How Claude Watermarks the Text It Generates

The Text Watermark Anthropic Announced on August 10

On August 10, Anthropic quietly posted a document to its help center, without any fanfare or press release. It said that Claude models released after August 2, 2026 would embed a machine-readable mark into the text they generate — a mark baked directly into the output itself. The mark is invisible to the naked eye, survives copy-and-paste across different platforms and editors, and holds up through some amount of editing.

If this were about images, I’d have understood immediately — it’s well known that Google DeepMind’s SynthID embeds invisible watermarks into generated images, and plenty of people have already heard of it. But how do you hide something invisible inside a sentence made of ordinary words? Do you slip in special characters between the letters, the way some tricks do?

With text, it’s genuinely hard to find places where you can make tiny changes — the kind of change equivalent to tweaking a single pixel value in an image — without anyone noticing the difference. So instead of attaching a mark to the finished writing after the fact, this technique subtly twists the way the model picks its words as it generates them. The mark isn’t extra data layered on top of the text; it’s embedded directly in which word gets chosen at each step.

---

Images Have Room to Hide Things. Text Doesn’t.

Let me start by explaining why image watermarking is so intuitive to understand in the first place.

A digital image is essentially an array of numbers spread across millions of individual pixels. And the human eye simply can’t detect tiny differences among these numbers. Whether a given pixel’s red value is 137 or 138, we honestly can’t tell the difference. Audio works the exact same way. There are frequency bands the human ear barely picks up at all, and quiet sounds that get completely buried right after a loud noise.

Because our senses can’t distinguish these minute differences, a margin opens up — a kind of blank space where extra information can be quietly carried without anyone noticing. SynthID-style image watermarks embed their signals right into that margin. Place the original image and the watermarked version side by side, and an ordinary person sees absolutely no difference — but a dedicated detector can still read the faint underlying pattern. It’s even possible to layer a watermark onto an image well after the fact, once the image has already been created and shared.

Text doesn’t have this kind of margin at all.

A sentence isn’t an array of pixels — it’s a sequence of tokens¹, and every single token carries real meaning. Tweak just one character in “The weather is nice today” and you either create an obvious typo or change the meaning of the sentence entirely. A harmless micro-adjustment like changing 137 to 138 is, in principle, simply impossible with ordinary text. There is a trick involving invisible Unicode characters tucked between visible ones, but that’s not really a watermark in any meaningful sense — it’s just a hidden character. Copy that text into a different editor and it mostly disappears anyway, and it’s trivially easy for anyone to find and strip out regardless.

So text watermarking had to take a completely different approach from the start. Instead of embedding a signal into a piece of writing that’s already finished, it intervenes directly in the process of writing itself, as the words are being chosen.

---

So They Changed How Words Get Picked

A language model doesn’t write an entire passage all at once, the way a person might draft a paragraph in one go. It pulls tokens one at a time, in sequence. At every single moment, it calculates a probability distribution across the entire vocabulary (typically well over 100,000 possible tokens) and draws one from that distribution. And here’s the key fact worth remembering: at most positions along the way, there isn’t just one single right answer.

Take a sentence like “The cause of this problem isn’t technology, but ___.” Whether the blank ends up filled with “the institution,” “the structure,” “the design,” or “the convention,” the sentence holds up perfectly fine either way. Swap “so” for “therefore,” or “this point” for “this juncture,” and the reader honestly won’t notice a meaningful difference. At virtually every token, there’s this slack, this room where either choice works just as well as the other. Information theory has a name for this: entropy.²

Text watermarking uses this slack as its communication channel. Instead of relying on blank space hidden in pixels, it relies on blank space hidden in choice itself.

The SynthID-Text paper, published by Google DeepMind in Nature back in October 2024, shows this structure more clearly than almost anything else out there. Here’s how the whole process works, step by step.

Previous token + secret key → hash → random seed → scoring functions g1 · g2 · g3
8 candidates	institution	structure	design	convention	method	framework	scheme	principle
Round 1 (g1)	structure		design		method		principle
Round 2 (g2)	design				principle
Round 3 (g3)	design
The orange cell is the token that actually gets output. The paper's default setting uses 30 layers; here it's reduced to 3 for illustration.

