Loading page…
Anthropic says readers will not see a difference, but its approach makes word selection part of an AI-detection system—and raises a harder question about what counts as a low-stakes change in generated prose.
Listen to this story
Anthropic plans to add provenance signals to future Claude responses by steering otherwise plausible word choices through a secret-keyed process. Detectors would look for the resulting statistical pattern rather than a label or embedded character. Anthropic says internal tests found no impact on content, creativity, or readability, but critics question whether supposedly interchangeable words can alter tone or meaning.
Claude’s watermark would be statistical: preceding words and a secret key influence choices among plausible continuations.
Anthropic says readers will not notice a difference, but watermarked and unwatermarked responses will not use identical wording.
Google’s SynthID study analyzed roughly 20 million Gemini responses and found a 0.01% thumbs-up-rate difference.
Anthropic plans to mark future Claude output without appending a label, inserting hidden characters, or changing the text in a way readers can spot. Instead, it will steer some of the model’s choices among plausible next words, leaving a detectable pattern across the response. The method turns ordinary word selection into part of the system for identifying AI-generated text.
The design starts from a common language-model condition: several possible next words can fit a sentence. Anthropic says watermarking changes the source of randomness used to choose among those options. Rather than relying on an arbitrary random-number generator, the system uses a secret key and words that came before to influence the selection.
Anthropic illustrates the mechanism with a sentence beginning, “The weather today was cold and….” It says words such as “overcast” and “grey” may both be plausible continuations, allowing the watermarking process to shape the random choice. The company says those low-stakes decisions accumulate over a response into a pattern readers cannot see.
The result is not a single marker embedded in a document. Anthropic says a detector can inspect a sequence of words and assess the probability that it is consistent with selections made using that key. Watermarked and unwatermarked versions can therefore contain different eligible wording, even as Anthropic says readers will not be able to distinguish them.
Nothing is added to the text and there are no hidden characters.
Anthropic, as quoted by 404 Media
Anthropic says its internal testing found no effect on Claude’s content, creativity, or readability, and that watermarked responses are indistinguishable from unwatermarked ones to readers. That is a company performance claim, not a claim that the two versions contain identical language: the mechanism deliberately changes which eligible words appear.
The distinction matters because “indistinguishable” is a practical threshold for a detection tool, while writers may use neighboring words for differences in tone, rhythm, implication, or precision. 404 Media argued that Anthropic’s description treats choices it calls low-stakes as more interchangeable than they can be in actual writing. The criticism is about the premise of the system, not whether a hidden character was inserted.
Anthropic’s approach is based on research by Google researchers behind SynthID, a watermarking tool. In the SynthID study cited in the discussion, researchers analyzed about 20 million watermarked and unwatermarked Gemini responses and found a 0.01% difference in thumbs-up rates. That result supports a narrow usability signal from the evaluated feedback measure; it does not settle the more subjective dispute over how altered wording affects style or meaning in a particular passage.
The study’s large-scale measure was product feedback: it routed a random fraction of queries to a watermarked model and compared Gemini users’ thumbs-up and thumbs-down responses with an unwatermarked counterpart. It also used side-by-side human assessments of watermarked and unwatermarked text for quality. Those tests address whether users notice a general quality difference, not why a particular word was selected in a particular sentence.
Anthropic’s proposal therefore puts two evaluations alongside one another: whether its keyed process can identify Claude-like word sequences, and whether altered selections change readers’ experience of the prose. The company says its internal testing found no impact on content, creativity, or readability. Its critics dispute whether reader-level indistinguishability is a sufficient standard for writing.
Story updates
Claude’s invisible text watermark earned an enthusiastic endorsement from AI-detection researcher Mustafa Ocal in an October 1, 2026 interview with FIU News. He argues that its hidden word patterns make it difficult to spot or remove. But Anthropic draws a crucial boundary: detecting a watermark signals possible Claude involvement, not conclusive proof of authorship.
Ocal, a professor at FIU’s Knight Foundation School of Computing & Information Sciences, calls the approach “brilliant.” His assessment follows weeks spent examining Anthropic’s publications and talking with industry colleagues. The interview offers his analysis of the system, rather than results from an independent test of Claude’s detector.
The system predates the interview: Anthropic published its technical announcement on August 14. Its marking commitments cover Claude models launched in the EU on or after August 2, 2026, with support for earlier models still being added. Although tied to the EU AI Act, the policy applies to supported models worldwide, including through Claude apps, its developer platform and cloud partners.
Ocal’s central point is that the watermark is not a visible writing habit. Looking for em dashes or familiar “AI words” will not reveal it, he says. Instead, a scanner checks whether word choices form a pattern that would be unlikely to appear by chance across a sufficiently long passage.
Anthropic’s August 14 technical explanation describes a version of Google DeepMind’s SynthID-Text method. When several words could express essentially the same meaning, a secret key and preceding words shape the random choice. A detector checks whether the resulting sequence fits that key. Nothing is appended to the text, and no hidden characters are inserted.
That separates watermark checking from commercial AI detectors, which look for differences between human and machine writing. Those services do not have Anthropic’s key. Their search for stylistic clues is fundamentally different from checking a pattern deliberately created during generation, the company explains.
The mark also is not a user-tracking tag. Anthropic says it carries no information identifying a person, organization or chat. The company says watermarking requires no extra tokens—the units used to measure model output—and has negligible impact on speed, without increasing the price to serve or use the model.
A watermark can only determine that Claude was likely involved with the content at some point. It cannot distinguish “Claude wrote this” from “Claude heavily edited this.”
Ocal says removing the mark from long text would require heavy editing or rewriting because people do not know which choices carry it. He also says light proofreading is unlikely to introduce a detectable mark. Anthropic’s explanation supports that distinction, while identifying several situations where detection becomes weaker:
Short passages contain fewer word choices, leaving less information for the detector.
Factual text leaves fewer opportunities to choose alternative words without sacrificing accuracy.
Light edits probably will not erase the mark completely, but a rewrite replacing every word can remove it.
A negative result therefore cannot certify that writing is human-made. Anthropic cautions that failure to detect a mark does not prove content was never generated or processed by AI. Its detector also cannot identify text produced by another AI system simply by checking for Claude’s watermark.
Ocal emphasizes that readers cannot inspect the mark themselves. Anthropic’s current guidance says text detection remains in private preview for eligible organizations, including regulators, law enforcement, media, fact-checkers, researchers and educational groups. Enterprises with relevant EU compliance obligations can also qualify. Anthropic says it plans to broaden access over time.
Files use a separate mechanism. Supported generated files, such as PNG and JPEG images, receive signed metadata called C2PA Content Credentials, recording Claude’s involvement. Anthropic offers a free Claude Content Checker for those credentials. Unlike the text pattern, file metadata can be stripped by conversion, re-saving or screenshots, leaving no detectable credential.
anthropic.comLoading discussion...
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.