Inside Claude’s Invisible Watermark: How Anthropic Tags AI Text, Images and Files

If you’ve used Claude recently to write a blog post, translate a document, or generate an image, that output probably carries a mark you can’t see. Anthropic has quietly built a provenance system into its models, changing how AI-assisted content will be identified online.

Here’s a clear breakdown of how it works, why it exists, and where it falls short.

Why Anthropic started watermarking Claude

The trigger was European regulation. Anthropic signed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, as a provider of both generative AI models and generative AI systems. Article 50 of the AI Act, whose transparency rules took effect on August 2, requires that AI-generated content be made recognizable as such.

Many observers were surprised by the scope. Although the rule comes from the EU, marks apply to output from supported Claude models across the Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag, wherever Claude is offered worldwide. Anthropic’s reasoning was practical: it said it was applying watermarking globally at launch because it didn’t yet have a durable way to limit it by region. Two techniques, two content types

Claude uses two complementary techniques: watermarks embedded in text and Content Credentials (C2PA) attached to files. Each is designed for a different output type. claude

1. Text: a statistical watermark woven into word choices

This is the clever part. A common assumption was that Anthropic would hide invisible Unicode characters inside text. It doesn’t. Anthropic has said plainly that nothing is added to the text and there are no hidden characters.

The implementation is based on Google DeepMind’s SynthID-Text approach and works during generation. Language models write by repeatedly picking a plausible next token from several options. Rather than adding characters or editing the finished response, Claude’s watermark changes the source of randomness used when making some of those choices.

In practice, when Claude has several reasonable options, the system uses a secret key plus a few preceding words to influence the pick. Each choice looks normal to a reader, but over a long enough passage, they leave a statistical pattern. A detector holding Anthropic’s key can check how consistent the word sequence is with the choices Claude would have made and estimate the likelihood that Claude was involved.

Anthropic also addressed the obvious worry about quality. Its internal testing found no impact on creativity, readability, or content, and watermarking requires no extra tokens and has a negligible effect on generation speed.

Where the text watermark backs off: facts and code

The watermark only works where Claude has genuine freedom of choice. When an exact output is required, and a different term would make a fact wrong or break code, the watermark isn’t applied. Anthropic’s own example: after “2 + 2 =”, there’s only one good next token, so no nudge is applied. For the same reason, code generally carries less watermarking than other text, though arbitrary parts like comments can still carry it.

Translation is a notable case the other way. A Claude translation carries a watermark because Claude chooses every word in the translated output.

2. Images and files: signed C2PA Content Credentials

For visual output, Anthropic takes a metadata-based route. For generated PNG, JPG, and SVG files, Claude attaches cryptographically signed C2PA provenance metadata indicating the file was created or processed with Claude, rather than altering the file itself.

C2PA is an industry standard, not an Anthropic invention. It attaches a cryptographically signed manifest to a media file recording who created it, what tools were used, whether AI was involved, and what edits were made. It’s backed by Adobe, Microsoft, Google, OpenAI, and other industry members.

Which Claude models are covered?

Claude models launched on or after August 2, 2026, support marking at launch. Older models are a transition case: those launched before that date fall under the EU’s transition period, and Anthropic says it is working to add watermarking to them over the coming months.

How detection will work

Anthropic has committed to making its marks checkable. It says it will support users and third parties in detecting Claude’s marks, as the code requires, with details in forthcoming documentation. The plan includes a watermark detection API that estimates the likelihood Claude was involved in writing a piece of text, which Anthropic stresses is not the same as proving authorship.

The limits: what a Claude watermark cannot tell you

This is the section most coverage skips, and it matters most for publishers, educators, and moderators.

• It’s a probability, not proof. Anthropic stressed that the presence of a mark doesn’t conclusively prove content was generated by Claude.

• No mark doesn’t mean human-written. Don’t assume unmarked content is human-made, especially if it came from an older model or was heavily edited.

• It can’t separate writing from editing. Anthropic acknowledges a watermark can only show Claude was likely involved at some point, not whether Claude wrote the text or heavily edited it.

• Rewrites erase it. Light editing probably won’t remove it completely, but a full rewrite replacing every word will.

• Short text is weak evidence. Detection is less reliable with small samples because there are fewer word choices to analyze.

• Light proofreading may not register. Because the watermark only applies to words Claude actually chooses, a few grammar or punctuation fixes may not provide enough evidence.

• It only detects Claude. It can’t identify text from other AI models, which use different methods and keys.

• C2PA has its own weak spots. C2PA credentials can be removed when a file is re-saved by non-C2PA tools, leaving no signal on stripped files.

Why this approach matters

Traditional AI detectors guess based on writing style, and they’re notorious for false positives. Anthropic’s system instead tries to detect a watermark tied specifically to its own models, rather than relying on linguistic or stylistic patterns. That’s a more grounded signal, even if it isn’t perfect.

The rollout hasn’t been free of pushback. Writers, developers, and other users have raised concerns that AI-assisted editing could wrongly flag human-created work as AI-generated. Anthropic’s own caveats about editing and probability are, in part, an answer to that concern.

What this means for creators and businesses

If you publish content with Claude’s help, assume it can be traced back to Claude once detection tools are public. The sensible response isn’t to hide AI use but to own your process: add your own expertise, examples, and editing, and disclose AI assistance where your platform or audience expects it.

For businesses building on Claude, there’s a compliance nuance. Commentators note that for enterprises integrating Claude into downstream products, AI-content marking responsibility doesn’t automatically transfer just because of Anthropic’s technical implementation.

FAQ

Does Claude add hidden characters to text?
No. The watermark lives in the statistical pattern of word choices, not in added characters.

Can I see Claude’s watermark?
No. Anthropic confirmed a regular user won’t be able to see it.

Does watermarking make Claude’s writing worse?
According to Anthropic’s internal testing, there is no measurable impact on quality, creativity, or readability.

Is Claude’s watermark the same as Google SynthID?
It’s built on the same research approach, SynthID-Text, but uses Anthropic’s own keys, so each company’s detector only recognizes its own marks.

Does this apply outside Europe?
Yes. Marking applies worldwide wherever supported Claude models are offered.