How Claude Watermarking Works: A Statistical Fingerprint, Not Proof of Authorship
See exactly how model probabilities, a secret key and recent context work together—then learn what detection can and cannot prove.
Anthropic says future and supported Claude models will use a version of SynthID-Text; this is not yet a claim about every Claude response.
Model probabilities come first. The published reference design samples candidates from the model’s ordinary distribution before key-and-context scores resolve the choice.
The key changes the sampling path, but it does not append hidden characters, insert a customer identifier or create a permanent list of preferred words.
Detection aggregates a key-dependent pattern across many eligible token positions. One word is not evidence, and Anthropic has not published Claude-specific thresholds.
A positive result suggests Claude involvement—not authorship or misconduct. Supported image files use separate signed C2PA metadata that can be stripped.
What Claude watermarking means
A content lead receives a 600-word Claude draft and pastes it into the CMS. A reviewer asks whether the text contains invisible characters—or whether one unusual word could reveal that Claude wrote it. Both ideas miss how the system works.
Anthropic says supported Claude models will use a version of Google DeepMind’s SynthID-Text. The mark is created during generation by making many low-stakes token choices statistically correlate with a secret key. A detector that knows the matching configuration can look for that pattern across a passage.
This is a provenance signal, not a universal AI-writing test. Claude may have drafted, translated, substantially edited or merely touched the text, and detection cannot identify the user or prove who authored the ideas.
Text watermarks and file credentials are different
Anthropic uses “watermark” as an umbrella term for two mechanisms. Text receives a statistical signal created while tokens are generated. Supported PNG, JPG and SVG files receive a small cryptographically signed C2PA content credential in metadata.
The text signal lives in the selected words, so ordinary copy and paste usually preserves it. The file credential lives in a signed manifest, so a screenshot, format conversion or metadata-stripping export can remove it. Neither mechanism identifies the user or proves authorship.
Worked example: how one watermarked token is selected
The language model and the watermark key do different jobs. The model decides which next tokens fit the context and assigns their probabilities. Only after candidate copies are drawn from that distribution does the key help resolve the sampling choice.
Start with ordinary model probabilities
For the unfinished sentence “The sky looked …”, imagine the model assigns vast 40%, endless 30%, blue 20% and grey 10%. These numbers are invented for teaching; Anthropic has not published Claude’s probabilities or tournament parameters. A nonsensical continuation would have negligible probability and would be correspondingly unlikely to enter the candidate draw.
Simplified worked example based on the published SynthID-Text reference design. Anthropic says Claude uses a version of SynthID-Text but has not disclosed its exact configuration.
-
Candidates are drawn from the model distribution
Suppose four ordinary draws produce vast, endless, vast and blue. The most probable token can appear more than once, while grey does not enter this particular draw.
Quality boundary: every competitor came from the language model’s probability distribution.
-
The key and recent context create repeatable scores
Conceptually, the provider combines the secret watermark key with “The sky looked” to seed pseudorandom scores for the sampled tokens. For this toy example, imagine layer-one scores of 0 for vast #1, 1 for endless, 0 for vast #2 and 0 for blue.
The seed stays with the provider; it is not inserted into the text and does not encode a user.
-
Candidate copies compete
In round one, endless beats vast #1 because 1 beats 0. Vast #2 and blue tie at 0, so a normal random tie-break lets vast advance. These values are illustrative—not Claude’s published settings.
The key influences which sampled candidate advances; it does not introduce an outside word.
-
The final winner becomes the next token
In the toy second layer, imagine endless scores 0 and vast scores 1. Vast wins, so the sentence becomes “The sky looked vast …”.
A different seed or candidate draw could produce a different sensible continuation.
-
The process repeats with new context
At the next position, the preceding context now includes vast, so the keyed scores change. Repeating many such low-stakes choices creates the passage-level statistical pattern.
There is no permanent green list: the same token can score differently elsewhere.
How the signal builds across a passage
One selected word contains almost no useful evidence. Consider a 180-word product explanation drafted entirely by a supported Claude model: dozens of eligible token choices may contribute small key-dependent signals. Those observations can accumulate into evidence a detector can score.
Now compare a human-written document where Claude changes three commas and replaces two words. Claude made too few choices for a reliable pattern to build. Anthropic has not published a Claude-specific minimum length, so “longer gives more evidence” is safer than claiming a fixed word or token threshold.
How Claude watermark detection works
Detection is separate from generation. The checker receives the finished passage and the matching secret configuration. It does not recover a hidden key from the prose and does not need to know which losing candidates appeared in the original tournament.
A worked detection example
Take the toy continuation “vast and endless, stretching beyond the distant hills.” At each eligible token position, the detector combines the same key with the preceding tokens, recomputes the expected keyed value for the token that actually appears, and records that observation. Imagine 12 of 16 layer-level checks align in this eight-position teaching example. That 12/16 result is illustrative—not a Claude threshold or confidence score.
The detector follows four conceptual stages:
Tokenize the submitted passage and identify eligible positions using the expected tokenizer and masking rules.
