Claude Now Watermarks Your Text. It Proves Less Than You Think.
Claude marks supported text outputs with an invisible watermark. Detection offers conditional provenance evidence; code robustness and authorship require separate checks.
Anthropic’s marking guide, checked 20 September 2026, identifies supported models and surfaces. It now describes a text-detection private preview for eligible organizations.
Coverage depends on the supported model and surface listed in Anthropic’s marking guide. Consult that list for the current rollout rather than inferring coverage from an undefined launch-date cutoff.
This reads like the arrival of a reliable AI detector. It is not one, and the gap between what it does and what people will assume it does is where all the damage is going to happen.
A detected mark does not prove Claude wrote something — Anthropic says that itself, because people use Claude to edit and translate their own writing. An absent mark does not prove a human did. Almost nobody is going to read the second half carefully enough.
One disclosure before anything else, because it is the honest thing to do in a piece about this: Claude helped draft this article, I edited it, and I take responsibility for the result — like most things on this site. The text verifier is in restricted private preview, so I cannot test whether this published version retains a detectable mark. That is itself part of the story.
What actually shipped
Two different mechanisms for two different output classes, and conflating them is the first mistake available.
Text gets a model-level statistical watermark. Token choices are subtly biased so a detector with the right key can find a pattern across a long enough passage. The text stays readable, and the signal survives ordinary copy-paste. Anthropic says it "may persist through some editing".
Files get C2PA digitally signed provenance metadata — currently for .svg, .png and .jpg. That is a cryptographic signature attached to a file, which is a fundamentally different kind of claim.
The rollout coincides with EU AI Act Article 50, whose transparency obligations became enforceable on 2 August 2026 and which requires machine-readable marking of synthetic output, text included. Anthropic is also a signatory to the General-Purpose AI Code of Practice.
The law is regional. The rollout is global, which is the rational engineering call rather than evidence of universal legal pressure. Watermarking happens at the inference layer. Maintaining watermarked and unwatermarked pipelines would mean a regional branch across Anthropic's own products, its API, and three cloud distribution channels — and then answering which rule applies when the user, the account, the inference region and the downstream app are in four different places. One compliant default worldwide is simply cheaper to operate — though that is my inference about the engineering economics, not something Anthropic has stated.
Update, 20 September 2026: a primary support article is now available, linked above. It distinguishes embedded text marks from signed file credentials and describes restricted detection access. Earlier press-only sourcing is superseded.
How a statistical text watermark works
A language model does not pick each next token with certainty. At every step it produces a probability distribution, and in open prose several continuations are equally acceptable. A statistical watermark turns that freedom into a covert channel.
In a common statistical-watermark design, generation stops sampling straight from the unmodified distribution and instead nudges the model toward certain eligible token choices according to a secret key. Nothing visible is inserted. There is no zero-width character to strip, no hidden HTML, no metadata field. The evidence exists only in the aggregate distribution of choices across a passage.
One token can contribute some statistical information, but usually cannot support reliable detection by itself. Short passages provide fewer observations. The useful threshold depends on the scheme, its error rates and the available sampling freedom.
The lineage is public even if Anthropic's exact construction is not. Kirchenbauer and colleagues described the canonical green-list/red-list approach in 2023: a keyed process splits the vocabulary into favoured and unfavoured sets, generation biases toward the favoured set, detection looks for an improbable concentration of them. Google DeepMind's SynthID-Text, published in Nature in October 2024 and deployed in Gemini, used tournament sampling instead — candidate tokens run through a keyed knockout whose repeated outcomes leave the signature.
Anthropic has not said which family Claude's belongs to. Reporting identifies token-level sampling bias as the mechanism, and that is as far as the public record goes. Mapping any specific published scheme onto Claude's production implementation would be speculation, so I am not going to do it.
Why text is the hard case, and code may be the stress case
Images give you an enormous continuous signal space. Thousands of imperceptible pixel adjustments, no visible difference, plenty of room to carry information.
Text is discrete. The model picks one token or another, and tokens are not interchangeable the way neighbouring pixel values are. Change a word and you may change meaning, tone, factual accuracy, or program behaviour.
And text runs out of entropy fast. The opening of an essay has many acceptable continuations — lots of room to bias. A factual answer requiring a specific name, a JSON object requiring a closing brace, a function call requiring an exact parameter: the set of valid continuations collapses to one. When there is only one correct next token, there is nowhere to hide a mark.
The table identifies possible constraints rather than a ranking of measured detection performance. Code and structured text vary substantially in length, comments, identifiers and implementation choices. No Claude-specific comparison by content type is established here.
A watermark depends on information carried in the output. When a task allows few valid choices, there may be less signal to work with, but patch length alone does not establish reliability. Claude-specific measurements are needed for the task and transformation being evaluated.
What this means if you use Claude Code
Code is a varied test case: a tiny constrained patch and a long implementation do not offer the same sampling freedom.
Syntax, APIs and repository conventions constrain some choices. Comments, identifiers and alternative implementations may leave others open. Measure detection on representative code before ranking it against prose.
