Does Claude Watermark Text You Wrote Yourself? Mostly Not

Executive Summary

• The watermark attaches only to words Claude picked, so lightly proofread human writing carries little or nothing to detect.
• It works by changing the source of the randomness Claude uses to choose between equally good words, not by pushing it toward particular words.
• Anthropic says nothing is added to the text, there are no hidden characters, no extra cost, and no information that could identify a user, an organisation or a chat.
• Code and factual statements carry less of it than ordinary prose, because exact answers leave no free choice for the mark to use.
• The fears that survive: no opt-out, no published error rate, no appeals route, and no answer on how much Claude-written text inside a human document is enough to trigger a detection.

What people thought it meant

The reaction to the first announcement was fast and mostly technical. Two claims dominated, and both turned out to be wrong.

The first was that a mark hidden in text must be made of hidden characters. On Hacker News, one commenter concluded that either there were “non printable Unicode characters, or the word choice is biased, and the Anthropic statement is lies.”

The second was that nudging word choice must damage the writing. In r/ClaudeAI, u/ChocolateGoggles wrote that it “sounds like an absolute lie that it won't change the meaning, quality or readability of its response.” u/kurthertz agreed there was “no way it can embed a watermark in the arrangement of words without it affecting meaning and readability.”

• u/againey framed the engineering problem fairly: it is “hard to design a watermark scheme that is simultaneously obvious and tamper-resistant while also not degrading the quality”
• The thread titled “Claude will watermark generated content, thank you EU” drew roughly 3,600 upvotes
• A separate r/Anthropic thread on the same topic drew around 620
• Across the threads sampled, reaction ran roughly seven to two against
• Some users said they had cancelled subscriptions, and a term for undisclosed AI use, “Claudefishing”, started circulating in the same week

How the Claude watermark actually works

Anthropic's explanation is more specific than the original announcement, and it rules out both theories above.

A model writes one word at a time, picking from a list of candidates. Often several are equally good. After “the weather today was cold and”, either “overcast” or “grey” works, and the choice between them normally comes down to a random number. The watermark replaces that random number. Instead of an arbitrary source of randomness, Claude uses a secret key plus the preceding words to settle which of the equally good options it takes.

The important part is what this does not do. It does not make Claude prefer any particular word, and it does not push it toward words it would never have used. Anthropic's own framing is that the watermark “only changes the source of the randomness used to pick among words”. Anyone holding the key can later check whether a passage matches the choices that key would have produced, and put a probability on Claude's involvement.

• The method is a version of SynthID-Text, published by Google DeepMind in Nature in 2024, from a family of approaches going back to a 2022 proposal by Scott Aaronson
• Anthropic states that nothing is added to the text and there are no hidden characters
• It produces no extra tokens, so it costs the same to run and has a negligible effect on speed
• It carries no identifying information and cannot be traced to a person, an organisation or a chat
• It will not push Claude toward odd vocabulary either; Anthropic uses “nubilous”, an obscure synonym for overcast, as an example of a word the mark would not make it reach for
• In DeepMind's published testing across live Gemini traffic, marked and unmarked responses showed no statistically significant difference in user ratings
• Anthropic adds a second data point: in a controlled study, human raters comparing marked and unmarked answers side by side saw no difference in quality

Why proofreading mostly escapes it

This is the part that answers the loudest complaint, and it follows directly from the mechanism. The mark lives in choices Claude makes. Where Claude makes no choices, there is nothing to mark.

Anthropic puts it plainly: when Claude proofreads a person's writing, “nearly all the words are the person's”, leaving “very little (if anything) for the watermark to attach to”. Fix the grammar and punctuation in a document and the mark can only live in that handful of corrections, which is usually too thin to register.

Set the fears next to that explanation and most of them dissolve.

• u/Ill-Bison-3941 feared a CV scenario: Claude “fixed a couple of typos. You send that updated doc to HR. HR uses Anthropic authorized AI detector.” Two typos leave essentially nothing to detect.
• u/Single_Ring4886 described writing a scientific paper alone, asking Claude “to improve just stylistic part of text”, and having it read as fraud. A light style pass sits in the same low-signal category.
• u/Dangerous_Ice2856 raised the sharpest version: people with dyslexia rely on proofreading tools and “it could flag it in an anti-cheat as cheating when they technically haven't.”
• Translation is the exception that proves the rule. A translation is fully marked, because every word in it was chosen by Claude.
• Factual writing carries less of it too. After “Isaac Newton's most famous work was called Principia”, only one next word is right, so the mark has nothing to work with.

Does the Claude watermark apply to code

Developers had a separate objection, and it also lands softer than they expected. Their worry was infrastructure rather than honesty.

u/Stuart_cn_ai put it as a compliance problem: “enterprise static analysis scanners or client security auditors rejecting clean pull requests because an invisible watermark flagged it as LLM-generated code.” u/geldonyetich, whose comment drew around 94 upvotes, worried instead about the mark confusing “agentic workflow scripts or compilers”.

