On August 14, 2026, Anthropic announced that future Claude models will embed a statistical watermark in the text they generate. The company is responding to the European AI Act, which requires providers of generative systems to mark synthetic output in a machine-readable form. The marking is meant to apply globally from launch, because Anthropic still cannot reliably tell users apart by region.
The watermark will be invisible. Nothing gets added to the response: no tag, no hidden character, no identifier of the person who wrote the prompt. The trace will be created during generation itself, and a detector that Anthropic plans to release should later recognize it. Who will get that detector is still unclear.
A system like this has a sensible purpose at its core. It gives platforms and researchers one more data point when tracking mass-generated disinformation. In schools and companies it can help verify a declared use of the model. The danger starts the moment a probable technical origin gets mistaken for authorship. A detector cannot tell who came up with the original idea, who framed the argument, who did the background research or who wrote the first draft. Even so, its result is easily shortened to “Claude’s signature” = “AI text”, and a piece of writing ends up carrying a stigma it does not deserve.
This is not a problem confined to articles produced from a single prompt. The same category will swallow a translation of your own manuscript, a heavier round of language editing, or code that Claude merely added comments to. So before the watermark becomes a routine tool in schools, newsrooms and companies, we need to know how accurate the detector is, who is allowed to use it, how it performs in languages other than English, and how a person can challenge a wrong conclusion. That is what this article is about.
How the text watermark is supposed to work
Let us start with a reminder of how large language models produce text. The model assembles its answer token by token. A token is roughly one English word. In Czech it is messier, because the training data contained far fewer Czech texts, so Czech words often end up split across several tokens. If you want to see how a given word is tokenized, OpenAI has an online tokenizer you can try.
Back to generating the sentence. The model does not know in advance how the text will turn out, but at every step it has several candidates available, each with a different probability. Anthropic has hinted at what the marking will look like in practice: a small change to the text.
Here are a few examples:
Without a watermark:
The cat sits by the window and watches the sun go down.
With an illustrative watermark:
The cat rests on the windowsill and observes the sun as it slips below the horizon.
Other marked variants:
From the windowsill, the cat observes the sun as it slowly sinks below the horizon.
The cat gazes quietly out of the window and watches the sun disappear beyond the horizon.
By the window the cat rests, observing the final moments of the setting sun.
The words in bold are the choices favoured by the secret parameter in this simplified example. As you can see, very little changes for an ordinary reader. The story survives and so, essentially, does the meaning. None of these outputs would offend anyone. But if a text contains enough altered sequences like this, the detector will find them, and a recurring statistical pattern across a longer passage will be enough to declare the text AI-generated.
What Anthropic is describing is its own variant of SynthID-Text, the method Google DeepMind published in Nature back in 2024. It derives pseudorandom values from a handful of preceding tokens and a secret parameter, and uses them to steer the choice between acceptable continuations. The detector then looks for a statistical regularity in the finished text, one that ordinary generation would produce less often.
In the published SynthID-Text method, the strength of that regularity can be expressed as a score:
The token xt is evaluated using pseudorandom functions gℓ, whose output depends on the secret parameter and on the preceding tokens. The detector averages those contributions across the whole text and compares the resulting score against a set threshold. The more tokens it has to work with, the better it can tell a chance match from a consistent pattern.
What do we actually want from a text generator?
Let us put the question plainly. What do we expect from a language model? That the most probable output is the best one. And the example above shows that this need not hold. If the most probable output was supposed to be “The cat sits by the window and watches the sun go down”, then “By the window the cat rests, observing the final moments of the setting sun” simply is not it. It has shifted. Only a little, but it has shifted.
The text is being changed not for the benefit of the output, and therefore of the user, but for the benefit of the watermark. Without that intervention no detectable trace would exist at all. What changes is the choice of certain words or parts of words. In one run the model picks “overcast”, in another “grey”, and both can be perfectly acceptable in meaning.
There is a second side to this, though. The SynthID-Text study compared almost 20 million Gemini responses and found no statistically significant difference between the marked and unmarked variants in user ratings. The same held in a controlled human evaluation. That is a strong result for the Google implementation that was tested, but it is not a validation of future Claude models. Anthropic has yet to publish its own comparison of quality, latency or detection accuracy.
