Putting Claude’s watermarking to the test

Anthropic has just started marking Claude’s output and has signed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, confirming it started embedding machine-readable watermarks in text from new Claude models on August 2, 2026.

That announcement is a good excuse to actually explain how this category of technology works, because most people assume watermarking means hidden code slipped into the content, a few invisible characters or sneaky whitespace tucked in like a barcode.

It doesn’t work that way.

The watermark is the content, it’s the actual words the model chose. Once you see how that works, you start noticing where the whole system gets shakier than it sounds.

Anthropic hasn’t published the exact mechanism behind Claude’s watermark, so it is unclear how this will affect output.

What follows is grounded in Google’s SynthID, the clearest publicly documented example of this category of technology, and the open C2PA standard, which is the closest public reference point we have for what Claude’s system likely resembles.

TL;DR

• AI watermarking doesn’t hide anything inside the text. It shapes which words a model picks at each step, using a secret key that turns “random” token selection into a specific, checkable pattern.

• Google’s SynthID does this with a keyed hash function, and it’s resilient enough to survive editing, cropping, and partial rewrites.

• Anthropic confirmed that Claude now does something in the same category, embedding watermarks in text and C2PA-compliant metadata in files to comply with the EU AI Act, though it hasn’t disclosed the exact mechanism.

• The open standard C2PA tackles a related but different problem: content provenance rather than token-level fingerprinting.

• All of these approaches have real limits, and the gap between “this can be detected” and “this will always be detected” is bigger than most explainers let on.

What is watermarking?

Every few weeks someone asks if AI companies are hiding invisible Unicode characters or zero-width spaces in generated text, a kind of digital secret handshake you could strip out with a find-and-replace. That approach exists in some contexts, and it’s trivially defeated. Copy the text into a plain text editor, and the “watermark” is gone.

That’s not what the serious players are doing.

Google built SynthID for this. OpenAI has adopted it too, for the images and audio it generates, though not yet confirmed for text. There’s also a separate open industry standard called C2PA (Coalition for Content Provenance and Authenticity) that tackles adjacent territory.

Anthropic has confirmed that Claude now marks its output too, using a text watermark for generated text and C2PA-compliant metadata for generated files, as part of signing the EU AI Act’s Article 50(2) Code of Practice, effective August 2, 2026.

The company hasn’t published how its text watermark actually works at the technical level, so what it shares with SynthID under the hood is unconfirmed. None of it depends on hidden characters, because hidden characters don’t survive the first paraphrase, screenshot, or platform that strips formatting.

How context-hash watermarking works

The actual mechanism is easiest to see through Gemini and SynthID, the clearest public example available. A language model doesn’t pick one exact next word. At every step, it scores a set of plausible candidates and normally samples from among the strongest ones, with some randomness controlled by “temperature.”

SynthID changes how that sampling happens. At each generation step, the model provider holds a secret 256-bit key. That key gets combined with the preceding tokens and run through a hash function, and the hash output deterministically splits the vocabulary into a “green” list and a “red” list.

Instead of sampling freely across all its top candidates, the model gets nudged toward whichever of those candidates fall on the green list. Do this at every step, across a long enough passage, and the text ends up containing more green-list tokens than chance alone would ever produce, a pattern invisible to a reader but recoverable by anyone holding the same key.

To anyone without the key, this looks exactly like ordinary random sampling, because the green and red lists reshuffle unpredictably at every step and there’s no way to tell which candidates were “nudged” without the key doing the sorting.

Functionally, it is random. The watermark doesn’t cost you output quality, because the model is still choosing from its top candidates either way. It’s just letting a secret key decide which of those top candidates gets the edge, instead of a dice roll.

A worked example

The following is a simplified version:

Say a model is completing “I love cake. My favorite dessert is ___” and the top candidates are chocolate, Black Forest, and cheesecake. Normally the model samples one based on temperature.

With SynthID, the provider holds a secret key and combines it with context, say the preceding few words, plus each candidate itself. It scores chocolate against key + “favorite dessert is” + “chocolate”, scores Black Forest the same way, and so on, then picks whichever candidate scores highest. Say it lands on chocolate, still one of the model’s own natural picks, just the one the key favored this round.

The process repeats for the next token: the next candidate set, maybe pie, ice cream, or smoothie, gets scored against the key and the updated context, and the highest scorer wins again.

Run that across a piece of text, and you get a specific, repeatable pattern, one that’s invisible to a reader but checkable by anyone holding the key.

Detection is a one-sample statistical test: if a fraction γ of the vocabulary is green at each step, an un-watermarked passage should land roughly γ of its words in the green list by chance. A watermarked passage lands far more. The gap measured in standard deviations is the z-score.

Why the statistics make this hard to fake

This is where the resilience claim actually earns its keep. Detection doesn’t need an exact match, just a consistent lean toward the green set more often than chance predicts. If roughly a quarter of candidates are green at each step (the fraction is usually called γ), an un-watermarked passage should land around a quarter of its words in the green set.

