Anthropic is introducing invisible watermarks for text generated by Claude, making it easier to identify AI-generated content without adding visible labels, unusual characters, or other markers that readers can see.
The move comes as the European Union prepares to require AI companies serving the region to mark AI-generated content. Anthropic and several other major AI providers have agreed to follow the EU Code of Conduct, with Anthropic becoming one of the first companies to explain how it will implement watermarking across Claude.
Anthropic confirmed that Claude’s watermark will be invisible to regular users. The company also says the technology will not have a material effect on the quality, readability, accuracy, or creativity of Claude’s responses.
Invisible watermarking and content provenance systems are already used with some AI-generated images. Text watermarking follows a similar concept, although the technical implementation is different.
Although the change is being introduced in response to European AI regulations, Anthropic plans to apply the watermark to Claude-generated text worldwide at launch.
“We don’t yet have a permanent way to apply watermarks regionally, so we’re applying watermarks globally at launch,” Anthropic explained in a blog post.
Future Claude models will generate watermarked text by default. Models released before August 2, 2026, are covered by the EU’s transition period, and Anthropic says it is working to add watermarking support to those models in the coming months.
How Claude’s invisible text watermark works
Anthropic says its watermarking system is based on Google DeepMind’s SynthID-Text approach. The system works while Claude is generating a response, rather than modifying the text after it has been completed.
Large language models generate text by repeatedly selecting the next likely token, such as a word, punctuation mark, or code element. Claude’s watermark changes the source of randomness used during some of those selections.
Instead of using an arbitrary random number generator, the system uses a private key and preceding text to influence which statistically reasonable token Claude selects. The result looks normal to the reader, but a long enough sequence can contain a detectable statistical pattern.
Anthropic describes the process as a series of “risky choices” that occur repeatedly throughout a response. These choices remain indistinguishable from ordinary text to readers, but a detector with access to the correct key can analyze the sequence and estimate whether Claude generated it.
As Anthropic explained:
“The words Claude chooses are still random, but the randomness is different. Instead of using an arbitrary random number generator to choose the next word, watermarking uses a key and some words before it to determine which word the model will choose.”
This approach does not add hidden characters, extra tokens, or visible markers to Claude’s responses. Anthropic also says the watermark has a negligible effect on generation speed.
A research paper published in Nature describes generative watermarking in similar terms:
Generative watermarking modifies the next-token sampling process to introduce subtle, context-specific changes to the generated text distribution. These changes create a statistical signature that can later be measured to determine whether the text was produced by a watermarked language model.
Source: Google DeepMind
When Claude has several reasonable ways to continue a sentence, the watermarking system uses its private key and the preceding words to help select one option. Each decision should appear completely normal, but the combined pattern across a longer response can be analyzed statistically.
Anthropic says internal testing found no meaningful impact on Claude’s creativity, readability, or content. The company also says watermarking does not require additional tokens and does not significantly increase computational costs.
Claude code and factual answers may contain fewer watermark signals
Claude’s watermark will not influence every token equally. Anthropic says the system reduces or avoids watermarking when there is only one factually correct answer or when changing the output could make code inaccurate or unusable.
For example, after Claude generates “2 + 2 =,” the correct next token is clearly “4.” There is no benefit to choosing a different token simply to strengthen a watermark signal.
The same principle applies to programming code. Replacing a required keyword, function, variable, or symbol with another option could cause the code to fail. As a result, executable code may contain less watermarking than ordinary prose.
Anthropic says watermarking may still be applied to areas of code with more flexibility, such as comments or descriptive text, but the impact on functional code should be negligible.
Watermark detection also depends on the length and variety of the text. Longer responses provide more statistical evidence, while highly predictable text gives the detector fewer meaningful choices to analyze.
Short or highly formulaic answers may therefore be more difficult to classify reliably. Similarly, lightly proofreading human-written content with Claude may not produce enough Claude-generated text for dependable detection.
Anthropic says the watermark is applied only to words Claude actually selects. Small changes to grammar or punctuation may not remove the signal, but a complete rewrite that replaces every word likely will.
Translations generated by Claude are expected to contain watermark signals because Claude selects each word in the translated output.
Anthropic is developing a Claude watermark detection API
Anthropic plans to make Claude watermark detection available through an API. The tool will estimate the likelihood that Claude generated or substantially interacted with a piece of text.
However, Anthropic emphasizes that watermark detection is not proof of authorship or identity. A positive result would indicate that Claude may have been involved with the content, but it would not establish whether Claude wrote the entire passage or merely edited it.
Claude’s watermark also cannot identify text generated by other AI systems. Other providers may use different watermarking techniques, private keys, or no watermarking system at all.
Anthropic says a light edit may not completely remove a watermark, while a full rewrite that replaces every word is likely to eliminate the detectable signal. Detection will also be less reliable when only a small sample of text is available.
Claude uses C2PA metadata for AI-generated images
Anthropic takes a different approach with images generated or edited by Claude. For PNG, JPG, and SVG files, the company does not modify the image itself with an invisible pixel-level watermark.
Instead, Claude attaches cryptographically signed C2PA provenance metadata. This metadata can indicate that an image was created or processed by Claude, provided the information remains attached to the file.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com