Home/Research explainer

Claude · SynthID-Text · Updated August 21, 2026

Claude’s text
watermark, decoded.

Anthropic has announced a statistical watermark for future Claude models. It is carried by patterns in token choices—not hidden characters, metadata, or extra words.

No hidden charactersKeyed statistical evidenceMore text, more signal

Signal bench / 01Reader ↔ detector

Reader sees

Theweathertodaywascoldandgrey.

Nothing was inserted into the sentence.Pattern appears across many choices →

Schematic based on Anthropic’s word-choice example. The dots and bits are explanatory, not Claude production telemetry.

The announcement

What Anthropic added

On August 14, 2026, Anthropic said future Claude models would generate text containing a watermark. It described its system as a version of Google DeepMind’s SynthID-Text and said it was implementing the change for the EU AI Act’s transparency requirements.[1][5]

The announcement says the mark carries no user, organisation, or chat identity; adds no tokens; and is meant to estimate whether Claude was involved in producing a passage. Anthropic also announced a detection API, but described it as forthcoming rather than available in the article.[1]

01 / Generation

The watermark lives in selection.

An autoregressive language model produces a probability distribution for the next token. SynthID-Text changes how a token is sampled from that distribution: a secret key and recent context create pseudorandom scores, then a tournament favours candidates that score well.[2]

AThe model proposesPlausibility, not a fixed word list

The weather today was cold and…

overcastplausible

greyplausible

sugaryunlikely

nubilousnot a normal choice

Anthropic’s example: watermarking works where multiple next words are reasonable. It does not make an implausible token sensible.

BThe key creates a seedContext-specific

Recent contexttodaywascoldand

Secret keyk

Random seedrₜ

The Nature paper’s experiments hashed the previous four tokens with a watermarking key. A repeated-context mask skipped watermarking when the same context window reappeared, avoiding repeated bias.

Published SynthID-Text reference method. Claude’s production context-window setting was not specified in Anthropic’s announcement.

CTournament sampling chooses the next tokenGoogle paper’s three-layer illustration

8 samples from the model distribution

greyovercastcrispgreywindyovercastgreycrisp

g₁

4 keyed winners

greycrispovercastgrey

g₂

2 keyed winners

greyovercast

g₃

Output tokengrey

Why a tournament? Each layer adds keyed evidence. The paper’s experiments generally used 30 layers, while this published illustration uses three so the process fits on a page.

Why quality can stay stable. With two competitors per match and averaging across random seeds, the method is single-token non-distortionary: the output distribution matches the original model distribution on average.

This bracket is a schematic reconstruction of Figure 2 in the SynthID-Text paper, using Anthropic’s weather vocabulary. It is not a trace from Claude.

02 / Detection

Detection rebuilds the evidence.

The detector does not search for a hidden payload. Given the text and matching key, it reconstructs context-dependent scores and asks whether the observed token choices correlate with them more often than ordinary text would.[2][4]

01Tokenize
Turn the submitted passage back into the token sequence used by the watermark system.
02Recreate seeds
Combine each recent context window with the same watermarking key.
03Compute g-values
Score every observed token with the keyed pseudorandom functions—the paper calls these g-values.
04Mask repeats
Exclude repeated contexts and positions outside the valid generated sequence.
05Score + threshold
Aggregate the evidence and compare it with a calibrated decision threshold.

Detector inputText + matching key

The published scoring method does not need access to the underlying language model.

Possible scoresMean · weighted · Bayesian

Google’s reference code includes simple weighted-mean and trained Bayesian detectors.

OutputEvidence, not authorship

A high score supports likely involvement by the keyed generator; it does not identify a person or establish who authored the final work.

Thresholds matter. Google reported true-positive rates at a fixed 1% false-positive rate and also evaluated a selective predictor that abstains when confidence is insufficient. Those are research evaluation settings, not published Claude API specifications.[2]

03 / Confidence

Signal needs both length and choice.

Two variables dominate detectability in the published method: how many tokens provide evidence, and how much entropy—or genuine choice—the model had at those positions.[1][2]

More token choiceLess token choice

Limited evidence

Short creative response

Stronger evidence

Long, varied prose

Weak evidence

Short exact answer

Mixed evidence

Long but highly constrained text

Shorter passageLonger passage

Qualitative relationship reported by Anthropic and the SynthID-Text paper; not a detector calibration chart.

More room

Long prose and translation

Long-form writing contains more selection steps. In translation, Claude chooses the output words, so Anthropic says the translated text carries a watermark.

Depends

Heavy editing

The more Claude rewrites, the more token decisions it owns. Light proofreading may leave too few changed words for confident detection.

Less room

Facts, maths, and code

Exact answers leave little freedom. Code can still contain choices in names or comments, but correctness constrains much of the output.

04 / Boundaries

What the result can—and cannot—say.

A watermark detector is a provider-specific statistical test. Treating its output as universal AI detection, identity, or proof of authorship would go beyond what Anthropic announced.

Can support

Claude was likely involved at some point.
A long passage contains a keyed statistical pattern.
Claude may have written or heavily edited the passage.

Cannot establish

Which person, account, organisation, or chat produced it.
Whether unmarked text was written by a human or another model.
Who owns the text or bears legal responsibility for it.

Original outputMore source token choices remain

Light editSignal may weaken

Complete rewriteOriginal pattern is replaced

Anthropic says light editing probably does not remove the watermark completely, while replacing every word does. The SynthID-Text paper likewise reports that edits and paraphrasing weaken generative watermarks.[1][2]

05 / Taxonomy

Four mechanisms people call a “watermark.”

They operate at different layers. Confusing them leads to the wrong inspection method.

MethodWhere the signal livesHow it is checkedWhat it indicates

Claude text watermarkPattern across token choicesMatching secret key + statistical scoreLikely Claude involvement

Hidden UnicodeInvisible code points inside the textCharacter-level inspectionPresence of those characters

C2PA credentialCryptographically signed file metadataC2PA-aware verifierRecorded file provenance

Post-hoc AI detectorLearned linguistic or statistical featuresClassifier without provider keyModel-estimated AI likelihood

What this means here

Choose the method that matches the signal.

Character cleanup is for invisible Unicode marks. Anthropic explicitly says Claude’s announced watermark does not use them. Semantic rewrite creates a new draft with new word choices, but this workspace does not promise a particular detector outcome.

Open the text workspace

Primary sources

Read the originals.

This explainer paraphrases the sources below. It does not reproduce Anthropic’s article or Google’s paper.