How Claude text watermarking works

What Claude text watermarking is

Claude text watermarking is a bias applied while the model picks words. It is not a tag attached to the file, and it is not a run of invisible Unicode characters you could strip with a regular expression. Anthropic describes it in How Claude's text watermarking works, dated 14 August 2026: the scheme "only changes the source of the randomness used to pick among words", using a secret key plus the few words that came before. Because the mark lives in which words were chosen, it survives copy and paste, and it dies when the words change.

Two things follow, and they are why people search for this topic. Detection is a statistical test that needs a lot of words before it means anything, so it can say nothing useful about a single sentence. And a negative result proves nothing: Anthropic's help centre states that a "lack of a detected mark doesn't mean the content wasn't AI-generated or processed".

The help page How Claude marks AI-generated content, read on 18 August 2026, lists the surfaces it covers: "Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag", including access through AWS, Google Cloud and Microsoft Foundry. Models launched on or after 2 August 2026 support machine-readable marking at launch, and earlier models are described as in progress. That date is not a coincidence. Article 50 of the EU AI Act applies from 2 August 2026, and it requires providers of systems generating synthetic text to mark the output "in a machine-readable format and detectable as artificially generated or manipulated". Anthropic says it applies the marking worldwide rather than only to EU traffic.

Files work differently. The help page says supported generated files (".svg, .png, or .jpg") carry cryptographically signed provenance metadata following the C2PA (Coalition for Content Provenance and Authenticity) standard. That is metadata attached beside the file contents, not a change to the contents, which is why it comes off so easily.

How the watermark biases token choice

At each step a language model produces a probability for every token (a token is a word or a piece of one) it could write next. A sampler picks one, and normally the randomness for that pick comes from an ordinary random number source. A watermarking sampler replaces that source with a keyed pseudorandom function. Its inputs are the secret key and the last few tokens, so the choice is reproducible by anyone holding the key and looks like ordinary variation to everyone else.

The first widely cited public version is A Watermark for Large Language Models (Kirchenbauer et al., ICML 2023). Before each token, the key and the preceding tokens select a pseudorandom "green" subset of the vocabulary, and the sampler adds a small bonus to the score of those tokens. Nothing is forbidden, so the text stays fluent, but green tokens turn up a little more often than chance allows.

Anthropic's post says its implementation is based on SynthID-Text, published by Google DeepMind in Nature in October 2024 as Scalable watermarking for identifying large language model outputs, and that this family of ideas goes back to a 2022 proposal from Scott Aaronson. SynthID-Text draws several candidate tokens from the model's own distribution and runs a knockout tournament between them, scored by the keyed function, so the surviving token tends to be one the key favours. The candidates come from the model's own distribution, which is the reason the published evaluation reports no measurable loss of quality.

The consequence that matters is entropy. The bias only has room to work where the model had a real choice. If the only correct next token is Paris, no scheme can move it without making the text wrong. Anthropic states this directly: watermarking "is sparser on factual passages where there are fewer choices that can be made without decreasing the accuracy of the text", and code "has generally less watermarking than some other forms of text" because it usually has to be exact. Signal density tracks how free the model was, so a long piece of open prose carries a strong mark while a short factual answer carries almost none.

One honest limit on all of the above. As of 18 August 2026, Anthropic has published the family its scheme belongs to, not the parameters or the detector threshold. The mechanics in this section come from the cited papers. Read them as the published design Anthropic names, not as a description of Claude's exact configuration.

Why detection is a hypothesis test, not a stamp

A detector takes the text and the key. It walks the text, recomputes what the key would have favoured at each position, scores each token, and adds the scores up. The null hypothesis is that the text was written without that keyed sampler: then the scores behave like coin flips and the total sits near its expected value. Watermarked text drifts above it. The output is a p-value, which is the probability of seeing a total that high from unwatermarked text, and a "detected" verdict is that p-value compared against a threshold somebody chose.

That design has two effects you feel in practice. Confidence grows with length, because each extra token is one more weak piece of evidence. Anthropic puts it this way: "Detecting a watermark also doesn't work well on small samples, where there are fewer word choices and thus less information to go on." The threshold is also a trade. Set it low enough to flag a paragraph and you will start flagging human paragraphs by chance.

You cannot run this test yourself yet. Anthropic's post says it "will soon be offering a watermark detection API" and is "in the process of working out the details of its implementation". So as of 18 August 2026 there is no public Claude watermark detector, and nobody outside Anthropic can confirm or refute a claim that a given passage carries the mark.

That gap matters because of what people reach for instead. The commercial "AI detectors" sold to schools and editors are classifiers trained on writing style. They hold no key and run no test of this kind. Their failure mode is documented: GPT detectors are biased against non-native English writers (Liang et al., Patterns, 2023) found that widely used detectors flagged more than half of a set of TOEFL essays by non-native writers as AI-generated, while classifying native-writer samples correctly. A watermark detector and a style classifier are different machines. Do not let anyone hand you the second while calling it the first.

What removes the watermark

Short outputs. A one-line answer holds too few decisions to move a statistic. There is no fix, because this is a property of the test rather than a gap in the implementation.

A rewrite. Anthropic says light editing may leave the mark readable, while "a complete rewrite where every word is replaced" removes it. Every word you replace is a word the key can no longer explain.

Paraphrase through another model. A second model re-chooses every token with its own sampler and no key, so the result carries that model's mark, if it has one, and not Claude's.

Translation, with one exception. Running Claude's English through a different translator destroys the signal, because a new sampler picks every target word. Anthropic notes the case that runs the other way: "A translation produced by Claude carries a watermark, because in this case every word is chosen by Claude."

