How Claude inserts watermarks into text content

Anthropic has signed the code of practice for article 50, paragraph 2, of the EU AI Act with commendable bureaucratic zeal.

The objective? To reassure lawmakers regarding the transparency of artificial intelligence-generated content, both in its role as a provider of bare-bones models and as a distributor of entire ecosystems. Here, we aim to illustrate how these solemn promises are intended to be turned into operational reality, how this wondrous tagging system is supposed to work, and, with due intellectual honesty, what technical chasms separate it from infallibility. This document will be duly expanded with even more detailed technical instructions as soon as someone figures out how to make it work properly.

The solemn promises to appease the EU AI Act

What exactly does this meticulous marking framework entail for the Claude universe:

• New models will mark everything from minute zero: Claude models released in the European Union starting from August 2, 2026, integrate machine-readable marking from the very first line. Texts will contain invisible watermarks skillfully nested within words, while exported files will include encrypted provenance metadata, provided the destination format benevolently decides to cooperate.
• The mark will follow you everywhere: tagging will apply to results from supported models across Claude Platform (API), Claude, Claude Code, Claude Cowork, Claude Tag, and anywhere across the globe one chooses to invoke them. If some third-party application or platform blissfully ignores the whole matter, no one should be overly surprised.
• The magnifying glass for the curious: a kit will be provided to allow users and third parties to uncover digital stamps, simply because the European code strictly demands it. Operational details will make their appearance in the next chapter of the documentation.
• Older models can wait: European regulations have been merciful enough to grant a comfortable grace period for models created before August 2, 2026. Technicians are working with due calm to stick a retroactive label on them as well.

The complete labeling plan reveals all its operational inner workings in the following paragraphs.

Machine-readable tags in content churned out by Claude

Given that the web is now cheerfully submerged in synthetic content, offering an illusion of transparency regarding the origin of texts should theoretically help people discern what they are reading. To complete the assignments handed down by Brussels regulators and avoid multimillion-euro fines, Anthropic is taking steps to inject computer-readable stamps into everything Claude produces.

What gets caught in the traceability net

• Models: versions of Claude released from August 2, 2026, leave the factory brand-marked. For earlier versions, attempts will be made to address them along the way, updating documentation should the endeavor prove successful.
• Products: seals follow output everywhere, covering Claude Platform (API), web interface, Claude Code, Claude Cowork, and Claude Tag. Invisible statistical watermarks will settle into every sentence, while metadata will attempt to anchor to graphic and document files, provided the format allows it.
• Cloud partners: watermarks spare no one, not even those querying Claude through AWS, Google Cloud, or Microsoft Foundry. Signed metadata, on the other hand, might conveniently evaporate en route, depending on how scrupulous or absent-minded the hosting infrastructure happens to be.
• Global coverage: the mechanism activates on a planetary scale wherever the service is accessible, without any territorial exemptions.

How Claude marks its digital territory

To leave its imprint on generated text and files, Claude relies on two complementary strategies: on the one hand, invisible statistical watermarks sewn directly into syntax; on the other, digitally signed metadata attached to binary files.

1. Invisible watermarks in text

When an enabled Claude model produces an answer, it conceals an imperceptible watermark right within the sequential choice of vocabulary. The human eye will notice absolutely nothing unusual, and the prose will preserve its usual formal fluidity intact.

Because the watermark is woven into the very structure of the text, it easily survives ordinary copy-pasting and even slight stylistic tweaks. Being applied upstream, right at the core of the language model, it remains present regardless of the software or interface used to generate the response.

2. Signed provenance metadata for files

When Claude generates visual or vector resources (such as .svg, .png, or .jpg), it attaches a cryptographically signed attestation. This procedure adheres to the open C2PA standard, the tool promoted across the technology sector to certify multimedia content authenticity. The presence of this digital signature certifies that Claude processed the file and even enables verification of whether third parties made subsequent tampering.

Hunting down digital stamps

Dedicated tools and APIs are currently being rolled out to allow anyone to verify the presence of these statistical watermarks and cryptographic metadata. The analysis checks for alignment with marking parameters: if positive, it reports the probability that the content passed through Claude’s servers. Mathematical details and related formulas will be distributed in subsequent technical documentation.

The numerous and inevitable limits of the system

Digital stamps represent a sophisticated statement of intent, but practical reality shows how trivial it is to knock them out across any medium.

