Claude’s New Text Watermark Will Steer Word Choices—and Test Whether Anyone Notices

Anthropic is building a watermark into future Claude text, but it will not be a visible label or hidden file tag. It will be a cryptographic bias in the model’s ordinary word-selection process: subtle enough, Anthropic says, that readers will not notice it, yet structured enough that a checker can estimate whether Claude was involved. The bet is that provenance can be added without changing the writing people receive. That claim is now the central technical and editorial dispute.

The rollout is tied to European Union rules, according to Anthropic’s account. The company says it signed the EU’s Code of Practice on Transparency of AI-Generated Content in July alongside roughly 190 other signatories, and that an EU AI Act requirement to mark generated text took effect on Aug. 2. Another report describes a watermarking requirement beginning in December, leaving the packet unclear on which compliance date governs this specific implementation.

The watermark lives in probability, not formatting

One way to picture the mechanism is a weighted coin, not a stamp. At a given generation step, the model may have several plausible words available. The watermarking system biases selection toward a key-derived set of preferred candidates and away from another set, while still allowing varied results. A detector that has the matching key can inspect the choices over a long passage and assess whether they occur more often than chance would predict.

That design makes the output detectable probabilistically, not conclusively attributable. Anthropic says a watermark cannot identify a particular user, account, or conversation. It is intended only to indicate the likelihood that Claude produced or edited text, and the company plans a separate API for checking whether a passage carries the signal.

The signal gets weaker where language has less slack

What the watermark does not promise

• It does not identify the person, account, or conversation behind detected text.
• It does not provide a strong signal for every kind of output; short, highly constrained passages are a stated weak point.
• It does not necessarily survive major revision. Anthropic says a sufficiently heavy rewrite can remove the watermark.

The editing limit is especially important. The signal reflects words Claude selected, so lightly edited material may retain a trace while extensive rewriting may not. One commentator points to rephrasing tools, including James Padolsey’s Declaude, as evidence that a motivated user could undermine a semantic watermark through recomposition. That is a critique of practical robustness, not evidence that every rewrite will defeat detection.

A quality claim meets a quality objection

John Gruber, the technology blogger, makes the opposing case: a system that nudges token selection cannot guarantee that it always chooses the most precise available wording. His concern is not that a reader will see a literal watermark, but that an added constraint can degrade prose even if the meaning generally survives. Steven Murdoch, a computer-science professor at University College London, disagrees, saying the change would probably have no noticeable impact because the model’s choices remain random, only statistically predictable.

The available evidence does not independently settle that argument. Anthropic’s test results support its claim about measured quality and satisfaction, while the critics identify a conceptual trade-off in any scheme that influences word probabilities. The useful question is therefore narrower than whether watermarking changes language at all: it is whether the imposed bias is large enough to create a meaningful degradation in the outputs users value.

Global compliance creates a wider experiment

Claude will not be alone in using this class of technique. Google DeepMind’s SynthID is described as watermarking images, video, audio, and text; for text, DeepMind says it adjusts token probability scores and does not affect quality. But the systems are not a common detection network. The reported design relies on provider-held secret keys, meaning Anthropic can detect Claude’s watermark and another provider cannot necessarily do so.

The next evidence will come from deployment, not just the mechanism. Anthropic still has to show how its checker presents uncertainty, how reliably the signal persists across routine editing, and whether independent testing replicates its claim of no meaningful quality cost. Its planned API could make the first question more concrete; the global rollout will make the others harder to avoid.