First, the secret key and the last several tokens generated are fed together into a hash function, which generates a random seed. That seed is then used to spawn several distinct scoring functions, each of which sprinkles a 0 or a 1 across every single token in the entire vocabulary. Then, several candidate tokens are drawn from the model’s original, unaltered probability distribution and put through a tournament of sorts. They’re paired up two at a time; whichever one scores higher under a given scoring function advances to the next round, then competes again in the following layer under a different scoring function, and whatever token ultimately survives all the way to the end becomes the actual output token. The paper’s default configuration uses 30 such layers.

Because the candidates were drawn from the model’s genuine, unmodified probability distribution to begin with, the overall quality of the output stays essentially unchanged. But to someone who happens to hold the secret key, one clear bias becomes visible: the output tokens end up consistently clustered toward the higher-scoring side of that particular key’s scoring table.

Detection, from this point on, becomes fairly straightforward. No access to the model is needed, and no original, unwatermarked text is needed either. You simply rerun the same scoring function with the same key over the observed text, compute the average score across all the tokens, and calculate “how likely is it that this exact score would appear if an ordinary human had written it purely by chance.” It’s a statistical test, plain and simple. Human-written text tends to land right around chance level, while watermarked text stands out clearly and statistically.

The computational cost is negligible as well. In that same paper, the latency increase caused by tournament sampling was measured at just 0.57%. That’s precisely why this method could realistically be deployed inside a live, production product. Google, in fact, has already built it directly into Gemini.

Whether Anthropic uses precisely this same method remains genuinely unknown for now. The company hasn’t disclosed the specific implementation details. But the four properties it has described — “woven directly into the text itself,” “survives copy-paste,” “tolerates some amount of editing,” and “no meaningful impact on quality” — line up almost exactly with the hallmark characteristics of this entire family of techniques. The original prototype of this family is the green-list/red-list method proposed by Kirchenbauer’s research team back in 2023, and tournament sampling is essentially its refined, more sophisticated descendant.

---

Even the Limitations Come From the Same Principle

Once you understand this underlying structure, every single limitation listed in Anthropic’s own documentation collapses into one single, unified explanation. These aren’t cautious legal disclaimers that a company simply tacked on out of an abundance of caution — they’re limitations baked directly into the underlying principle itself, and couldn’t really be otherwise.

Why it survives copy-paste: the marker isn’t some kind of file property sitting off to the side — it’s the actual word choices themselves. Move the text anywhere, and the marker inevitably moves right along with it. There’s no separate metadata layer that can simply fall off in transit, because no such layer exists to begin with.

Why it tolerates some editing: the underlying signal is thinly scattered across hundreds and hundreds of individual word choices. Rewrite a handful of sentences and the statistical score naturally drops somewhat — but it doesn’t zero out entirely.

Why it fails on short pieces of text follows the exact same logic. This is fundamentally a statistical test, and statistical tests inherently need a reasonably large sample to work reliably. SynthID-Text’s own published measurements show that at just 50 tokens, detection success drops all the way down to around 0.3 at a 1% false-positive rate. In practical terms, a piece of writing barely ten sentences long is simply too short to judge with any real confidence.

Why it collapses under paraphrasing³ and translation is especially interesting to think through. When a human being or another AI model rewrites the sentences, token selection effectively gets re-drawn through an entirely different process that has nothing whatsoever to do with the original secret key. The signal isn’t so much erased as it is overwritten by an unrelated one.

And there’s one more limitation that the documentation itself never actually mentions. I personally think this is the most important one of all. The total amount of information a watermark can ever carry is fundamentally bound by the entropy of the generation process itself. Where there’s genuinely only one viable option available at a given position, there’s simply nothing left to plant a signal in. If every candidate token turns out identical anyway, there’s no real reason to even hold a tournament in the first place.

Which is exactly why short code snippets, rigidly formulaic table outputs, direct quotations, and precise calculation results — text where the correct answer is nearly predetermined from the start — end up carrying almost no detectable marker at all. It’s more than a little ironic. This technology works weakest of all exactly where the fight over AI authorship burns hottest.

---

Korea Already Required Disclosure Since January

This announcement isn’t just a story about European regulation, either. Korea already has its own domestic disclosure requirement, and has for some time now.

The Basic Act on the Development of Artificial Intelligence and Establishment of Trust, along with its accompanying enforcement decree, formally took effect on January 22, 2026. Article 31 requires generative AI providers to clearly disclose that their output was, in fact, AI-generated. There are two separate tracks built into this requirement. For general everyday output, providers can choose either a human-perceptible label or a machine-readable method such as watermarking or embedded metadata; for deepfakes specifically, only a clearly visible, unmistakably human-recognizable label is permitted. Text-based output is explicitly covered as well.

