Does Claude Watermark Text? How It Works

Watermarking an image is easy. You nudge millions of pixel values by amounts no eye can catch, and you are done. Watermarking text is a different problem entirely. There are no pixels, only words, and you cannot change a word “slightly”. It is either that word or a different one.

The system Anthropic switched on for models released from August 2, 2026 attacks exactly that problem. Every answer Claude writes carries a trace you cannot feel while reading but that a statistical test can measure. Here is how that is possible. 👇🏻

What Claude’s Watermark Actually Is

Anthropic ships two separate mechanisms, and most coverage blends them into one.

1. A watermark embedded in the text. As Claude generates an answer, an imperceptible pattern is woven into its word choices. Because the pattern is the text, it travels with copy and paste instead of being stripped when the content moves to a new document. It operates at the model level, so the interface you use does not matter.

2. Signed provenance metadata on files. When Claude produces a .svg, .png or .jpg, it attaches a cryptographically signed record following the C2PA (Coalition for Content Provenance and Authenticity) open standard. That record signals Claude’s involvement and makes later tampering detectable.

The distinction matters: one lives inside the content, the other lives around the file. Metadata is trivially removable, a screenshot is enough. A mark inside the words is much harder to strip. That is why both exist.

How far does it reach?

So the code you generate with Claude Code and the completion you pull from the API are both in scope.

Why now?

The date is not arbitrary. August 2, 2026 is the day the EU AI Act’s transparency obligations start applying. Article 50 requires providers of generative systems to mark synthetic output in a machine-readable way. Anthropic applying it worldwide is the practical shortcut: the rule comes from Europe, but running one behavior everywhere is simpler than running region-specific models.

How Do You Physically Put a Mark Into Text?

This is the interesting part. Anthropic has not published its scheme, only a promise of technical documentation to come. But the open literature here is deep, and there is a production system whose design is fully public. What follows are the known answers to “how could this possibly work”.

First, kill a common misconception

Text watermarking is not sprinkling invisible Unicode characters such as zero-width spaces between words. That trick has been around for years and it does not hold up: paste the text as plain text, or run it through almost any editor, and those characters are gone.

The real approach sits much deeper, at the moment the model picks a word.

What a language model is doing at every step

At each step, a language model does exactly one thing: it assigns a probability to every token in its vocabulary. After “the weather today is really”, it might give “nice” 0.31, “warm” 0.22, “grim” 0.07. One of them is then sampled.

The key observation: there is almost always more than one acceptable candidate. Saying “warm” instead of “nice” does not break the sentence. That slack is where a watermark lives. You smuggle a secret rule into which acceptable candidate wins, without hurting quality.

Method 1: Green lists and red lists

The classic approach, proposed by Kirchenbauer and colleagues at the University of Maryland in 2023. The logic:

1. At each step, hash the previous token and use the result to seed a random number generator.
2. Use that seed to split the vocabulary in two: a green list (say 25 percent of it) and a red list.
3. Add a small bonus to the scores of green tokens. The model picks them slightly more often.
4. Later, anyone holding the same hash key can replay the process and recompute which list each word belonged to.

Detection is just counting. In ordinary human text, roughly 25 percent of words land on the green list by chance. In watermarked text, that share is noticeably higher. You quantify the gap with a z-score: seeing 40 percent green instead of 25 percent across 500 words is astronomically unlikely to be coincidence.

The weakness is that the scheme deliberately distorts the model’s distribution. The bigger the bonus, the easier detection gets and the worse the writing reads.

Method 2: Tournament sampling (SynthID-Text)

The scheme Google DeepMind runs in production inside Gemini, published in Nature in October 2024. It is more elegant, because it can leave the model’s probability distribution intact.

Think of a knockout tournament:

1. Draw several candidate tokens from the model’s real distribution. For a three-layer tournament, eight candidates.
2. Using a seed derived from a secret key plus the preceding context, assign each candidate a pseudorandom score, its g-value.
3. Pair the candidates up. In each match, the higher g-value wins.
4. When the bracket is finished, the surviving candidate is emitted.

Because every candidate was drawn from the model’s own distribution, the resulting text stays natural. But the emitted tokens are now systematically drawn from the high-g side. To detect, you average the g-values of the tokens in a passage: chance gives you the expected baseline, a watermarked passage sits measurably above it.

DeepMind ran this across a product serving millions of users, with negligible latency cost.

What both methods share: this is a statistical test

Neither scheme returns yes or no. Both return a probability, and three consequences fall directly out of that:

• Short text cannot be detected. One sentence does not contain enough tokens for the signal to separate from noise. Reliable detection generally needs a few hundred tokens.
• Low-entropy text cannot be marked. After “2 + 2 = " the model has no freedom, there is one correct answer. The same goes for rigid code syntax, definitions and quotations. Where the model has no choice, there is nowhere to hide a mark.
• Rewriting destroys the signal. Pushing the text through another model, or translating it, replaces the word choices wholesale and the watermark goes with them. Word-level edits preserve part of the signal, because the hashing works over short windows.

What the Mark Proves, and What It Does Not

Anthropic’s phrasing is carefully hedged: a detected mark indicates the content may have been processed by Claude, and does not establish complete provenance.

“Processed” is doing real work in that sentence. Hand Claude your own draft and ask it to fix the grammar, and the output can carry the mark too. So the watermark does not say “an AI wrote this”. It says “this text passed through Claude at some point”. That gap between authorship and handling disappears in most of the news coverage.

