Anthropic Embeds Watermarks in AI-Generated Text

"We’re applying watermarking globally at launch because we don't yet have a durable way to scope it by region," Anthropic explained in a blog post.

Anthropic's global rollout and EU compliance

Anthropic says it is implementing watermarking across Claude to comply with the EU AI Act and the EU's Code of Practice. The company confirmed the watermark will be applied globally at launch rather than scoped to the EU alone. Models launched before August 2, 2026, are covered by the EU's transition period; Anthropic says it is "working to add watermarking to those models over the coming months."

How the Claude watermark works

Anthropic describes its approach as based on Google DeepMind's SynthID-Text research and as a generative watermarking method that operates during token selection. Rather than appending visible markers or inserting hidden characters, Claude's watermark "changes the source of randomness used when making some of those choices." In practice, when Claude faces multiple reasonable next-token choices, the system uses a secret key plus a few preceding words to bias which of those choices is selected.

The company explained: "Watermarking uses low-stakes choices like these—which occur many times over a piece of generated text—to leave a pattern in Claude’s responses. That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it." Across a sufficiently long piece of text, those small, context-dependent nudges leave a measurable statistical signature.

Technical limits: code, factual answers, length and entropy

Anthropic is explicit about exceptions. Where an exact output is required—"where there isn’t a choice"—the watermark is not applied. The company gives the example of arithmetic completion: after "2 + 2 =" there is a single clear next token, so "the ‘nudge’ of the watermark wouldn’t be applied here." The same logic applies to many instances of code, where substituting one token for another could break functioning output.

The underlying research notes two key factors that affect detection performance: text length and entropy in the model's distribution. Longer texts "contain more watermarking evidence," while low-entropy outputs—where the model almost always returns the same response—leave little room for the watermark's tournament sampling to influence token choice. Anthropic also notes that "light proofreading of human-written text may leave too little Claude-generated material for reliable detection," while translations produced by Claude do carry a watermark because Claude selects every word in the translated output.

Detection API, image provenance, and what the watermark can (and can't) prove

Anthropic plans to offer a watermark detection API that can estimate the likelihood that Claude was involved with a piece of text. The company warns the result is probabilistic: a watermark "can only determine that Claude was likely involved with the content at some point. It cannot distinguish 'Claude wrote this' from 'Claude heavily edited this.'" Light editing may not remove the watermark completely; a full rewrite replacing every word could.

The watermark also cannot identify whether another model authored text, since "other providers may use different watermarking methods and different keys." For generated PNG, JPG, and SVG files, Anthropic will not embed a text-style watermark; instead Claude will attach cryptographically signed C2PA provenance metadata indicating the file was created or processed with Claude.

What this means for technologists, policymakers, and end users

• Technologists and security teams: will likely test the detection API and validate how watermarking behaves across long versus short texts, low-entropy outputs, and translated content, while noting that code and exact factual responses carry less watermarking.
• Policymakers and regulators: will have a concrete, company-specified technical approach to evaluate for EU AI Act compliance; Anthropic’s decision to apply watermarking globally at launch is a regulatory and operational choice regulators can observe and verify over time.
• End users and enterprises: should know the watermark is invisible to regular users, "does not require extra tokens," and—Anthropic says—has "no practical impact on the quality or content of Claude's output, including creativity and readability," with a negligible speed impact reported in internal testing.

Anthropic's implementation creates a probabilistic, statistical signal rather than a visible or deterministic stamp. The company is rolling the capability out globally, building a detection API, and working to retrofit earlier models over the coming months. Those concrete steps supply tools for detection while preserving operational limits—most notably the dependency on a secret key, the variable strength of the signal with text length and entropy, and the inability to prove definitive authorship.

Source: BleepingComputer — How Anthropic plans to watermark Claude's AI-generated text