Starting with models launched on or after August 2, 2026, Claude’s text output carries an invisible watermark: a machine-readable signal woven into the words themselves. Anthropic’s support article states it plainly.

“Claude models launched on or after August 2, 2026 will support machine-readable marking at launch.”

So every eligible response leaves this mark by default. But nothing about the visible text is supposed to change.

“Nothing is added to the text and there are no hidden characters.”

No extra characters, no invisible Unicode tricks, nothing appended. So what, exactly, is being altered?

The mechanism isn’t something Anthropic invented from scratch. By its own account, it’s an implementation of an approach Google DeepMind published in Nature in 2024, called SynthID-Text.

“Claude’s text watermark is a version of the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024.”

That’s worth underlining: Anthropic describes this as a version of the approach, not a drop-in copy of DeepMind’s own implementation. It’s also worth separating from a completely different mechanism Anthropic uses for other file types.

“When Claude generates a supported file type, such as a .svg, .png, or .jpg, it will attach signed provenance metadata. This metadata follows the Coalition for Content Provenance and Authenticity (C2PA) open standard.”

Images get cryptographically signed metadata under the C2PA standard — an entirely separate system from the no-characters-added watermark this article is about. Part of the motivation is regulatory. Anthropic ties the rollout to the EU AI Act.

“We’re implementing watermarking to comply with the EU AI Act.”

Anthropic says it signed the EU’s Code of Practice on Transparency of AI-Generated Content, alongside roughly 190 other signatories, in July 2026.

Anthropic’s own explainer offers one example to make the mechanism concrete: finish the sentence “Isaac Newton’s most famous work is titled…” If you know even a little history, there’s really only one word that can come next — “Mathematica,” the second word of Philosophiæ Naturalis Principia Mathematica. That single example carries the whole article. Everything below comes back to the difference between a sentence with a “Mathematica” moment in it, and one without.

Swapping the dice for a keyed pair of dice

Models like Claude don’t build text one character at a time. They work in tokens — pieces of text, often shorter than a whole word, that form the model’s internal vocabulary. At each step, the model assigns a probability to every token in that vocabulary: this is the next-token distribution.

Generating a response means drawing one token from that distribution, over and over — a process called sampling. A setting called temperature controls how flat or peaked that draw is: turn it up, and lower-probability tokens get picked more often. An ordinary draw uses a pseudorandom number — a number that looks random but is actually produced by a fixed, repeatable procedure.

The watermark doesn’t touch the shape of that draw at all. It swaps out where the randomness comes from: instead of an ordinary pseudorandom number, the draw uses a keyed pseudorandom number. The seed for that number is a hash of the last few tokens (a run of tokens like this is called an n-gram) combined with a secret key. The Nature paper describes it this way.

“For the random seed generator, in our experiments we use the existing sliding-window method, where the random seed is a hash of the most recent H tokens (x_{t−H}, …, x_{t−1}; we use H = 4) along with the watermarking key.”

In the paper’s experiments, that window covers the last four tokens (H = 4). From that seed, a function assigns every token in the vocabulary a score of either 0 or 1 — the g-value. There are multiple independent versions of this function, one per layer, and the paper’s experiments use 30 layers. The underlying idea — summing g-values over an n-gram window to embed a watermark — traces back to a 2022 blog post by Scott Aaronson.

A knockout tournament in the paper, a for-loop in the code

The Nature paper calls the next step “Tournament sampling,” and describes it in bracket terms — candidate tokens are paired off, and the higher-scoring one in each pair advances.

“We randomly divide these candidates into M/2 pairs, and, in the first tournament layer, in each pair the token with the higher score under g_1(⋅, r_t) is selected.”

“For our experiments, we generally use m = 30 layers unless otherwise stated”

The paper also notes that stacking more layers doesn’t keep making detection easier without limit.

