▲ 451 points
back
423 comments
> When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.
I'd like to know a lot more about how that works.
A lot of my interactions with Claude return pretty precise text. If I ask it to edit a project and refactor a specific function in several places I know exactly what I want to happen, it will NOT be OK if those refactors have some kind of weird pattern baked into their text to act as a watermark.
I guess this may be covered by this:
> Content generated by Claude may not carry a detectable mark if, for example: [...] The passage is very short, leaving too little text for a reliable signal;
>I'd like to know a lot more about how that works.
My guess is that it works like Gemini's SynthID: by altering the logprobs of the next token.
Like, for every 10th token, instead of outputting the most probable, it outputs the 17th most probable, or something. (Obviously it's way more complicated but I think conceptually this is how it works.) No human will notice this, but a classifier trained on Claude's output will.
So it's not like the watermark is the words "le epic bacon" and Claude will output "le epic bacon" in everything. That would be extremely annoying (and easy to defeat).
Scott Aaronson talks about his project at OpenAI to do this^
You can carefully select which pseudorandom number generator (prng) you use to be able to id text of a certain length. I expect there is some performance characteristic you have to manage since you're doing this on every inference, but once you do that it doesn't change the output in any meaningful way (the prng is still a statistically valid prng, it just happens to let you check if the output used that prng)
The point is that you can do this simply by swapping to a different RNG, which isn't noticeable to the end user, and while it changes the output, it's not any different from how using a different seed or being lumped in a different batch will change the output.
^ excerpt:
> So then to watermark, instead of selecting the next token randomly, the idea will be to select it pseudorandomly, using a cryptographic pseudorandom function, whose key is known only to OpenAI. That won’t make any detectable difference to the end user, assuming the end user can’t distinguish the pseudorandom numbers from truly random ones. But now you can choose a pseudorandom function that secretly biases a certain score—a sum over a certain function g evaluated at each n-gram (sequence of n consecutive tokens), for some small n—which score you can also compute if you know the key for this pseudorandom function.
Most likely this method https://arxiv.org/pdf/2301.10226 (EDIT: and Google's SynthID paper which builds on it https://www.nature.com/articles/s41586-024-08025-4)
> I'd like to know a lot more about how that works.
Count load-bearing words using two different algorithms in a belt-and-braces fashion
It was quick :) … https://claudewatermarkremover.app/
My guess is it will be similar to how Genius watermarked lyrics, using things like variants of punctuation
https://www.pcmag.com/news/genius-we-caught-google-red-hande...
Maybe there is a reason why Opus 5 produces such word salad conversations
What happens if someone handwrites a Claude output, then someone uses that handwritten text as a reference.
Now you've got a watermarked idea which may have no direct linkage to the usage of Claude.
I ran some tests from the watermarking literature: https://johnjwang.com/post/2026/08/12/how-claude-watermarkin...
Short version: it's likely a SynthID style statistical watermarking scheme that Anthropic is using. There's likely no hidden unicode and no large stable green/red scheme.
Longer version: I found some really statistically significant outcomes when using Gloaguen et al.’s (https://www.sri.inf.ethz.ch/blog/probingsynthid) detection algorithm for SynthID, though unfortunately it seems like the models might be pre-biased to pass that test already. The difficult thing is that it's hard to conclusively know which models definitely already have watermarking enabled and if there are any models that don't have watermarking, which means that being able to get a highly positive statistical result is much harder.
You can take a look at the full writeup, but many of the clues from Anthropic's blog post, plus negative results on many of the simpler tests, point to them using such a scheme. Of course, it's possible that they came up with a novel new scheme/algorithm, but amongst the available literature, the SynthID family of models is probably the best bet.
I notice the "Limitations" section talks about how content only at some point touched by Claude may return a positive, and content that returns a negative may still be Claude generated. But I really would have liked for them to state explicitly that entirely false positives where a piece is fully human-written may still be marked as generated, because too many institutions with the power to ruin someone's life over that have trouble understanding the concept.
I've heard that this kind of watermarking process works by biassing the statistical sampling towards a partition of the set of possible next tokens (red set and green set), at each position. It might only be a slight nudge each time, but over a sequence of tokens, the likelihood of repeating the bias by chance is increasingly improbable.
The bias is different for each position and follows a defined RNG, seeded somehow predictably.
Can be either an open algorithm, or not. If not open, then an API could be provided to determine if text is watermarked or not.
How it applies to code - maybe it could be a subtle nudge to symbol names, etc, I'm just speculating (I only read about this in passing very recently).
So my code that Claude makes, which previously was using the best (most probable) tokens for the job, will now be getting worse in random positions, to appease a voluntary EU suggestion. Love that.
