The mark rides on low-stakes word choices settled by a secret key, so only someone holding the key can test for it. Anthropic says code and factual passages carry little of it, and the detection API it has promised is not built yet.
Anthropic laid out last Friday, in a blog post answering basic questions, how the invisible watermark it will apply to Claude's text works. It runs on a version of SynthID-Text, the watermarking technology Google DeepMind built, released open source and set out in a 2024 paper, which turns word-choice probabilities into patterns a detector can find.
Claude-processed images are getting C2PA support at the same time. Both answer the EU AI Act's demand that synthetic audio, image, video and text carry machine-readable marks allowing the content to be identified as artificially generated or manipulated.
The mark is built out of word choices with nothing riding on them. In the sample fragment The weather today was cold and…, a word like sugary would be a highly improbable continuation, whereas overcast and grey are each fairly likely and either one leaves what the sentence means largely intact; normally a random number generator settles which one lands. With watermarking switched on the pick stays random, but the randomness is computed from a secret key together with the words directly preceding the choice rather than from an arbitrary generator. Repeated across the many inconsequential choices in a stretch of output, that imprints a pattern no human reader can see and anyone holding the key can. Anthropic says the marking adds nothing to what users pay and makes no meaningful difference to how good Claude's outputs are or what they say.
Reading the pattern means running the key again: whoever holds it can test whether a text's run of word choices matches what Claude would have picked under that key, and estimate from the fit how likely it is that Claude wrote it. An API for detecting the watermark is coming before long, Anthropic says, with the specifics of how it will be built not yet settled. The company separates all of this from the AI-detection products sold by firms such as Pangram, which hunt for stylistic giveaways in writing; picking out those style patterns, it says, is a different exercise from testing a text for a watermark.
Anthropic's own post sets out where the mark fades. Minor edits are unlikely to strip it out entirely, though a rewrite from scratch that leaves no original word standing will get rid of it — and at that point, the company says, it is arguable whether the text can still be described as AI-generated. Code bears a fainter mark than ordinary prose, since the model has to output code that runs and has little room to choose among options that would all work equally well, and passages of fact thin the marking out too, because fewer alternative wordings are available that would not cost accuracy.
Detection works in one direction only. Anthropic says finding a watermark points to Claude's involvement rather than settling it: the model may have done no more than condense or translate an idea a person had already written. The absence of one does not mean a text was not generated by AI. Because the signal accumulates from small shifts in wording, very short passages, and ones put through paraphrase or rewriting, may no longer show anything detectable.
Researchers outside the company doubt any of this will hold back AI slop. Reese Richardson, a metascientist at Northwestern University, told Nature that removing a watermark from text is easy, running it through a different model being one route, so the marks probably will not deter determined actors from turning out the bogus or shoddy AI-written papers that go by that name. Nihar Shah, a computer scientist at Carnegie Mellon University who studies how science is assessed, said that if AI companies build tools letting outsiders test for the mark, and those tools keep false positives to a tolerable level, certain improper uses of AI would become detectable.
Watermarks might give journal editors and conference organizers a way to police outright bans on AI in peer review, as ICML 2026 did in one of the two review routes it offered: at the July meeting, organizers embedded a mark in the papers sent out to reviewers so that any review report produced with AI would contain giveaway wording, and 506 reviewers were caught breaching the ban. Shah, who was behind the ICML scheme, said the outcome points to a picture in which some improper AI use is handled carefully enough to slip past detection, while plenty of other people simply paste model output straight in.