A watermarked passage lands well above that, and the gap, measured in standard deviations as a z-score, is what gets checked. Over a few hundred tokens, a real watermark typically pushes that z-score into the high single digits, strong evidence by normal statistical standards, without needing every single token to cooperate.

That statistical margin is also part of why the watermark holds up under some editing. Chop the text up, reorder sections, paraphrase a few sentences, and the untouched portions still carry their own share of signal, so the overall score drops but doesn’t necessarily disappear. It has real limits, though. Heavy editing, translation, or paraphrasing the whole piece can weaken or remove the signal entirely, which is the caveat Anthropic itself has attached to Claude’s watermark.

Where the assumptions start to wobble

This is the part most explainers skip, and it’s worth sitting with before you treat watermarking as a solved problem.

The math above assumes real candidate diversity at each token. Plenty of text doesn’t have that. Whether it is a block of code, a list of factual dates, or a name spelled one specific way, there’s often only one correct next token, or close to it. No meaningful candidate pool means no meaningful watermark signal, regardless of how good the scoring function is. Low-entropy content (like short Linkedin posts) is watermark-resistant almost by accident.

The confidence numbers above also assume a long enough sample. Short outputs, a tweet, a headline, a two-sentence reply, simply don’t give the statistics room to work. You need volume for the pattern to become improbable-by-chance rather than merely unusual.

Cross-model laundering is the other gap.

SynthID can tell you whether text came from a Gemini-family model with a specific key. It can’t tell you whether a different provider’s model produced the underlying draft, and heavy multi-pass rewriting (draft in one model, polish in a second, translate and translate back) degrades any single model’s fingerprint layer by layer.

C2PA takes a different angle here by attaching verifiable provenance metadata to media as it’s created and edited, closer to a chain of custody than a statistical fingerprint.

That makes it useful for images and video in a way token-level watermarking isn’t, but it depends on every tool in the chain actually participating, which is a coordination problem.

Detection access itself is asymmetric. You need the secret key, or access to whoever holds it, to run the check with any confidence. Third-party “AI detector” tools that claim to spot watermarked text without that access are mostly pattern-matching on style, not reading a cryptographic signal, and their false-positive rates reflect exactly that.

Watermarketing isn’t theater; the cryptographic core is genuinely sound, and it holds up reasonably well against everyday editing. But “sound in principle” and “reliable in every real-world case” are different claims, and the gap between them is where most of the actual policy and product decisions live.

What this means if you’re building with AI

If your workflow depends on watermark detection catching AI-generated text reliably, plan around the edge cases above rather than the headline claim. Long-form content is where this works best. Short copy or technical content with few valid token choices, and anything passed through multiple models or heavy paraphrasing is where confidence drops fast, sometimes to nothing.

Can the Claude watermark be identified?

Anthropic hasn’t published the exact scheme (token-bias key, hash function, sampling details, etc), so there is no way of currently building a viable detector. Unless there is a verification key, no one outside Anthropic would be able to realistically do this.

I decided to put some of this to the test by building an artifact walking through how these schemes generally work statistically (n-gram*/token frequency-bias detection, z-score tests over a suspected watermark distribution), so you understand what signal a real detector would be looking for.

*n-gram = a sequence of x adjacent elements from a string of text

There’s no real detection happening since it isn’t Anthropic’s key, so it shouldn’t find anything in any text. Running my own unedited sentences through it a few times still produced a stray high-ish z-score here and there, not because it detected anything, but because z-scores on short passages are noisy by nature.

I decided to then run the entire blog post past it, and got an even more interesting result: every other word was marked as red. This is because the detector isn’t actually scoring several thousand independent words, it’s scoring a much smaller set of repeated word pairs.

Ordinary English leans hard on a small rotating cast of function words, “the,” “a,” “of,” “in,” “is,” “and,” and they show up every couple of words in any grammatical sentence.

Whichever way this key happens to hash those specific pairs gets replayed on roughly the same rhythm the words themselves fall into. It’s the same non-independence problem from the earlier test, just more visible at length as a handful of fixed, deterministic coin flips dressed up as a large sample.

Wait, what does that mean?

Calm down, let’s keep in mind this isn’t a real codebreaker tool of any sort.

But a statistically sound detection method can still produce a confident-looking, false signal on ordinary text if it isn’t built to account for how repetitive real language is. That’s not a flaw, and it’s a documented failure mode in the actual research this whole category of watermarking comes from.

Kirchenbauer et al., the team behind “A Watermark for Large Language Models” (ICML 2023), introduced the green-list scheme this post has been describing throughout. Buried in their own discussion of the detection statistic is the same problem this post’s tool just hit: a repeated bigram like “Barack Obama” gets one fixed green or red verdict the moment it’s first hashed, and every later repetition of that exact pair just cashes in on the same verdict again. Their own worst-case scenario, stated plainly in the paper, is ordinary human-written text with enough repetition of a phrase like that racking up a falsely high green-token count and getting flagged as machine-generated, nothing watermarked about it at all.

The same team followed up the next year with “On the Reliability of Watermarks for Large Language Models” (ICLR 2024), and that one’s the actual experiment. They took watermarked text and ran it through human rewriting, LLM paraphrasing, and mixing it into longer hand-written documents, then measured how detection held up. Two things came out of it that pull in opposite directions.

