The Claude watermark is a hidden statistical pattern in the words that newer Anthropic models choose, and only someone holding Anthropic's private key can test a passage for it. There is no visible character, no tag in the file and no change to what the text says. It started on 2 August 2026 for models launched from that date, nobody outside a short list of organisations can check for it yet, and a full rewrite by a different model erases it. A detected mark would show that a Claude model was involved in producing the words. It cannot show who did the thinking.
Key takeaways
- The mark is a pattern in word choice, not a hidden character. Find and replace does nothing to it, and copying and pasting carries it along.
- Only models launched on or after 2 August 2026 mark text. As of 1 September 2026, Anthropic named Fable 5.1 and Mythos 5.1.
- Detection needs Anthropic's private key, so no school, employer or browser extension can check a piece of text today.
- In the one published simulation, a full paraphrase by an unmarked model erased the mark from every text, so a missing mark proves nothing.
What Is the Claude Watermark?#
The Claude watermark is a slight, keyed bias in which word Claude picks at moments where several words would do equally well. When a large language model writes, it chooses each next word from a short list of plausible candidates. According to Anthropic (2026), the sentence "The weather today was cold and" is very unlikely to continue with "sugary", while "overcast" and "grey" both fit. Normally an arbitrary random number settles which one appears. If any of the vocabulary here is new, the AI glossary covers it.
A weighted coin is the clearest way to picture it. Bend a coin very slightly and it still lands on either side, but one side comes up a little more often. Nobody could tell from one flip. Over five hundred flips the bias is obvious to anyone who knows which way the coin was bent, and a piece of writing contains hundreds of these small choices.
The practical consequence is that the mark survives things a hidden character would not. Copying and pasting carries it along, and Anthropic states it may persist through some editing. Find and replace does nothing to it, because there is no character to find.
How Does Claude's Watermark Work?#
Claude's watermark works by replacing the random number behind each close word choice with one computed from a secret key and the few words just before it. The choice still looks random to a reader, because from the reader's side it is. Anyone holding the key can later recompute which choices the key would have favoured and count how often the text agrees.
The diagram below shows where that substitution happens in the sentence.
The key does not give Claude a favourite word. This is because the preceding words feed into every calculation, so the same candidate wins in one sentence and loses in the next. Anthropic's analogy is a board game where players stop rolling dice and instead read successive digits of pi from a random starting point. Play is unchanged, and only someone who knows to look for pi can tell which source the game used.
Checking text this way would be far too expensive if it meant rerunning the original prompt through the original model. According to Raschka (2026), the published SynthID Text scheme that Anthropic's method is based on avoids that with tournament sampling. Several scoring functions are derived from the key, the candidate words compete in knockout rounds scored by those functions, and the winner becomes the next word.
Detection then needs only the key and the same scoring functions. The detector walks through the passage, recomputes the score at each position and averages it. Text written without the key agrees with it about half the time, since its author is effectively guessing. Marked text agrees noticeably more often, and above a calibrated threshold the passage is flagged. Generation costs almost nothing extra, and Anthropic confirms the watermark adds no tokens.
That threshold is where a detector can quietly go wrong. Balakhonov (2026), reproducing the published scheme, calibrated against 100,000 random key tables per text to reach a setting where clean text is wrongly flagged once in a hundred. A threshold he had earlier believed was a one percent setting turned out to produce about five percent false alarms. A detection result quoted without its calibration means very little.
The mark also cannot attach where only one answer is correct. Anthropic's example is "Isaac Newton's most famous work was called Principia", where no other word would do. Code carries little signal for the same reason, because a substitute token often breaks the program, although comments inside code are free wording and carry the mark like prose.
When Did the Claude Watermark Start, and Which Models Carry It?#
The Claude watermark started on 2 August 2026, and it applies only to Claude models launched on or after that date. As of Anthropic's Help Center on 1 September 2026, that meant Fable 5.1 and Mythos 5.1. Models already on the market are being retrofitted during a legal transition period that closes on 2 December 2026, and Anthropic has given no date for any specific older model.
