Anthropic says Claude can now mark generated text in a way that survives copy-and-paste and some editing. It has not explained the mechanism. The available clues point toward token-level statistical watermarking—with important limits for short passages, paraphrases, and code.
On August 11, 2026, Anthropic updated a Help Center article with a consequential claim: Claude models launched on or after August 2 embed an imperceptible, machine-readable mark in the text they generate. Anthropic says the mark travels with copied text and may survive some editing. Files such as PNGs, JPGs, and SVGs receive a different treatment: cryptographically signed provenance metadata using the C2PA standard.
The policy is tied to the EU AI Act’s transparency rules, but Anthropic says the rollout is worldwide. It covers Claude across Anthropic’s own products, its API, coding tools, and deployments through major cloud platforms. The announcement does not describe an EU-only switch or an opt-out.
What Anthropic has described is the watermark’s behavior, not its mechanism. Technical documentation and detection tools are promised later. That leaves room for uncertainty—but not an unlimited number of plausible designs. The stated properties narrow the field considerably. This essay offers a testable inference from those properties and from established watermarking research; it is analysis, not confirmation of Anthropic’s implementation.
What Anthropic has actually said
Before speculating, it helps to separate the confirmed claims from the interpretation:
- Rollout: Claude models launched on or after August 2, 2026 support marking at launch; older models are expected to be updated during the EU AI Act’s transition period.
- Text: the mark is introduced during generation and remains part of the text when it is copied elsewhere.
- Files: generated files such as PNGs, JPGs, and SVGs use signed C2PA provenance metadata rather than the text-marking method.
- Detection: technical documentation and tools for users or third parties have not yet been released.
- Meaning: a detected mark may show that content was processed by Claude. It does not, by itself, prove that Claude authored the ideas or the entire text.
- Limits: the absence of a detectable mark proves little. Short passages, substantial editing, paraphrasing, translation, or mixtures of human and model-written text may weaken or erase the signal.
Those limitations are not incidental. They are exactly what one would expect from the most plausible mechanism.
The leading hypothesis: a token-level statistical watermark
Core hypothesis
Anthropic is most likely using a keyed statistical watermark applied during token sampling. The system subtly favors certain otherwise plausible token choices, creating a pattern that can later be detected across a sufficiently long passage. The mark is probably not hidden Unicode, clipboard metadata, or a visible tag.
Confidence: moderate. The public description fits this family of methods well, but Anthropic has not confirmed the design.
A language model generates text one token at a time. At many steps, several next tokens are plausible: “large” or “big,” “however” or “but,” one sentence rhythm or another. A statistical watermark uses that freedom. With a secret key and the preceding context, the generator can pseudorandomly favor some candidate tokens over others—gently enough that no individual word looks suspicious.
The signal appears only in aggregate. Across a long passage, preferred tokens occur more often than they would under ordinary generation. A detector using the corresponding key can test how unlikely that skew would be in unmarked text and return a confidence score. The watermark is therefore not a hidden object inside the document. It is a pattern distributed across many ordinary word choices.
This is an established research direction. Kirchenbauer and colleagues published a green-list/red-list design in 2023. Scott Aaronson described a cryptographic approach that biases sampling while preserving the output distribution in expectation. Google DeepMind’s SynthID-Text, published in Nature in 2024, uses a tournament-sampling method and has been deployed with Gemini. Anthropic would not be inventing a new category; it would be adopting one of several known approaches within it.
Why the obvious alternatives fit less well
Invisible Unicode. Zero-width spaces, unusual whitespace, and homoglyph substitutions can carry hidden data through a basic copy-and-paste. But they are brittle. Text normalization, plain-text filters, retyping, or simple cleanup can remove them. They also create practical risks in source code, JSON, configuration files, search indexes, and diff tools. That makes character-level steganography a poor fit for a system meant to operate across prose, structured output, and Claude Code.
A statistical watermark avoids those problems because it uses ordinary characters. There is no special glyph to strip; the signal lies in the distribution of token choices.
Clipboard or file metadata. Anthropic already distinguishes file provenance from text marking: files receive C2PA metadata, while the text mark is said to travel with the text itself. Metadata can disappear when content is pasted into a plain-text field, re-encoded, or converted. Anthropic’s contrast between the two methods points toward an in-band signal rather than an attachment to the clipboard or document container.
How the hypothesis explains the fine print
Short passages are hard to classify. A statistical test needs enough observations to separate signal from chance. A sentence or two may contain too few flexible token choices. Published systems vary, but reliable detection commonly improves with passages measured in hundreds rather than dozens of tokens.
Paraphrasing and translation weaken the mark. The signal depends on the particular tokens selected during generation. Rewriting the same meaning in different words replaces those choices. Translation changes the sequence even more extensively. Under this hypothesis, a missing mark after a substantial rewrite is expected—not evidence that Claude was never involved.
