Anthropic’s Text Watermarks
Last week, Anthropic published a support document describing how Claude will mark AI-generated content in future models. It opens with this: "Anthropic has signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, as a provider of both generative AI models and generative AI systems."
The document then explains what that commitment means: "New models will mark AI-generated content from day one. Claude models launched in the EU on or after August 2, 2026 will support machine-readable marking at launch. Generated text will carry embedded watermarks, and generated files will include digitally signed provenance metadata where supported."
Two questions came to mind immediately. Will I keep authorship of my work? And how is the watermark added — can it be manipulated or removed?
Anthropic's document stays vague. Still, enough information is available to answer both.
Authorship
The question clients kept asking was: "Does the watermark say that I'm not the author, that I don't have authorship?"
To answer it, you have to separate two things. The watermark indicates how content was created. Authorship is a social and legal attribution of who is responsible for a work. These live on different planes. The watermark says nothing about authorship — it cannot grant it or revoke it, because that isn't its business. It is a provenance signal, nothing more: an indication that a supported model processed these tokens.
One of the few things Anthropic's document is explicit about is what a detected mark means. It shows that content may have been processed by Claude, but it does not confirm full provenance on its own. It says what a machine did. It says nothing about what a person did or didn't do.
So the short answer is no. The watermark makes no claim that person X isn't the author. It makes no claim that no human is the author. It does one thing: it records something about the text's history and stays silent about who was involved. A client's document with their byline on it is as much theirs after the watermark as before. The watermark didn't touch the authorship question at all.
The anxiety is understandable, but it has two sources. The first is the fear that the watermark strips authorship. That one is answered — it cannot strip what it doesn't address. The second, and more fundamental, is the question underneath: "Is AI-generated text still copyrightable, and does the watermark make the AI involvement detectable?"
That is the real issue, and it's legitimate, but it has nothing to do with the watermark. The copyright question exists whether or not the text is marked. In the U.S., the Copyright Office holds that works lacking sufficient human authorship aren't protectable, and fully AI-generated material can't be registered. As of March 2026, this is settled law: the Supreme Court let the human-authorship requirement stand by denying review in Thaler v. Perlmutter. The watermark changes none of it. (This is the conceptual and current U.S. posture, not legal advice, and the picture differs across jurisdictions.)
The uncomfortable but honest truth is this: the watermark doesn't take away authorship. It takes away deniability.
If your "authorship" of a fully AI-generated piece depends on nobody being able to detect that it was AI-generated, you never had authorship in the legal sense. Your "authorship" was undetectability.
How is the watermark added?
Anthropic says only that the watermark is embedded in text imperceptibly and survives copy-paste and some editing. Nothing is added to the text, and the watermark doesn't change the meaning.
Anthropic hasn't disclosed the insertion mechanism. No one outside their watermarking team knows exactly how it works. That's the straight answer — everything past it is inference.
Still, understanding how a language model works makes it easier to see how it could be done. A language model produces one token at a time; a token can be a word, part of a word, or a combination. At each step, it computes a probability distribution over the entire vocabulary — thousands of possible next tokens, each assigned a score — and samples one. Often several are near-equally good. "Striking" versus "notable" versus "significant": the model assigns them similar probabilities and picks one.
Watermarking usually inserts one step before that pick. Google DeepMind's SynthID-Text scheme takes the last few generated tokens and runs them through a hash function together with a secret key, producing a pseudo-random number. That number assigns a value to every token in the vocabulary — a random score stamped on each candidate, for that position only. The model then biases its choice toward a candidate with a high watermark score. SynthID calls this Tournament Sampling. Whether Claude uses this or another approach is undisclosed.
The selection isn't blind: the scheme runs the top candidates through several bracket rounds, with the watermark value breaking ties, while the model's own probabilities dominate enough to preserve quality. Among near-equivalent options, the highest-scoring one wins. If Anthropic works this way, nothing is added to the text — no hidden characters, no metadata. What changes is which of several equally fluent words the model lands on.
The watermark becomes a statistical skew distributed across thousands of micro-decisions, and only the secret key knows its direction.
One on-record hint locates where this happens. An Anthropic engineer said the model isn't aware it's being watermarked — which places the insertion at the decoding stage, where the model's next-token probabilities are converted into the token actually emitted. Anthropic says it is working on features to let users and third parties detect these watermarks, with details promised in forthcoming documentation. I'll return to this when that lands.
Can the watermark be manipulated or removed?
There's no yes-or-no answer because the question bundles two that have different answers: Can it be degraded by editing? And can you confirm it's gone?
Copy-paste, formatting changes, moving text between documents — the mark travels intact, because it lives in the word choices and the words are unchanged. Anthropic states the watermark "may persist through some editing," and separately that a mark might not be detectable after text is "heavily edited, paraphrased, translated, or mixed into other writing." So editing degrades it.
But can you confirm it's gone? You can't — there's no detection tool.
The sharper point
The asymmetry is the real story. The watermark is simultaneously fragile and unerasable on demand. Fragile, because ordinary editing degrades it. Unerasable on demand because without a tool you can't confirm you removed it. It is weak evidence and an unreliable target at once. That double failure — too fragile to prove AI use, too opaque to cleanly defeat — is a more interesting thesis than "it's permanent" or "just edit it out," and it's the one the facts support.
The AI detector
Detectors like Pangram, GPTZero, and Originality are a different thing entirely, answering a different question. A watermark reads a mark that was deliberately placed. A detector guesses from style.
Anthropic's watermark asks: does this text carry the specific signal a supported Claude model wove in at generation time? Pangram and the others ask: does this text look AI-generated? — a guess based on statistical patterns the detector was trained on from AI and human writing.
What does a hit mean? A watermark hit means a Claude model processed these tokens — provenance, not authorship, and not even necessarily generation, since Claude might only have translated or polished human text. A detector hit means the text statistically resembles AI writing. Neither establishes authorship. They fail differently: the watermark is precise and narrow, the detector fuzzy and broad.
One thing to be clear about, because the confusion is common: Anthropic's watermark doesn't replace tools like Pangram, GPTZero, or Originality. They aren't on the same axis. The watermark isn't a better detector; it's a different category — a planted provenance signal versus an inferred style profile. Same label, different machines, different questions, different failures.