Two distinct problems emerged in practice, though. First, the legal obligation falls squarely on AI providers themselves, not on individual end users. Second, even if a given provider genuinely wanted to choose the machine-readable route, there was effectively no usable standard technology available to implement it with. So the government ultimately set a grace period of at least one full year, and fines of up to ₩30,000,000 (roughly $21,600) have effectively been pushed back to sometime in 2027 or later.

Anthropic’s move directly addresses this exact gap in a meaningful way. A watermark applied at the model level itself means that for domestic businesses building products on top of Claude, a machine-readable label now comes bundled in automatically, by default. That removes one of the main reasons providers had previously cited for the standard’s absence.

Here’s where the letter of the law and what the technology actually tells you start to diverge, though. Korean law requires disclosing “the fact that AI created this particular piece of content.” But that’s not exactly what this watermark is actually saying. As the company itself has openly acknowledged, the label still appears even in cases where Claude isn’t the original author at all. Sentences that merely went through proofreading, translation, summarization, or a simple format conversion all come out marked “processed by Claude” regardless. Compare this against European guidance, which specifically exempts simple grammar-correction assistance from its disclosure requirement — here, by contrast, the technology ends up disclosing far more broadly than the law actually demands.

In other words, this mark isn’t proof that Claude actually wrote the text in question — it’s simply a record that the text passed through Claude at some point along the way. Assuming Claude authored something purely because the mark happens to be present is exactly where misunderstanding tends to creep in.

---

Oswarld’s Lens

What I personally kept thinking about, for far longer than the underlying technology itself, was the thorny question of who actually holds the detection key.

You simply can’t read this watermark without possessing the key. But if that key is ever made public, anyone at all could reverse-engineer it and strip the watermark right out — once you know which tokens score high under a given key, you just swap those specific tokens out for others. Keep the key entirely private, though, and the authority to decide “did an AI actually write this” ends up concentrated almost entirely in the hands of a single model company.

The EU’s Code of Practice requires that independent third parties be able to detect the watermark themselves, but these two demands genuinely conflict with each other in principle. The realistic fix, in practice, would be some kind of detection service run directly by the company itself — which inevitably means anyone seeking a verdict has to send the text in question over to that company’s own servers. A recruiter would effectively have to upload a candidate’s cover letter; a school would have to upload a student’s homework assignment, just to get a determination back. A mechanism originally built for the sake of transparency ends up quietly creating an entirely new point of data concentration instead.

I’ve personally seen this exact pattern play out repeatedly while building go-to-market strategy over the years. When companies sit down to evaluate AI tools, they typically start by building a detailed feature-comparison spreadsheet — but what actually ended up deciding the contract was almost always something that never even appeared on that spreadsheet. This watermark is exactly that kind of overlooked item. If you’re building a document-processing product on top of the Claude API, you need to seriously account for the fact that a customer feeds in their own private manuscript, and the output comes back carrying a detectable signal embedded within it — that’s very much a matter for your terms of service and your disclosure language going forward.

Still, I think we should stay fairly clear-eyed about how effective this measure actually is in practice. Anyone determined to strip the mark just has to rewrite the text once, or simply switch to using a model that doesn’t watermark its output at all. In the end, the mark only really ends up attached to content produced by whoever is already playing by the rules anyway. So personally, I don’t see this measure so much as a device for catching bad actors — I see it more as infrastructure that quietly makes machine-readable tagging the default setting on the ordinary, everyday content produced by rule-following businesses.

---

Closing

Here’s the short summary.

First, images have a kind of blank space that people simply can’t perceive, so signals can be comfortably hidden there — but text has no equivalent blank space at all. That’s precisely why text watermarking doesn’t stamp a mark onto a piece of writing after it’s already finished; instead, it subtly shifts how the model chooses its words as it goes, one token at a time.

Second, everything else about this technology follows naturally from this one single principle. Copy and paste the text anywhere you like, and the mark stays fully intact. Short pieces of writing, or text where the correct answer is nearly fixed in advance, end up carrying almost no mark at all. And if you rewrite the sentences yourself, the mark gets quietly overwritten and effectively disappears.