Spotting a mark merely suggests that Claude touched the text, but it by no means constitutes proof of exclusive intellectual authorship:

• Claude might not be the author of the idea: if a user employs the model for proofreading, translating, summarizing, or formatting personal notes, the output will still receive the factory mark, even if the substance, data, and concepts belong entirely to a human.
• Subsequent manipulations alter the picture: once exported, marked text can be shortened, reworked, or merged with other sources without the system being able to document the actual dynamics of the modifications.

Conversely, the total absence of marking does not certify that the text is of purely human origin. Content generated by Claude will appear completely anonymous in the following cases:

• It was produced by models released prior to the introduction of the marking system;
• It underwent deep paraphrasing, extensive rewriting, external translation, or was incorporated into broader texts;
• The passage is too short to gather a sufficient volume of statistical evidence;
• Metadata was wiped away by saving under a different name, changing formats, taking a screenshot, or applying compression;
• Processing occurred via a channel or format that does not support watermark implementation.

Obligations for developers integrating Claude

Anyone choosing to integrate Claude within commercial applications is required to carefully examine the requirements of article 50 of the EU AI Act to avoid regulatory infringements. Because compliance with the European framework is mandatory upstream, technical specifications and detection libraries will be provided to facilitate the adaptation of downstream products.

Frequently asked questions and technical operating details

Digital watermarking aims to establish the statistical probability that a text derives from Claude processing, in compliance with regulatory obligations signed with the European Union alongside more than 190 industry operators.

Key points in brief

• The adopted method does not alter content expressive quality or coherence in any way;
• Watermarked text remains indistinguishable from unwatermarked writing;
• No hidden special characters, invisible tags, or artificial Unicode sequences are inserted;
• Generation consumes no additional tokens and incurs no extra computational costs;
• The signature includes no personal identifiers, account references, or conversation details;
• Marking involves the entire AI landscape: all major developers operating in the European market are implementing similar protocols.

How the watermark works mathematically

Autoregressive language models operate by predicting one token at a time. At each iteration, the algorithm evaluates the most coherent candidates based on previous context. In a sentence like “Today the weather was cold and…”, words like “overcast” or “gray” carry nearly identical probabilities and do not change the meaning of the discourse, whereas a word like “sugared” is ruled out a priori. Under ordinary circumstances, the choice between equivalent options is guided by a standard random generator.

Generative watermarking intervenes precisely in these low semantic impact decisions. Replacing pure randomness with a pseudorandom sequence determined by a secret cryptographic key and preceding words, the model leaves a tiny probabilistic footprint. Anyone holding the decoding key can analyze the sequence of choices post-hoc: if the words reflect the cryptographic scheme, the text is classified as generated by the model.

This does not mean Claude will always use the same term or force abstruse words out of context; natural language remains intact, but the statistical trajectory of words becomes measurable.

The Monopoly and pi analogy

To understand the concept, imagine a game of Monopoly where token movement relies not on rolling random dice, but on the sequence of decimal digits of pi starting from a secret position (for example, from digit number 1,012,845). To the players at the table, the game will appear entirely normal and unpredictable. However, an observer aware of the pi sequence will be able to reconstruct moves post-hoc and certify with mathematical certainty that the game followed that specific predefined scheme.

Intrinsic limits and low-entropy contexts

The algorithm only allows answering the question: “What is the probability that this passage was generated by Claude?”. It cannot attest whether a text is entirely human or generated by another LLM equipped with different keys.

Furthermore, effectiveness visibly drops in very short texts and low-entropy technical passages, where lexical choice is strictly constrained. For example, after the sequence “Isaac Newton’s most famous work is titled Principia…”, the subsequent term must necessarily be “Mathematica”: with no valid lexical alternatives existing, the watermark cannot intervene without compromising content correctness.

Source code, translations, and revisions

The same principle applies to programming and editing:

• Source code: in rigid syntactic portions (such as after “2 + 2 = 4”), the watermark does not intervene; it instead finds space in discursive comments or where syntax provides equivalent choices without altering execution.
• Proofreading: minimal spelling corrections leave the author’s original structure intact, rendering the statistical imprint almost negligible.
• Translations: full translations are entirely watermarked because every single token is selected by the model.

