How does Anthropic's watermark work?

Why word choice and not hidden characters

A hidden character is trivial to strip and trivial to detect, so it is useless as a durable mark. Biasing word selection instead puts the signal in the text's own content, where removing it means genuinely rewriting the passage.

At each generated token the model holds a distribution over plausible next words. The watermark splits those options using a pseudo-random function seeded by a secret key and the preceding context, then nudges selection toward one side. Any individual choice is unremarkable — several words fit, one gets picked. Across thousands of choices the skew is statistically obvious to whoever holds the key.

This is the same family of method as Google's SynthID-Text, published in Nature in 2024, which is the paper Anthropic points to.

What the method cannot do, by Anthropic's own account

It answers only one question. With the key, you can ask how likely it is that Claude partly wrote a passage. It cannot establish that text is human-written, and it says nothing about other AI systems, which use different keys or different methods entirely.

Short text defeats it. Fewer word choices means less signal. Confidence grows with length, so a paragraph carries little and a sentence carries essentially none.

Factual and constrained writing carries less. The mark needs freedom to choose among near-equivalent words. Where only one word is correct — a name, a formula, a technical term — there is nothing to bias. Code and heavily factual text are therefore marked sparsely.

Editing-only tasks barely mark at all. Hand Claude your own writing and ask it to fix the grammar, and the mark can only live in the handful of corrections it made.

What this means for you in practice

Copying, retyping and reformatting change nothing — the words are the mark, and those operations preserve the words. Substantive paraphrase does degrade it, because it replaces the choices being measured. That is not a loophole; it is just what it means to rewrite something.

Deleting invisible characters does nothing at all to it. This is worth repeating because it is the single most common misunderstanding, and an entire category of “remover” tools is built on it.

Most importantly: none of this is checkable by you. The key is Anthropic's. Every claim about a specific passage's watermark status, from anyone other than Anthropic, is currently unverifiable.

Which models carry it

The stated rule is that it applies to Claude models launched on or after 2 August 2026. Models released before that date are not retroactively marked.

We keep a per-model page tracking launch dates against that cutoff, because the rule is easy to state and surprisingly awkward to apply — several launch dates are not published precisely enough to settle the question.

Questions

How does an Anthropic watermark work?

It applies a keyed statistical bias to the model's word choices. At each step a pseudo-random rule seeded by a secret key nudges selection toward one half of the plausible next words. The bias is undetectable in any single sentence and measurable across a long passage by anyone holding the key.

Is the watermark hidden characters?

No. Nothing is inserted into the text. The mark lives in which words were chosen, which is why stripping invisible characters has no effect on it.

Can I remove Anthropic's watermark?

Not by any find-and-replace operation, because nothing was added. Substantially rewriting a passage does degrade it, since the mark is carried by the specific word choices. No tool can confirm either way, as the detection key is not public.

Which Claude models are watermarked?

Anthropic's rule is models launched on or after 2 August 2026. Earlier models are not marked retroactively.

Does it work on code?

Weakly. Code offers few genuinely interchangeable choices, and the mark needs that freedom to exist. Anthropic notes the same limitation for factual passages where only one word is correct.