Many good comments here. It’s somewhat common for me to voice record say a blog post of product updates, more like a ramble. Then have Claude clean it up. Then argue back and forth about certain things until it’s good, then make a final pass sometimes to change a few key words. This is incredibly different than pure ai text. Presumably it will show as ai generated here, even though I would argue it is not really. So I can’t use Claude for this usecase anymore.
I think the solution is assume everything is ai generated unless told otherwise and rely on authorship/brand as a sign of quality.
All big LLMs already visibly watermark all their text with easy to detect annoying phrases and turns of speech that everyone is already sick of hearing. Why do AI companies keep making their products worse to appease anti-AI, it’s not like they’ll suddenly start supporting it if you do so. If you’re worried about European customers, just relax your firewalls to let more VPNs through, if the productivity boost is high they will use it anyway if their rules keep crippling their own models
We need to just stop pretending we can reliably tell if plain text is written by an LLM.
It’s just not a reasonable ask.
I have had a hunch for a while now that (in addition to these tools), Anthropic has actually leaned in to Claude's distinctive manner of writing since it makes the text more obviously AI generated and thus less susceptible to misuse.
That's not necessarily the same thing as a markov-style fingerprint but it could be a correlated factor.
An interesting factor of this is competition.
If Claude was the only model family they could ship a change like this and users who want to cheat (or don't like watermarks for other reasons) would just have to put up with it.
In a world with many different competing models, the risk of losing customers to other providers over this is much more real.
Maybe they've looked at the numbers and the portion of people who clearly use Claude to cheat on examples etc is so tiny that losing them to other providers isn't a problem?
Can someone help me understand how exactly this watermarking of text works?
Given that text is, well, text, and not some kind of binary format, I don't see how any watermarking can work unless you insert characters which are invalid under Unicode. I further don't really understand how this won't be perceivable by assistive technology (the "watermark" will just appear as either unreadable characters, or if the watermark is mixed thoroughly enough into the text, it will scramble the text to any speech synthesizer and will make it really really obvious). Thus, I don't see how this wouldn't be insanely trivial to remove. And this is before we get into things being put on the clipboard. Sure, I can press the "Copy" button at the end of each response, but what I can also do is manually select the response and copy it, or only copy partial selections, or any number of other things. How does this "watermark" (or any "watermark" technology) take into account this?
So, really, to summarize this: I see no way of this actually being technologically achievable unless we revise the very core of how computers work and encodings for textual information. So I'm very curious as to how this is actually supposed to work.
I cannot wait for the inevitable "I've always used Claude watermarks in my writing, even before we had LLMs!" when someone gets caught using an LLM.
Seems like an awful idea. I hope that that "watermark" will soon be discovered, reverse-engineered, and that tools to remove it will appear.
If I understand correctly, this means that any text with the "watermark" is legally uncopyrightable, including code.
Relevant comment from a few days ago:
A surprising number of people are worried that the code they don’t read will be imperceptibly different.
> We’re also working to enable users and other third parties to detect Claude’s embedded watermarks and provenance metadata.
This seems to be similar in execution to Google's SynthID. I hope they release actual code the technically proficient can use, unlike SynthID which can only (afaik) be queried with Gemini's UI.
Especially when they say they'll let you use their tool to detect it, this just seems like a cat and mouse game. Have Claude write a long passage, then run it through another model with instructions to slightly paraphrase it. Ensure with the tool that it's no longer watermarked.
Even if all models are mandated by EU to do their own watermarking, it doesn't take a new frontier model to be capable of paraphrasing it, so you can use 2026's open models to do that paraphrasing, far into the future.
The funny part is that a lot of people have already developed an impressive ear for spotting AI-isms, so for now I'm not even sure how important it is to have this. No technique can be 100% guaranteed accurate anyway, and humans are pretty good at recognizing AI already.
This is outrageous. I hope only Anthropic will do this. Are they going to disclose at least the specific Unicode whitespace characters used for the watermark? Or will they use some other trick?
If I heavily edit LLM output, will this still hold the watermark?
You really can't make this stuff up, it doesn't make any sense.
I don’t like the idea of hacking a response to contain a watermark. I also don’t like the idea of false positives detections coming directly from Anthropic. If people read more AI generated content, people will probably start writing more in that style
This is becoming serious anthropic hasn't even drop the anti detected pattern or mechanism this platform https://founderstoday.org/claude-watermark-remover is claiming to detect it using their own internal pattern but i tried it though it result is quite okay i can't even tell if it worked or not because the text are the same am wondering what they removed
I wonder if this is at least partially motivated by Anthropic's need to know what training materials are themselves Claude-generated.
