How Claude's text watermark actually works — and why it's easy to dodge

What is actually being stamped

Large language models write one token at a time. For every next word, Claude scores a long list of candidates and picks the best one. But in everyday prose, several candidates are often equally good. After the sentence "The weather today was cold and", the next word could plausibly be "overcast" or "grey". The meaning is the same either way, so the model resolves the tie with randomness.

Watermarking hijacks exactly these low-stakes coin flips. Instead of an arbitrary random number generator, Claude uses a secret key combined with the few words that came before to decide which of the equally good words to pick. The output still reads as normal, random prose — but anyone holding the key can look at the sequence of word choices and compute the probability that it came from Claude. This is the SynthID-Text method that Google DeepMind published in Nature in 2024, itself a descendant of an idea Scott Aaronson proposed in 2022.

Anthropic is explicit that nothing is added to the text: no hidden characters, no extra tokens, no change in price, no detectable difference to a reader. The company says internal testing and DeepMind's original study found no measurable impact on quality or creativity.

What the watermark can — and cannot — prove

The key limitation is baked into the design. The watermark answers only one question: "How likely is it that Claude was partly involved in writing this?" It does not confirm the text is human-written, and it cannot tell you whether a different model wrote it. Each provider has its own key; an OpenAI or Mistral watermark is invisible to Anthropic's detector.

Confidence also scales with length. A two-sentence snippet has too few word choices to register a reliable signal; a long essay is much easier to classify. And where the text must be exact, the watermark disappears entirely. "Isaac Newton's most famous work was called Principia…" leaves only one right answer, so there is no coin flip to stamp. The same applies to code: once the model has written "2 + 2 =", only "4" will do, and code that must compile leaves little room for arbitrary choices. The watermark lives mainly in comments and other optional phrasing.

How to get around it

Anthropic concedes the basics in its own FAQ. Light editing probably won't remove the signal, but a complete rewrite — where every word is replaced — will. Three practical routes follow directly from the mechanism:

• Rewrite or paraphrase. Run the output through a different model, or rewrite it by hand. The moment the word choices are no longer the ones Claude made, the key stops matching.
• Use an open-weights model. A local Llama, Mistral or Qwen run on your own hardware has no key, no watermark, and no obligation under the AI Act. Switching models is the cheapest and most reliable way to produce unmarked text.
• Keep it short or exact. Short outputs, factual passages and code carry little or no watermark to begin with — the detector has nothing to read.

Translation is a special case. A translation produced by Claude is watermarked, because Claude chose every word. But a translation done by another model, or by a human, carries no Claude watermark at all. The mark does not follow the meaning of the text; it follows the specific word choices.

The harder question: does any of this matter?

Here is the uncomfortable part, and it is worth saying plainly. A watermark that a determined user can erase in minutes will mostly catch people who do not know it exists. The people regulators actually worry about — coordinated disinformation, fraud, impersonation — already have the tools to sidestep it, and they will.

There is a deeper structural problem, too. This marks the beginning of a world where essentially every piece of text and code passes through an AI model at some point. When everything carries a mark, the mark stops distinguishing anything; it only adds friction and, subtly, a stigma. A watermark sends a quiet signal that AI-edited text is somehow suspect — that machine-involved writing is a thing to be wary of. But bad writing existed long before these models, and it will exist long after. A typewriter, a word processor and a pen all produce text, and nobody has ever needed to mark which tool typed it. The quality of the thinking was always the thing that mattered, not the instrument.

None of this is a reason to panic, and none of it is an argument against the AI Act's underlying goal. There are genuine problems — deepfakes, synthetic media, invisible influence operations — that labelling is meant to address. The question is whether an easily removed statistical fingerprint on prose is the right tool for those problems, or whether it mainly creates a compliance checkbox and a false sense of certainty. Anthropic's own honest answers suggest the latter.

What Europe is actually getting

The watermark is not a voluntary feature. Under Article 50 of the EU AI Act, providers must mark AI-generated content, and the obligation began applying on August 2, 2026. Anthropic is one of roughly 190 signatories of the EU Code of Practice on Transparency of AI-Generated Content, alongside Google, Meta, Microsoft, OpenAI and Mistral. Anthropic is rolling the watermark out globally because it has no durable way to scope it to a single region yet. Models launched before August 2 get a transition period, and watermarking will be added to them over the coming months.

For images and other files, the approach is different: Claude attaches a C2PA content credential — a small, cryptographically signed note in the file's metadata — rather than an embedded watermark. A detection API for text is also on the way, though Anthropic says the details are still being worked out. We covered the compliance angle for developers and pipelines when the watermark first went live — what it means for your pipeline.

The bottom line

Claude's watermark is technically elegant and practically almost invisible — which is precisely the problem. It will not catch a motivated actor, it cannot identify other models, and it says nothing about whether a human wrote the text. What it will reliably do is label ordinary, everyday AI-assisted writing as machine-involved, in a world that is rapidly making every piece of writing machine-involved. Whether that is transparency or just theatre depends on what you hoped the mark would accomplish.