How Claude's text watermarking works

My notes

Summary

Anthropic is rolling out invisible text watermarking in future Claude models to comply with the EU AI Act’s August 2026 Code of Practice on AI-generated content. The method (based on Google DeepMind’s SynthID-Text) biases the random token-selection process itself rather than adding visible markers, so watermarked text reads identically to normal output, costs nothing extra, and can’t be traced to a specific user, organization, or chat.

Key Insight

• Mechanism: LLMs constantly pick between multiple equally-good next-token candidates (e.g. “overcast” vs “grey”). Normally that tie is broken by a random number; watermarking swaps the randomness source for one derived from a secret key plus the preceding words, leaving a statistically detectable pattern without changing the meaning or quality of the text.
• No measurable cost: confirmed via Google’s Gemini A/B test (no significant difference in thumbs-up/down ratings) and Anthropic’s internal testing, with no impact on speed, price, creativity, or readability.
• Watermark strength is content-dependent: dense in open-ended/creative writing, sparse to absent in factual text, math, and code, since anywhere there’s really only one correct next token, there’s no room for the bias to act. Light proofreading (grammar/punctuation only) may leave too few AI-chosen words to register at all.
• Detection needs volume: short passages don’t carry enough signal; confidence rises with text length. A watermark can only answer “how likely was Claude involved,” not confirm human authorship or identify a different AI’s output (even one that also watermarks, since it would use a different key/method).
• Proves involvement, not authorship: can’t distinguish “Claude wrote this” from “Claude heavily edited this,” and doesn’t affect IP ownership or legal responsibility for the output.
• Survives light edits, not rewrites: a full word-for-word rewrite strips the watermark; minor edits generally don’t.
• Applied globally at launch, not scoped to the EU, because Anthropic doesn’t yet have a reliable way to detect user region.
• Separate system for files: images (.png/.jpg/.svg) get a C2PA content credential, signed metadata saying “made/processed with Claude,” the same open standard camera makers use. This is not a watermark: nothing is hidden or embedded in the pixels, and it’s stripped if the metadata is stripped.
• What’s next: a watermark detection API is planned (no date yet); pre-August-2026 Claude models get watermarking retrofitted “over the coming months.”
• Industry-wide, not Claude-specific: ~190 signatories to the EU Code of Practice (July 2026) are implementing their own watermarks with their own keys, and none of them can read each other’s.