How Anthropic’s Claude Watermark Works: A Technical Deep Dive

Anthropic released an FAQ to answer common questions about the watermark applied to Claude’s generated text.

The watermark is introduced to comply with the EU AI Act; other major model developers have signed the same code of conduct and will implement similar watermarks.

The watermark does not affect Claude’s output quality or content.

Readers cannot distinguish watermarked from non‑watermarked text.

No extra characters or hidden symbols are added to the text.

The watermark requires no additional tokens and incurs no extra cost.

The watermark cannot be traced back to a specific individual, organization, or conversation.

To understand the watermark, one must first know that large language models generate text token by token, selecting the most probable next word from a candidate list. When multiple candidates are equally plausible, the choice is determined by a random number.

The watermark replaces that random source with a key + previous‑context deterministic random generator . The model still randomly picks between equally likely words (e.g., “overcast” vs. “grey”), but the entire sequence of choices follows a hidden pattern that only someone possessing the secret key can verify, yielding a likelihood that the passage was generated by Claude.

An illustrative analogy compares the process to a Monopoly‑style game where dice are replaced by digits of π starting at position 1,012,845; the gameplay feels unchanged, yet anyone who knows the π sequence can later confirm the game’s randomness source.

The method is not Anthropic’s invention. Claude uses a version of Google DeepMind’s 2024 SynthID‑Text paper published in Nature , which traces back to Scott Aaronson’s 2022 proposal. The core design principle remains: only the source of randomness changes, not the model’s word‑selection behavior .

Limitations of the Watermark

The watermark’s strength grows with the amount of text Claude generates; the fewer words available for the watermark to embed, the harder it is to detect. Short texts provide insufficient token choices for reliable detection. Fact‑heavy paragraphs offer limited lexical alternatives, making the watermark sparse (e.g., after “Isaac Newton’s most famous work was called Principia…”, the next token is forced to “Mathematica”). Code, which requires precise tokens, similarly lacks watermarkable space, except in free‑form comments.

Another key limitation is that the watermark cannot distinguish between text originally written by Claude and text heavily edited by Claude. It can only answer whether Claude possibly contributed; it cannot confirm human authorship or identify text generated by other AIs, because each model uses its own secret key and method.

Light editing does not remove the watermark, but a full rewrite can erase it, raising the question of whether the resulting passage should still be considered AI‑generated.

Future Outlook

Starting August 2 2026, every long‑form passage generated by Claude will carry this invisible, hard‑to‑remove watermark.

Community reactions compare Anthropic’s approach with recent watermark implementations from other AI models.

How Claude's text watermark works
https://www.anthropic.com/news/claude-text-watermark