Watermarking AI text: what Claude's watermark proves, and what it doesn't

Anthropic has started putting an invisible watermark into the text Claude generates. The headlines sold it, predictably, as an “AI detector”. The reality is narrower, more honest and more useful to understand correctly, especially if you are in a regulated environment, where the temptation to build policies or accusations on such a signal is high, and the signal cannot bear the weight.

In brief

• What: a statistical watermark on Claude-generated text, active on models created after 2 August 2026, with retrofitting on older ones, applied globally, not just in the EU.
• The driver: compliance with Article 50 of the EU AI Act (disclosure of AI-generated content).
• How: a version of SynthID-Text (Google DeepMind). It adds no hidden characters or tokens; it tilts the choice between plausible words using a secret key, leaving a statistical pattern detectable only with the key.
• For files (SVG, PNG, JPG): not a statistical watermark, but signed C2PA provenance metadata.
• The central catch: it proves that Claude processed the text, not that it wrote it.

How it works

When Claude picks the next word and has several reasonable options, it uses a secret key plus the preceding context to tilt the choice a certain way. Each word on its own looks natural. Over enough text a statistical pattern emerges that only the key holder can read. Nothing visible is added, there are no hidden characters, and the impact on speed and quality is, per Anthropic, negligible.

The practical consequence matters: detection is centralised at Anthropic. You cannot verify a text independently. Without their key, the signal is unreadable to you. That makes the watermark a weak operational tool by construction: it depends on a single holder.

For generated files the mechanism is different and more robust: C2PA, an open provenance standard, attaches signed cryptographic metadata. It is the same family of technology increasingly used for image authenticity. It is hard to forge, but the metadata can be stripped. Robust against forgery, not against removal.

What it actually proves: processing, not authorship

This is the core, and the part most headlines miss. The mark says “Claude touched this text”, not “Claude composed this text”. It doesn’t distinguish between generating from scratch and correcting, translating or reformatting. If you hand your own article to Claude for proofreading, you get back a marked document, even though you wrote it. As proof of authorship, the watermark is worth nothing.

On top of that, the mark travels with the text. A fragment generated or corrected by Claude, then copied into another document, carries the signal with it. It is a tracking angle worth keeping in mind: the signal doesn’t stay tied to the original session.

Where it breaks

• It doesn’t apply where there is a single correct answer: precise facts, exact code syntax. The watermark needs freedom of choice between words.
• Light proofreading weakens the signal. A complete rewrite removes it. Paraphrasing degrades it.
• Short text means unreliable detection.
• The detection API Anthropic is preparing gives a probability, not a verdict.

Why it matters for an organisation

The legitimate value is provenance and transparency: an increasingly regulated requirement (EU AI Act), useful for content traceability. But as an operational tool, the watermark has two traps a professional must not miss.

1. Presence does not mean authorship. A “hit” doesn’t prove fabrication. It can just mean someone corrected their own text with Claude. Building an accusation (academic, HR, editorial) on that is a mistake.
2. Absence does not mean human. Only Claude is marked. Another model, a human, or a rewritten text carry no mark. So the absence of the watermark proves nothing, and removing it is trivial. Any “detect AI by watermark” policy is, by construction, evadable and asymmetric.

What to take away

The text watermark is a tool of weak, verifiable provenance, not a reliable AI detector. For serious authenticity, the sturdier piece in the same announcement is C2PA on files: cryptographic, signed provenance, hard to forge, exactly the “proof, not presumption” pattern that matters in a security context. Treat the text watermark as a contextual signal, never as proof. And build nothing important, neither accusations nor defences, on its presence or absence.

If you are building an AI-content or provenance policy, don’t anchor it on watermarks. Get in touch and we start from what’s verifiable: signed provenance and controls that don’t depend on someone else’s key.

Sources

• TechCrunch — Anthropic says it will watermark text generated by its AI models
• Axios — Anthropic’s text watermarks signal new front in AI detection
• Official Anthropic announcement; SynthID-Text (Google DeepMind, published in Nature); Article 50 of the EU AI Act; the C2PA standard.