According to Anthropic’s announcement, the marking adds no tokens, so it does not change the price, and the overhead during generation is negligible. Google’s study likewise describes only a small computational surcharge and a way of combining it with speculative sampling. Exact figures for Claude’s infrastructure are not public, and this remains an announced intention for future models. The detection API has not been released and Anthropic is only now preparing the details. Older models get a transition period: under the European rules, systems placed on the market before August 2, 2026 have to comply by December 2, 2026. Anthropic says marking for older models will arrive over the coming months.
A statistical trace is being sold as a signature
The real worry comes from somewhere slightly different. If we accept that the watermark is a kind of “AI signature”, that framing carries connotations which push the problem somewhere it probably should not go. In practice a cryptographic signature confirms that a particular holder of a private key signed particular data. A text watermark gives only a probabilistic result: this sequence of tokens matches what generation with a given secret parameter would produce. It says nothing whatsoever about how the text came about.
According to Anthropic, the detector answers one question: whether Claude probably contributed to at least part of the text. It will not reveal who had the idea, who did the research, who built the argument or who is accountable for the published content. An article produced from a one-sentence prompt will carry the same trace as a manuscript a person wrote themselves and then had Claude edit more heavily for language.
Translating your own text makes the problem even clearer. Picture the author of a dissertation, or a researcher with a paper due to appear in an English-language journal. The author chooses the topic, does the literature review, writes the manuscript in their own language, checks the facts, and then asks Claude for an English translation. Or hires a human translator who uses AI for the final pass, for proofreading, or even for the translation itself. Anthropic states explicitly that translation from one language into another will carry the watermark, because every token of the target text is chosen by Claude. If a school, a newsroom or a corporate system reduces the detector output to a simple yes/no verdict, the author’s translation lands straight in the “AI text” bucket. The ideas, the data, the argument and the original phrasing may all be entirely their own.
The same fate awaits an author who uses Claude as a copy editor. With a light proofread the signal will be weak or absent, because the model changes only a few places. With a stylistic rewrite it gets far more opportunities to choose tokens, and detection grows stronger. The line between “human” and “AI” text will therefore not follow authorship. It will follow how much of the final wording the model touched.
That is a problem. At a school, an “AI text” label can trigger a cheating investigation; at a magazine, a rejected manuscript; at a company, an internal inquiry. Yet the finding on its own says nothing about whether using the tool broke any rule. That can only be judged against conditions known in advance, a declared workflow and other evidence.
Who gets to see the detector’s verdict
Anthropic has not yet said who will get access to the detection API, on what terms, or how detailed the output will be. We do not know whether it will be a publicly available check, a paid developer interface, a tool for selected partners, or some combination of the three. The thresholds, the version of the detector model, the calibration and the procedure for disputed results are all unknown as well.
The secret parameter probably cannot simply be published. If everyone knew it, attackers could more easily verify that they had stripped the watermark, or manufacture texts that imitate it. But secrecy creates an information advantage for the operator. Anthropic will know the method, the test data and the decision threshold, while the person being checked may get nothing more than a score or a category.
That makes auditability all the more important. For a serious decision, a screenshot reading “probably Claude” is not enough. An institution has to record the detector version, the threshold used, the full unrounded score, the length of the sample and the known error rate. Otherwise the result cannot be reproduced later, nor can anyone judge whether a service update changed what it means. Independent oversight can be arranged without publishing the secret parameter, for example through accredited auditors, fixed test sets and archived detector versions. Anthropic has described no such regime so far.
The watermark itself, the company says, carries no identity of the user, the organization or the conversation. It should not be possible to work back from a sequence of words to the account that produced it. The detection service is a separate question. It has to receive the text being analysed, and depending on how it is built, its operational logs may contain the requester’s account, the time of the request or an IP address. We do not yet know the rules for retaining and using that data. For student work, unpublished articles, contracts or source code, that is a risk in its own right, and claims that the watermark is anonymous do nothing to answer it.
What about source code?
In code the watermark has less room than in free text. Syntax, library names, APIs and logical dependencies often pin down the next token quite precisely. After “2 + 2 =” there are not several equally good answers. In the same way, the model cannot freely change the name of a function it calls if the program is meant to run.
Some freedom remains, though. The model picks local variable names, comments, docstrings, the order of certain auxiliary constructs, or one of several comparable implementations. Those are the places where the watermark will influence the choice. So the source text changes here too, though it should stay within functionally acceptable variants.
