Anthropic has announced that Claude models rolling out starting August 2, 2026 will support invisible text watermarks from day one. The company is also working on adding these markers to previously released models. This doesn\u2019t mean that every text currently generated by any version of Claude already includes such a watermark.<\/p>
For supported models, the watermark will be applied globally, regardless of whether you’re using the Claude app, the API, Claude Code or partners’ cloud services. The watermark will be woven directly into the text so it should survive copying, pasting and some later edits. However, Anthropic hasn’t yet published technical details or any tool<\/mark><\/a> that could be used to check for the presence of the watermark. The company has only announced it will release the relevant documentation and a detection mechanism.<\/p> This isn\u2019t the first solution of its kind. As early as May 2024, Google expanded SynthID to cover text generated in the Gemini app and its web version. The system doesn\u2019t insert hidden characters into the file. It influences the probabilities of selecting subsequent tokens, creating a statistical pattern that a detector can recognize. However, Google has cautioned from the start that this method isn\u2019t foolproof<\/a>.<\/mark><\/p> So why the strong reaction to Anthropic’s decision? The issue isn’t limited to people who pass off generated text as their own. The debate centers on what the invisible marker actually confirms and how it will be used by universities, employers, publishers and online platforms.<\/p> Text watermarking is different from a watermark applied to an image. The reader doesn’t see a logo, a symbol or a message. The signal is encoded in the statistical properties of the generated text.<\/p> One of the first researchers to publicly describe this mechanism was Scott Aaronson<\/mark><\/a>, a computer scientist and former OpenAI researcher who worked on the theoretical foundations of watermarking text generated by language models. A model doesn\u2019t pick each subsequent word in a fully deterministic way. It has a set of possible tokens and associated probabilities. A watermarking system can gently favor some of the permissible options without noticeably changing the text\u2019s meaning.<\/p> Over a sufficiently long stretch, a pattern emerges that looks like ordinary text to a reader but can be detected by a tool that knows the method that has been used. Aaronson pointed out that such a scheme could make it harder to pass off generated content as human-written work. Later, he called the theoretical foundations of watermarking language models<\/mark><\/a> one of the most important results of his work on AI safety.<\/p> Google describes its approach in much the same way. SynthID is meant to provide audiences with information about the provenance of content without impacting its readability, accuracy or generation speed. The company doesn’t call it a definitive solution, though. It treats the watermark as one component of a broader system for identifying synthetic media.<\/p> Advocates of labeling agree on this point: as the volume of model-generated content grows, we need tools that can at least partially determine its provenance. But that doesn\u2019t mean that there\u2019s consensus on the interpretation of any trace that\u2019s found.<\/p> Anthropic itself acknowledges that detecting a watermark doesn\u2019t necessarily mean Claude is the author of the entire content. The model might have only fixed the grammar, translated the text, prepared a summary or changed the document\u2019s format. The ideas, data and original wording may have come from a person.<\/p> William Allen<\/mark><\/a>, co-creator of the Content Authenticity Initiative and a contributor to the C2PA standard for digital content provenance, points out the difference between full generation and text editing. In his view, watermarking all text reduces the complex process of text creation to a binary label.<\/p> Allen highlights the difference between using a model as the equivalent of a proofreader and generating the entire piece with a single prompt. A watermark can signal AI involvement, but it doesn\u2019t show its scope. Instead of a simple split between human and AI-generated text, Allen proposes a provenance history for the document that would record each stage of editing and the changes made.<\/p> A similar concern is raised by Federico Germani and Giovanni Spitale<\/mark><\/a>, researchers in information ethics and AI\u2019s impact on content circulation. In their view, information about a text\u2019s provenance doesn\u2019t say anything definitive about its truthfulness, quality or the author\u2019s intent. A piece labeled as AI-generated can be reliable, while an unlabeled text may contain manipulation or false information.<\/p> Researchers warn that a simple label can stigmatize policy-compliant use of tools while also creating unwarranted trust in unlabeled content. In their view, transparency across the entire process matters more than a signal that a model was involved.<\/p> The second part of the debate concerns effectiveness. Anthropic says the mark can survive copying and some editing, but it also lists scenarios where it can disappear or become undetectable. That includes heavy rewriting, paraphrasing, translation, combining it with other texts, and very short passages.<\/p> This isn’t a problem unique to Claude. Google says SynthID works best on longer, more varied content<\/mark><\/a>. A few edits or light paraphrasing might not remove the signal, but a full rewrite or translation significantly lowers detection confidence.<\/p> The system also has less flexibility when answering factual questions. When the model answers a question about a country’s capital or quotes a specific work, the number of correct next-word options is limited. That leaves less room for choices that could encode an additional pattern.<\/p> Alex Cui<\/mark><\/a>, co-founder and CTO of GPTZero, a company that builds tools for detecting AI-generated text, suspects that Anthropic\u2019s solution may be based on influencing the token distribution in a similar way. Anthropic hasn\u2019t confirmed this hypothesis, so it shouldn\u2019t be presented as an explanation of the system\u2019s actual design.<\/p> Cui points out a broader problem. A public detector is needed so users don\u2019t have to rely solely on Anthropic\u2019s statement. On the other hand, such a tool could help test successive versions of a text until the watermark stops being detected. That sets up a classic arms race between watermarking and evasion.<\/p> The mere existence of an imperfect label isn\u2019t especially dangerous on its own. What\u2019s far more important is the consequences attached to the detection result.<\/p> Alexander Nemecek, Yuzhou Jiang and Erman Ayday<\/mark><\/a>, researchers who study the technical and regulatory aspects of watermarking AI content, argue that without common standards, watermarks could become nothing more than a symbol of control. They analyze not only the effectiveness of the watermarks themselves, but also the conditions that must be met for detection to be used reliably in practice.<\/p> In their view, an effective system needs three layers: defined technical standards, an independent audit infrastructure, and mechanisms for accountability and rule enforcement.<\/p> Without them, the provider can unilaterally set the labeling scheme, detection thresholds and how to interpret the result. An external observer won’t be able to assess whether the system works as claimed or how often it makes mistakes.<\/p> A research team including Nemecek and Ayday<\/mark><\/a> highlights another point. Watermark strength depends on the statistical properties of the content, and those vary across languages and user groups. In a review of the key benchmarks, the authors found that almost none report results that account for linguistic, cultural or demographic differences.<\/p> This doesn\u2019t prove that the Claude system performs worse in minoritary languages. However, it shows why tests covering multiple languages are needed before using the output for a student or an employee.<\/p>A trace hidden in words<\/h4>
Who actually wrote this?<\/h4>
What if the watermark isn’t foolproof?<\/h4>
How do we check it?<\/h4>
A judge in their own case<\/h4>