Is the detection mechanism going to be open, free, and possible to run locally without prostrating to an opaque third-party company that will do whatever they want with the text content provided (including using it for training), and take no responsibility in case of false-positives for which there can exist no proof or evidence against by the victim? This is another useless, if not actively harmful, performative EU regulation, for which they ought to take the full blame despite the fact "AI" companies have been researching and working on watermarks, including in text, for a while now. Just copy-and-paste everything you see and let a machine decide for you if what you're reading is slop or not. Real propaganda machine doesn't care about inane rules and won't waste time with gimped mainstream models either.
>Claude may not be the original author. People often use Claude to proofread, translate, summarize, or convert files. The output can carry a Claude mark even if the underlying ideas, text, or data originated from another source;
Such models already struggle not making any unnecessary or unwanted changes to a corpus, this makes them unable to by design.
Notice the subtle capture in you having to use Anthropic to identify Anthropic's watermarks? Smart of them
Huh... I wonder if some big version of a bloom filter would work as well. Hash all output text, probably in chunks of a couple tens of tokens each (that would need tweaking to find the most useful hash input length I guess), and smash 'em into a bloom filter. Every month or something, Anthropic releases a giant file containing whatever huge length of bytevomit would have to be used to get an acceptable false positive ratio. (In terms of bloom filters! Meaning: still far from a perfect ratio.) Maybe one for each model they provide or something?
Then at least you could have two weak-postive signals, and a strong-negative signal. (Though one that only fits precise chunks of tokens) I'm sure I'm missing something here, but my groggy morning brain thinks that doesn't seem too bad.
Thats why recently it pushes so much comments in code - it has to squeeze the watermarks somewhere
I think it's definitely important that any AI generated content can be easily identified as such. I think the new EU law that requires that, has too many unnecessary exceptions.
So great that Anthropic is doing something about this, but it's not clear what their watermark exactly is. How do I, as a user running into some content online, know that it's generated by Claude? What is their watermark?
It sounds to me like they create the pattern in the regular text of the content, which sounds interesting, but also odd, unreliable, and may limit the content you can get out of Claude. Will it subtle change the words in order to hide this pattern in it? I don't know if that's something anyone wants.
> Generated text will carry embedded watermarks, and generated files will include digitally signed provenance metadata where supported.
This should make it easier to catch cheaters who use Claude, right? Unless everyone runs their artifacts through some watermark and metadata sanitizer?
>Content generated by Claude may not carry a detectable mark if, for example: ...
>A file’s metadata was stripped through format conversion, re-saving, screenshots, or other means
Ah. So what essentially every single consumer-oriented media host does. Gotcha.
I fully recognise this is a hard problem, but hopefully metadata isn't the only method for media. Standard procedure is to shrink files for storage and privacy reasons, and non-visual metadata goes out the window by default.
So this won't be happening in the US, but in the EU:
"When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.
Because the watermark is part of the text, it will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing. Watermarking will be applied at the model level, which means it will be present no matter which Claude product or surface the text comes from."
Seems to me like this creates a huge incentive to game the watermark. Also, how does it prevent having AI generate the text, then the user copy-paste it into a clean document?
OpenAI has been watermarking their images with C2PA for some time.
I wonder how the caveman skill will affect this. Also, you can probably put the output of Claude in another LLM to get rid of the watermark.
No mention of what data they are specifically encoding. Will it be like printing dots, traceable to the exact account that generated the text?
Like others have said, it's not reasonable to ask this.
I propose we defeat this with the obvious: Simply, figure out what are some of the markers Claude and others will use for these tools, and sprinkle them randomly on everything we type or produce, all the time, 100%. If users flood the tools, and everything returns as AI-generated, then the tools become useless.
New models will mark AI-generated content from day one. Claude models launched in the EU on or after August 2, 2026 will support machine-readable marking at launch. Generated text will carry embedded watermarks, and generated files will include digitally signed provenance metadata where supported.
So, they’ve been doing this for over a week without telling anyone?
My question is what's to stop Google or any competitor from using watermarks of Claude or OpenAI from degrading the rankings of sites that use it but ignore or even reward sites that use Gemini. Seems like an easy thing to do for competitors, and maybe an unforeseen side effect of these types of things or regulations.
I've long thought we would have some sort of verified-point-of-origin for data using a hash or cryptographic seal of some kind. I don't know the precise technical language for that but some metadata traveler that can verify the data has not been edited after creation.
People with dyslexia and dystrophia, commonly use LLMs to proofread content. Even Anthropic admits this is a limitation.
I wonder after how much editing an LLM output wont be reliably detectable? And what the EU law even says about this. I find that a good LLM workflow can be to generate outlines that are then edited pretty heavily manually to fit into whatever context it will be published in.
Ok so they ingested the world's content, sold it back to us and now they're protecting themselves against the copyright claims under the guise of safety and user privacy whilst creating the regulatory moat that decreases competition?
What am I missing?
Won't there instantly be tools to detect and remove/obfuscate these kinds of watermarks?