Detection will be more fragile in code. A short function offers few decisions from which to build a statistical signal. A formatter rewrites whitespace and line breaks, stripping comments deletes part of the free tokens, and ordinary refactoring rewrites names and structure alike. In a project assembled from a hand-written base, additions from Claude, generated tests and code from other tools, no single verdict will describe where the whole thing came from.
A positive finding may come mainly from comments or documentation rather than from the algorithm. A negative result, in turn, proves nothing about human authorship. To judge a developer’s work, the repository history, the issues, the design decisions, the code review and the ability to explain a change all say far more.
The text watermark and C2PA solve different problems
For supported file types such as PNG, JPG and SVG, Anthropic also intends to use C2PA. It attaches a cryptographically signed statement to the file metadata saying that Claude created or processed the file. According to the company, that record contains no identity of the user or the organization.
| Property | Text watermark | C2PA in a file |
|---|---|---|
| Where the trace lives | A statistical sequence of tokens | Cryptographically signed metadata |
| What the check returns | Degree of match with a given generator | Validity of the signature and content of the statement |
| Effect on the content | Influences the choice of some tokens | Need not alter the image data or the file content |
| What weakens the trace | Rewriting, paraphrasing, mixing texts | Stripping the metadata or converting the file |
| What the result tells you | This model probably contributed to the text | A signed tool claims to have created or modified the file |
By its nature, C2PA comes closer to a true digital signature. Its weakness is that it is tied to the file. Metadata is easily lost on export, in a screenshot or during conversion. A text watermark survives plain copying, but its verdict stays statistical. The absence of either trace proves nothing about human origin.
The marking will mostly cover systems that agree to it
Blanket deployment across large hosted services will not create a universal AI text detector. Anyone can run an open-weight model, say one of the Llama variants, on their own machine or server. That gives them control over the inference layer, the tokenizer and the way tokens are sampled. If the marking is not an inseparable part of the model, they can technically switch it off, replace it or work around it.
This does not mean European law grants open models an automatic exemption. Article 2(12) of the AI Act explicitly preserves the obligations of Article 50 for openly licensed systems as well. Purely personal, non-professional use by a natural person does fall outside the user obligations in the regulation. The real difficulty is technical enforceability against a model whose operation the user fully controls.
An awkward asymmetry follows. An ordinary user of hosted Claude can be flagged even after legitimately translating their own article, while someone who deliberately wants to hide the origin of a text will reach for an unmarked local model or a chain of follow-up edits. The detection system therefore sees most clearly the people who stayed inside the regulated ecosystem. The most determined evasion slips past it.
Partial coverage is still not worthless. For platforms, the watermark works as one signal among many when looking for coordinated distribution of large volumes of synthetic content. Researchers can combine a finding with publication times, account networks and distribution patterns. That kind of use works with aggregated data and tolerates uncertainty far better than a decision about a single student or employee.
Transparency, everyone with their own version
By the end of July 2026, roughly 190 organizations had signed the Code of Practice on Transparency of AI-generated Content. The section covering the marking and detection of generative content was signed by 82 of them, Anthropic, Google, Meta, Microsoft, Mistral and OpenAI among them. A shared obligation, however, does not mean a shared technology.
Each provider can choose a different secret parameter, and possibly an entirely different method. Anthropic’s detector will look for Claude’s trace. A negative result tells us nothing about whether the text came from Gemini, ChatGPT, a local model or a human being. Without a common interface, a school or a newsroom would have to send one document to several services and keep track of different thresholds and limitations for each of them.
The European code asks for interoperability to the extent that the state of the art allows. It has not yet been decided whether we get a common standard for querying several providers, a federation of separate detectors, or a babel of mutually incompatible services. And even a shared user interface would not on its own fix the differences in measurement quality.
Open questions for APIs and companies
Anthropic announced a global rollout in future models, but has not publicly distinguished between claude.ai, the direct API, Amazon Bedrock, Google Vertex AI and individual enterprise contracts. We do not know whether every call will be marked, whether exemptions will exist, or how the strength of the signal changes with a different temperature, sampling method or output limit.
In a corporate application, Claude often produces only part of the result. The software adds a fixed template, fills in values from a database, merges responses from several models, shortens the text or translates it. The resulting document then carries a weak Claude trace, several different traces, or none that is easy to recognize. Labelling a whole application or document with a single binary value distorts that production history.