Then the toolchain goes to work on whatever signal survived. Formatters normalise whitespace, quoting, import order and line breaks. Linters rewrite constructs. Refactoring renames identifiers. Compilation produces a different artifact entirely. Every one of those tools is designed to preserve behaviour, not a token sequence, and on most teams several run automatically on save or in CI. How much of an undisclosed scheme's signal they take with them is unknown — no code-specific robustness study is cited here.
Test short patches, structured formats and longer implementations separately; no Claude-specific reliability ranking is established here. Security sensitivity is not itself a measure of watermark signal. Do not treat the mark as dependable production-code provenance without validation for the relevant workflow.
Your provenance controls stay where they already were: review, tests, static analysis, ownership, traceable commits. A statistical watermark neither validates code nor identifies who is accountable for shipping it. That was already the job of the verification layer.
The asymmetry, stated precisely
A watermark detector assesses evidence of a particular generation or processing path. It does not by itself decide authorship or misconduct.
A positive would mean a passage contains a statistical pattern consistent with Anthropic's watermark under the detector's assumptions — and even that needs qualification while false-positive rates, accuracy and minimum passage length remain unpublished. Anthropic states plainly that detection does not prove Claude authored the content, because people use Claude to edit and translate their own writing. Someone can supply the argument, the structure, the facts and most of the wording, ask for a light edit, and receive marked output.
The negative direction is far weaker, and it is the one that will hurt people. A detector can fail because the text is human-written — or because the passage is short, because it is low-entropy, because it was substantially rewritten or translated, because the tested representation is not the original text, because it came from a model not yet retrofitted, or because it came from an entirely different system. An absent mark alone does not establish human authorship.
A positive can be strong evidence of contact with a marked generation path when its validated error rate and test conditions support that inference. A negative can also be informative within a validated detection regime. Neither result alone establishes human authorship, absence of AI assistance or wrongdoing.
This is not C2PA, and the difference matters
C2PA gives the stronger verification while the manifest is attached, because a verifier checks a cryptographic signature rather than estimating a pattern — though what it verifies is the signed provenance record, not the truth of every claim in it. And it is metadata, not an indelible mark inside the content. The text watermark trades that attachment for portability: it survives plain copy-paste because the words themselves carry it. The price is probabilistic detection whose characteristics are unpublished.
Neither should be described as permanent. Both regularly will be.
If you publish AI-assisted writing
Consult Anthropic’s marking guide for current model and surface coverage before relying on any marking behavior. Keep records of authorship, sources and editing decisions separately; a detector alone cannot reconstruct how a document was written.
If authorship matters for your work, keep the actual record: drafts, version history, sources, review notes, an honest account of how the model was used. And if you write an editorial policy, define the conduct rather than the tool. "Any contact with Claude", "Claude-generated first draft", "substantive machine-written passages" and "grammar correction" are four different things, and no statistical mark can tell them apart.
Verbatim reuse preserves the signal through copy-paste. Deliberate rewriting may weaken or remove it — Anthropic's public wording is only that the mark "may persist through some editing", and no robustness data by transformation is cited here.
So this is a plausible incentive problem rather than a demonstrated one-step bypass. If it holds, the cooperative user carries the artifact more reliably than the adversarial one — an odd property for a system institutions will want to point at misconduct. And note the wrinkle: paraphrasing through a covered Claude model could simply apply a fresh mark.
Schools and employers are where the harm lands
Text detection is now in restricted private preview. The institutional risk remains: a probabilistic result can be mistaken for a complete account of how a document was written.
A detected mark could come from translating or editing the person's own work. The false-positive rate is unpublished. The degree of Claude involvement cannot be reconstructed from the signal. And an absent mark is no defence either — the text may have been rewritten, translated, screenshotted, or generated by a model or surface outside the documented coverage.
Using either result as proof would create a straightforward due-process failure. Someone accused would have real difficulty challenging a detector whose error rate, threshold and minimum passage length are undisclosed, and the institution cannot honestly explain what the result establishes, because the mechanism does not establish authorship. This is the measure-becomes-the-target failure with someone's degree or job attached to it.
A watermark result should never be sole evidence for discipline, rejection or termination. Drafts, version history, sources, an oral explanation and the precise policy allegedly breached are all better evidence, and all of them existed before this shipped.
What would make this useful rather than theatre
Marking and detection serve different purposes. A provenance signal can support an investigation when its limitations are known; it should not be promoted into an authorship oracle.
Four uncomfortable conclusions
One. Interpret both outcomes against validated error rates, passage length and transformations. A negative outside those conditions cannot establish human authorship.
Two. Short, tightly constrained passages can offer little statistical evidence. A categorical claim that code is always the weakest case needs measurement.
Three. Editing or paraphrasing may weaken a mark, but a guaranteed one-pass bypass has not been demonstrated here. Rewriting through a marked model may introduce another mark.
Four. Restricted detector access is progress, but broad decisions still need published error characteristics and independent evaluation. A rollout announcement is not a validation report.
Treat it as what it currently is: a signal that may survive one generation path and some subsequent handling. Not proof of authorship, originality, intent, misconduct or innocence. Anything stronger is confidence the mechanism has not earned yet.
