How Claude’s Watermarks Work: Anthropic details new invisible marking system for future versions of Claude

Anthropic introduced invisible, machine-readable signals that text and images were generated by Claude.

What’s new: The marks will be deployed worldwide in all Claude models launched after August 2, 2026. The company said the watermarks are necessary in order to comply with the European Union’s AI Act.

How it works: Anthropic will generate a digital watermark – a hidden, coded signature that is used to identify AI-generated content – for generated text and a metadata credential for edited images. The policy applies to all forthcoming models and will be phased in for existing models. On August 14, the company added more details about its watermarking methods, their limitations, and implications for users.

• Claude’s technique is based on SynthID-Text, a method published by Google researchers in 2024. Typically, language models make low-stakes decisions between alternative words in a sentence. For marked text, a secret, randomized process – called the “seed generator” in the Google paper – subtly nudges the model toward certain word choices as it generates text. Those choices create a pattern that can later be detected by a scoring function, which measures how strongly the text matches the pattern. SynthID-Text gives a statistical score that indicates how strongly a piece of text matches the watermarking associated with its secret key. Anthropic says will release an API that assigns this probability score to submitted text.
• A watermarking signal gives a probability of Claude usage but it is not definitive evidence of generated text. Additionally, false negatives are possible in both watermarking and C2PA. Information created by humans but summarized, translated, condensed, or combined with synthetic information may contain a watermark signal.
• The company said watermarking will not (i) decrease output quality, (ii) be visible to the reader, (iii) require additional tokens or be more expensive, or (iv) have identifying information that could allow text to be traced back to a user.
• The watermarks are designed to be persistent. They survive copying and pasting and some editing. On the other hand, text that is heavily edited or paraphrased and images stripped of their metadata through format conversion may not include the watermark.
• Code and other deterministic text will generally have fewer watermarks. Unlike prose, there is frequently a best choice for code or more exact fields – for example, the correct next character for 2 + 2 = should inevitably be 4. But textual watermarks will still be used in cases where there isn’t a deterministic best choice and in code comments. This makes AI-generated code detectable.
• Claude models do not generate images from scratch but can edit and process images or generate them using code. These images will have a cryptographically signed credential in their metadata. The method, called C2PA, helps prove the provenance of an image or video. C2PA is different from a text watermark because, unlike in SynthID-Text, nothing in the content is adjusted. Any software that reads C2PA credentials can identify Anthropic’s, and the company will provide its own checking tool.

Behind the news: The announcement received widespread backlash, with many critics saying that watermarking is ineffective, harmful, or a privacy violation for AI users. Proponents argued that distinguishing between AI-generated and human-written text could actually help AI engineers.

• Anecdotally, dozens of Claude users on X claimed they canceled their Claude subscriptions. Still, Anthropic said it did not see a measurable increase in cancellations.
• Some users believe subtle adjustments in generated text will deteriorate output quality, despite Anthropic’s assurances to the contrary. Others worry about reputational damage associated with false positives and argue that the watermarking detection lacks nuance around how AI is used. For example, a person who uses Claude for editing assistance could be accused of entirely AI-generated messages; a lawyer could suffer backlash from judges or opposing counsel a flagged legal brief even if the content is accurate. Other professionals have similar worries.
• Some critics contend that watermarking isn’t meaningfully accurate since marked text can potentially be stripped away by passing text through a different AI model, or because one company’s API detector can’t detect text generated by other LLMs. Also, former Microsoft executive Steven Sinofsky said on X that users should have a “right to private thoughts free of a digital trail.”
• Other critics fear Anthropic will use watermarking to support claims of others copying or distilling their models, as part of Anthropic’s efforts to stymie competitors worldwide. 
• Proponents believe transparency around AI usage is a positive development. Scott Aaronson, a computer science professor whose work laid the groundwork for SynthID-Text, argued that even if detection methods aren’t perfect, watermarking can help deter scholarly cheating and plagiarism. And some AI researchers have argued that watermarks can be useful to avoid training unknowingly on synthetic content, which can lead to increased bias or model collapse in new generative models.

Why it matters: Anthropic isn’t the only company that will have to build a way for generated text to be detectable; it’s just the first mover. Article 50 of the EU AI Act demands machine-readable watermarks for generated content, including text, image, audio, and video. However, Anthropic chose to apply this globally, rather than only within the EU. Some large AI developers, including OpenAI, Google, Meta, and Microsoft, have also signed the EU’s Code of Practice on Transparency of AI-generated Content, a voluntary framework for demonstrating compliance with the AI Act’s requirements for marking and labelling AI-generated content. These and other companies may use different techniques, and it still remains to be seen if they will implement watermarking only in the EU, or globally.

We’re thinking: We’ve long taken the view that harmful use cases of AI should be regulated rather than the technology itself. Anthropic’s watermarking and detection methods are built into the technology, subtly altering generated text. Addressing plagiarism and identifying synthetic content for model builders may be laudable goals, but we anticipate that universal watermarking will prove to be too blunt an instrument, opening a Pandora’s box of issues around privacy, quality of output, and harmful false positives.