Anthropic says Claude’s text now carries a watermark. It has not said what the watermark is.
So people are filling in the blank, and they mostly fill it in the same way. Ask how you hide a mark inside plain text and the answer comes back fast: you put something in there. A zero width space at U+200B. A variation selector that renders as nothing. A curly apostrophe where a straight one belongs. Steganography, the same trick as burying a message in the low bits of a photograph.
That family of techniques is real, and the tooling for it is mature. As provenance it is close to worthless. Open the file in a hex editor and the mark is sitting right there in the bytes. You can search for it. Find and replace clears it in about three seconds. If that were what Anthropic had shipped, this piece could stop at two hundred words, and most of them would be removal instructions.
Look at the behavior the company does describe, though, and it points down a different road. Along that one, nothing gets inserted into your text. No character, no byte, no spacing trick. You cannot delete the mark, because deletion needs a target and there is no target to hit.
What Anthropic said, and what it did not
Anthropic’s help center now confirms that Claude models released after 2 August 2026 embed a machine readable watermark in their text output, with older models being updated on a rolling basis. Coverage includes the API, Claude, Claude Code, and Claude Cowork, plus access through cloud partners. The scope is worldwide, well beyond the EU. The page went up on 11 August 2026.
The official description reads: “When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself.” The page stresses that this is metadata-free and that it travels along with copy and paste.
That is the entire disclosure.
Anthropic has not said what the technology is. No algorithm, no paper, no spec, only a promise that technical documentation is forthcoming. The Register’s reporter put it plainly: “it’s unclear how Anthropic will make the watermarks hard to remove.”
Which matters, because confident explanations naming a specific scheme are already circulating. Every one of them is a guess.
Two different technologies, one name
Finish that first road before leaving it, because being easy to find is not its worst problem. It breaks all at once. Change a word, retype a sentence, paste the text through a field that strips formatting, and the pattern scatters. Nothing weaker survives underneath. The mark is intact or it is gone, and ordinary editing takes it out by accident.
No LLM vendor has ever admitted to using it, either. The one documented incident dates to April 2025, when the education technology company Rumi noticed that longer responses from GPT-o3 and o4-mini carried unusual Unicode characters, mostly the narrow no-break space at U+202F, in what looked like a systematic pattern. Two days later Rumi posted an update: OpenAI had gotten in touch to say it was no watermark, just “a quirk of large-scale reinforcement learning”. A day after that, the characters stopped appearing.
The other approach is called statistical watermarking, opened up by Kirchenbauer and colleagues in the 2023 paper A Watermark for Large Language Models. It inserts no characters at all.
What happens before a word gets picked
When the model is about to write "this method is really __", it holds a short list of candidates and normally samples one by probability. A watermark first uses a key to split the vocabulary into two halves, then leans the sampling toward one of them.
Read that one sentence and you see nothing. All four words were already fine. Run the statistics over a whole text, though, and the green half shows up far more often than chance allows. That is the signature.
The nudge only ever happens between candidates that mean nearly the same thing. It will not push "effective" to "blue".
Here is the shape of it. Before the model picks each word, the preceding n-gram gets hashed, and that hash splits the entire vocabulary into a green list and a red list. The split changes at every position and is unpredictable without the key. The model then receives a small nudge, a constant added to the score of every green candidate, so it leans green wherever several words would have worked equally well. Nothing is inserted. Nothing is swapped in afterward. Detection never needs the model at all: count how many words in a passage landed on green, compare that against the fraction chance would give you, and the gap becomes a z-score.
The paper’s settings: the green fraction γ is usually 0.25, the nudge δ is usually 2.0. Put the detection threshold at z > 4 and the odds of calling human writing machine generated are 3 in 100,000. The abstract claims detection is possible from as few as 25 tokens. At 128 tokens, 98.4 percent of generations get caught.