Legal implications, privacy, and performance

The introduction of marking does not slow down processing, does not alter licensing terms or intellectual property rights according to the terms of service, and does not track personal user data. It merely serves as technical attestation of algorithmic participation in drafting.

The scientific foundation: Google DeepMind’s SynthID-Text architecture

Large language models (LLMs) have achieved an expressive fidelity that makes synthetic content virtually indistinguishable from text written by human authors. To protect the integrity of the information ecosystem and mitigate misuse without compromising text quality or production system efficiency, research developed SynthID-Text, an industrial-scale generative watermarking architecture.

Unlike approaches based on logging everything (highly invasive to privacy) or post-hoc classifiers (expensive and prone to false positives, especially on non-native text), SynthID-Text acts solely during sampling at generation time, requiring neither model retraining nor access to proprietary weights during verification.

Figure 1: Overview of text generation in LLMs and the generative watermarking process. Top: standard generation proceeds by sequentially sampling from the model distribution. Bottom: the architecture centers on three key elements: the pseudorandom seed generator, the probabilistic sampling algorithm, and the scoring function. In the SynthID-Text framework, the algorithm called Tournament sampling is introduced.

Watermarking architecture with SynthID-Text

The system is based on three operational components: a sliding-window pseudorandom seed generator (the hash of recent tokens combined with a secret cryptographic key), a sampling algorithm, and a scoring function for post-hoc verification.

Figure 2: Operational scheme of tournament sampling watermarking in SynthID-Text. Top: candidate tokens in the vocabulary are evaluated via pseudorandom marking functions driven by the cryptographic seed. Bottom: selection occurs through a multi-level single-elimination tournament, where token pairs compete based on assigned scores until the winning token is determined.

Tournament sampling algorithm

The core mechanism behind Tournament sampling arranges a single-elimination tournament among candidate tokens drawn from the model’s probabilistic distribution. The pseudorandom seed generates multiple independent scoring functions: tokens face off in pairs across successive hierarchical levels, where only the candidate with the highest score advances to the upper step until declaring the final winner to be inserted into the sequence.

Detection, verification, and repeated context masking

During analysis, verification calculates the mean score obtained by tokens against reference marking functions. An average value markedly higher than that of natural text signals synthetic origin.

To prevent quality distortions or cyclical repetitions caused by reusing the same context windows in very long texts, a repeated context masking technique was implemented. In the standard 30-level tournament setup, the system operates in distortion-free mode, ensuring complete stylistic fidelity to the original model.

Integration with speculative sampling

In ultra-high-performance industrial contexts, text generation is accelerated using speculative sampling, in which a lightweight model anticipates tokens that are subsequently validated by the main model. SynthID-Text integrates with this architecture via the fast watermarked speculative sampling algorithm, preserving operational efficiency and acceptance rates without introducing perceptible delays.

Experimental evaluation and large-scale validation

Comparison with state-of-the-art baseline methodologies (Gumbel sampling for distortion-free methods and the Soft Red List algorithm for controlled-distortion methods) demonstrated the clear performance superiority of SynthID-Text across multiple architectures, such as Gemma (2B and 7B) and Mistral 7B.

Figure 3: Detection performance of SynthID-Text. a) Comparison of detection capability as a function of text length between SynthID-Text and Gumbel sampling; b) Abstention rate via selective prediction to minimize error margins; c) Trade-off between text quality and detectability compared to the Soft Red List algorithm.

Field validation: 20 million responses in production on Gemini

The practical viability of the architecture was tested on approximately 20 million live responses delivered by the Gemini service. Analysis of direct user feedback (positive and negative ratings) showed a variation of less than 0.02% between marked and unmarked responses. Blind qualitative tests with human evaluators and automated perplexity checks confirmed the total absence of qualitative degradation.

In terms of compute times, tests run on dedicated TPU v5e processors with 30-level tournament sampling recorded a latency increase of merely 0.57% per token (15.615 ms compared to 15.527 ms for the base model), a completely negligible figure in industrial operational workflows.

Limitations and open source availability

While representing a milestone for the transparency required by international regulations, generative watermarks require coordinated adoption by model providers and remain susceptible to manipulation or extensive rewriting. To foster research advancement and allow transparent implementation of these solutions, the complete source code and evaluation data were released publicly in the official GitHub repository: https://github.com/google-deepmind/synthid-text.