“detectability does not increase indefinitely with the number of layers”

So does the actual code really instantiate 2^30 candidate tokens and run them through a bracket? Reading Google DeepMind’s public reference implementation, it doesn’t (this is a read, not a run — the code below wasn’t executed).

probs = torch.softmax(scores, dim=1)

for i in range(depth):
    g_values_at_depth = g_values[:, :, i]
    g_mass_at_depth = (g_values_at_depth * probs).sum(axis=1, keepdims=True)
    probs = probs * (1 + g_values_at_depth - g_mass_at_depth)

Instead of sampling candidates and pitting them against each other, the code nudges the probabilities directly, 30 times in a row (depth times). Each pass does one thing: it nudges up the probability of every token whose g-value is 1, and nudges down every token whose g-value is 0. How much each side moves is set by the probability-weighted average g across the current distribution (g_mass_at_depth in the code above). The “30-layer tournament” in the paper turns out to be, in the reference implementation, a loop that runs 30 times.

Whether this update really is nothing more than a redistribution of existing probability mass is something you can check by computing it. Running 2,000 keys through a 512-token vocabulary with 30 layers, the largest deviation of the post-update probabilities from summing to 1 was 6.661e-16, and none of the probabilities went negative (the smallest value observed was -4.141e-34, which is floating-point rounding noise, not a real negative probability). Averaging over every possible key produces the original distribution back, to machine precision: enumerating all 4,096 patterns for a 6-token vocabulary with 2 layers, the largest deviation from the original distribution was 8.882e-16.

This is what Anthropic means, literally, by “nothing is added to the text.” The watermark never inserts or removes a token — it only redistributes probability mass that was already there.

How that redistribution is done depends on how many candidates compete in each match. When exactly two compete per match, the paper calls this “non-distortionary.”

“When Tournament sampling is configured with exactly two ‘competitors’ for each match in the tournament, then Tournament sampling is single-token non-distortionary.”

In the reference implementation, that split is a single if statement.

if self._num_leaves == 2:
    updated_scores = update_scores(scores_top_k, g_values)
else:
    updated_scores = update_scores_distortionary(
        scores_top_k, g_values, self._num_leaves
    )

num_leaves defaults to 2 — the non-distortionary path is the default. Every measurement in the rest of this article uses that non-distortionary setting. The distortionary path (num_leaves of 3 or more) is discussed only as something read in the code, not measured.

No choice, no watermark

The rest of this article’s measurements come from applying a public implementation, not Claude itself: Hugging Face’s transformers library (version 5.15.0) running on a small open model, Qwen/Qwen2.5-0.5B-Instruct. This is not a measurement of Claude’s own watermark, and Anthropic hasn’t published which key count or layer count it actually uses in production.

Consider what happens to the update when the next token was never in doubt. If the distribution is a single spike on some token x — probability 1 on x, 0 on everything else — then the probability-weighted average g equals x’s own g-value exactly, because no other token contributes anything. The update becomes p ← p × (1 + g − g) = p × 1: nothing changes.

That’s exactly what the measurements show. The score referenced throughout the rest of this article is the average g-value of the selected token, taken across every layer and every position in the response: it clusters around 0.5 when there’s no watermark, and climbs away from 0.5 as the watermark takes hold. For a distribution with zero entropy (a measure of how spread out the choices are — zero means the outcome is fixed) run over 20,000 trials, the watermarked and unwatermarked scores were both 0.50162, with a difference of exactly +0.00000. Widen the temperature so entropy climbs to 1.5507 bits, and the gap opens to +0.05102; push it to 4.5754 bits, and the gap reaches +0.15361.

The same pattern shows up in real text. Asked to write out the multiplication table for seven, one line at a time, from “7 x 1 = 7” through “7 x 20”, the watermarked and unwatermarked scores came out identical — both 0.50289, with zero variance either way. Every one of the ten generations — five with the watermark on, five with it off — came out to exactly the same 196 tokens. Turning the watermark on didn’t change a single character of the output.

Where the answer is genuinely fixed, the watermark has nothing to do — but a translation Claude produces still carries it. Anthropic explains why.

“Yes. A translation produced by Claude carries a watermark, because in this case every word is chosen by Claude.”

The meaning of the source text might be fixed, but which word expresses that meaning in the target language is still a choice the model makes. The same logic applies to editing.

“Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.”