The good news for watermarking is the signal survived better than you’d expect, staying detectable after roughly 800 tokens on average even under strong human paraphrasing, using a threshold most fields would call very strong evidence.

The catch sitting right next to it as paraphrased or mixed-in text statistically tends to leak n-grams from the original passage, and that leakage can produce high-confidence detections in places that shouldn’t register anything at all. (Which is why the Bible often gets flagged as being written by AI.)

What’s unknown about Anthropic’s real scheme

Public reporting confirms the watermark exists, applies globally to Claude’s outputs as of August 2, 2026, and is intended to be imperceptible to readers. Anthropic hasn’t published the specifics that would let a third party build a real detector:

• The hash function and how much preceding context it uses per token.

• The green-list fraction (γ) and how strongly sampling is biased toward it.

• The secret key or key-rotation policy.

• Whether a public verification endpoint exists at all, reporting doesn’t mention one for text (unlike C2PA on images, which is an open, independently verifiable standard by design).

That last distinction matters, given the image-side provenance (signed C2PA metadata on .svg/.png/.jpg) is a published, interoperable standard you genuinely can check today with independent tools. The text watermark is not architected that way in what’s public so far.

So now what?

A few options do exist:

1. C2PA content credentials on images: real and checkable now, using independent verifier tools, since it’s an open standard rather than a proprietary statistical signal.

2. General AI-text stylometric detectors (perplexity/burstiness tools in the GPTZero family) : These don’t read any watermark at all; they guess from writing style. Coverage of Anthropic’s rollout explicitly flags their unreliability, and independent research has shown they misfire on both human and AI text often enough that a “detected” or “clean” result from one isn’t good evidence on its own, eg light editing, translation, or short passages degrade them further.

3. A dedicated Anthropic verification tool for text: Not confirmed as publicly available as of this writing (Aug 2026) in any of the coverage checked below. If one ships, it would be the only way to reliably check the real watermark, since it’s the only party holding the key. I personally wouldn’t put it past them to monetize this, but who knows, really.

Frequently asked questions

Is AI watermarking the same as hidden text or invisible characters?

No. Some early or low-effort watermarking schemes used invisible Unicode characters or whitespace patterns, and those are trivially removed by copying text into a plain editor. Serious watermarking like Google’s SynthID works differently: it shapes the actual word choices the model makes using a cryptographic key, so there’s nothing to strip out because the “watermark” is the content itself.

How does SynthID watermark AI-generated text?

SynthID uses a secret key combined with the surrounding context to score each plausible next word, then leans toward whichever ones score highest instead of leaving the choice to random sampling. To anyone without the key, the output looks like normal text, and quality holds up well because the model is still choosing among candidates it already found plausible.

Can you remove an AI watermark by editing or paraphrasing the text?

Partial editing usually isn’t enough. The watermark’s statistical signal is spread across the individual token choices throughout the text, so cutting, reordering, or paraphrasing some sections still leaves a detectable pattern in what remains. Getting the signal below a detectable threshold generally takes rewriting most of the piece, translating it, or otherwise touching a large share of the actual word choices, not just light copyediting.

Does AI watermarking work on short text or code?

Not reliably. The statistical confidence behind watermark detection depends on having enough tokens with real candidate diversity to build a pattern from. Short outputs don’t provide enough volume, and shorter content often has only one plausible next token at each step, leaving little room for a watermark signal to exist in the first place.

What’s the difference between SynthID and C2PA?

SynthID is a token-level cryptographic fingerprint built into how a model generates text or media. C2PA (Coalition for Content Provenance and Authenticity) is an open industry standard focused on attaching verifiable provenance metadata to content as it’s created and edited, more like a chain of custody than a statistical signal. They solve related but different problems, and a piece of content could use one, both, or neither depending on the tools involved in producing it.

Does Claude watermark its output?

Yes. Anthropic has confirmed that Claude embeds machine-readable watermarks in generated text and C2PA-compliant provenance metadata in generated files, starting with models launched from August 2, 2026 onward, applied globally rather than only in the EU. The move complies with Article 50 of the EU AI Act. Anthropic hasn’t disclosed the specific technical mechanism behind the text watermark, and has said the watermark can be weakened or removed by heavy editing, translation, or very short passages.

Can third-party AI detector tools reliably spot watermarked content?

Generally no, unless they have access to the specific model provider’s secret key. Most consumer-facing “AI detector” tools are pattern-matching on writing style rather than checking a cryptographic signal, which is why their false-positive and false-negative rates are considerably higher than the underlying watermarking technology itself would suggest.

Can you break the Claude content watermark?

In principle, given enough determination: heavy editing, translation, or full paraphrasing can weaken or remove the signal, per Anthropic’s own caveat above. In practice, nobody outside Anthropic can verify whether a given piece of text is watermarked in the first place, since nobody outside Anthropic holds the key. That also means there’s no way to confirm removal worked, since there’s no way to confirm detection would have worked either.