Third, the problem that genuinely remains isn’t really a technical one at all — it’s fundamentally about who holds the detection key and gets to make the final call. If the key is ever made public, anyone can strip the watermark out entirely; if it isn’t made public, the authority to judge ends up concentrated entirely in the hands of a single model company. The mark discussed throughout this piece isn’t some separate file of metadata sitting off to the side — it’s a genuinely statistical pattern that shows up directly in word choice itself.

What you can actually try out right now is surprisingly simple, honestly. Write down, in a single line, all the text that currently leaves your organization after passing through AI in some form — press releases, product detail pages, customer service copy, draft contracts, and so on. Sort them into two piles: “cases where it genuinely wouldn’t be a problem if a mark showed this was AI-processed” and everything else, and you’ll end up with a rough outline of the policy you’ll eventually need to sort out going forward.

Are you currently using AI in your own work to draft or polish documents that go out externally to clients or the public? If a mark reading “processed by AI” were attached to that particular output, which document would end up causing the biggest headache for you? Tell me about it in the comments. Once enough cases come in from readers, in the next issue I’ll put together a breakdown of what kind of risk the mark poses, organized by document type.

---

💬 Tell me in the comments which document would be most problematic if it carried the mark. I’ll factor it into the next issue. 📨 If you have a colleague in content, legal, or engineering, please pass this along to them.

---

References & Further Reading

Primary sources

• Anthropic, “How Claude marks AI-generated content”, Claude Help Center, August 10, 2026. View document ··· This is where today’s piece starts. It’s short, so I’d genuinely recommend reading the original document yourself. The “Limitations” section in particular shows what the company is deliberately not promising.
• Sumanth Dathathri et al., “Scalable watermarking for identifying large language model outputs”, Nature, Vol. 634, October 24, 2024, pp. 818–823. View paper ··· This is the basis for today’s explanation of the underlying mechanism. Just Fig. 2’s tournament diagram alone gets the whole principle across. Side note: several secondary sources cite this paper as Vol. 631, p. 755 — that’s actually the bibliographic info for an entirely different paper.
• John Kirchenbauer et al., “A Watermark for Large Language Models”, ICML, 2023. View paper ··· This is the prototype of this whole approach. It’s actually easier to grasp the underlying concept here, since it uses the simplest possible form — a straightforward green list and a red list.
• Korea’s “Framework Act on the Development of Artificial Intelligence and Establishment of Trust”, Article 31 and its Enforcement Decree, effective January 22, 2026. View statute ··· This is the legal basis for Korea’s domestic labeling requirement. The key point worth noting is how the labeling method differs between deepfakes and ordinary, everyday AI output.
• European Commission, “Transparency obligations under Article 50 of the AI Act”, 2026. View official FAQ ··· This is the primary source for confirming exactly when Article 50 takes effect (August 2, 2026) and where the code of practice fits into the broader picture.

Background

• Coalition for Content Provenance and Authenticity, C2PA Specification. View spec ··· This is the standard for file-level marking. Just skimming how the signature structure is built shows you clearly why it’s “gone the moment you strip it off.”
• Nikola Jovanović, Robin Staab, Martin Vechev, “Watermark Stealing in Large Language Models”, ICML, 2024. View paper ··· This covers attacks that reverse-engineer a watermark in order to erase or forge it. If you want to dig deeper into the technical side of today’s “detection key” problem, start here.

---

The author is Oswarld (Kwangseob Ahn). Current roles: Adjunct Professor at Sejong University, Strategy Consultant at INLEVEL9. Career, research, books, and recent work are kept current on the About page. Latest · July 2026: HEMA-2: A Consolidation-Aware Tri-Memory Architecture with Multi-Channel Scheduling for Lifelong Conversational AI.

📝 Glossary

Footnotes

1. Token: The smallest unit a language model uses to handle text. It can be a whole word or just a fragment of one. Rather than writing a sentence all at once, the model generates text by stringing these individual tokens together one at a time, in sequence. ↩

2. Entropy: A measure of how many different options could plausibly come next at a given position in a sentence. If there are many reasonable candidate next words, entropy is high; if the next word is essentially fixed and predictable, entropy is low. A watermark can only hide itself in positions where entropy happens to be high. ↩

3. Paraphrase: Rewriting something in different words while keeping the underlying meaning fully intact. This covers both a human manually rewording a passage by hand and running that same passage through another AI system. ↩