Anthropic watermarks Claude’s text with an invisible SynthID-Text signature

August 14, 2026. Anthropic lays out, in a blog post, how it will mark text generated by Claude. August 2, 2026. That is the cutoff: models launched before that date fall under the EU AI Act’s transition period. In between. The invisible watermark becomes a technical reality, not just a legal one.

The driver is regulatory: the EU’s AI Act requires providers serving the bloc to mark AI-generated content so it can be identified. Anthropic, a signatory to the Code of Practice, is one of the first to explain how it will do it. Its chosen method, Google DeepMind’s SynthID-Text, does not add hidden characters to finished text — it alters how words are chosen during generation.

A European obligation that becomes a global feature

The most instructive line is one sentence from Anthropic: “We’re applying watermarking globally at launch because we don’t yet have a durable way to scope it by region.” In other words, a constraint designed for the European market ends up applied to every Claude user, wherever they are.

That is technically logical: a watermark built on word choice cannot be cleanly switched on or off by the requester’s geography while user location remains unreliable. The practical result is that a European watermark becomes, in effect, a global standard.

Models launched before August 2, 2026 remain covered by the EU’s transition period; Anthropic says it is working to add watermarking to them “over the coming months.” Future Claude models will generate watermarked text by default.

What the AI Act actually requires

Article 50 of the EU AI Act requires providers of generative AI systems to mark outputs — text, image, audio, video — in a machine-readable format and to make them detectable as generated or manipulated. The text deliberately leaves the method open; it is the Code of Practice signed by providers that pins down the technical details.

Anthropic chose statistical watermarking for text and C2PA metadata for images. The split is not accidental: text has no container in which to store signed metadata, unlike PNG or JPEG. Hence a watermark that acts at generation time, on token choices, rather than after the fact on the bytes.

How the watermark works without adding anything to the text

The principle, inherited from SynthID-Text, rests on how a language model works at all. Claude generates text by repeatedly choosing the most plausible next token from several options. Most of those choices are loosely constrained: several words would fit equally well.

The watermark changes the source of randomness in those choices. Instead of an arbitrary random number generator, the system uses a secret key and a few preceding words to break ties between options. Each choice remains indistinguishable from a normal one on its own, but the full sequence leaves a statistical fingerprint.

“Watermarking uses low-stakes choices like these — which occur many times over a piece of generated text — to leave a pattern in Claude’s responses. That pattern is undetectable to the reader, but detectable to anyone who has the key that encodes it,” Anthropic explains. Nothing is added to the text, no hidden characters, no extra tokens, and the effect on generation speed is negligible.

There is a deliberate exception: exact outputs. Where only one answer is correct — a sum, a fact, a piece of code that would break if a term were swapped — the watermark is not applied. “Once the model has written ‘2 + 2 =’, there is a very clear best choice for the next token,” the company notes. Code, which often must be exact, therefore carries less watermarking than prose, except in its arbitrary parts such as comments.

The limits: what a watermark does not prove

Anthropic is remarkably clear about what the technique cannot do. The watermark only applies to words Claude actually chooses: light proofreading — a few grammar fixes — can leave too little material for reliable detection. A complete rewrite, replacing every word, erases it. The SynthID-Text paper formalizes this: detection reliability grows with text length and the entropy of the distribution — the more freedom the model has, the sharper the signature.

Detection is therefore probabilistic, not forensic. The upcoming detection API announced by Anthropic will “estimate the likelihood that Claude was involved in writing a piece of text” — which is not the same as proving who wrote it. It cannot tell “Claude wrote this” from “Claude heavily edited this,” nor identify text from another model — each provider uses its own method and its own key.

For images (PNG, JPG, SVG), Anthropic takes a different route: cryptographically signed C2PA provenance metadata stating the file was created or processed with Claude, rather than a watermark embedded in the pixels.

In practice, this makes a watermark a triage tool, not a verdict. A publisher who sees a strong watermark signal can prioritize review; a detector that returns a weak or negative signal proves nothing either way. The value sits in the middle — separating likely-generated from likely-human at scale — not at the edges, where rewrites, translations, and short snippets blur the boundary.

A provenance ecosystem building in parallel

Anthropic is not alone in this space. Google DeepMind built SynthID for images, video, and now text; OpenAI has announced its own provenance standards; and the Coalition for Content Provenance and Authenticity (C2PA) promotes signed metadata that follows a file from creation to distribution — which is why Anthropic reuses C2PA for images.

The convergence settles on a common principle: add nothing visible, tie the mark to a key, and measure a probability rather than assert a certainty. It is an architecture of probabilistic trust, very different from a digital tattoo or a hash — which is exactly why its limits must be understood by those who will rely on it.

Verdict

If you publish or moderate content, treat the watermark as what it is: a probabilistic provenance signal, useful for triaging or prioritizing content, but insufficient to ground an accusation or an automated decision. Editing, translation, and rewriting degrade the signature, and a negative result does not prove AI was absent.

If you deploy or consume models, note that the cost is near zero and the rollout global: this is a compliance standard arriving by default. Do not build legal or forensic processes on watermark detection alone — it measures a likelihood, not a certainty.

The deeper signal is that provenance for generated content is entering its industrial phase: from a European obligation, it becomes a default feature of frontier models. The open question is whether readers will know how to read a signal that, by design, remains statistical rather than conclusive.

References

• BleepingComputer — How Anthropic plans to watermark Claude’s AI-generated text, August 14, 2026
• Google DeepMind — SynthID-Text (Tournament sampling), accessed August 16, 2026
• Anthropic — blog post cited by BleepingComputer on Claude watermarking, accessed August 16, 2026