Anthropic says future Claude models will generate text containing an invisible, probabilistic watermark that can be checked by authorised parties. The method is designed to estimate whether Claude was involved in producing a passage, not to prove that Claude wrote it in full or identify the person who used the model.

The company described the system in an announcement published on August 14, 2026 and updated on September 1. Anthropic says the watermark will not add visible labels, hidden characters or extra tokens to the output.

Contents

What Anthropic is changing

Large language models generate text sequentially, selecting the next token—often a word or part of a word—from several plausible possibilities. Claude's proposed watermark uses that existing generation process rather than inserting information into the finished passage.

Anthropic says the feature will apply to future Claude models, while models launched before August 2, 2026 will be covered by a transition period and receive watermarking over the following months. The company says it is applying the system globally at launch because it does not yet have a durable way to limit the feature by region.

The move is linked by Anthropic to transparency requirements under the EU AI Act. The company also says it signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026.

Anthropic identifies the approach as a version of Google's SynthID-Text method, which it says was introduced in a 2024 Nature paper.

How the watermark works

At many points during generation, a model has more than one reasonable next word. For example, several words might fit grammatically and semantically without materially changing the meaning of a sentence. These are “low-stakes” choices: selecting one over another is unlikely to affect the usefulness of the response.

According to Anthropic, Claude continues to make random choices among such candidates, but the source of that randomness is determined using two inputs:

  • a secret key; and
  • the words that came before the choice.

The resulting pattern is distributed across the model's word choices. It is not a visible tag and does not require additional generated content. A verifier holding the relevant key can examine a sequence of words and test whether those choices are statistically consistent with Claude's watermarking process.

The output of that test is a probability or likelihood, rather than an authorship verdict. A high likelihood would indicate that Claude was probably involved in generating the passage. It would not establish who operated Claude, which account or organisation was involved, or whether the model wrote the entire text.

Anthropic says the watermark does not identify a user, organisation or chat, and that the key cannot be used to recover those details.

The company says readers should not be able to distinguish watermarked text from unwatermarked text. It also reports that its internal testing found no impact on content, creativity or readability. In addition, Anthropic cites evaluations of SynthID-Text by Google DeepMind that reportedly found no statistically significant difference in user ratings between watermarked and unwatermarked model traffic.

Those results are presented in the announcement without sample sizes, full methods, effect estimates or confidence intervals.

What a positive result can show

The watermark is intended to answer a narrow provenance question: is this text statistically consistent with generation by a Claude model using the relevant watermarking key?

That could help eligible regulators, media organisations, fact-checkers, educational institutions and researchers investigate the likely origin of a passage. Anthropic says a detection API is in private preview for such organisations, including EU civil-society groups, with plans to expand access.

A positive result would not show that every word came from Claude. Anthropic says the system can remain detectable after light editing, but a complete rewrite that replaces every word will remove the watermark. If Claude proofreads human-written material, most of the words may still have been selected by the human author, leaving too little Claude-generated material for reliable detection.

The same distinction applies to translation. Anthropic says translations are watermarked because every word in the translated output is selected by Claude. That could indicate Claude involvement in the translation, but it would not establish anything about the authorship of the original text.

The detector also cannot establish that a passage was generated by AI generally. Text produced by another AI system may not contain Claude's watermark and may not be identifiable by the Claude detector.

Where detection becomes weaker

A statistical watermark needs enough model-selected choices to produce a measurable pattern. Short passages provide fewer observations, so Anthropic says detection confidence becomes weaker as passage length decreases and can improve as more text is available.

The method is also less useful where the model has little freedom to choose:

  • factual statements may have only one acceptable continuation;
  • proofreading and light grammar or punctuation edits may change too few words;
  • many code completions require exact syntax or outputs;
  • executable code generally receives less watermarking than ordinary prose.

Anthropic says arbitrary choices may still create watermarking opportunities in parts of code such as comments. However, the announcement does not quantify detection performance for code, short answers, different languages, different Claude versions or different levels of editing.

These limitations mean that absence of a detectable watermark would not prove that Claude was not involved. It could instead reflect a passage that was too short, too constrained, too heavily edited or generated by a system using a different watermark.

Files, access and rollout

Text watermarking is separate from the provenance system Anthropic describes for files. The company says supported PNG, JPG and SVG files will receive a C2PA content credential in their metadata indicating that Claude made or processed them.

C2PA is an open standard for recording content provenance in signed metadata. Unlike a statistical text watermark, a C2PA credential is attached as metadata rather than encoded through the content's generation choices. The two systems therefore address related provenance questions through different technical mechanisms.

Anthropic's detection API is currently described as being in private preview. Its general availability, interface, key-management arrangements and operating thresholds have not been specified in the supplied announcement.

Sources