed toward words it would otherwise avoid, such as the obscure synonym "nubilous".

The design principle traces back to a proposal by Scott Aaronson in 2022, and every method in that family changes only the source of the randomness rather than the candidate words themselves. Anthropic likens the effect to playing Monopoly with the digits of pi instead of dice.

Google DeepMind reported no statistically significant rating difference on watermarked Gemini traffic

Anthropic says internal testing showed no impact on the content, creativity or readability of Claude's text. In the SynthID-Text paper, Google DeepMind served a watermarked model to part of its Gemini traffic and found no statistically significant difference in thumbs-up and thumbs-down ratings; in a controlled study, human raters comparing answers side by side saw no quality difference.

The key answers only one question: how likely it is that Claude was partly involved. It does not establish that a text was written by a person, and it cannot identify output from another model, which would use a different key or a different method entirely. Short samples offer too few choices, and confidence grows with passage length.

Detection services such as Pangram work differently because they do not hold the key: they look for phrasing tells, including the fondness of AI models for the construction "this isn't X, it's Y" and their heavy use of the word "quietly".

Exact outputs such as code and arithmetic leave the watermark nothing to occupy

Where only one continuation is correct, the nudge is not applied. After "2 + 2 =" or "Isaac Newton's most famous work was called Principia", the next token is fixed, so no watermark signal is left. Code is exact in many places for the same reason and generally carries less watermarking than prose.

Arbitrary choices inside code, such as the wording of comments, can still carry the watermark, with what Anthropic calls a negligible effect on the code itself. Proofreading behaves similarly: when nearly all the words are the person's, the handful of corrections may be too few to register.

Light editing of watermarked text probably will not remove the mark, while a full rewrite that replaces every word will. A positive result shows only that Claude was likely involved and cannot separate writing from heavy editing. Anthropic says it changes nothing about ownership or users' rights under its terms.

Around 190 signatories signed the EU Code of Practice on transparency in July 2026

Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026, alongside several other major model providers and around 190 signatories in total, which requires providers of AI systems to mark generated text. Other developers that signed will implement their own watermarks.

The watermark is being applied globally at launch because Anthropic says it has no durable way to scope it by region. Nothing in the watermark or its key allows recovery of information about a user, their organization or their conversations with Claude.

Files are handled differently. When Claude produces a supported type such as .png, .jpg or .svg, it attaches a content credential, a cryptographically signed note in the metadata stating that the file was made or processed with Claude, using the open C2PA standard read by camera makers and photo editing software.

What's next Anthropic says a watermark detection API is coming, with implementation details still being worked out, and it plans to offer its own tool for checking C2PA credentials in files. Models launched before August 2, 2026 fall under a transition period in the EU law and are due to receive watermarking over the coming months. Anthropic says it will keep evaluating regional scoping and share updates.