The date was set by law, not by Anthropic. Article 50 of the EU AI Act became applicable on 2 August 2026 and requires providers of generative AI to mark output in a machine-readable way. Penalties under the Act reach 15 million euros or 3 percent of worldwide annual turnover, which explains why roughly 190 organisations, including OpenAI, Google, Microsoft, Meta and Mistral, signed the voluntary Code of Practice within weeks.
| Date | What happened |
|---|---|
| 10 June 2026 | European Commission publishes the Code of Practice on Transparency of AI-Generated Content |
| 27 July 2026 | Deadline to be an initial signatory, roughly 190 organisations sign |
| 2 August 2026 | Article 50 applies, and Claude models launched from this date mark text |
| 14 August 2026 | Anthropic publishes its watermark FAQ explaining the mechanism |
| 1 September 2026 | Anthropic updates the FAQ with the status of the detection API |
| 2 December 2026 | Transition deadline for models already on the market before 2 August |
Table: the dated events in the rollout. Sources: European Commission, Anthropic, Anthropic Help Center.
Because marking sits in the model rather than in an account setting, it reaches every surface at once. According to Anthropic's Help Center, that covers the API, the Claude apps, Claude Code, Claude Cowork and Claude Tag, and the models served through AWS, Google Cloud and Microsoft Foundry, worldwide rather than only in Europe. Anthropic's stated reason is that it has no durable way to scope marking by region.
Article 50 also decides who carries the duty, which surprises people. The marking obligation falls on the provider of the AI system, not on the person typing the prompt. The only disclosure duty that reaches an individual applies narrowly to unedited AI-generated text published on matters of public interest inside the EU. This is not legal advice, and the post on translated writing covers the case the law did not anticipate.
Most confusion about the watermark comes from mixing up three separate schedules. The first decides which models mark text, and it is the only one moving. The second decides who can detect the mark. The third decides how schools, employers and publishers will use detection, and nobody has started on it.
The detection clock is the one that matters for anyone worried about an accusation. As of 1 September 2026, Anthropic's detection API was in private preview for organisations with a legal reason to verify compliance. The list covers regulators, law enforcement, media, fact checkers, independent researchers, educational organisations, EU civil society groups and enterprises with their own Article 50 duties. Anthropic has said access will widen and has given no date.
So a school cannot check a submitted essay today, an employer cannot check a report, and no browser extension can read this mark whatever it claims. The early panic shows how easily the clocks get crossed. A widely read r/ClaudeAI thread from August 2026, titled "Nothing you generate with Claude today is watermarked", drew 110 upvotes and 96 comments correcting the assumption that every Claude model had started marking at once. That was true on the day it was posted and has since changed, which is why every claim about this watermark needs a date.
Can Claude's Watermark Be Removed?#
A full rewrite by a different, unmarked model erased the mark in the only published test, and lighter changes mostly did not. That test was not run against Anthropic's watermark, because Anthropic's key and detector are private. Kirill Balakhonov (2026) reproduced the published SynthID Text scheme with his own key and measured what survives.
His design is what makes the numbers worth reporting. He generated ten fictional reports of 500 to 600 words with a Qwen2.5-14B model, produced matched marked and clean pairs from identical prompts, and scored every rewrite against 100 pre-registered factual claims judged blind by four models. The detector found the mark in all ten marked texts and in none of the clean ones before any rewriting. The corpus, prompts and judge decisions are public.
The chart below shows what each kind of change did to the signal in that test, alongside the direction Anthropic describes for lighter edits.
Light synonym edits cleared the mark from two texts out of ten. A full paraphrase by an unmarked model cleared all ten and kept all 100 claims intact. Round trips through German and through Chinese cleared none, which runs against the common assumption. This is because translating away and back restores familiar English phrasing, and in his test 45 percent of five-word sequences after the German round trip matched the original exactly, against under 10 percent after a paraphrase.
