Claude / Anthropic · August 2026

Claude watermark: what Anthropic actually announced

Claude now embeds machine-readable marks in supported AI-generated content. For text, Anthropic says the watermark is imperceptible, travels with copy/paste, and is applied at the model level. The important technical question is what kind of watermark it is.

Updated 14 Aug 202612 min readPrimary-source based

Short answer: yes, supported Claude models watermark generated text. Anthropic has not disclosed the algorithm. The public behavior is consistent with modern keyed statistical text watermarking, but there is not enough evidence to say Claude specifically uses the Kirchenbauer green-list construction, SynthID Tournament Sampling, or another named method.

What Anthropic has confirmed

Anthropic's Help Center provides unusually specific product-level claims while deliberately withholding the detection construction.

Confirmed

Embedded directly in text

Anthropic says a supported Claude model “weaves” an imperceptible watermark directly into generated text. This rules out a mark that exists only in browser metadata or a chat transcript wrapper.

Confirmed

Applied at model level

The watermark is intended to appear across supported Claude surfaces, including Claude products, the API, Claude Code, Cowork, Claude Tag, and supported cloud partner access.

Confirmed

Survives copy and paste

Because the signal is encoded in the text itself, ordinary copy/paste does not remove it. Anthropic also says it may persist through some editing.

Confirmed

Third-party detection planned

Anthropic says it is working to let users and other third parties detect supported marks and will publish technical documentation describing the detection mechanisms.

Coverage matters. Anthropic says models launched on or after 2 August 2026 support marking at launch, while support for earlier models is still being added. Absence of a detectable mark therefore cannot be treated as evidence that a text was not generated by Claude.

What Anthropic has not disclosed

The gap between product behavior and algorithm identity is where most speculation begins.

Unknown

Token-selection rule

No public documentation says whether Claude uses green/red vocabulary partitions, keyed tournament sampling, Gumbel or exponential sampling, rejection sampling, semantic hashing, or a proprietary hybrid.

Unknown

Detection statistic

Anthropic has not published a z-score, likelihood-ratio test, classifier, alignment detector, threshold, or calibration curve for text.

Unknown

Key hierarchy

We do not know whether keys differ by model, tenant, region, time window, deployment surface, or customer.

Unknown

Security guarantees

No public claim yet establishes distribution preservation, cryptographic undetectability, unforgeability, key-recovery resistance, or robustness against adaptive detector-guided rewriting.

How Claude's watermark may work

The best evidence is architectural rather than proprietary. Anthropic's stated properties fit the broad class of generation-time statistical watermarks: the model's decoding process introduces a hidden, keyed pattern into token choices, and a detector later aggregates weak evidence across many positions.

Why the Kirchenbauer connection is plausible

Kirchenbauer et al.'s 2023 method uses the preceding context to pseudorandomly partition the vocabulary into preferred and non-preferred token sets. A small logit bias makes preferred tokens more likely. Detection reconstructs the same partitions and asks whether preferred tokens occur more often than chance predicts. That architecture naturally produces several properties Anthropic describes: invisibility, copy/paste persistence, a need for enough text, and degradation under heavy paraphrasing.

But those properties are not unique to Kirchenbauer. Google DeepMind's SynthID-Text also modifies generation-time token selection with keyed context-dependent scores. Kuditipudi et al. use secret random sequences and alignment. Aaronson/Kirchner explored secret-key pseudorandom sampling at OpenAI before the Kirchenbauer paper appeared.

Most defensible conclusion: Claude belongs to the modern keyed statistical watermarking lineage. Calling it specifically a “green-list watermark” is premature until Anthropic publishes the detector or generation algorithm.

Why short text is a clue

Anthropic explicitly says very short passages may leave too little text for a reliable signal. That is exactly what one expects when a detector accumulates many small probabilistic deviations. If each token carries only a little evidence, statistical confidence grows as more watermark-bearing positions are observed.

Why translation and heavy paraphrasing matter

A token-level watermark depends on particular generated choices. Translation changes nearly every token; aggressive paraphrasing replaces many of the lexical choices that carry the signal. Anthropic lists heavy editing, paraphrasing, translation, and mixing as reasons a Claude mark may no longer be detectable.

What a future Claude detector will probably return

Anthropic has not specified the interface, so this section is inference rather than product documentation. A serious detector should return more than a binary “AI / human” label. It should expose a calibrated score, confidence category, or p-value-like measure tied to a known false-positive rate.

In a simple green-list system, if a fraction γ of the vocabulary is designated green and the text contains T testable tokens, the classic statistic is:

z = (N_green − γT) / √(Tγ(1−γ))

The actual Claude detector may be completely different. The important principle is the same: detection is probabilistic evidence about a watermarking process, not semantic authorship detection.

Do not use an unofficial “Claude detector” as if it can read Anthropic's secret mark. Unless a tool has access to Anthropic's published detector, verification key, or approved detection API, it is most likely performing generic AI-text classification rather than Claude-watermark verification.

