Anthropic explains how Claude’s text watermarks work

Anthropic says Claude’s new text watermarking will be invisible to readers but detectable through a secret key, with the system designed to satisfy the European Union’s AI transparency requirements. TechCrunch reports that the company has now explained how the mechanism will work, including its limits for editing and code.

The system is based on Google DeepMind’s SynthID-Text approach, described in a 2024 paper. Large language models typically choose the next token from several plausible options. When watermarking is enabled, Claude uses a cryptographic key to bias those low-stakes choices toward particular tokens. The resulting statistical pattern is invisible to humans but can be detected across a sufficiently long passage.

For example, Claude might choose between “grey” and “overcast” when describing the weather. It is less likely to apply the watermark when there is only one sensible answer, such as completing “Paris is the capital of” with “France.” Anthropic compares the key’s complexity and randomness to the digits of pi.

“Watermarking does not impact the quality of Claude’s output. To a reader, a watermarked response is indistinguishable from an unwatermarked one.”

Anthropic says watermark generation has a negligible effect on speed and token costs. The company plans to release a detection API that can use the relevant keys to determine whether Claude was likely involved in producing a text passage.

Editing, translation, and code

The watermark is not a definitive record that Claude wrote every word. Light editing of human-written material may leave too little Claude-generated text for detection, while light editing of Claude-generated material probably will not remove the watermark. Anthropic says a complete rewrite replacing every word will remove it, although such text may no longer reasonably be described as AI-generated.

Recommended reading

Anthropic leads AI spending as revenue tops $11.5 billion

Translations produced by Claude can also contain the watermark. Detection is less reliable for short passages and for text Claude has only lightly proofread, because there may not be enough modified tokens to form a statistically meaningful pattern.

Code generally receives less watermarking than prose because functional code offers fewer interchangeable choices. The system can still apply to arbitrary elements such as comments or terms where multiple options would work, but Anthropic says this should have a negligible effect on the code itself.

Engadget reports that Anthropic is applying the changes across Claude products using models released after August 2, while adding watermarking support to older models over the coming months. The company also plans to watermark images by adding a cryptographically signed note to their metadata. Anthropic said it was applying the changes across products at launch because it did not have a reliable way to implement them only in specific regions.

The announcement has prompted public complaints from some Claude users, including posts on X claiming canceled subscriptions. Gizmodo reported that Anthropic told Business Insider it had not seen an increase in cancellations following the watermark announcement, leaving the scale of the backlash unverified.