So is that what Anthropic shipped? Nobody outside the company knows. The four behaviors the help center describes (no metadata, survives copy and paste, may survive some editing, too little text means too little signal) all match statistical watermarking, and none of them match hidden characters. A hidden character never degrades by degrees, and there is no length below which one quietly stops working.
Call that a reasonable inference. It is still an inference.
The questions writers actually ask
If only part of it came from AI, does that show?
Yes, and the technique can point at which part. A follow up from the Kirchenbauer team, published at ICLR in 2024, introduced a sliding window test called WinMax that hunts for the highest scoring contiguous stretch inside a long document.
Here are the measured numbers (the paper calls this the copy-paste attack, which is exactly the scenario). AUC runs from 0.5, meaning a coin flip, up to 1.0, meaning perfect separation.
| AI fraction | Text length | Detection AUC |
|---|---|---|
| 25% (one continuous block) | 600 tokens | above 0.95 |
| 10% (split into three pieces) | 200 tokens | below 0.7 |
| 10% (split into three pieces) | 600 tokens | below 0.85 |
Two thousand AI written words inside a twenty thousand word manuscript is 10 percent, which lands squarely in the least detectable band. That assumes the two thousand words go in untouched. It also cuts the other way: the longer the surrounding document, the better detection gets.
How much rewriting washes it out?
Start with the thing everyone wants and nobody has produced. A table mapping “rewrote X percent” to “detection falls to Y percent” does not exist. The published work measures rewriting methods. Rewriting proportions have never been studied that way. If you find a table like that online, someone made it up.
What does exist:
| What was done | What detection is left |
|---|---|
| Nothing | AUC above 0.999 |
| Rewritten by another AI | AUC drops 0.05 to 0.15; still above 0.85 at 200 tokens |
| Rewritten by humans (paid, told to break it) | still detectable after roughly 800 tokens on average |
| Translated into another language | AUC falls to 0.54 to 0.67 |
The third row deserves its setup spelled out. Fourteen graduate students, given a cash incentive, told explicitly that the job was to destroy the watermark, required to preserve length and meaning. Every attack in the study remained confidently detectable somewhere between 400 and 800 tokens.
Row four is the most effective removal anyone has demonstrated. Translation pushes the signal down near guessing, because the signature lives in a particular token sequence in the source language, and swapping the vocabulary throws it away.
The authors frame the whole question better than “can you wash it out” does. Ask instead how far an attack pushes up the number of tokens needed for confident detection.
Does it degrade the prose?
Two designs, two very different costs.
The Kirchenbauer style approach edits the probability distribution directly, and its cost is measurable and scales with watermark strength. The paper’s tradeoff curve shows perplexity (roughly, how surprised the model is by its own output, where lower reads as more fluent) climbing from around 4 or 5 to roughly 13 once the nudge is turned up hard.
Google DeepMind’s SynthID-Text, published in Nature in October 2024, takes another route. It leaves the distribution alone. The method, called tournament sampling, draws eight candidates from the model’s original distribution and runs them through a knockout bracket, where a key derived score decides which candidate advances at each round. When every match has exactly two competitors, the paper proves the output distribution equals the original distribution in expectation.
Its quality evidence is the hardest anyone has produced. Google ran a live experiment across roughly 20 million real Gemini responses. Thumbs up rates differed by 0.01 percent, thumbs down rates by 0.02 percent, neither statistically significant.
Which means “watermarking doesn’t affect quality” is too broad a claim. The accurate version comes in two halves. Designs built to preserve the distribution show no measurable difference across 20 million pieces of real feedback. Designs that add a bias have a cost you can measure, and it grows with strength.
Word order stays untouched either way. These schemes change which word gets picked. They leave the grammar of the sentence and the order of the paragraphs alone.
The line writers should memorize
One sentence in Anthropic’s documentation matters more to a novelist than every technical detail above.