Can the Claude watermark be removed?

Anthropic's embedded text mark is not merely hidden Unicode characters or browser metadata. It is applied at model level during generation and survives ordinary copy/paste. Tools that strip zero-width spaces or normalize Unicode do not demonstrate removal of Claude's statistical watermark.

If the mark is a generation-time statistical scheme — as Anthropic's described behavior strongly suggests — transformations that replace many token choices can reduce detectability:

  • Heavy editing and paraphrasing
  • Translation into another language
  • Summarization or condensation
  • Regeneration by another capable LLM
  • Mixing with human-written or other-model text

Anthropic explicitly lists these as reasons a Claude mark may no longer be detectable. That describes reduced statistical evidence — not certifiable removal. Without an authorized detector and published threshold, claiming successful removal is unsupported.

Do not conflate mark classes. Stripping invisible characters from AI text is a different forensic operation from weakening a generation-time token watermark.

Read the full AI watermark removal guide →

Is there a Claude watermark detector?

Confirmed Anthropic says it is working to enable users and third parties to detect supported marks and will publish technical documentation describing the detection mechanisms.

Unknown As of August 2026, Anthropic has not publicly released a general-purpose Claude text watermark detector, verification API or detection key for third-party use.

This means there is currently no official way for external parties to verify Claude's embedded text watermark with the same confidence as an authorized provider detector. Generic AI-text classifiers — tools that estimate whether prose resembles model output — are a different technology with different error modes. They should not be treated as Claude watermark verifiers.

Forensic caution: a positive result from an unofficial “Claude detector” is not evidence that Anthropic's secret watermark was detected. A negative result is not proof the text is human-written or unmarked.

Read the AI watermark detection guide →

What a Claude watermark can — and cannot — prove

ObservationReasonable interpretationWhat it does not prove
Supported Claude mark detectedThe content may have been processed by a supported Claude system.That Claude originated every word or idea.
No mark detectedNo supported mark was recovered at the chosen threshold.That the text is human-written or never touched Claude.
Weak / borderline signalThe passage may be short, edited, mixed, low-entropy, or simply unmarked.Reliable attribution without additional evidence.
C2PA signature present on a fileA signed provenance assertion can be cryptographically checked.That copied text outside the file preserves the same provenance chain.

Anthropic itself emphasizes this distinction: a detected mark is not fully conclusive provenance. Claude may have proofread, translated, summarized, or reformatted material whose underlying content came from elsewhere.

Claude uses two different provenance layers

Text watermarking is only half of Anthropic's 2026 content-marking architecture. For supported generated files, including SVG, PNG and JPG, Anthropic says Claude attaches signed provenance metadata following the C2PA standard.

Embedded text watermark

Lives in the generated text. Useful after copy/paste. Probabilistic. Can weaken after substantial rewriting.

C2PA signed provenance

Lives in a file's provenance manifest. Cryptographically verifiable. Can carry richer history, but may be stripped by conversion, screenshots, or workflows that discard metadata.

The two mechanisms are complementary. A file-level signature can make strong statements about a preserved artifact; a statistical watermark can remain present when plain text escapes its original container.

Read the full C2PA vs watermarking comparison →

Claude watermark FAQ

Does Claude watermark AI-generated text?

Yes. Anthropic says supported Claude models embed an imperceptible watermark directly into generated text at the model level.

Can I detect a Claude watermark now?

Anthropic says it is working on detection for users and third parties and will publish technical documentation. The public algorithm and official general-purpose text detector have not yet been disclosed.

Is Claude's watermark based on Kirchenbauer et al.?

Possibly, but there is no direct public evidence establishing that. Claude's disclosed properties are consistent with Kirchenbauer-style statistical token watermarking, but also with SynthID-like, Aaronson/Kuditipudi-style, and newer hybrid schemes.

Can paraphrasing remove the Claude watermark?

Anthropic says heavy editing, paraphrasing, translation, or mixing can leave a text without a detectable mark. That does not mean every light edit removes the watermark.

Does a detected Claude watermark prove Claude wrote the text?

No. It indicates the content may have been processed by Claude. It does not establish who authored the underlying ideas or whether humans edited the result.

Can Claude's watermark be removed?

Heavy editing, paraphrasing, translation and regeneration can reduce detectability per Anthropic. Unicode cleaners do not remove the statistical mark. Certifiable removal requires an authorized detector, which is not yet public.

Is there an official Claude watermark detector?

Not yet for third-party use. Anthropic says detection documentation is forthcoming. Unofficial tools are unlikely to verify Anthropic's actual watermark.

Do invisible-character cleaners remove Claude's watermark?

No. Claude's mark is embedded at model level in token choices, not in zero-width Unicode characters. Stripping invisible characters addresses a different mark class entirely.

Related ZK-F guides