Claude Introduces Text Watermarking: How It Works and What Its Limits Are
Anthropic embeds a SynthID-Text-inspired statistical signature into Claude models launched after August 2, 2026, applying it globally to meet the obligations of the European AI Act. When Chris Best, CEO of Substack, coined the term "Claudefishing" to describe those who use AI to generate content while passing it off as their own, he touched on a nerve that the tech industry is discovering to be far more sensitive than expected. A few days later, Anthropic announced that text produced by new Claude models will henceforth carry an invisible watermark designed to estimate the probability that artificial intelligence wrote or processed a piece of content. Not a stamp, not a symbol, not a polite note at the bottom of the response. Something far more subtle, and precisely for that reason, harder to explain without slipping into technicalities or alarmism.
The connection to European regulation is no coincidence. Article 50 of the AI Act requires providers of generative AI systems to make their outputs machine-readable and identifiable as artificial, to the extent that this is technically feasible. Transparency obligations took effect on August 2, 2026, and Anthropic chose to align that date with the debut of its watermarking: all Claude models launched in the European Union from that day forward support it from day one, while the company states it is working to apply it retroactively to previous models, taking advantage of the transitional period provided by the law.
What is surprising is the scope of its application. Anthropic has not built a geographical toggle that watermarks texts only for European users; the marking applies everywhere, for anyone using Claude, from individual subscribers to teams integrating it via API. The official rationale is pragmatic rather than ideological: the company does not yet have a sufficiently reliable method to restrict watermarking to a specific region, preferring uniform behavior across Claude, Claude Platform, Claude Code, Claude Cowork, and Claude Tag, regardless of location. The result, however one judges it, is that a regulation designed for the twenty-seven member states ends up reshaping the behavior of a product used by millions of people worldwide—an extraterritorial effect that Euronews described as emblematic of how Brussels ends up setting regulatory precedents beyond its borders.
How a Signature Is Hidden Inside a Sentence
To understand how text watermarking works, one must start with a simple idea: how a language model constructs a response. Claude does not write an entire sentence at once; it generates it word by word, or rather token by token, assigning a probability to possible continuations at each step. After a sentence about the weather, for instance, multiple equally plausible alternatives exist: "gray", "cloudy", "overcast" are all valid choices, none of which change the meaning of the discourse. It is in these moments of harmless ambiguity that the watermark creeps in.
The model continues to choose among plausible alternatives, but the source of randomness guiding the choice is no longer completely unpredictable; it is determined by a secret key combined with the words already written. The text remains natural on the surface, but the overall sequence contains a statistical regularity that whoever holds the key can verify. Anthropic compares the mechanism to a game of Monopoly played not with dice, but with a long sequence of digits of pi: the moves still appear random to an outside observer, but someone who knows the sequence can verify whether the results are compatible with that specific source. It is the same narrative principle that underpins Thomas Pynchon's The Crying of Lot 49, where an apparently insignificant symbol—a post horn drawn absently—reveals itself as the clue to a hidden network beneath the ordinary surface of things. Claude's watermark works much like that: an invisible pattern to the naked eye, readable only by those who know where to look.
One point must be clarified immediately, as it is the source of many misunderstandings: the system does not force Claude to use improbable or artificial words. No ad hoc vocabulary is introduced, and no single word is privileged regardless of context. The marking intervenes only when semantically equivalent alternatives genuinely exist, and this intrinsic limit is also the first clue as to where the system ceases to work well—a topic we will return to.
The Debt to SynthID and Scientific Literature
Anthropic did not invent this technique from scratch. The method used is a variant of the SynthID-Text approach developed by Google DeepMind and described in a 2024 paper published in Nature, titled "Scalable watermarking for identifying large language model outputs". The study describes a technique designed to keep text quality intact, ensure good detection accuracy, and withstand large-scale use without adding response latency. It is the main public and verifiable precedent on which Anthropic's choice is based, and Google itself tested SynthID-Text on large volumes of Gemini traffic, collecting user feedback that, according to the company, revealed no perceptible quality differences between watermarked and unwatermarked outputs.
It must be clearly stated that technical lineage does not imply identity of implementation. Anthropic and Google can use different keys, different detectors, and different thresholds, meaning that text watermarked by Claude is not recognizable by tools designed for Gemini's SynthID, nor vice versa. Every major AI provider is building its own proprietary system, a tower of Babel of incompatible signatures that makes it hard to imagine, at least for now, a single universal detection standard.
Precisely the proprietary nature of the key is what distinguishes Claude's watermark from generic detection software like Pangram, which instead analyzes stylistic patterns, lexical frequency, and syntactic constructions typical of artificial prose. A generic detector tries to guess whether a text "sounds" written by a machine; the watermark detector verifies compatibility with a specific statistical signature produced by a precise model with a precise key. They are two complementary rather than overlapping approaches, and the difference is not subtle: without the key, no one outside can replicate the detection that Anthropic performs internally.
What It Really Proves, and What It Doesn't
Here we arrive at the heart of the matter—the line dividing technical enthusiasm from practical concerns. The watermark, when detected, indicates a probability, not an absolute certainty, that Claude was involved in generating or editing a text. It does not say who had the original idea, who verified the facts, or who wrote the first draft before Claude translated or polished it. A text can originate from a person's pen and then pass through the model's hands for translation, proofreading, or summarization, in which case the watermark would signal AI involvement without reflecting any of the human effort that preceded it.