Anthropic's answer is that code carries less watermarking than prose, for the same reason factual text does. Where an exact output is required, and a different token would break the program, there is no free choice and the nudge is not applied. What remains is the genuinely arbitrary material, such as comments, which Anthropic says has a negligible effect on the code itself.

• Exact outputs get no mark, because there is no equally good alternative to choose between
• Comments and other free-form text inside code can still carry it
• Nothing is inserted into the file, so there are no stray characters for a compiler to trip over
• The scanner-rejection scenario depends on tools that do not exist yet, since the detection API has not shipped

What survives the explanation

Plenty. The mechanism being gentler than feared does not answer the governance questions, and several of the original complaints are untouched.

u/OwnAd2284 asked the question Anthropic still has not answered: “how much editing dilutes or removes it? Or how many phrases or sentences of Claude added to a piece of human writing embeds the signature?” There is no published threshold. Anthropic says only that light editing probably will not remove a mark and a complete rewrite will.

There is still no opt-out, no published accuracy or false-positive rate, and no stated route to contest a result. On the opt-out, the counter-argument is reasonable: u/magic6435 noted that “an opt-out doesn't make any sense, defeats the purpose”, since anyone with something to hide would use it first.

• Detection is a probability, not a verdict; comparable tools return an explicit “uncertain” alongside yes and no
• Short passages may never carry enough signal to test
• Research on this family of watermarks found that after heavy human paraphrasing, detection needed around 800 tokens, roughly 600 words
• The chief technology officer of GPTZero has said free paraphrasing tools already defeat Google's equivalent system
• A public detection API also works as a testing tool for evasion: reword, check, repeat until it comes back clean

The explainer did not settle the argument

The thread discussing Anthropic's explainer drew around 370 points and 238 comments, and the objections did not stop. They moved.

The new argument is about verification rather than proofreading. u/EightFolding, with 38 upvotes, put the intuition simply: “embedding the key means changing the text and changing the text means changing the meaning.” u/Federal_Decision_608 raised the sharper technical version, that without the full context “you can't know what the model output distribution would have been”, predicting the result will be “either going to be super fragile or super inaccurate”. u/thorin85 defended it in one line: “It's a pseudorandom key instead of pure random, and cannot make a discernible difference.”

Here is the honest position. The published research shows this class of scheme can preserve the output distribution, and DeepMind's own testing found no measurable quality difference. But Anthropic has not published its implementation, so nobody outside the company can confirm that the deployed version behaves the way the paper describes. The quality claim rests on Anthropic's word plus an analogous published system, not on an independent audit.

• The highest-voted comment in that thread was not about proofreading at all; it was about the mark applying worldwide rather than only in the EU
• u/ok_000000 argued the obvious middle path: “This should be an option. Whatever industry or enterprise needs watermarked outputs can have it”
• The SynthID authors note that stronger detectability trades off against quality and diversity, so the balance chosen matters and Anthropic has not disclosed theirs
• Low-entropy output weakens detection, which is the same reason code and factual text carry less
• No independent test of Claude's deployed watermark had been published as of 15 August

What a Claude watermark can and cannot prove

Anthropic is careful here, and the distinction matters more than the technology. A mark says Claude was probably involved somewhere. It cannot separate “Claude wrote this” from “Claude heavily edited this”.

It also says nothing about ownership or legal responsibility, and it cannot tell you that a human wrote something. An absence of a mark proves nothing either, since the text may come from an older model, a different AI, or a rewrite.

• A mark cannot identify who used Claude, only that Claude was likely involved
• It cannot detect another company's AI, which would use a different key or a different method entirely
• Confidence rises with length, so long passages are far more testable than short ones
• Anthropic's terms and users' rights over their output are unchanged by any of this

The law behind it

The trigger is Article 50 of the EU AI Act, which tells providers of systems that generate synthetic content to mark outputs in a machine-readable, detectable way. It applied from 2 August 2026, and fines for transparency breaches reach €15 million or 3% of worldwide annual turnover, whichever is higher.

Anthropic signed the accompanying Code of Practice on Transparency in July 2026, alongside roughly 190 signatories including Google, Meta, Microsoft, Mistral and OpenAI. xAI does not appear on that list.

• Systems already on the market before 2 August 2026 have until 2 December 2026 to comply
• The Code of Practice is voluntary; Article 50 itself is binding
• Article 50 exempts systems performing an assistive function for standard editing, which is roughly where proofreading already lands in practice
• Anthropic is applying the mark worldwide because, in its words, it does not yet have “a durable way to scope it by region”, and says it will keep evaluating alternatives
• Businesses using Claude can carry a separate duty covering deepfakes and text published to inform the public on matters of public interest

Where everyone else stands

Other providers are marking content too, though the field is more uneven than the headlines imply. The split runs between text and images, and almost everyone finds text harder.