At each position, combine the matching secret key with the preceding context to reproduce the pseudorandom keyed value.
Score the token that actually appears, then combine observations across many positions. A single high-scoring word proves nothing.
Return calibrated statistical evidence or likelihood. Anthropic has not published Claude’s scoring function, threshold or false-positive operating point.
When the signal is strong or weak
Signal strength depends on how many eligible choices the model made and how much freedom existed at each choice. These are relative expectations, not Claude-specific published thresholds.
Practical expectations:
Long, original explainer copied intact: stronger evidence because many open-ended choices accumulate.
The same explainer after light copy-editing: often weaker but potentially still detectable because most keyed choices remain.
One-sentence factual answer: weak or inconclusive because the passage is short and accuracy leaves little freedom.
Claude corrects five typos in human copy: weak or absent because Claude generated very little of the final sequence.
Long translation produced by Claude: potentially detectable because Claude chooses the output sequence, although translation constrains wording.
Code, JSON, equations or exact quotations: usually weaker because syntax and fidelity reduce the number of safe alternatives.
Heavy paraphrasing, rearrangement or mixing with other writing: much weaker or lost because token-and-context relationships change.
What C2PA looks like in practice
Imagine Claude creates campaign-hero.png on a supported surface. Anthropic says the file receives a small signed C2PA content credential. A compatible validator can inspect the manifest, verify its signature and certificate chain, and check whether the signed content binding still matches the asset. The pixels themselves do not need a visible watermark.
Now imagine a social platform recompresses that PNG, a designer exports it through software that drops metadata, or someone takes a screenshot. The new file may have no readable manifest. C2PA is tamper-evident, not indelible: “no credential found” means only that no supported credential is present, not that Claude was never involved.
What a result can and cannot prove
Watermark evidence is asymmetric. A positive result can support a limited provenance conclusion, while a missing mark is often inconclusive.
How to interpret Claude watermark and C2PA results
Observation |
Reasonable conclusion |
What it does not prove |
|---|---|---|
Claude text mark detected |
Claude was likely involved in generating or substantially processing some of the passage. |
Who authored the ideas, who used Claude, ownership, intent or misconduct. |
No Claude text mark detected |
No reliable positive Claude signal was found. |
Human authorship or the absence of AI involvement. |
Valid Claude C2PA credential |
A signed Claude provenance claim validates for this supported asset. |
The user’s identity, ownership of the concept or truthfulness of the content. |
No C2PA credential |
No readable supported credential is present. |
That Claude or another AI was never involved. |
Why Anthropic is introducing marking now
The immediate policy driver is Article 50 of the EU AI Act. Subject to statutory exceptions—including certain assistive editing and outputs that do not substantially alter the input—providers must make synthetic text, image, audio and video outputs machine-readable and detectable where technically feasible. The obligations became applicable on 2 August 2026.
The European Commission’s FAQ gives providers of pre-existing systems a transition until 2 December 2026. Anthropic says it is rolling the marking system out worldwide because it cannot yet scope watermarking durably by region; models launched in the EU on or after 2 August support marking from launch, while older models are being updated over the coming months.
A practical checklist for content teams
A defensible publishing workflow:
Record the model, date, purpose, source material and human reviewer for each AI-assisted asset.
Distinguish a Claude-drafted passage from a human draft that Claude only proofread.
Keep the complete original text when you may need to assess a statistical watermark later.
Test whether your CMS, DAM and image optimizer preserve C2PA credentials.
Store an original copy of every credentialed file before conversion, resizing or screenshotting.
Never turn a detector score into an accusation without corroborating records, human review and an appeal path.
Common questions about Claude watermarking
No. Anthropic says supported future models will mark eligible output, models launched in the EU on or after 2 August 2026 support marking from launch, and older models are being updated over the coming months. Very short or constrained output may also contain too little signal.
No. Anthropic says Claude uses a version of SynthID-Text. The mark comes from a key-dependent statistical pattern across ordinary token choices; it does not append zero-width characters, a hidden string or extra tokens.
The key can help decide which sampled candidate wins, but candidates come from the model’s normal probability distribution first. That limits the choice to plausible continuations. Anthropic says its tests found no practical effect on content, creativity or readability, although Claude’s exact configuration is not public.
Copy and paste normally preserves the chosen words, so it preserves the signal. Light editing may leave enough of the pattern to detect; heavy rewriting, rearranging, mixing or translating the passage can weaken or remove it. A negative result still does not prove human authorship.
No. The Claude Code attribution is a visible, configurable Git commit trailer or pull-request footer. The text watermark is an invisible statistical pattern in supported generated text. They can coexist, but they are different mechanisms.
- How Claude’s text watermark works - Anthropic
- Code of Practice on Transparency of AI-generated Content: FAQ - European Commission
- C2PA Technical Specification 2.4 - C2PA
- How Claude marks AI-generated content - Anthropic
- Scalable watermarking for identifying large language model outputs - Nature
- Regulation (EU) 2024/1689, Article 50 - European Union
- C2PA Security Considerations 2.4 - C2PA
- Claude Code attribution settings - Anthropic
