Claude's invisible watermark is coming. A full rewrite erases it

Future Claude models will come with a built-in text watermark. Anthropic describes it as a way to estimate the likelihood that Claude was involved in writing a given passage, and the stated reason for the change is the EU AI Act, which from August 2 requires AI providers serving the European market to mark AI-generated content. Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026, one of roughly 190 signatories, and is applying the watermark globally because it does not yet have a durable way to scope it by region. The move is part of a broader compliance push at Anthropic, which recently put a former Supreme Court justice in charge of its AI policy.

More interesting than the mechanism is what Anthropic concedes in the same post. The watermark is meant to be read after the fact by anyone holding the key. It will not survive someone determined to remove it. Light editing probably will not get rid of it completely, but a complete rewrite where every word is replaced will. The EU marking requirement is being met with a tool that assumes cooperation.

How the watermark works: swapping the randomness, not the words

Language models choose text one word at a time from a list of candidates. When several are equally sensible, the choice is settled by a random number. After "The weather today was cold and...", the next word will not be "sugary", but it could plausibly be "overcast" or "grey". The watermark changes where that randomness comes from. Instead of an arbitrary random number generator, Claude uses the key and a few preceding words to settle the pick. The words stay random and stay within the set Claude would have considered anyway; the method never pushes the model toward something like "nubilous", an obscure synonym almost no one would expect.

The result is invisible to readers. Anyone with the key can check the sequence of words against what the key would produce and assign a probability that Claude generated the text. Anthropic's implementation is a version of SynthID-Text, the approach Google DeepMind published in a 2024 Nature paper, part of a family that goes back to a 2022 proposal by Scott Aaronson. In the SynthID-Text paper, DeepMind tested the technique on a slice of Gemini traffic and found no statistically significant difference in thumbs-up and thumbs-down ratings compared with an unwatermarked model.

Anthropic's own analogy: players in a board game get their dice rolls from a book of pi digits instead of dice. The game plays out the same for everyone involved, but a spectator who knows the sequence can later work out that pi was the source. Claude's text works the same way. The experience is identical; the provenance is checkable.

Where the watermark misses: exact code and lightly edited text

Anthropic is explicit about the blind spots. Detection gets more reliable as a passage grows, but small samples carry too few word choices to build confidence. Factual text gives the watermark nothing to act on: after "Isaac Newton's most famous work was called Principia", the next word has to be "Mathematica", with no equally good alternative. Code is mostly the same. Exact output has no room for a nudge, so code generally carries less watermarking than ordinary prose; the arbitrary spots, like comments, can still be marked. For a company pushing Claude deeper into real codebases, most visibly through Claude Code, that is an awkward gap.

Proofreading is another gap. When Claude edits a human's text, nearly all the words remain the writer's, and the handful of corrections may be too few to register. The more Claude writes, the more decisions it makes, and the more space the watermark has. Translations are fully watermarked because Claude chooses every word.

The watermark also answers a narrow question. It can estimate the likelihood that Claude was involved at some point, but it cannot tell "Claude wrote this" from "Claude heavily edited this", and it says nothing about ownership or authorship rights.

No cost, no tracing, and a detection API on the way

The change is designed to be cheap and quiet. Watermarking produces no extra tokens and has a negligible impact on speed, so serving and using Claude costs the same. It carries no identifying information: nothing in the watermark or the key would let anyone recover details about a user, their organization, or their chats.

Checking requires the key, which is why Anthropic says it will soon offer a watermark detection API, with implementation details still being worked out. That also separates watermarking from AI detection software such as Pangram, which has no key and works by scanning for phrasing tells, the subtle habits that appear in model output. Detection remains an arms race with generation, and the generator gets to move second. Provenance is contested on the platform side too: X's new creator payouts hinge entirely on what X itself decides counts as original.

Files take a different route. When Claude produces a supported format such as a PNG, JPG, or SVG, it attaches a content credential, a small cryptographically signed note in the metadata using the C2PA standard, the same one used by camera manufacturers. Unlike the text watermark, nothing is embedded in the file. Any C2PA-aware tool can read the note, which only records that Claude was involved. Older Claude models, covered by the EU law's transition period for models launched before August 2, 2026, will get watermarking over the coming months, including releases already on the market like Claude Sonnet 5.

Whether this satisfies the intent behind the EU requirement is a separate question. The watermark is a compliance instrument with published boundaries. It works on long, loose text that no one touches afterward. It goes quiet on code, on light edits of human writing, and on any passage someone bothers to rewrite, which is exactly the territory where synthetic content tends to spread.