Light editing produces graceful degradation. Correcting a few sentences in a long essay may leave most of the statistical pattern intact. As edits accumulate, confidence should fall rather than flip cleanly from “present” to “absent.” That matches Anthropic’s claim that the mark may survive some editing.
Detection requires controlled tooling. Readers cannot inspect a statistical watermark by eye. A detector needs the relevant key material or access to a service that holds it. My secondary prediction is therefore that Anthropic will offer a hosted detector or API, perhaps with model-specific or rotating keys, rather than publish everything needed to reproduce detection locally. That is a prediction, not a disclosed fact.
“Processed by” is the right claim. Suppose a person writes a draft and asks Claude to shorten, translate, or polish it. Claude’s pass may introduce the watermark even though the argument, evidence, and much of the wording originated with the person. A positive result would indicate Claude’s involvement somewhere in the pipeline. It would not settle authorship, originality, intent, or misconduct.
The hardest case: code and constrained output
Statistical watermarking works best when the model has several acceptable next-token choices. Code often provides the opposite environment. In for i in range(len(items)):, an API call, a JSON schema, or a deterministic completion, many tokens are fixed by syntax or specification. Nudging the model toward a different token can make the output invalid.
Under the statistical-watermark hypothesis, watermark strength should rise with generation entropy—the amount of legitimate choice available to the model. Creative prose should be easier to mark than boilerplate. Technical explanation may fall somewhere in the middle. Code may carry most of its signal in comments, variable names, docstrings, formatting choices, and other areas where alternatives remain acceptable.
This yields a useful test. If Anthropic’s documentation warns about temperature-zero generation, constrained decoding, structured formats, or code, that would strengthen the case for a sampling-based design. If detection is equally strong in rigid JSON and free-form prose, the mechanism is probably more complicated than the one proposed here.
What the watermark would—and would not—change
The strongest case for detection would be long, minimally edited text generated by a covered Claude model. The weakest cases would be short excerpts, heavily revised documents, translations, mixed-authorship drafts, and constrained outputs. That asymmetry matters: a watermark may catch straightforward copy-and-paste use more reliably than deliberate evasion.
It also means institutions must resist turning a probabilistic provenance signal into an authorship verdict. A positive result could support a claim that Claude touched the text. A negative result could not establish that Claude did not. Schools, employers, publishers, and courts would need calibrated false-positive rates, minimum-length guidance, version information, and an appeal process before using detection in consequential decisions.
The competitive effects are equally uneven. Providers that control both the model and the sampler can enforce a watermark across their services. Open-weight models cannot guarantee the same behavior because the operator can alter or remove the sampling logic. A worldwide rollout may reflect Anthropic’s policy position, but it also bets that other large providers will adopt comparable systems quickly enough to reduce incentives to switch.
There is a real upside. Even an imperfect “this text likely passed through Claude” signal could help platforms triage automated spam, help model developers identify synthetic material in training corpora, and give publishers a more principled alternative to today’s generic AI-text classifiers. But its value will depend less on the existence of the watermark than on how transparently the detector is calibrated and how cautiously institutions interpret its output.
Five predictions that could prove this theory right—or wrong
- Sampling-time insertion: Anthropic will describe a keyed statistical signal introduced while tokens are generated, probably resembling the Kirchenbauer, Aaronson, or SynthID family of methods.
- A minimum useful length: the documentation will specify that reliable detection requires a substantial passage and will publish false-positive rates at defined thresholds.
- Controlled detection: Anthropic will provide a hosted detector, API, or restricted verification mechanism rather than release reusable secret keys without controls.
- Weaker performance on constrained text: the documentation will include caveats for code, temperature-zero output, structured data, and other low-entropy generation.
- Versioned or rotating signals: detection will account for model version, rollout date, or changing keys so that a compromised design can be replaced.
The theory would be weakened if Anthropic reveals that the mark is primarily Unicode steganography, clipboard metadata, or another post-processing layer. It would also be weakened if the detector works reliably on very short passages, survives full translation, or shows no dependence on how the text was sampled.
Until the technical documentation arrives, the most defensible conclusion is narrower than either the alarmists or the enthusiasts suggest. Anthropic appears to be deploying a probabilistic provenance signal, not an indelible authorship tag. It may survive casual copying and modest edits while remaining fragile under rewriting, weak on short or constrained text, and unable to distinguish “Claude wrote this” from “Claude touched this.”
That is still consequential. The central question is not whether the watermark is perfect—it will not be—but who can run the detector, how its uncertainty is expressed, and what institutions decide a positive result is allowed to mean.
Disclosure and caveats: This article is an analytical hypothesis written in August 2026. It is based on Anthropic’s Help Center article “How Claude marks AI-generated content,” contemporaneous reporting, and published watermarking research including Kirchenbauer et al. (2023) and Google DeepMind’s SynthID-Text work in Nature (2024). Anthropic has not confirmed the implementation described here. All mechanism claims remain inferences and should be revisited when official technical documentation and detection tools are released.