Anthropic says its future models will use a Claude text watermark that lets a key-holder estimate whether Claude helped write a passage. The company announced the change on Aug. 14, saying it and other major AI providers are adopting such measures to comply with the EU AI Act. The mark is neither a visible label nor an invisible character tucked into copied text. It is a statistical pattern created as the model generates prose.
That distinction is doing a lot of work. Anthropic says the system does not identify a particular person, organization or chat, and cannot establish definitive authorship. A positive result means only that a passage is statistically consistent with having been partly written by Claude.
How does Claude text watermarking work?
Language models generate text one token at a time, weighing possible continuations before selecting one. Anthropic says its watermark changes the source of randomness used to settle certain low-stakes choices among plausible options. Rather than relying on an arbitrary random-number generator, the model uses a secret key and preceding words to select among candidates.
A reader sees ordinary prose. Someone with the key can test whether the sequence of choices matches the keyed process, then assign a probability of Claude involvement. Anthropic says the method does not add characters, require extra tokens, or make the model select words it would otherwise reject. For a primer on the underlying next-token process, see how LLMs generate an answer.
The technique is a version of SynthID-Text, an approach published by Google DeepMind in 2024, according to Anthropic. Anthropic says its internal tests found no effect on content, creativity or readability. It also points to DeepMind testing that found no statistically significant difference in user ratings and no perceived quality difference in controlled comparisons. Those are company-reported results and cited prior research, not an independent test of Anthropic's deployment.
What can a Claude watermark prove?
Less than marketers, teachers and fraud detectives might prefer. Anthropic says detection is weak on short passages because there are too few word choices to assess. Confidence rises with length. It also cannot say that text was written by a human, determine whether another AI produced it, or identify the person behind a prompt.
Factual writing presents another limit. Where accuracy permits only one correct continuation, there is little room to encode a signal without risking an error. Light proofreading of human-written text may likewise leave too few Claude-selected changes for a detector to register.
The dispute is over whether the choices are really low-stakes
Anthropic's position is that the affected alternatives are indistinguishable in practice and leave output quality intact. Daring Fireball's critique reaches the opposite normative conclusion: near-synonyms still carry different shades of meaning, so influencing which viable word gets selected compromises the writer's control over precision.
That objection is a judgment about writing, rather than a demonstrated degradation in Claude output. Still, it identifies the trade-off cleanly. The watermark is not metadata pasted onto prose; it is part of the model's decision process for producing that prose. Anthropic says readers will not notice the difference. Critics argue that imperceptibility is not the same standard as choosing the best available word.
This story draws on original reporting from Daring Fireball.
