Claude Gets Invisible Watermarks: What Anthropic Can Actually Prove

Anthropic plans to add machine-readable markings to Claude outputs. For text, an invisible watermark is embedded directly into the generated output; for supported files, Anthropic uses signed provenance metadata.¹

The obvious conclusion is that this will make it possible to reliably determine whether a text was written by Claude.

That is not what the system does.

Anthropic describes the marking much more carefully. A positive detection is a signal that content was processed by Claude. It is not proof that Claude was the original author. Conversely, the absence of a watermark does not prove that no AI system was involved.¹

What Anthropic is building is therefore less a universal AI detector than a technical provenance layer. That distinction matters more than the watermark itself.

What Anthropic actually announced

According to Anthropic, the marking is implemented at the model level. It is not a feature tied only to the Claude.ai interface. On supported models, it is intended to apply regardless of how the model is accessed. Anthropic explicitly mentions Claude, the API, Claude Code and Cowork, as well as access through AWS, Google Cloud and Microsoft Foundry.¹

The rollout is not retroactive across every existing model at once. New models launched in the EU from August 2, 2026 are expected to support marking from the start. Existing models are being updated. For those systems, the EU AI Act provides a transition period for the marking and detection requirement until December 2, 2026.²

Anthropic also says the markings will be applied globally on supported models, rather than only to requests originating in the EU.¹

That makes operational sense. Maintaining a separate inference path for Europe would create additional model variants, testing requirements and deployment logic. A single implementation is simpler even if the regulatory trigger comes from Europe.

Two kinds of marking for two kinds of content

For files, provenance can travel as metadata attached to the file itself. Anthropic uses C2PA, an open standard for Content Credentials. Those metadata records can be cryptographically signed and carry information about origin and modification history.¹

Text is harder. Metadata are useless once somebody copies a paragraph into another editor.

That is why the text watermark is supposed to become part of the generated text itself. Anthropic calls it an “imperceptible watermark” embedded during generation. Ordinary copy and paste should preserve it, and some edits may preserve the signal as well.¹

One important detail is still missing: Anthropic has not published the algorithm.

It is therefore too early to claim that Claude uses a particular token scheme or a specific statistical encoding. Anthropic says more technical documentation and detection tooling will follow.¹

How a text watermark can work in principle

Invisible Unicode characters would be the trivial approach. Zero-width spaces or unusual whitespace can be stripped by normalization, editors or format conversions, which makes them a poor basis for a robust watermark.

Research on LLM watermarking therefore focuses on methods that influence token selection during generation. A language model computes a probability distribution for the next token. A watermark can slightly favour certain valid tokens and create a statistical pattern across many tokens.

A simplified distribution might look like this:

answer         0.34
output         0.28
sequence       0.17
response       0.08

A watermarking scheme could shift the weights slightly:

answer         0.31
output         0.34
sequence       0.18
response       0.06

The individual difference is meaningless. Across a sufficiently long passage, however, it can produce a statistically detectable signal.

Kirchenbauer et al. described this basic approach in 2023. Google’s SynthID Text similarly operates during generation and modifies the probabilities of candidate tokens.³⁴

This explains how modern text watermarking can work. It does not mean Anthropic is using exactly this mechanism. Until Anthropic publishes the technical details, that remains unknown.

A positive detection does not prove authorship

The most important limitation comes directly from Anthropic.

A watermark can appear in text whose original content was written by a human. If someone writes an article themselves and then asks Claude to translate it, summarize it or substantially edit it, Claude generates a new output. That output may carry the watermark.¹

In that case, the statement

This text contains a Claude watermark.

could be correct.

The statement

This text was written by Claude.

would not follow from it.

The technically cleaner interpretation is that Claude was probably involved in processing the text.

For universities, publishers and employers, that distinction is critical. A provenance signal is not an authorship test and certainly not automatic proof of misconduct.

No watermark proves just as little

The reverse direction is equally unreliable.

A statistical signal can be weakened by heavy editing, paraphrasing, translation or mixing the output with other text. Very short outputs may also contain too few tokens for reliable detection.¹

This is a known limitation of text watermarking. Google describes similar constraints for SynthID: longer and more variable passages are easier to detect, while extensive rewriting or translation can significantly weaken the signal.³

The logic is therefore asymmetric:

Watermark detected
-> relevant provenance signal

No watermark detected
-> no reliable conclusion about AI involvement

That is still a cleaner technical problem than a classifier that simply guesses from writing style. But it is nowhere near a binary “human or AI” test.

The EU AI Act is the trigger

The timing is not accidental. The transparency obligations in Article 50 of the EU AI Act have applied since August 2, 2026. Providers of generative systems must design their systems so that synthetically generated or manipulated content can be marked in a machine-readable way and detected as artificially generated or manipulated.²

The EU requires markings to be effective, interoperable, robust and reliable. The accompanying Code of Practice describes technical and organizational measures providers can use to demonstrate compliance.⁵

The exceptions are just as interesting. The Commission’s guidance mentions short sequences of numbers, symbols or letters as well as source code. Purely assistive standard editing functions are also outside the marking obligation.²

That is quite different from the popular shorthand that “every AI output must be watermarked”.

Claude Code is therefore a special case

Anthropic explicitly lists Claude Code as one of the surfaces through which supported models can produce marked content.¹ At the same time, the EU explicitly exempts source code from the Article 50(2) marking requirement.²

That is technically understandable. Natural language usually offers several semantically equivalent phrasings. Source code has less freedom. A token cannot simply be replaced with a statistically convenient alternative without potentially changing syntax, types or semantics.

Anthropic has not yet documented how it draws that boundary in practice. The likely distinction is between natural-language text generated inside Claude Code and the actual source code itself, but without technical documentation I would not infer more than that.

Swiss API users do not escape the issue at the border

Because Anthropic intends to roll out marking globally and at the model level, a company in Switzerland can receive marked output as well. The location of the API client does not determine whether the model produces the marking in the first place.¹

That is separate from the regulatory question. The AI Act can also apply to providers outside the EU when the output of their systems is used in the EU. The Commission explicitly covers that third-country scenario in its current guidance.²

Anyone embedding Claude into their own product should therefore separate two questions: what Anthropic marks in the base model, and what obligations apply to the downstream product or publication. A model-provider watermark does not automatically satisfy every transparency obligation of the system built on top of it.

My assessment

Text watermarks do not solve AI detection. Real-world authorship is already too mixed: a human writes, a model edits, the human adds material, another model translates it, and somebody performs a final revision.

As a provenance signal, however, watermarking is useful. The provider deliberately inserts a defined signal during generation instead of trying to infer AI involvement afterwards from stylistic clues. That makes the technical problem much cleaner.

What matters next is how robust Anthropic’s implementation turns out to be, how open the detection interfaces become, and whether interoperable schemes emerge across providers. For files, C2PA already provides a shared standard. For text, that layer is still much less mature.

The more useful question is therefore no longer:

Was this text written by an AI?

but rather:

Which systems were involved in creating and processing this content?

That is less spectacular than a universal AI detector. Technically, it is the more meaningful question.

Footnotes#

1. Anthropic: How Claude marks AI-generated content, Claude Help Center, August 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹

2. European Commission: Transparency obligations under Article 50 of the AI Act, July 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

3. Google DeepMind: Watermarking AI-generated text and video with SynthID, May 2024. ↩ ↩²

4. John Kirchenbauer et al.: A Watermark for Large Language Models, 2023. ↩

5. European Commission: Code of Practice on Transparency of AI-generated Content, June 2026. ↩