On September 1st, Anthropic announced that future Claude models will gradually add invisible watermarks to the generated text, and will open a private testing interface for eligible institutions to conduct inspections. This does not involve inserting invisible characters into sentences or attaching a series of user IDs to each article; instead, it involves making slight adjustments to the selection probabilities between multiple similarly reasonable words, allowing longer texts to exhibit patterns that can be statistically recognized.
The company has adopted a implementation of SynthID-Text, claiming that this mechanism will not increase the output of Token. No noticeable decline in quality has been found in internal evaluations either. The watermark will be enabled globally on the new models, and there will be a transition period for the old models. The overall rollout is expected to last for several months. Anthropic clearly acknowledges that there is currently no reliable method to isolate this mechanism by region on a long-term basis; therefore, they have chosen to deploy it uniformly rather than providing it only within the European Union.
This arrangement is related to the EU's Artificial Intelligence Act and its guidelines for the practice of general artificial intelligence models. Anthropic signed the guidelines in July 2026, and the relevant transparency requirements came into effect on August 2. However, interpreting compliance actions as "text that can be verified afterward" would greatly exaggerate their effect. The official stance on watermarks is quite restrained: the detection results can only indicate that Claude may have been involved in the generation, but they cannot prove whether the text was actually completed by a human or by AI, let alone identify specific users, organizations, or conversations.
The watermark changes the probability of words, not it assigns a unique identity to each article.
When large models generate a sentence, there are usually multiple candidates for the next word that are semantically similar and grammatically correct. The watermark system uses a secret rule to make small adjustments to the sampling probabilities of these candidates. Individually, these adjustments may not be noticeable, but over a long enough text, these deviations can accumulate into a statistical signal. The detector uses this signal to determine whether the text matches the watermark distribution of Claude, rather than searching for a fixed marker within the file.
This design has two direct advantages. First, even after being copied to plain text, having the font changed, or having the file metadata removed, the signal may still be preserved; second, it will not be immediately deleted by simple formatting cleanup, unlike zero-width characters. At the same time, its evidential nature is also weaker: statistical relevance does not equate to proof of identity. Two people writing independent short sentences may produce similar results, and multiple models or human editing could also jointly create an article; therefore, detectors can only provide probabilistic judgments.
Anthropic lists a number of limitations. Short texts do not have sufficient samples, which can lead to reduced detection effectiveness; paragraphs with strong factual content may have fewer options for wording, resulting in limited signal space; code requires precise output and is not suitable for arbitrary word changes; minor edits may retain watermarks, while substantial rewriting, translation, or having another model restate the text may wash out these signals. Therefore, it is more suitable for examining long pieces of material of unknown origin and cannot be used as a sole tool for determining cheating in exams or fabricating news.
Watermarks also do not encode personal information. The notation Anthropic indicates that the mechanism cannot be used to target a specific account, enterprise, or chat record. This limitation reduces the risk of watermarks being used as cross-text trackers, but it also means that the platform cannot determine "who generated" the content based solely on detection results. If an organization needs to audit a specific workflow, it still relies on account logs, version records, reference chains, and manual declarations; it cannot outsource the responsibility tracing to a mere score.
The testing interface is first provided to professional institutions, but the real challenge is how to avoid treating probability as a definitive judgment.
The first batch of private testers includes qualified regulatory agencies, media and fact-checking organizations, researchers, educational institutions, civil society organizations in the European Union, as well as enterprises that undertake relevant obligations. Anthropic plans to gradually expand the scope, rather than immediately providing a public testing webpage available to everyone. There are practical reasons for this approach: if attackers could test texts indefinitely and get results instantaneously, it would be easier for them to find ways to remove watermarks; professional users would also be better equipped to understand false positives and false negatives.
There will be another layer of marking when generating files. For supported file types, Claude will use the content credentials from C2PA to save source metadata. C2PA and text watermarks address different issues: the former is more like a verifiable resume carried with the file, suitable for original files that have not had their metadata stripped; the latter is embedded within the language distribution and is more resistant to copying and pasting, but its effectiveness is more probabilistic. However, even when both are used together, they cannot cover all scenarios such as screenshots, overwriting, and processing across models.
The most common mistakes made by schools, editorial departments, and platforms are to directly set the detection threshold as the penalty threshold. Watermark detection should trigger further verification, such as reviewing the writing process, drafts, and citations, rather than independently determining whether a student has cheated or if an author has falsified work. Institutions also need to keep track of model versions and detector versions, as the scoring criteria for the same piece of text may change after algorithm updates. When releasing conclusions to the public, it is important to provide information about the sample length, editing history, and uncertainties, rather than just presenting a percentage.
The value of a watermark does not lie in creating a “AI lie detector,” but rather in adding a machine-readable clue to the investigation of the source. As more and more content is assisted by models, the binary question of “whether it was written by AI” itself loses its meaning. More useful questions are: which steps AI was involved in, who bears the ultimate responsibility, and whether the chain of evidence is complete. What Anthropic proposes this time is a limited but deployable technical measure; only in conjunction with logs, content verification, and human procedural justice can it potentially increase transparency, rather than create new misjudgments.
