Date Published
August 30, 2026
Total Read
7 min
Tags
Future Claude models will produce text that carries a watermark, so that afterwards someone can work out how likely it is that Claude was involved in writing it. Nothing is added to the page. There are no hidden characters, no invisible Unicode, no secret quota of em dashes. The mark lives inside the choices the model makes while it writes.
Here is how that works, without any maths.
When a model writes a sentence, it does not know the whole sentence in advance. For every new word, it works out which words could sensibly come next, then picks one. Give it "the weather today is" and grey, cloudy and overcast are all reasonable. The meaning of the sentence barely changes whichever one comes out.
In an ordinary model, that choice is settled by a random number.
Everything about watermarking happens in that moment.
A watermarked model still makes those choices at random. What changes is the source of the randomness.
Instead of pulling a number out of a general purpose random number generator, the model works out its number from two things: a secret key, and a few of the words that came immediately before. The choice still looks random from the outside. But it is now a choice that can be recreated by anyone holding the key.
A helpful way to picture it: imagine a board game where players move by rolling dice. Now imagine that instead of rolling, everyone reads their next move from a long list of digits, starting at some agreed point. The game plays out exactly the same. Nobody at the table notices a difference. But afterwards, someone who has that same list can look at the sequence of moves and work out whether the game probably used it.
That is the whole idea. The text reads normally. The pattern of choices is checkable.
To make this concrete, it helps to look at the family of methods this belongs to.
At each step, before the model picks, a rule sorts all the possible next words into two groups. Call them green and red. The model then favours a green option, so long as favouring one does not damage the sentence.
The important detail, and the one people usually get wrong: this does not mean the model develops a permanent fondness for overcast. The sorting changes at every single step. A word that is green in one sentence is red in the next. The method also does not push the model towards words it would never have used anyway. It picks among words that were already good candidates.
This is the part that makes the whole thing work.
The sorting is not truly random. It is decided by the secret key plus the words that came immediately before. Those two things are combined into a number, and that number decides which words count as green at that exact moment.
So anyone holding the key can take a finished text, walk through it word by word, and recreate the sorting exactly as it happened during writing. The previous words are sitting right there in the text. The key supplies the missing half. That is why the check can be replayed months later, and why nobody without the key can run it.
Claude's watermark is a version of SynthID-Text, published by Google DeepMind in a Nature paper in 2024. It replaces the simple nudge with a small knockout competition for every word.
Several candidate words are drawn, all of them honest picks from what the model actually wanted to say. They are paired off like players in a bracket. Green beats red. If both are the same colour, a coin flip decides. The winners are re-sorted with a fresh rule and play another round, and so on until one word is left. That word gets written.
The important part: no bad word is ever forced into the text. Every word in the bracket was one the model was happy with. The competition only decides which of the good ones survives.
Google DeepMind tested the quality impact by serving a watermarked model to part of their Gemini traffic and comparing thumbs up and thumbs down ratings. They found no statistically significant difference. A controlled study with human raters comparing answers side by side found no difference in quality either. Anthropic reports the same from internal testing.
Because red words still appear in a marked text, the check cannot be a simple yes or no.
Someone writing without any knowledge of the key would land near half green and half red, the same way flipping a coin many times lands near half heads. A marked text lands clearly above that line. The detector counts, compares against what pure chance would produce, and measures how far apart they are.
So the output is a likelihood, not a verdict. And it answers only one question: how likely is it that this model was involved. It cannot tell you that a human wrote something. It cannot tell you that a different AI wrote it, because a different model would have a different key, or a different method entirely.
The watermark needs room to work, and that room is the set of moments where two words were equally good. Several kinds of text do not offer many.
Short passages.
Fewer choices means fewer chances to leave a pattern. Confidence grows with length.
Factual sentences.
After "Isaac Newton's most famous work was called Principia", only one word is correct. There is nothing arbitrary to work with.
Code.
Code usually has to be exact, so there is little room. Comments inside the code are a different matter, but by definition that has almost no effect on the code itself.
Proofreading.
If you hand a model your own writing and ask it to fix grammar, nearly every word is still yours. The mark can only attach to the handful of corrections, which is often too few to register.
Heavy rewriting.
Light editing probably will not remove the mark. Replacing every word will, although at that point it is fair to ask whether the text is still AI generated.
This is not a Claude feature and it is not an Anthropic idea.
Anthropic is doing it to comply with the EU AI Act. In July 2026, Anthropic and around 190 other signatories signed the EU Code of Practice on Transparency of AI-Generated Content, which requires providers serving the EU market to mark AI generated text. Other major model developers signed the same code and will roll out their own watermarks.
Anthropic is applying it globally at launch because there is not yet a durable way to limit it by region.
Two points worth being clear about, because both get misread.
It cannot be traced to you. The watermark and its key carry nothing about the user, their organisation, or their conversations. It says something about the model, not about the person at the keyboard.
It says nothing about authorship or ownership. A positive result means the model was probably involved somewhere. It cannot separate "the model wrote this" from "the model heavily edited this", and it does not change anyone's rights.
There is also no public detector yet. Anthropic has said a detection API is coming, with details still being worked out. Files are handled differently again: images and similar outputs get a signed note in the file metadata using the C2PA standard, which is a label rather than a watermark, and it changes nothing inside the file.
The mark is not in the letters. It is in which word the model chose, at the moments where more than one word would have done the job. A secret key decides how those moments get sorted, the model follows that sorting, and later the same key lets someone count the pattern and see whether it could have happened by chance.
Sources
Anthropic, How Claude's text watermark works https://www.anthropic.com/news/claude-text-watermark
Google DeepMind, SynthID-Text, Nature (2024): https://www.nature.com/articles/s41586-024-08025-4
Kirchenbauer et al., A Watermark for Large Language Models (2023)
