Anthropic explains how Claude’s invisible text watermark works

Anthropic has published a detailed explanation of how its watermarking system for Claude-generated text will work, the company said in a blog post.

Language models generate text one token at a time by choosing from a set of possible candidates. In a phrase such as “The weather today was cold and…”, words like “overcast” or “grey” may be equally suitable from a reader’s perspective, with the final choice normally determined by randomness.

Claude’s watermark takes advantage of these small choices. It does not introduce new words into the model’s vocabulary but changes the source of randomness used to select between them. Instead of relying on a standard random-number generator, the choice is determined by a secret key together with several preceding words. Someone with access to that key can later check whether a sequence of words follows the pattern Claude would have been expected to produce.

To a reader, a watermarked response is indistinguishable from an unwatermarked one.

Anthropic says nothing is added to the text, there are no hidden characters and the system does not consume additional tokens, meaning it should not make generation slower or more expensive. The watermark also contains no identifying information and cannot be linked to a particular person, company or conversation.

The system is based on SynthID-Text, an approach published by Google DeepMind in 2024. Google tested its effect on output quality by serving a watermarked model to a portion of Gemini traffic and found no statistically significant difference in user ratings.

The technology does have limitations, which Anthropic outlines in its own explanation. The detector can only estimate the likelihood that a piece of text was written at least partly by Claude. It cannot establish human authorship or identify text generated by other AI models, while detection becomes less reliable with short passages and factual content, where the model has fewer meaningful choices between alternative words.

For the same reason, code is less likely to carry a detectable watermark than regular prose because programming often leaves the model with fewer valid choices. Watermarking may still appear in elements such as comments.

Removing the watermark entirely generally requires extensive rewriting in which every word is replaced. Minor edits are unlikely to erase it, while translations produced by Claude can be fully watermarked because the model chooses all of the words in the translated output.

The change is being introduced in response to the European Union’s AI Act. In July 2026, Anthropic joined around 190 signatories to the EU code covering transparency around AI-generated content. The watermark will be applied globally because Anthropic currently has no reliable way to restrict it to a single region. The company also plans to make detection available through a dedicated API.