DIPPER, a paraphrase model built to evade watermark detectors, also cleared all ten, and it altered 23 of the 100 claims along the way. Numbers drifted first, then names and roles. That is the cost removal advice rarely mentions, and it is the same failure described in the post on AI hallucination, where a fluent text saying something slightly different is harder to catch than a broken one.
The limits are real. This is ten texts in one length range, tested against a reproduction with the researcher's key, and it says nothing measured about Anthropic's production detector. What it does show is a property of the design. The mark lives entirely in specific word choices, so once those choices come from another process, there is nothing left for the key to recognise. The consequence that matters most is the reverse case. A text with no detectable mark may still have started as Claude output, so the absence of a mark proves nothing either.
Does Any Other AI Company Watermark Text?#
Google watermarked text before Anthropic did, and with far less attention. Google has run SynthID Text inside Gemini since 2024 and published the method in Nature. Anthropic has confirmed that its own watermark is a version of that published scheme, which traces back to a 2022 proposal by Scott Aaronson.
The chart below summarises which major providers mark text, as Balakhonov found it in August 2026.
OpenAI is the interesting case. Reporting in 2024, as summarised by Balakhonov, established that the company had a working text watermark, with internally measured detection of long ChatGPT output at around 99.9 percent, and chose not to ship it. The reasons given were fear of false accusations and concern that non-native English speakers would be flagged unfairly. Open-weight models apply no mark at all.
That history points at the real question. A watermark is a provenance signal about a model's involvement, not a verdict about who did the work, and Anthropic says as much in its own FAQ. The comparison of AI watermarks and AI detectors covers what each kind of evidence can and cannot support, which is the part that decides whether a detection ever becomes an accusation.
Common questions#
The questions below are the ones readers ask most once they know the mark exists, answered from Anthropic's FAQ and the published test.
Does watermarking make Claude's output worse?
According to Anthropic, it has no effect on the content, creativity or readability of what Claude writes. The SynthID Text paper the method is based on tested this by serving a watermarked model to part of Gemini's traffic and found no statistically significant difference in user ratings.
Can a watermark be traced back to me?
Anthropic states that nothing in the watermark or its key allows anyone to recover information about a user, an organisation or a conversation. The mark identifies the model, not the person who typed the prompt.
Was anything I generated before August 2026 watermarked?
No. Marking applies to models launched on or after 2 August 2026, and every model available before that date predates the cutoff. Older models may gain marking during the transition period that ends on 2 December 2026.
Does the watermark work on code?
Barely. Where an exact token is required, so that a different choice would break the program, the nudge is not applied. Comments inside code are the exception, because their wording is free.
Does light editing remove the mark?
Rarely. Light synonym edits cleared two texts out of ten in Balakhonov's simulation, and Anthropic's own wording is that a mark may persist through some editing.
Sources#
- How Claude's text watermark works (Anthropic, 14 Aug 2026, updated 1 Sep 2026)
- How Claude marks AI-generated content (Anthropic Help Center)
- EU AI Act, Article 50, transparency obligations
- Signing the Code of Practice on Transparency of AI-generated Content (European Commission)
- How Claude Watermarks AI-Generated Text (Sebastian Raschka, 22 Aug 2026)
- Scalable watermarking for identifying large language model outputs (Nature, 2024)
- My AI Safety Lecture for UT Effective Altruism (Scott Aaronson, 2022)
- An affordable AI text watermark remover (Kirill Balakhonov, 22 Aug 2026)
- Corpus, code, prompts and judge decisions for that test (GitHub)
- Everything I could find out about AI text watermarks (Kirill Balakhonov, 16 Aug 2026)
- Paraphrasing evades detectors of AI-generated text (Krishna et al., DIPPER, 2023)
- Nothing you generate with Claude today is watermarked (r/ClaudeAI, August 2026)
- SynthID (Google DeepMind)
Last reviewed: 18 October 2026. This page now combines four earlier posts on how the watermark works, its timeline and removal. The supported-model list and the detection-API status are as Anthropic stated them on 1 September 2026 and are the two things most likely to have moved. Both are re-checked monthly until the 2 December 2026 transition deadline passes.