A detected mark only means the content may have been processed by Claude. The company says so directly: Claude may not be the original author. Proofreading counts as processing. So does summarizing. So does a light polish pass over your own sentences.
The reverse holds too. The same page lists what can strip the mark: heavy editing, paraphrasing, translation, format conversion, even a screenshot.
Put those two together and the conclusion stings a little.
A writer who wrote every word and ran the manuscript through an AI once for line edits may carry the mark.
A manuscript generated end to end by AI and then put through a translation pass may carry nothing at all.
A watermark proves processing, not authorship. Public argument treats those as the same claim almost every single time.
Who ends up carrying the mark
The obvious reading is that all of this is aimed at the operations turning out a hundred books a day. Sign the output and the flood becomes traceable. The direction is backwards.
Signal strength depends on how much untouched model output is still sitting in the finished file. Used as generated, or run through a light polish, it reads at full strength. Rewritten hard, or carried across a language, it thins toward nothing. Which turns the whole thing into a question about cost. Who pays less to get out from under it?
An industrial pipeline pays close to nothing. Bolting a translation step onto a process that is already automated is one more call, and the measured result is in the table above: AUC of 0.54 to 0.67, near enough to a coin flip. There is a cheaper move than that one. A watermark of this family is applied at the moment of generation by whoever runs the model, so an operation running open weights on its own hardware never has one applied to begin with. The SynthID paper puts that in its own limitations section and draws the conclusion that follows from it: a scheme like this counts for something only if the industry adopts it broadly.
Set that against the writer who treats a model as a coach and lets it pass over one draft. That writer is not going to add a translation round to scrub a mark they were never hiding in the first place. The mark stays where it is.
So the clearest traces land on the people using AI in small, openly acknowledged amounts, and the cost to anyone who has decided to get around it rounds down to zero. That is not the same as saying the technology is pointless. It makes casual generation passed off as original work more annoying to pull off, and most of the abuse out there is casual. Just do not expect it to clear the market of machine written books.
What it works out to if you write with AI
- You used it to proofread or polish. The file may well carry a mark, and a mark does not make the model your author.
- You had it draft and then rewrote in your own words. The signal thins in proportion to how many of its original sentences you left standing.
- Only a few chapters went through it. Low mixing ratios are the hardest case for detection, though the method can still point at which stretches.
- You translated the finished book for another market. Almost nothing survives that.
None of it asks you to write differently. The one thing it asks is that you know what your own manuscript has been through, because when the question arrives, a writer who can answer it in detail is standing somewhere very different from a writer who cannot.
None of this is checkable yet
As of 11 August 2026, Anthropic has no public detection tool, no published spec, and no API. The company says only that it is working toward letting users and third parties detect the mark.
Publishers cannot check. Prize juries cannot check. You cannot check your own manuscript.
Google’s SynthID is the most open thing available: the algorithm was open sourced in October 2024 and merged into Hugging Face Transformers. That only verifies text you generated yourself with the same key. Checking actual Gemini output still requires Google’s key, and the detection portal remains a waitlist, aimed at journalists and researchers.
The real exposure sits somewhere else
Consider the one case so far that has cost a novelist an entire book.
Shy Girl had already been printed when its own publisher pulped it. Readers noticed the voice drifting between chapters, then the AI detection company Pangram ran the full text and returned a 78 percent probability that it was AI generated. After The New York Times covered it, Hachette canceled the US edition and destroyed the UK stock. That was March 2026. As far as anyone knows, it is the first time a major publisher has withdrawn a published book over an AI allegation.
The author, Mia Ballard, denies using AI. She says a freelance editor added the passages without her knowledge, and that ongoing litigation keeps her from saying more.
No watermark appears anywhere in that sequence. None appears in the Commonwealth Short Story Prize controversy either. The writer Vauhini Vara, working for The Atlantic, pushed fifteen years of the prize’s regional winners through Pangram, and four came back flagged as probably mostly AI written. No award was rescinded. The Commonwealth Foundation said it can only “operate on the principle of trust” until reliable tools exist.