Google marks text in its Gemini apps and marks generated images, video and audio. OpenAI is the more revealing case: it built a text watermarking tool years ago and chose not to release it, citing false positives and the fear that users would move to competitors that did not mark. It does mark images. Meta and Microsoft have documented image marking with no public evidence of text watermarking, and Grok's image tool applies a visible mark with no removal setting.

• No public documentation establishes text watermarking at Meta, Microsoft, Mistral, xAI, DeepSeek or Qwen
• Open-weight models run locally carry no automatic mark, since this kind of watermarking is switched on during generation rather than built into the weights
• Several commenters said the change would push people toward open-weight or Chinese models, one such comment drawing over 200 upvotes
• Third-party AI detectors work on a completely different basis, hunting stylistic tells rather than checking a key, because they do not have Anthropic's key
• Anthropic names two of those tells outright: AI models are fond of the construction “this isn't X, it's Y”, and they use the word “quietly” far more than you would expect

What the rules already say

None of the professions that actually govern this rely on detection. The American Bar Association's guidance puts the duty on the lawyer to disclose where appropriate and verify output before filing, which is separate from confidentiality and has its own rules.

Publishing and accountancy landed in the same place. Medical journal rules say AI cannot be an author and treat concealment as potential misconduct. Elsevier requires a disclosure statement. Accountancy guidance warns that staying quiet is unlikely to protect a firm from a negligence claim over work it failed to check.

Universities have moved in the opposite direction from where the fear points. One university's guidance refuses to accept any AI detector as the sole basis for a misconduct case, and reports that a third of recent cases resting on detector output alone ended with no finding against the student.

• Detection tools have a documented record of misfiring on people who write in English as a second language
• The best known professional sanction over AI use, a $5,000 penalty against lawyers in New York, was for citing cases that did not exist
• There is still no verified instance of anyone being penalised because a statistical watermark was detected
• The consistent rule across professions is disclose and verify, not avoid detection

The questions still unanswered

Anthropic answered the mechanism questions thoroughly and left the governance ones open.

The threshold problem is the big one. Nobody has said how much Claude-written text inside a human document produces a detectable mark, which is exactly the number that decides whether a heavily assisted draft gets flagged. There is no published accuracy rate, no false-positive rate, and no described process for contesting a result.

• How much Claude-written material inside a human document triggers a detection
• What the false-positive rate is, and what a detector should report when uncertain
• Who arbitrates a disputed result, and on what evidence
• When the detection API ships, and who is allowed to run it
• Whether the worldwide rollout is later scoped back to the EU, as Anthropic has hinted
• Whether anyone outside Anthropic will be able to verify the deployed implementation, rather than the published paper it is based on

Quick answers on the Claude watermark

Claude does watermark code, but less than prose. Where an exact output is required, and a different token would break the program, there is no free choice and no mark is applied. Comments and other free-form text inside code can still carry it.

Claude does not watermark images the same way. Supported files such as .png, .jpg and .svg get a signed C2PA content credential in the file metadata instead of an embedded mark. Nothing inside the file changes, and the credential is stripped by screenshots or format conversion. Anthropic says it will provide a tool where you can drop a file in and check it, and any C2PA-aware software can already read the credential.

Not every Claude model is watermarked yet. Models launched on or after 2 August 2026 carry it, and older models are being retrofitted under a 2 December 2026 deadline.

Claude watermark detection is not public yet. Anthropic says a detection API is coming and that the implementation details are still being worked out.

Removing a Claude watermark takes a full rewrite. Light editing probably will not shift it. Replacing every word will, at which point the text is arguably no longer AI-generated anyway.

Where this leaves things

The Claude watermark is narrower than the reaction assumed. It marks what Claude wrote, thins out on code and facts, and mostly ignores the light proofreading that generated the loudest complaints. On the specific charge that it would brand your own writing as machine-made, the panic was misplaced.

What remains is smaller but more durable, and it is not really about proofreading. A probabilistic signal is being attached to a large share of the world's text. The tools to read it are arriving. The rules for what happens when one comes back positive have not been written, and the implementation itself has not been opened to anyone outside Anthropic.

So the reasonable position is neither the first week's panic nor full reassurance. The mechanism is narrower than people feared, on Anthropic's account and the published research behind it, and that account has not yet been independently checked. That is worth watching, and it is a separate question from what you paste where, which has not changed at all.

Sources

• Anthropic: How Claude's text watermarking works (14 August 2026)
• Anthropic: How Claude marks AI-generated content
• EU AI Act, Article 50: Transparency obligations
• Nature: Scalable watermarking for identifying large language model outputs (SynthID-Text)
• Kirchenbauer et al.: On the Reliability of Watermarks for Large Language Models
• Washington State University: Detecting and reporting AI misconduct
• City A.M.: Claude to watermark AI slop, including edited human writing
• TechCrunch: Anthropic says it will watermark text generated by its AI models