Claude’s Secret Text Watermark: Invisible to Readers, Detectable by Key

Anthropic announced on August 14, 2026, that future Claude models will generate text carrying a hidden watermark — one that readers cannot see but that can be detected by anyone holding the right cryptographic key.

The Regulation Behind the Decision

This did not come from nowhere. The EU AI Act now requires AI providers operating in the European market to tag their generated content. Anthropic was among the companies — about 190 in total — that signed the EU Code of Practice on Transparency of AI-Generated Content back in July 2026, and the requirement officially started on August 2.

Rather than building a region-specific switch, Anthropic chose to apply the watermark everywhere. Users in Asia, the US, or anywhere else will get watermarked output from Claude, same as users in Europe. The company has acknowledged it doesn't yet have a clean technical method to flip it on or off by geography, and it says it will revisit that as things develop.

Image Credit: Anthropic & Cryptographic Watermarking Architecture

How It Actually Works

Large language models like Claude generate text one word at a time. For each word, the model considers a range of plausible next options. In a sentence like "The weather today was cold and…", the next word could reasonably be "overcast" or "grey" — both fit, neither changes the meaning in any significant way. Normally, a random number settles that kind of low-stakes tie.

With watermarking, that source of randomness changes. Instead of pulling from an arbitrary random number generator, Claude uses a cryptographic key — combined with the few words that came before — to determine which word gets picked. The words still feel random to the reader. But someone with that key can run a check on a piece of text and determine the statistical likelihood that Claude wrote it.

Anthropic explains it with a Monopoly analogy: instead of rolling a die each turn, imagine players move according to digits of pi, starting from some randomly selected point. The game plays out the same way. But if you could see all the moves afterward and you knew pi, you could figure out whether pi, not dice, generated those moves. The technique itself is called SynthID-Text, originally published by Google DeepMind in a Nature paper in 2024. Anthropic's implementation is a version of that approach, which traces back to a 2022 proposal by computer scientist Scott Aaronson.

As for quality concerns — Google DeepMind's own research compared watermarked and unwatermarked Gemini traffic using thumbs-up and thumbs-down ratings and found no statistically significant difference between the two. In a controlled study, human raters comparing watermarked and unwatermarked answers side by side also reported no difference in quality.

What the Watermark Cannot Do

There's a long list of things this system cannot tell you. It can only answer the question: "What is the likelihood this was partly written by Claude?" It cannot confirm whether text is human-written, and it cannot identify whether another AI model wrote it — even if that model uses its own watermark, the keys are different. It cannot point to a specific user, organization, or conversation. There is no identifying information in the watermark or its key that would allow anyone to recover information about the user, their organization, or their chats with Claude.

Detection also struggles on short texts. The watermark works by accumulating statistical evidence across many word choices — the longer the text, the more confident the detection. Highly constrained writing is another weak spot. Factual passages, where there is really only one correct next word, give the watermark very little to work on. The same applies to code, where syntax requirements mean most word choices aren't optional. And if Claude is only proofreading a human's document, fixing a handful of commas, there may not be enough Claude-chosen words for the watermark to register. Light editing of a watermarked text probably won't remove the watermark entirely. A complete word-for-word rewrite will — though at that point, calling the output AI-generated becomes debatable anyway.

Speed, Cost and Privacy: The Basics

Watermarking produces no extra tokens, which means it doesn't change API pricing. The performance impact is negligible. The watermark carries no personal data and cannot be used to trace output back to any individual or organization.

A watermark detection API is in the works, though Anthropic hasn't published a timeline yet. For files like images and SVGs, a separate mechanism is already in place — a small cryptographically signed note attached to file metadata using the C2PA standard, the same open standard used by camera manufacturers and photo-editing software. Older Claude models are not yet covered. The EU AI Act includes a transition period for models launched before August 2, 2026, and Anthropic plans to add watermarking to those models over the coming months.