One detail from that episode says everything about where things stand. Faced with an allegation, Granta handled it by pasting the suspect text into Claude and asking the chatbot whether it thought a machine had written it.
What is actually in use, then, is the post-hoc detector, and that is a different animal from statistical watermarking. A watermark requires the vendor to intervene at the moment of generation, which is precisely what lets the false positive rate be controlled mathematically. A post-hoc detector has no evidence from the generation side at all. It guesses from surface features like perplexity and sentence length variation, its false positive rate can only be measured empirically, and the empirical numbers are ugly.
OpenAI retired its own AI Text Classifier in July 2023 for low accuracy: it identified 26 percent of AI text correctly while flagging 9 percent of human text as AI. A study published in Patterns that same year reads worse. More than half of TOEFL essays by non-native English speakers were classified as AI generated, while essays by American eighth graders drew almost no false positives. The researchers then showed that “upgrading” the vocabulary in the non-native essays brought the false positive rate down. What the detector had measured was linguistic complexity. Vanderbilt disabled Turnitin’s AI detection feature in August 2023, citing this exact risk.
Which leaves a writer in a specific position: a detector with an unknown false positive rate can accuse you, and you have no way to prove yourself innocent. Watermarking barely registers next to that.
A note for anyone who repeats themselves on purpose
Statistical watermarking can control its false positive rate mathematically, and the paper still documents one concrete hole.
The green list at each position is determined by the preceding n-gram. Repeat the same n-gram and it gets counted as green again and again. The paper’s own example is a phrase like “Barack Obama”: if it happens to land on green, a human written piece that leans on it heavily can score as machine generated.
For novelists this is no abstraction. Prose with a refrain, poetry, work that repeats a fixed epithet for a character, any style that builds rhythm through deliberate repetition, all of it sits inside that failure mode.
What the law actually asks of you
Less than most people assume.
Article 50(2) of the EU AI Act places the obligation on model providers. Providers of AI systems that generate synthetic text must ensure the output is marked in a machine readable way. That clause became applicable on 2 August 2026, and it is the legal hook behind Anthropic’s move.
The disclosure duty that lands on users sits in Article 50(4), and its scope is narrow. It covers text published for the purpose of informing the public on matters of public interest, and even that carries an exemption where the text has been through human review and someone holds editorial responsibility.
Novels fall outside it. As the text stands, the EU does not require novelists to disclose AI use.
What will actually bind you are the rules of publishers, prizes, and platforms. Those are private contracts rather than legislation. They are being written right now, and most of them land stricter than the law.
What you can bank on
The certain part is small.
No hidden symbol sits tucked between your letters, and no removal step exists, because a file with nothing added to it has nothing to strip. The mark behaves like a statistical signature. It needs a certain length before anyone can be confident; translation nearly clears it; heavy rewriting weakens it without zeroing it out. What it can establish is that a passage went through some model. Who wrote the passage is beyond its reach. And Anthropic’s version, today, is something nobody at all can check.
The useful thought is smaller still. Very little about your working life changes here, except that saying it yourself is safer than being accused of it.
Rie Qudan won the 2024 Akutagawa Prize for Sympathy Tower Tokyo, and in her acceptance speech volunteered that roughly 5 percent of the text came directly from ChatGPT. The judges called the book close to flawless. The prize stands.
Shy Girl was pulped. The gap between those two outcomes may have less to do with how much AI went in and more to do with who brought it up first.
All technical details in this piece were verified on 11 August 2026. Anthropic’s announcement went out the same day, the technical documentation and detection tools do not exist yet, and the details could shift within weeks. Research cited: Kirchenbauer et al. (arXiv:2301.10226, arXiv:2306.04634), Dathathri et al. (Nature 634, 2024), He et al. (ACL 2024), Liang et al. (Patterns, 2023).