The European Commission guidelines divide obligations between providers and deployers at different points in the chain. Without technical documentation from Anthropic, though, developers do not know whether they have to preserve the watermark, how to describe further processing, or who bears responsibility for the detectability of the result. They need those answers before marking becomes part of contracts, audits and compliance checks.
Without the parameters, a score cannot be read honestly
Every threshold balances two errors. Set the detector more sensitively and it catches a larger share of marked texts, but false alarms go up as well. A stricter threshold cuts the number of false findings and misses more watermarks at the same time.
The SynthID-Text study reports some of its results at a false positive rate of one percent. That is not a published parameter of any future Anthropic product, but a hypothetical example shows the effect of base rates nicely. Imagine a detector with 95 percent sensitivity and a one percent false positive rate. In a set of 10,000 documents, only one percent, that is 100 texts, carry a watermark. The detector correctly finds about 95 of them and at the same time wrongly flags roughly 99 of the remaining 9,900. Among the positive results there will be slightly more false findings than correct ones.
Anthropic has not published sensitivity at a fixed false positive rate, the shortest usable sample, uncertainty intervals or calibration by language and text type. Nor do we have results for translations, legal drafting, student work or source code. Without those numbers, a score cannot be used seriously in grading, in disciplinary action or in a decision to reject a publication.
The academic study assumes the detector will abstain from a decision on an uncertain sample. Institutional software, however, usually demands a plain yes or no. The moment “cannot be determined reliably” disappears as an option, a statistical estimate turns into administrative certainty that the data do not support.
Czech, and every other language, needs its own calibration
Signal strength grows with the length of the text and with the number of places where several acceptable continuations exist. The main SynthID-Text experiments worked with, among other things, the English-language ELI5 dataset and specific Google models. Those results tell you nothing about reliability for Czech academic articles, term papers or official documents, and the same caution applies to any language that was never tested.
Czech is a heavily inflected Slavic language whose sentence structure differs sharply from English. That changes both the tokenization and the distribution of probabilities. On its own it does not tell us whether the trace will be stronger or weaker; the outcome depends on the tokenizer, the training data, the model and the generation settings. Which is exactly why we need a separate Czech calibration by length and genre, rather than a number borrowed from an English test.
Czech universities already advise caution with the AI detectors on the market today. Charles University in Prague warns that current tools cannot prove the use of generative AI with any certainty, and builds its guidance instead on a declared workflow and an assessment of the work itself. Masaryk University in Brno points to probabilistic results, limited verifiability and the need to protect texts sent to third parties. Style-based AI detectors work differently from a watermark with a secret parameter, but the experience of institutions misreading the output carries over.
Gaming the system
Anthropic concedes that light editing usually does not remove the watermark, while a full rewrite does. Between those two poles sit paraphrasing, word substitution, mixing marked and unmarked passages, and round-trip translation. Attempts at various watermark removers are already appearing, whether as browser extensions or as standalone tools.
A preprint focused on SynthID-Text recorded weaker detection after paraphrasing, after mixing texts and after translating back and forth. The authors tested an open implementation, the Sheared-LLaMA 1.3B model and 200 samples of 200 tokens each. The result therefore cannot be presented as a measurement of Anthropic’s future system. A peer-reviewed EMNLP 2024 study found a sharp drop in detection after targeted paraphrasing for two other families of watermarks. Both papers, though, are a reminder of the difference between resistance to ordinary copy editing and resistance to a person deliberately erasing the trace.
Translation plays two distinct roles. When Claude translates an original human text, it generates new tokens and embeds its own watermark in the result. When an already marked text is translated by a different system and then translated back, the original statistical sequence falls apart. So translation creates the trace in one case and weakens it in the other. What matters is which model generated the version handed to the detector.
Robustness also collides with accuracy. A stronger intervention in token selection can leave a clearer trace, but it narrows the model’s freedom. A very gentle method, on the other hand, is more easily lost in a short, factual or subsequently edited text. Without published parameters for Claude, we do not know where Anthropic will set that trade-off.
What does the EU actually want?