Code, mostly. Correct code offers few interchangeable choices. TechCrunch reported on 15 August 2026 that Anthropic expects "a negligible effect on the actual code produced", with marks more likely to appear in comments. That is a press report of a company statement rather than published documentation, so treat the detail about comments as unconfirmed. Comments and identifier names are the parts of a patch with real room for choice.

Metadata stripping, for files. C2PA provenance sits beside the image data, so anything that re-encodes the file usually drops it unless told to keep it. That includes the image optimiser in a normal static site build. Anthropic's help page lists metadata stripping among the reasons a mark goes missing.

What a detected mark actually proves

Less than the word "watermark" suggests. Anthropic's post is blunt: "A watermark can only determine that Claude was likely involved with the content at some point. It cannot distinguish 'Claude wrote this' from 'Claude heavily edited this.'" The help page adds that "Claude may not be the original author", because people use Claude to edit writing they produced themselves, and that content may have changed after Claude touched it.

Nothing in Anthropic's published material describes a per-account or per-user signal. The mark, as documented, indicates that a Claude model was involved. If someone tells you a watermark reveals which user or which API key produced a passage, that claim is not in the primary sources as of 18 August 2026.

Does this change publishing AI-assisted code from your server?

For code, the technical answer is mostly no, for two reasons already given: the signal in exact code is weak, and no public detector exists. What decides whether you may publish is policy, and policy has not changed. Open source projects have written their own rules for AI-assisted contributions, and those rules are enforced by a maintainer reading your pull request, not by a detector reading your tokens.

For prose your server generates, the answer is yes, in one specific way. If an API call writes your release notes or your product pages, the words are Claude's, so the mark is in them. Rendering markdown to HTML, minifying, storing the result in Postgres, and serving it from a CDN all leave the words alone, so all of them leave the mark alone. What degrades it is a human editor rewriting the sentences.

You cannot prompt the watermark away. It is applied in the sampling layer, underneath the text the model produces, so an instruction like "do not watermark this" has nothing to act on. That is a different situation from the ordinary reasons an agent ignores an instruction you wrote, where the instruction did reach the model and lost to something else. There is no documented opt-out for API customers as of 18 August 2026.

If you use Claude to run a server rather than to write for you, this changes very little. Shell commands and config snippets are short and constrained, so they hold almost no signal, and nothing about marking affects what runs on your box. Day to day sysadmin work with Claude raises a different question, which is what leaves your machine in the first place: see what a coding agent actually sends off your server.

What you should disclose

Disclosure is a rules question, not a detection question. A watermark does not create a duty to disclose, and it does not discharge one. Work out which rule binds you, then follow it whether or not anything could catch you.

The EU AI Act splits the job in two. Article 50(2) puts the marking duty on the provider, which is Anthropic, and that is the obligation this rollout meets. Article 50(4) puts a duty on the deployer: whoever publishes AI-generated text "to inform the public on matters of public interest" must disclose that it was artificially generated. It carries an exemption that most publishing teams sit inside, where "the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication". Both apply from 2 August 2026. A reviewed post with a named editor behind it is treated differently from a feed that publishes without a person reading it. This is a reading of the text of the regulation and not legal advice.

Other rules reach further than the law does. Your employment contract, your client agreement, the contributing guide of the project you send patches to, and the policy of the publisher you write for can each demand more. They are also the rules somebody will actually check.

When you do disclose, say what the model did and what you verified. "Draft written with Claude, every command run on a clean Ubuntu 24.04 install before publishing" tells a technical reader something real. A generic "AI was used" badge does not, because the part a model cannot do for you is the checking.

And do not use a watermark result as an accusation. A positive result says a Claude model was involved somewhere, including as the editor of someone's own writing. A negative result says nothing at all.

FAQ

Can I turn off Claude's text watermark?

No documented opt-out exists as of 18 August 2026. Anthropic's help page describes marking across Claude, the Claude Platform (API), Claude Code, Claude Cowork and Claude Tag, including access through AWS, Google Cloud and Microsoft Foundry, and it names no setting to disable it. Asking the model not to watermark its answer also does nothing, because the mark is applied by the sampler that chooses tokens, not by the model following your instruction.

Does the watermark show up in code Claude writes?

Barely. Watermarking works by choosing between options that are all acceptable, and correct code rarely offers many. Anthropic says code "has generally less watermarking than some other forms of text" because it usually has to be exact. TechCrunch reported on 15 August 2026 that Anthropic expects a negligible effect on the code itself, with marks more likely in comments, which is a press report of a statement rather than published documentation. The parts of a patch with room to vary are comments and identifier names.

If a detector finds no watermark, does that prove a human wrote it?

No, and this is the most common mistake people make with watermarks. Anthropic's own page says a "lack of a detected mark doesn't mean the content wasn't AI-generated or processed". The text may be too short to test, it may have been edited or paraphrased, it may come from a model released before marking shipped, or it may come from another vendor entirely. The test is one-sided: it can raise confidence that Claude was involved, and it can never show that Claude was not.

Does paraphrasing or translating remove the watermark?

Paraphrasing through another model removes it, because that model re-chooses every word with its own sampler and no key. Translating with an outside tool removes it for the same reason. The exception runs in the other direction: Anthropic says "a translation produced by Claude carries a watermark, because in this case every word is chosen by Claude", so translating your own writing with Claude adds a mark that was not there before.

Can I check a document for a Claude watermark myself?

Not yet. Detection needs the key, so it cannot be done by reading the text or with any offline tool. Anthropic says it "will soon be offering a watermark detection API" and is still working out the details, so as of 18 August 2026 there is no public detector. Anything sold today as a Claude detector is a style classifier, a different mechanism with a documented false positive problem on writing by people whose first language is not English (Liang et al., Patterns, 2023).