← Back to feed

Anthropic has published a technical explanation of how the invisible watermarks it deployed in all Claude output on August 11 actually work, adding specificity to what had previously been a policy announcement with few implementation details.

The short answer: the watermarks ride on word-choice decisions Claude makes while generating text. When multiple valid phrasings exist for a sentence, Claude selects among them to embed a statistical signal. The signal is not a metadata tag, not a visible mark, and not tied to any single word — it is distributed across the response and requires a key to detect.

The Code Problem

Code is the exception, and Anthropic acknowledges it directly. Functional code must be correct. Where correctness is the only criterion — the line must compile, the function must return the right value — the model has no freedom to vary phrasing for watermarking purposes. The signal cannot be embedded where no choice exists.

Comments inside code are a different matter. Comments are prose. Where the model chooses between “initialize” and “set up,” or selects a phrase to describe what a block does, the watermark can be applied. But the volume of comments in a typical code response is small relative to the functional code itself, so the aggregate watermark signal in code output is described by Anthropic as “much weaker” than in prose.

Anthropic says the practical consequence is that Claude-generated code will carry a watermark signal but one that is less robust to detection and more vulnerable to modification. The company did not disclose the specific threshold at which a code response can be confidently attributed.

Editing Survival

The robustness question is where most practical use cases intersect. Anthropic’s explanation maps directly onto common writing workflows:

Light editing — correcting grammar, adjusting tone, replacing individual words — leaves most of the distributed watermark signal intact. The signal is designed to survive minor modifications because it is embedded across a wide enough spread of choices.

A complete rewrite — every word replaced — removes the watermark. Anthropic frames this as definitionally ambiguous: if every word has been substituted, the resulting text may no longer qualify as AI-generated output in any meaningful sense.

The architecture uses SynthID Text, the statistical watermarking method developed by Google DeepMind and described in their 2024 research. Anthropic says it uses the same approach across its watermarked models rather than a proprietary implementation.

Detection API

The current watermark infrastructure is one-directional: Claude embeds the signal, but detection requires a key that only Anthropic holds. Anthropic says it plans to publish a watermark detection API that will allow third parties — publishers, platforms, employers, regulatory bodies — to check whether a given text originated from a Claude model.

The detection API would extend the EU AI Act compliance mechanism beyond Anthropic’s own products. The Act’s transparency code requires that AI-generated content be identifiable, but identification is only actionable if downstream parties can check at scale. The API would provide that check.

Anthropic has not given a timeline for the API’s release or whether it will carry any access restrictions.

Scope

The watermarks apply to all Claude models released from August 2, 2026 — the deployment date for the implementation, which predates the public activation on August 11. The marking runs globally, not only for EU users, because the Act’s practical enforcement requires consistent application across Anthropic’s generation stack.

The approach is not unique to Anthropic. The company notes that other major model developers that have signed the EU AI Act’s Code of Practice on Transparency of AI-Generated Content are expected to implement their own watermarking systems. Google has separately explained how it is handling visible watermarks — allowing users to remove them from images and video — while keeping SynthID invisible watermarks in place underneath.

For developers building on Claude, the practical implication is that all text output from August 2, 2026 models carries an embedded attribution signal. Code carries a weaker version of the same signal. A detection API that lets others verify attribution is coming.