How Claude's watermark works
Anthropic has not published its mechanism, but the class of system it belongs to is well documented. What is confirmed, what is inferable, and what is guesswork.
Anthropic's watermark · 4 min read
Anthropic began marking Claude's text output in August 2026 and has said technical documentation on detection is forthcoming. It does not exist yet.
So this article separates three things that usually get blended: what Anthropic has confirmed, what can be reasonably inferred from the published state of the art, and what is nobody's business to assert.
Confirmed by Anthropic
- The mark is applied at the model level, so it is present regardless of surface — app, API, or any product built on Claude.
- Every Claude model launched on or after 2 August 2026 marks text at launch. Support for earlier models is described as in progress.
- It is imperceptible: woven into the text, not visible, and it does not change meaning or readability.
- It is applied globally, not only for EU users.
- It survives copy-paste and "may persist through some editing".
- It may not survive heavy editing, paraphrasing, translation, mixing with other content, or very short passages.
- A detected mark means the content may have been processed by Claude — not that Claude authored it.
- Images use C2PA instead, a completely different mechanism based on signed metadata.
That list is the whole of the public record on behaviour. Everything below is inference.
What "woven into the text" almost certainly means
Two properties in that list, taken together, constrain the design considerably.
It survives copy-paste, and it is imperceptible. That rules out any mechanism based on hidden characters — zero-width codepoints, Unicode tag characters, variation selectors. Those are imperceptible, but they do not survive plain-text handling reliably, and Anthropic would be describing something far more fragile than what they describe.
It is degraded by paraphrasing and translation but not by copy-paste. That is the signature of a sampling-based statistical watermark, and it points at essentially one design.
How that class of system works
Generation is a sequence of choices. At each step the model holds a probability distribution over next tokens, and usually several are near-equivalent — the sentence works with any of them.
A sampling watermark exploits that slack:
- A secret key, combined with a hash of the preceding few tokens, seeds a pseudorandom function.
- That function scores the candidate tokens for this position.
- Sampling is nudged toward higher-scoring candidates.
The nudge is small enough that quality does not visibly suffer. But across hundreds of positions, the accumulated bias forms a statistical pattern that chance would not produce.
Detection reverses it. Holding the same key, a detector recomputes the expected score at each position and measures whether the text scores higher than chance across the whole passage. Enough excess, and it reports a likely watermark.
Google's SynthID-Text is a published, peer-reviewed implementation of exactly this, running in Gemini since before Claude's mark existed. Its behaviour matches every property Anthropic describes.
Why this explains the durability list
Each item on Anthropic's "may not survive" list follows directly:
Paraphrasing replaces the specific tokens that carried the signal. The pattern is the word choices; change them and the evidence goes with them.
Translation replaces every token.
Short passages never accumulate enough signal. Statistical confidence needs sample size, and a few sentences do not provide it. This is a hard floor, not a tuning issue.
Mixing with other content dilutes it — your own sentences contribute nothing to the pattern.
Copy-paste changes no tokens at all, which is why it survives.
What nobody outside Anthropic knows
The specifics. Which pseudorandom function, how many preceding tokens seed it, how strong the bias is, how many tokens detection needs for a confident call, and what the false-positive rate looks like.
Most importantly: the key. A statistical watermark is not a public checksum. It is a private property of the text, readable only by whoever holds the key. Which is why no external party — not you, not us, not a university, not a publisher — can currently check a passage for Claude's mark, and why any tool reporting a percentage is running a generic style heuristic instead.
Is there source code?
Not from Anthropic. Nothing has been published.
The closest public reference implementation is SynthID-Text, which Google open-sourced. It shows the shape of the approach, and it is a reasonable thing to read if you want to understand the mechanism concretely. It is not Claude's implementation and its key is not Claude's key.
What follows practically
If the inference above is right — and the behavioural evidence is fairly strong — then the character layer in Claude output is a separate issue from the watermark. Em dashes, curly quotes and zero-width characters are real, countable and worth removing. They are not where the mark lives, and removing them does not touch it.
The only lever on the statistical layer is changing word choices, which is what Anthropic's own list identifies. Whether any particular rewrite goes far enough is unmeasurable until a detector exists.
Scan your text to see the character layer exactly. On the rest, we will publish what we find when there is something to test against.
Related: does Anthropic watermark Claude's text? · what SynthID-Text is · can it be removed? · is Claude detectable?
Sources: Anthropic Help Center