Similarly, according to Anthropic, the presence of the watermark does not alter user rights under the terms of service, does not establish ownership of the text, and above all, contains no identifying data about who generated it—the account, the organization, or the individual conversation. It is a signal about method, not about the human author. Anyone who hoped for, or feared, a nominal tracking system will be left disappointed or relieved, depending on their point of view.
Where the System Breaks Down
Every detection technology has its blind spots, and it is worth listing them honestly here, because it is precisely in the margins that the tool's real reliability is played out. Very short texts offer few statistical decisions upon which watermarking can act, making them difficult to classify with certainty. Highly factual passages—those where only one correct answer, formula, or precise data point exists—leave the model very little freedom of choice, and thus little room for a watermark. If Claude merely corrects punctuation in a human-written text, most of the original words remain intact, and the signal risks being too weak to catch. A complete rewrite, in which every word is replaced, can conversely wipe out the original marking entirely, though in that case the final text has become something quite distant from the initial output.
Translations follow a different logic: because every single word of the translated version is chosen by the model, Anthropic maintains that they are watermarked in full, unlike light proofreading. Source code is a case apart. Many choices in a program are constrained by syntax, function names, and required behavior for everything to work, and forcing a different token would risk breaking execution. For this reason, watermarking tends to concentrate in comments and non-essential parts of the code, remaining virtually absent in the lines that actually run the program—much like in Return of the Obra Dinn, the investigative video game where the truth never lies in the event itself, but in the marginal details surrounding it, the visual clues at the edges of the scene.
Finally, a reminder worth repeating: the absence of a watermark does not prove that a text was written by a human. It could come from a Claude model prior to August 2, 2026, or from a competing AI system that simply does not use the same technique.
Files Follow a Different Path
For images—PNG, JPG, SVG, and other supported formats—Anthropic does not use the same statistical logic applied to text. Instead, it relies on the open C2PA standard (Coalition for Content Provenance and Authenticity), attaching cryptographically signed metadata indicating Claude's involvement in creating or modifying the file. It is a more readable system, but also a more fragile one: that metadata can disappear with a simple format conversion, re-saving, a screenshot, or any software that fails to preserve it along the chain. The practical consequence is that the absence of metadata does not at all prove an image was untouched by AI—a detail anyone working with visual content should keep firmly in mind before jumping to conclusions.
Who Wins, Who Loses, Who Is Left with Doubts
On the editorial front, Article 50 of the AI Act provides an important exception for content published for informational purposes when subject to human review and where a person or organization assumes editorial responsibility. It is a commonsense clause acknowledging that using AI to translate, summarize, or brainstorm is not equivalent to text entirely delegated to a machine, but its practical application will depend heavily on how it is interpreted in future guidelines. For an editorial team, a watermark can help reconstruct a piece's production process, but it in no way replaces source verification or the author's responsibility.
The most heated front, judging by coverage in TechCrunch, concerns schools and workplaces. Several users fear that a statistical signal—inherently probabilistic and imperfect—will be treated as definitive proof of academic fraud or professional bad faith. The risk is not theoretical: a text translated or lightly revised by Claude might generate no detectable signal, whereas a positive hit could indicate either full generation or a simple translation, without the detector being able to distinguish between the two scenarios. Anyone evaluating work—a teacher, a human resources manager—should treat the watermark as a clue to be contextualized, not a verdict, taking into account version history, notes, and the overall workflow.
Less discussed but no less relevant governance questions also remain open. Who controls access to the detection key, and with what audit and revocation guarantees, is not yet clear in public documentation. Anthropic announced it is working on a dedicated detection API, without yet providing details on authentication, thresholds, supported formats, or timelines. This is the step that will decide whether this tool remains a declared principle or becomes a practice verifiable by independent third parties—schools, publishing platforms, moderation services—with all the risks of improper use that opening such a tool entails, from workplace surveillance to hiring filtering based on a signal that, to repeat, is never a certainty.
A Piece of a Larger Puzzle
The European code of practice on transparency for AI-generated content, developed through a multi-stakeholder process coordinated by the AI Office, gathered around 190 signatories, including Google, Meta, Microsoft, OpenAI, Mistral, Cohere, and Synthesia alongside Anthropic itself. Adherence to the code remains voluntary, whereas Article 50 obligations are legally binding—a distinction worth keeping in mind when reading that "the entire industry" is moving in the same direction: it is, but with vastly different margins of freedom from company to company.
What emerges when bringing together official sources and international press reactions is a picture halfway between technical progress and an unproven gamble. Compared to detectors that analyze style after the fact, a watermark embedded during generation is a more sophisticated approach because it is born inside the process rather than inferred afterward. Its real effectiveness, however, will depend on open factors: the concrete availability of a detection API, robustness after multiple edits and translations, independent testing across non-English languages and technical domains, and above all, the caution with which schools, businesses, and newsrooms choose to interpret positive or negative results.
Knowing that Claude intervened in a text does not, in the end, answer the most important question: who developed the ideas, verified the data, and assumed responsibility for what gets published. A watermark can add technical transparency regarding a content's origin, but it cannot replace human judgment on what to do with that information. Anthropic is betting that an invisible signal, if handled with care, is worth more than no signal at all. It remains to be seen whether the rest of the world—from teachers to judges to newsroom colleagues—will be willing to use it with the same caution with which it was built.