Light edits leave the watermark mostly intact; a full rewrite, where every word is replaced, removes it. The more of the text a human rewrites, the more of those choice points get reassigned away from the model — which is consistent with everything above.

“Almost certain” is not “barely watermarked”

What happens at positions where the choice is almost — but not quite — settled? Say the top token has a 99.99% probability, with 0.0001 spread across everything else. Does the watermark barely register there too? Measuring it, the answer is no. At a maximum probability of 99.99% (0.0001 remaining), the amount the watermark moved the probability turned out to be roughly 128 times the size of that remaining probability. Compare that to a distribution with probability 1 on a single token, exactly zero remaining: across all 5,000 keys tested, the update didn’t move a single bit. Leave even a sliver of probability on the table, and the result looks nothing like that.

The cause is the sheer number of layers. Each individual layer can amplify a token’s probability by at most 2x, but with 30 layers stacked, that compounds to as much as 2^30x for a token that started with almost none. Because total probability has to stay at 1, whatever gets pushed up somewhere else has to come down. “Zero remaining choice means zero watermark” holds exactly — but “the choice is almost settled” does not mean “barely watermarked.” The watermark leans hardest on whatever sliver of a choice is actually left.

Why code and lists of facts carry a lighter watermark

Anthropic flags this pattern directly, ahead of any measurement.

“Watermarking is sparser on factual passages where there are fewer choices that can be made without decreasing the accuracy of the text.”

“code—which in very many cases has to be exact—has generally less watermarking than some other forms of text.”

Generating three kinds of text, five samples each, produces exactly that pattern. Asked for a long explanation of why the sky looks blue, the unwatermarked score averaged 0.50026, and the watermarked score averaged 0.53416 — a gap 5.5 times the size of the unwatermarked standard deviation (0.00617). The multiplication-table text, as noted above, showed no gap at all: the watermarked and unwatermarked scores were identical. Code generation didn’t move upward either — 0.50262 unwatermarked versus 0.50035 watermarked.

Is scarcity of choice the whole story? No — there’s a second mechanism. The reference implementation skips watermarking at any position where the current n-gram context has already appeared earlier in the same generation.

# 5. Check if the current watermarking context was previously used, if
# yes skip watermarking.
...
updated_watermarked_scores = torch.where(
    is_repeated_context,
    input=scores_top_k,
    other=updated_scores,
)

Why the reference implementation needs this rule at all shows up directly in measurement. Reusing the same distribution at every position, extending a generated text from 10 tokens to 400 tokens, the unwatermarked score’s standard deviation flattened out at around 0.035 and stopped shrinking. In theory, it should keep shrinking as the text gets longer. The cause: the same tokens kept recurring, which meant the same 4-token context kept recurring too. Identical context means an identical seed, which means the same g-values get added over and over — length stops buying independent evidence.

Rerunning the measurement with a different distribution at every position, and the repeat-context skip rule turned on, the standard deviation shrank exactly as expected. At 400 tokens, the measured standard deviation was 0.00452, closely matching the theoretical value of 0.5/√(30×400) ≈ 0.00456. It’s also possible to measure how often that skip rule actually fires in real generations.

In watermarked text, the share of positions dropped for repeated context was 0.6% for the long explanation, 21.9% for the multiplication table, and 29.6% for the code — because patterns like def, return, and repeated indentation keep recreating the same 4-token context. Code and factual lists come out lighter for two compounding reasons: fewer real choices to make, and the repeat-context rule actively excluding positions where the same short pattern shows up again.

What detection can and can’t tell you

What does a scorer actually need? The Nature paper is specific.

“A scoring function only requires access to the tokenized text, the watermarking key k and the random seed generator f_r; no access to the LLM is required.”

A tokenizer (the tool that splits text into tokens), the key, and the text itself — no access to the model that generated it. The result reads as distance from 0.5. Unwatermarked text averages 0.5, with a standard deviation set by the number of layers m and the number of positions T, following 0.5/√(mT). Measured at T = 400 with a different distribution at every position, the standard deviation came out to 0.00452, matching the theoretical 0.00456 closely.