Article 50 of the AI Act requires providers of generative systems to ensure that synthetic output is marked in a machine-readable form and made detectable, as far as the state of the art allows. It provides an exemption for standard editing functions and for interventions that do not substantially alter the input data or their meaning. Special rules also apply to publishing texts in the public interest that have undergone human review and for which someone bears editorial responsibility.
The regulation does not turn the detector into proof of plagiarism, fraud or authorship. It demands transparency about origin and about the involvement of a system. If a school or an employer attaches a sanction to a score, it is building its own decision-making process and has to defend its accuracy, its proportionality and the right to a defence.
The same Code of Practice was signed by a broad group of providers, so marking will not remain a Claude peculiarity. That raises the chance that information about machine origin becomes a normal part of the digital environment. It also raises the risk that a whole range of different technical signals ends up under one misleading label: “AI text”.
Where the watermark makes sense
The watermark has genuinely useful applications, as long as we do not expect more from it than it can deliver. In an analysis of millions of public posts it helps reveal an unusual share of content from a single system. Combined with network analysis, publication times and account behaviour, it contributes to investigations of coordinated disinformation campaigns. At that scale, individual errors can be described statistically.
In education, a finding opens a conversation about how the student used the tool and whether that matched the assignment. It also supports rules that require translation, language editing or the generation of parts of a work to be described openly. What it should not do is replace an assessment of the content, of the intermediate drafts and of the author’s ability to defend their conclusions.
It is most useful as an additional signal about the origin of a text, one that gets evaluated together with other evidence. The more serious the consequence, the less an institution may rely on the detector alone.
Minimum rules for schools, newsrooms and companies
Before an organization feeds a result into a decision about a specific person, it should publish exactly how it proceeds:
Validate the detector for the specific use
A generic test in English is not enough. An organization needs the sensitivity, the false positive rate and the uncertainty intervals for the model, language, genre and text length it actually deals with.
Allow an inconclusive result
A short sample, a heavily edited one or one that is otherwise unsuitable has to end up as “cannot be determined reliably”. The system must not force it into one of two categories.
Keep a reproducible record
That means the exact wording of the text that was checked, the date, the detector version, the threshold set in advance, the full score and the calibration used.
Ban automatic sanctions
A positive result opens a further review. On its own it must not decide a grade, a disciplinary measure, a dismissal or a rejected publication.
Give the person all the evidence and room to respond
The author being checked needs to know the result and the limits of the method. They have to be able to submit notes, sources, version history, a repository, the original text before translation and a declared account of how AI was used.
Ensure independent review and an appeal
The final verdict belongs to a human being who weighs all the evidence. An appeal has to be handled by a different person or body.
Protect the documents being checked
The organization defines in advance the legal basis for processing, the retention period, who has access and the rules for deletion. Sensitive text should not be sent to an external API without adequate contractual and technical safeguards. If a secure local version of the detector becomes available, it will be the better option for confidential documents.
The wording in the user interface has to stay precise as well. “A signal matching Claude’s watermark was found” is a narrower and more honest formulation than “written by Claude” or “AI text”. The first describes a measurement. The other two attribute to the system an authorship that the detector never establishes.
Sources
- Anthropic: How Claude’s text watermark works, August 14, 2026
- Dathathri et al.: Scalable watermarking for identifying large language model outputs, Nature 634, 2024
- Google DeepMind: Watermarking AI-generated text and video with SynthID, May 14, 2024
- European Commission: Code of Practice on Transparency of AI-generated Content, updated July 31, 2026
- European Commission: Strong backing for the Code of Practice on Transparency of AI-generated Content, list of signatories as of July 31, 2026
- European Commission: Questions and answers on the Code of Practice, 2026
- European Commission: Guidelines on transparency obligations for providers and deployers of certain AI systems, updated August 6, 2026
- European Union: Regulation (EU) 2024/1689, Artificial Intelligence Act
- AI Act Service Desk: Article 2: Scope
- AI Act Service Desk: Article 50: Transparency obligations
- C2PA: Coalition for Content Provenance and Authenticity
- Han et al.: Robustness Assessment and Enhancement of Text Watermarking for Google’s SynthID, preprint, 2025
- Rastogi and Pruthi: Revisiting the Robustness of Watermarking to Paraphrasing Attacks, EMNLP 2024
- Charles University: Recommendations on generative artificial intelligence in final theses (in Czech), updated June 2, 2026
- Masaryk University: Why don’t AI detectors work?, April 20, 2026