The reverse direction matters even more:

How is this different from AI detectors?

Tools like GPTZero are guessing. They score how “predictable” a passage looks and turn that into a verdict. No key, no mathematical guarantee, and a false positive rate high enough that they are notorious for flagging text written by non-native English speakers.

Watermark detection is a different animal. You hold a secret key, and the question you ask is a hypothesis test: how likely is this exact sequence if it had not been generated with this key? You can tune the false positive rate to whatever threshold you need. The price is that detection requires the key, which means the provider controls who can detect.

So who can detect it today?

Nobody. Anthropic says it will support users and third parties in detecting the marks and will share detection mechanisms in forthcoming technical documentation. As of this writing there is no documentation and no public verification tool.

The practical takeaway: treat any product advertising itself as a “Claude watermark detector” with suspicion. Without the key, the only thing on offer is the old guessing game with a new label.

What Changes for Developers

If you build on the Claude API, a few things are worth internalising.

Your output is marked. Text you surface under your own product’s name still carries the model’s trace. That is the design, not a bug, and no opt-out has been announced.

Code is in scope too. Anthropic lists code as a separate surface. In practice code is low-entropy: a function name or a loop structure rarely has many equally plausible alternatives. Do not expect a detectable signal to survive in short snippets.

C2PA metadata is fragile. Run a Claude-generated image through a processing pipeline, re-encode it, or upload it to most social platforms, and the metadata is gone. If provenance matters to you, keep the original file untouched.

Never build compliance on the absence of a mark. Treating “no watermark found” as evidence that a human wrote something is invalid for all the reasons above.

Can the watermark be removed?

Technically, yes, and not with much effort. Rewriting the passage with a different model, or round-tripping it through translation, wipes most of the signal. The academic literature studies this under “scrubbing”, alongside “spoofing” attacks that forge a watermark into text the model never produced.

Knowing this frames the system correctly: a watermark is a label, not a lock. It is built to carry provenance through ordinary, well-meaning use. It does not stop a determined adversary, and it does not claim to.

Frequently Asked Questions

Q: Does Claude watermark the text it writes? A: Yes. Anthropic states that Claude models released on or after August 2, 2026 embed an imperceptible mark in generated text, with older models being retrofitted. Because the mark is in the text itself, it travels with copy and paste.

Q: Is Claude’s watermark visible? A: No. There are no extra characters, symbols or notices in the output. The mark is hidden in the statistical pattern of word choices and is not noticeable while reading.

Q: How do you detect Claude’s watermark? A: There is no public way right now. Anthropic has said it will share detection mechanisms in forthcoming technical documentation, but as of this article’s publication neither the documentation nor a public verification tool exists.

Q: If no watermark is found, was the text definitely written by a human? A: No. A short passage, heavy editing, a format conversion, or generation by a different AI model all produce text with no detectable mark. The absence of a watermark proves nothing.

Q: Does finding a watermark prove an AI wrote the text? A: Not exactly. In Anthropic’s own wording, a detected mark indicates the content may have been processed by Claude. Asking Claude to edit your own draft can produce a mark too, so the finding means “this text passed through Claude”, not “an AI is the author”.

Q: How does text watermarking work technically? A: At each step a model produces a probability distribution over the next token, and there is usually more than one plausible candidate. Watermarking schemes use a secret key to bias that choice: the classic method splits the vocabulary into a green list and a red list and slightly favours green tokens, while SynthID-Text runs a knockout tournament among candidates using pseudorandom scores. Detection measures whether that statistical lean is too strong to be chance.

Q: Does Claude use invisible Unicode characters to watermark text? A: No. Zero-width characters and similar tricks disappear on conversion to plain text, so they are not a serious approach. Real schemes intervene in the word selection itself.

Q: Is Claude API output watermarked? A: Yes. Anthropic lists the API, Claude apps, Claude Code, Cowork and Claude Tag separately, and access through AWS, Google Cloud and Microsoft Foundry is covered as well. No setting to disable marking has been announced.

Q: Is code generated by Claude watermarked? A: Code is listed as an in-scope surface, but code has little expressive slack. Rigid syntax means there is often only one plausible token, so a detectable signal is unlikely to survive in short snippets.

Q: Can Claude’s watermark be removed? A: Technically yes. Rewriting the text with another model or round-tripping it through translation changes the word choices and destroys most of the signal. The watermark is designed to carry provenance through normal use, not to withstand a determined attacker.

Q: Does Claude watermark images? A: Images are handled by the other mechanism. Claude attaches C2PA provenance metadata to .svg, .png and .jpg output rather than altering the pixels, so nothing is visibly stamped on the picture. That metadata does not survive a screenshot, a re-encode, or an upload to most platforms.

Q: What is C2PA, and how is it different from the watermark? A: C2PA is an open standard for attaching signed provenance metadata to files, which Claude applies to .svg, .png and .jpg output. The difference: C2PA data lives in file metadata and is lost to screenshots, re-encoding or uploads to most platforms, whereas the text watermark lives inside the content.

Q: Why did this start on August 2, 2026? A: That is the date the EU AI Act’s transparency obligations begin to apply. Article 50 requires synthetic content to be marked in a machine-readable form. Rather than limiting the behavior to one region, Anthropic rolled it out worldwide.

Q: Can teachers use this to check student work? A: Not today, since no verification tool has been released. Even once one exists, the limits stand: it only catches Claude output, it does not work on short passages, and a negative result does not show that a human wrote the text. It cannot support an accusation on its own.

Take care… 🙂