Claude’s invisible text watermark: what it proves, and what it doesn’t

What Anthropic announced

Anthropic committed to embedding machine-readable marks in content generated by its models under the European Union’s Code of Practice for Article 50(2) of the AI Act, which it signed in July 2026 along with roughly 190 other signatories. The obligation date is August 2, 2026. The rollout applies to models launched on or after that date; older Claude models will follow “over the coming months.”

Two kinds of marking were announced. For text: an invisible watermark inside the generated words themselves. For files: a content credential — a small, cryptographically signed note in the file’s metadata, using the open C2PA standard, saying the file was made or processed with Claude.

On August 14, Anthropic published a technical explainer answering the questions the announcement left open. It confirmed three things that matter for anyone who checks content. First, the method: Claude’s watermark is a version of SynthID-Text, the scheme Google DeepMind published in Nature in 2024. Second, the plan for verification: “We will soon be offering a watermark detection API” — in development, details being worked out. Third, the scope: watermarking applies globally because, in Anthropic’s words, “we don’t yet have a durable way to scope it by region.”

The text watermark is not metadata sitting alongside the output — in Anthropic’s description, “it will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing.” And one clarification now matters more than any other: nothing is added to the text. There are no hidden characters.

How the watermark actually works

A language model writes one word at a time. Often the choice doesn’t matter much: “The weather today was cold and…” is completed sensibly by “overcast” or “grey” either way. Under normal conditions the model settles these low-stakes choices with an arbitrary random number. Watermarking changes only the source of that randomness. Instead of an arbitrary generator, the choice is settled by a secret key plus the few words that came before. The choices remain random; but a sequence of choices is now checkable for consistency with the key — and if it is consistent, one can assign a probability that the text was generated by Claude.

Anthropic is explicit about what this is not. It is not hidden characters (“Nothing is added to the text and there are no hidden characters”). It is not a cost or a quality tax — no extra tokens, and no measurable change to output quality in SynthID-Text’s 20-million-response live experiment. It is not user-identifying — the mark carries nothing about the user, the organisation, or the chat. And the model itself does not know it is being watermarked: the mechanism operates in the sampling pipeline below the model, out of reach of any prompt.

The method’s lineage is public: a 2022 proposal by Scott Aaronson, the “green-list” scheme of Kirchenbauer and colleagues (ICML 2023), and SynthID-Text (Nature, 2024). Claude’s watermark is a version of the last of these.

Where the mark is thin: the watermark can only act where the model has a real choice. That excludes more than you might expect.

What a present watermark proves

Style-based AI detection — every detector on the market today, ours included — produces a probability: this text reads like model output. A verified watermark is a different kind of statement: this text came from this provider’s model. It is closer to a signature than a signal.

For the people who deal with AI-writing questions daily — teachers, editors, reviewers — that difference matters. A verified mark ends the guessing for that specific text. It also changes the conversation: “the detector thinks this is AI” invites argument; “this carries the provider’s mark” mostly doesn’t.

The limits still deserve stating. A watermark identifies the origin of generated text, not the intent — AI-assisted writing is legitimate in many settings, and a mark is not an accusation. And a mark says nothing about the parts of a document that were written by a person around pasted model output.

Treat a positive result as a strong lead rather than a verdict. Even key-based detection returns a probability, weakens on short passages, and — as the forensic research below shows — can in rare cases fire on text Claude never wrote. “The provider’s mark was detected” is the strongest claim available in content checking today; “the provider’s mark is proof of authorship” overstates even that.

What an absent watermark does not prove

The watermark only exists in text from supported Claude models generated after the rollout. Text from other providers’ models, from older Claude models, from local open-weight models, or from before August 2026 carries no mark and never will. For years, the overwhelming majority of AI-generated text in circulation will be unwatermarked.

Anthropic’s own phrasing — the mark “may persist through some editing” — is an honest hedge, and it cuts both ways: some editing may preserve it, and heavier rewriting may not. Paraphrasing tools exist precisely to launder AI text. A determined evader is the least likely person to hand you a marked document.

How effective? A July 2026 forensic evaluation tested three watermark schemes — including SynthID-Text — against meaning-preserving paraphrase across 846 runs. Every single detected KGW- and Unigram-marked text lost its watermark after one paraphrase pass; SynthID’s removal rate was 98.3%. At frontier API rates, one paraphrase pass over a 1,000-word article costs roughly four cents. The determined evader Anthropic’s hedge imagines is not hypothetical: the tooling and the price are already public.

So the asymmetry is the whole story: presence is strong evidence, absence is no evidence. Any workflow that treats “no watermark found” as “human-written” has built a hole exactly where the dishonest cases walk through.

What it takes to remove a watermark

Start with Anthropic’s own words: “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.” That single sentence sorts the market into three categories.

What doesn’t work: stripping “hidden characters.” There are none. “Nothing is added to the text” rules out the entire category of zero-width-character strippers for Claude text — tools selling that are removing something that was never there. The caveat: invisible Unicode and generator metadata are real in other places — some chat exports, and the metadata layer of files. Stripping those is legitimate cleanup. It is just not watermark removal.

What works: meaning-preserving paraphrase. The watermark lives in word choice, so replacing the word choices replaces the mark. The forensic numbers above — 98.3% to 100% removal in one pass — come from academic testing on published schemes; Anthropic has not published its own paraphrase-resistance figures. The honest summary: paraphrase very likely defeats the mark, and nobody outside Anthropic can yet prove it either way, because the detector that would show a before-and-after score does not exist publicly.

The evasion-oracle problem. Verification and evasion share the same instrument. A publicly accessible detection API — which the EU Code effectively requires, so third parties can verify — is also a free tuning target: paraphrase, check, adjust, repeat, until the mark no longer registers. The obligation that makes verification possible makes adversarial iteration efficient. Anthropic has confirmed the API; it has not said how it will handle rate-limiting or abuse.

