Claude Text Watermarking: What It Can and Cannot Prove

Anthropic says newer Claude models now embed a hidden statistical watermark in the text they generate, and that authorized detection systems can check for it. A positive result is evidence that Claude may have written or heavily edited a passage. It is not proof of ownership, dishonesty, plagiarism, or who pressed the keys. A negative result proves even less. That distinction matters for schools, publishers, employers, and platforms considering automated enforcement.

What changed

Anthropic published a technical explanation of its watermarking approach on August 14, 2026, and updated it on September 1. The company ties the change to the EU AI Act and the EU Code of Practice on Transparency of AI-Generated Content, which Anthropic says it signed in July 2026 along with about 190 other signatories. The EU requirement took effect August 2, 2026.

Anthropic says watermarking applies globally, not only in the EU, because it does not yet have a way to scope it by region. Models launched before August 2, 2026 get a transition period, and Anthropic plans to add watermarking to them over the coming months.

The company makes several claims about the user impact. It says the watermark does not affect quality, adds no characters or extra tokens, costs nothing extra, and carries no identifying information about users or organizations. It also says watermarking does not change ownership, authorship, legal responsibility, or user rights under its terms.

For images and supported files such as PNG, JPG, and SVG, Anthropic says it attaches a signed C2PA content credential in the file’s metadata instead.

How it works

Anthropic explains that Claude writes one word at a time, often choosing among several plausible candidates. According to Anthropic, the watermark replaces the random number generator used for those low-stakes choices with a keyed function based on a secret key and the preceding words. To a reader, the choices still look random. To someone holding the key, the pattern is measurable.

Anthropic says this follows the same principle as SynthID-Text from Google DeepMind, described in a 2024 Nature paper, which builds on a 2022 proposal by Scott Aaronson. The output of a check is a probability that Claude was involved, not a yes or no answer.

How it differs from AI detectors

General AI text classifiers, which Anthropic contrasts with tools such as Pangram, look for stylistic tells. They infer patterns from writing and can behave differently across languages, genres, and heavily edited text.

Provider watermarking works differently. It checks for a specific keyed signal that only the model operator can verify. That makes it more targeted, but also narrower. It can only speak to Claude involvement. It cannot detect other AI systems, and it cannot confirm human authorship.

The limits Anthropic acknowledges

The explanation is candid about where the signal weakens:

• Short passages are unreliable. Confidence grows with length.
• Factual text, exact outputs, and code carry a sparser signal, because few word choices are equally good. Code comments may carry it.
• Proofreading human text often leaves too few Claude-chosen words to detect.
• Light editing probably will not remove the watermark, but a complete word-by-word rewrite will.
• Translations produced by Claude are watermarked.
• The watermark cannot distinguish “Claude wrote this” from “Claude heavily edited this.”

Why it matters

A positive signal may show model involvement without explaining the human contribution. A writer may have supplied the reporting, structure, and edits. A model may have translated a draft. The same signal should not be treated as a complete authorship judgment.

A missing watermark is also not proof that text was written without AI. Older models still in transition, other providers, short passages, code, and substantial rewriting can all leave no detectable signal. A policy built on “no watermark means human” will be wrong in predictable ways.

Who can check

Anthropic says a detection API is in private preview for eligible organizations, including regulators, law enforcement, media, fact-checkers, researchers, educational organizations, EU civil society groups, and enterprises that need compliance verification. The company plans to expand access and offers a registration form. Individual users should not expect a public checker yet.

What to test

Organizations that gain detection access should test before they rely on it. A sensible evaluation includes:

• known Claude outputs of different lengths, to see where confidence becomes usable;
• human-written text that Claude only proofread;
• code with and without comments;
• text lightly edited, heavily edited, and fully rewritten by a person;
• text from older Claude models and other providers, to confirm they do not produce false positives.

Record the detector version and date for every test, since coverage may change as older models are added.

A responsible policy

Do not use a detector result as the sole basis for punishment or rejection. Preserve the tested text, detector version, date, confidence information, and appeal route. Ask what policy was actually violated and whether that policy was clearly communicated.

For publishers, process evidence is more useful than a detector score. Keep interview notes, source links, drafts, revision history, and fact checks. These records show how an article was made in a way no single signal can.

What to watch

Watch how quickly older Claude models receive watermarking, how widely the detection API opens, and whether other providers adopt compatible approaches under the EU code. Anthropic’s Fable 5.1 and Mythos 5.1 announcement also references the watermark, which suggests it is now a standard part of new model launches.

The conclusion

Claude’s watermark is a real technical signal with clear limits, and Anthropic is upfront about them. It can raise the likelihood that Claude was involved in a long passage. It cannot tell you who did the thinking, and its absence tells you little. Treat it as one piece of evidence, keep process records, and never let a single score decide a consequential outcome.