Stretching a text from 10 tokens to 400 tokens — 40x longer — widened the gap between watermarked and unwatermarked scores from 5.3 standard deviations to 34.2 standard deviations, a 6.45x increase, close to the √40 ≈ 6.32 scaling the math predicts. This measurement used a synthetic distribution; real text mixes in more low-entropy positions, so the real-world gap would be smaller than this.

What if someone tries to score the same text without the right key? Swapping out a single one of thirty keys barely moved the score at all (0.53416 down to 0.53174). With 30 independent layers, each carrying its own share of evidence, losing one key only costs a thirtieth of the total evidence. Swap out every key, and the score drops to somewhere between 0.503 and 0.510 — indistinguishable from unwatermarked text.

Even with the right key, there are hard limits on what a passing score can tell you.

“Using our key, one can only answer the question ‘What is the likelihood this was partly written by Claude?'”

It can’t confirm a human wrote something, and it can’t tell whether a different AI wrote it, Anthropic notes. Is a low false-positive rate — the share of unwatermarked text that gets wrongly flagged as watermarked — enough to trust on its own? OpenAI, which built its own text watermark in 2024 and chose not to ship it, raised one reason worth taking seriously.

“While text watermarking has a low false positive rate, applying it to large volumes of text would lead to a large number of total false positives.”

A low false-positive rate per document doesn’t stay low in absolute terms once you multiply it across enough documents — especially when the actual base rate of AI-generated text (the share of everything scored that really was machine-written) is low. OpenAI also flagged a fairness concern.

“it could stigmatize use of AI as a useful writing tool for non-native English speakers.”

The knobs that control watermark strength

Anyone trying this approach out has a short list of settings that actually determine how it behaves.

Knob	What it does	Reference value
ngram_len (how many prior tokens seed the hash)	Larger values resist repetition better, but need more context to detect	Hugging Face recommends 5, minimum 2
Number of keys (= number of layers)	More keys stack more evidence, but detectability plateaus	Hugging Face recommends 20–30, the paper’s experiments use 30
num_leaves	2 means non-distortionary, 3+ means distortionary (reference implementation defaults to 2)	Every measurement in this article uses the non-distortionary path
How long repeated context is remembered	Governs how aggressively repeated n-grams get excluded from watermarking	Default behavior varies by implementation

These are Hugging Face’s recommended values and the values used in the paper’s experiments — not Claude’s production settings. Anthropic hasn’t disclosed its key count, layer count, or whether it runs the distortionary or non-distortionary path.

Closing

The watermark has almost nothing to do with “Mathematica” showing up after “Isaac Newton’s most famous work is titled…” There’s no choice to make there. It lands where the model genuinely could have gone either way — the moments where the next word was still undecided.

Every number in this article comes from a small public model, not Claude, run through Hugging Face’s implementation. What settings Anthropic actually runs in production is still undisclosed. But the algebra behind it doesn’t depend on model size: pin the probability to a single point, and the update loops right back to where it started, every time.

Next time you’re reading a long AI-written explanation next to a plain list of facts, it’s worth asking which one had more room to choose. That’s usually where the lighter watermark is hiding.

Primary sources

• Anthropic: How Claude’s text watermark works — used for the introduction, mechanism, limitations, and detection sections
• Anthropic support article: How Claude marks AI-generated content — used for the C2PA distinction in the introduction and the note that the detection API is not yet public
• Nature paper: Dathathri et al., Nature 634:818–823 (2024) — used for the mechanism, tournament sampling, detection, and quality sections
• Reference implementation, google-deepmind/synthid-text — quoted for the code sections; read, not executed
• Hugging Face: Introducing SynthID Text — source for the implementation used in measurements and the recommended settings in the knobs section
• EU AI Act, Article 50 — regulatory background for the introduction
• European Commission: announcement of the Code of Practice on transparency — regulatory background for the introduction
• OpenAI: Understanding the source of what we see and hear online — used in the detection section, on the absolute count of false positives
• Scott Aaronson’s blog (2022) — used in the mechanism section, on the origin of the g-function approach