Two honesty rules when evaluating any “removal” claim. First, “became undetectable” is not “was removed” — detectability depends on text length and composition, not just the mark. Second, a lower score on a conventional AI detector proves nothing about the watermark: they are different instruments measuring different things.

The attack in the other direction: spoofing

Scrubbing — removing a mark — is the intuitive attack. The mirror image is stranger and, for anyone who acts on detection results, more important: spoofing. In 2024, researchers at ETH Zurich (Jovanović, Staab and Vechev, ICML) demonstrated an automated “watermark stealing” algorithm: query a watermarked model, reverse-engineer its rules, and then both strip marks from AI text and plant the pattern in human text. Against the schemes then considered state-of-the-art, both attacks succeeded over 80% of the time, for less than $50 in API calls.

The implication cuts against intuition. A positive watermark result is the strongest evidence available — and strong evidence can be planted. “This document carries Claude’s mark” is, in principle, a frame-job vector: human-written text made to look machine-generated. Paraphrase models built for evasion (DIPPER, 2023) showed the offensive toolkit forming years before any deployment; spoofing research shows it runs both ways.

Two qualifications keep this in proportion. These results were demonstrated against published research schemes, not against Anthropic’s deployment — key secrecy and SynthID’s design both raise the cost. And no spoofing attack on Claude’s watermark has been publicly reported. But the structural risk is documented and peer-reviewed, and it belongs in any workflow that treats a watermark hit as an accusation. Detection results punish; they do not prosecute.

The regulation behind it — three blocs, one direction

Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic text, images, audio or video to ensure the outputs are marked in a machine-readable format and detectable as artificially generated. The obligation applies from August 2, 2026. A Code of Practice operationalises it, and Anthropic is a signatory — which is why the announcement lands on that exact date.

China moved a year earlier. Its Measures for Labeling AI-Generated Synthetic Content, with a mandatory national standard (GB 45438-2025), took effect on September 1, 2025 — and go further than the EU in two ways. They require both explicit labels (visible notices a person can see) and implicit labels (machine-readable marks in the content or its metadata), and they put duties on distribution platforms too: platforms must check for labels and flag suspected AI content even when it arrives unlabelled. Maliciously removing, altering, forging, or concealing a required label is itself prohibited — as is providing tools to do it.

South Korea’s AI Basic Act took effect on January 22, 2026 — the first comprehensive national AI framework law after the EU’s. Its transparency provisions require businesses providing generative-AI products or services to indicate that outputs were AI-generated; content that could be mistaken for reality must be clearly labelled, by human-visible or machine-readable means. Enforcement of the transparency provisions carries a grace period of at least a year, with fines deferred except in cases of serious harm — the duty exists now; the penalties wait.

The strategic consequence: Anthropic is unlikely to remain alone. With three major blocs requiring identifiable AI content — one of them already making label-checking a platform duty — the share of provenance-carrying AI text grows, and content checking gradually shifts from pure statistical guessing toward verification. That shift will take years, but its direction is now set by regulation on three continents, not by any one company’s choice.

The detection stack: what can be verified, and when

Google’s SynthID offers a preview of what provider-side verification looks like at scale: a Detector portal where approved organisations check text, images, audio and video for Google’s marks. Anthropic’s API will presumably converge on a similar shape — provider-operated, key-based, returning a probability rather than a verdict.

One more finding belongs in the verification story, because it disciplines every claim above. The July 2026 forensic evaluation tested whether watermark detection meets the standard US courts apply to scientific evidence (the Daubert criteria). None of the three methods tested satisfied more than two of five factors. Baseline false-negative rates were already high before any attack — 70–83% depending on scheme — and one SynthID configuration flagged 5.4% of paraphrased human-written control texts as AI.

Watermark detection is the best instrument in content checking. It is still a probabilistic instrument, and its evidence, as currently constructed, would struggle in a courtroom. That is exactly why it belongs at the front of a workflow, not as the whole workflow.

What changes for AI detection

The first tier is provenance verification: once Anthropic’s API is live, checking for the mark becomes a deterministic call with a probabilistic answer — likely involved, or not found. It is the strongest signal available for marked text, silent about everything else, and — as the spoofing research shows — it can occasionally be wrong in both directions.

The second tier is what exists today: style-based analysis, which estimates the probability that prose reads as model-generated, and which remains the only tool for the unwatermarked majority — a signal with evidence, and abstention when there is too little prose to judge.

Where Stipple stands: we do not detect Claude’s watermark today — nobody outside Anthropic can, until the detection API ships and its specification is published. When it does, watermark verification becomes a natural deterministic check in front of our style analysis — the same way our fact-check tool already reads the provenance markers some AI-exported documents carry. Until then, the only honest claims are the ones on this page.

What to do differently now

If you review submitted writing: keep asking for process evidence — drafts and version history remain stronger evidence of authorship than any detector score, and they will remain stronger than watermark absence too. If someone’s work is questioned on the basis of a watermark-style claim, ask a simple question: which key verified it, and who held it? Until Anthropic’s API exists, no third party can genuinely answer “Claude’s.”

If you publish with AI assistance: expect provenance marking to spread, and disclose AI use where your context calls for it — transparency ages better than discovery. Note the irony without exploiting it: a complete rewrite strips the mark, and that same rewrite is the documented evasion path. Choosing disclosure over laundering is the whole game.

If you rely on detection tools: prefer ones that show their evidence and state their limits. A tool that claims certainty — from style, or from “watermark detection” it cannot actually perform — was overclaiming before watermarks and is overclaiming after them.