Claude’s newest feature? A secret handshake
Anthropic recently announced machine-readable watermarking for Claude text outputs to meet EU AI Act obligations. Here is what is publicly confirmed, what remains unknown, and how LLM text watermarking actually works under the hood.
Beyond Guesswork
For years, identifying text written by an artificial intelligence has felt like chasing shadows. Automated detection tools looked for stylistic quirks or predictability, but they frequently flagged human writing while missing machine output entirely. Anthropic has now taken a fundamentally different path by embedding a machine-readable statistical signal directly inside text generated by supported Claude models [1].
This marks an important transition in generative technology. Instead of relying on external post-hoc classifiers that guess whether a sentence sounds too robotic, the generation process itself leaves a subtle footprint inside the output [2]. The implications touch everything from regulatory compliance to technical architecture, though much of how it works in practice remains intentionally guarded [1].
What Actually Changed
In early August 2026, Anthropic updated its official documentation to confirm that supported Claude models will embed imperceptible, machine-readable watermarks directly into text generations [1]. This decision aligns with compliance commitments under the European Union AI Act transparency requirements, which mandate clear identification of AI-generated content [2].
For the person interacting with Claude, nothing in the user interface appears different [1]. The generated text looks entirely normal, contains no visible labels, and does not alter the meaning or tone of the response [1]. Additionally, where supported file formats are exported, Anthropic includes digitally signed C2PA provenance metadata [3]. While C2PA attaches cryptographically signed headers to files like images or documents, the text watermark lives within the text choices themselves [1, 3]. Anthropic has noted that technical details and detection tools will be released in subsequent updates [1].
What Invisible Watermark Really Means
When people hear the word watermark, they often imagine a translucent stamp on a photo or a hidden string of zero-width Unicode characters pasted into a paragraph. Text watermarking in modern large language models operates on a completely different principle [4]. It is neither a visible tag, nor a secret character code, nor ordinary file header metadata [1].
Instead, an invisible text watermark is a statistical signal embedded in the model token selection process [4]. Token - roughly, a small piece of text or sub-word unit that a language model processes - selection usually follows a probability distribution over thousands of possible next words [4]. When a model generates text normally, it samples from these probabilities based on context and temperature [4]. A watermarking system introduces a deliberate, mathematical bias into those selections according to a secret cryptographic key [4]. To a human reader, the phrasing remains natural and grammatically fluid, but to a mathematical detector holding the key, the specific sequence of choices is far too structured to have happened by random chance [4].
Is Claude Using Green and Red Tokens?
To understand how an LLM can subtly bias its own choices, it helps to examine foundational research in the field. In 2023, John Kirchenbauer and a team of researchers introduced a framework for watermarking language model outputs by partitioning the model vocabulary into pseudorandom groups [4]. Their reference implementation demonstrated how statistical markers could be injected during sampling without corrupting text quality [6].
In simple terms, the Kirchenbauer algorithm uses a hash of the previously generated token to seed a pseudorandom number generator [4]. This generator splits the model full vocabulary into two sets: a green list of favored tokens and a red list of restricted tokens [4]. During generation, the system slightly increases the logit scores - the raw preference values assigned to candidate tokens - for words on the green list [4]. A single green word in a sentence proves nothing. However, across a hundred tokens, an unwatermarked text might contain roughly fifty percent green tokens, whereas watermarked text will lean overwhelmingly green [4]. A detector evaluates this ratio using a standard statistical test, calculating a p-value to determine if the bias is statistically significant [4].
Crucially, Anthropic has not publicly confirmed that Claude uses the Kirchenbauer green token algorithm [1]. The exact token-selection mechanics, key structure, and mathematical thresholds behind Claude watermark remain undisclosed [1]. The Kirchenbauer approach serves as a clear academic blueprint for what text watermarking can look like, rather than proof of Anthropic specific implementation [4].
The SynthID Approach and Multi-Token Tournaments
The classic green-list approach is not the only way to embed statistical signals in generated text. Other modern production systems use alternative sampling mechanics to balance watermark strength, text quality, and detection confidence [5]. For instance, Google DeepMind developed SynthID-Text, an open research and production framework that takes a tournament-based sampling approach [5].
Instead of splitting the entire vocabulary into binary color lists based on the immediate past token, SynthID-Text computes pseudorandom values for candidate token sequences using gumbel keys [5]. It compares candidate tokens through a tournament structure, distorting sampling probabilities in a way that leaves a detectable signal over longer passages while preserving the model target probability distribution [5].
Comparing these research frameworks highlights that LLM watermarking is a broad family of techniques rather than a single fixed formula [4, 5]. There is currently no public evidence indicating that Anthropic uses SynthID or any derivative of it [1]. Discussing SynthID simply illustrates how different teams solve the challenge of maintaining high text quality while injecting robust statistical signals [5].
Can a Text Watermark Survive Editing?
Anthropic states that its text watermark is designed to persist through basic copying, pasting, and light editing [1, 2]. However, the physical reality of statistical watermarking means that signal strength correlates directly with the amount of unaltered text preserved [4].
When you copy text from Claude into a plain text editor, the statistical distribution of token choices remains intact [1]. Minor edits, such as changing a punctuation mark, replacing a word with a synonym, or fixing a typo, remove only a small fraction of the signal [4]. However, heavier transformations present a different challenge. Paraphrasing a paragraph, translating it into another language, or running it through a separate language model alters the token sequence significantly [4]. As original token pairings vanish, the statistical deviation from normal human text diminishes [4]. Academic research shows that while light modifications do not destroy statistical markers, extreme rewriting or mixing short AI snippets into long human essays can reduce detector confidence below statistical significance thresholds [4].
What This Means for Everyday Use
For writers, software developers, and creators working with Claude daily, it is helpful to clarify what this change actually means in practice. First, text generated by Claude does not contain visible branding or public tags [1]. A person reading your document in a standard browser or word processor cannot visually identify a watermark [1].
Second, this does not mean every existing public AI detector will suddenly recognize Claude output [1]. Detection requires specialized tooling and access to the corresponding detection key or verification system [1, 4]. Anthropic has indicated that detection tooling will be made available in the future, particularly for verification needs tied to regulatory requirements [1, 2]. Third, for developers using Claude Code or the API, file-level provenance like C2PA applies to supported media artifacts, whereas text-level statistical signals operate during language generation itself [1, 3]. Watermarking does not impair writing quality, increase latency, or turn ordinary text into a public beacon [1].
Provenance Over Detection
The arrival of embedded text watermarking signals a broader philosophical shift across the artificial intelligence industry [2, 3]. For years, the public conversation focused on post-hoc detection, asking whether an external algorithm could spot AI writing after the fact. That model proved fragile because statistical classifiers without built-in keys suffer from high false positive rates and easily fall behind advancing LLM capabilities [4].
Watermarking and C2PA metadata represent a move toward intentional provenance [3]. Rather than playing endless games of cat and mouse, platform providers build verifiable signals directly into output generation [1, 2]. Yet, watermarking is not a silver bullet [4]. No single technology can solve questions of authenticity, authorship, or academic integrity on its own. As detection tools roll out, the key technical question will not be whether text can be marked, but how transparently and responsibly those signals are verified in the real world [1, 2].