Claude is now hiding invisible watermarks in its text, and changing a few words may not remove them

Copy a paragraph from Claude into an email, rewrite a sentence, swap a few words and remove the formatting. To anyone reading it, what remains is ordinary text. There is no label, no strange symbol and no obvious indication that an AI system was involved. But underneath the words, Anthropic is now introducing something that could make the text identifiable anyway: an invisible, machine-readable watermark woven into Claude's output itself.

The change is part of Anthropic's response to new transparency requirements under the European Union's AI Act. Claude models launched on or after August 2, 2026 are being designed to mark generated text from the moment it is created, with older models expected to follow during a transition period. More importantly for users outside Europe, Anthropic isn't treating this purely as an EU feature. The watermarking system is being deployed at the model level, meaning Claude-generated content can carry the mark regardless of where the model is accessed.

That makes this considerably more interesting than a simple "AI generated" label. The watermark isn't intended for humans to see at all. It's designed for machines to detect.

This isn't a hidden character at the end of your paragraph

The first assumption when people hear about an invisible text watermark is usually that Claude must be inserting hidden Unicode characters, zero-width spaces or some other invisible data between words. That would certainly be possible, but it would also be relatively fragile. Paste the text through the wrong editor, normalize the characters or deliberately strip unusual Unicode and the watermark could disappear.

Anthropic describes its approach differently. The watermark is embedded into generated text at the model level and is intended to survive normal actions such as copying and pasting. The company also says the signal may remain detectable after some editing.

Anthropic hasn't yet publicly documented the exact algorithm behind Claude's implementation. That distinction matters. Research into language-model watermarking has demonstrated several ways of creating statistical patterns in generated text, often by subtly influencing which tokens a model chooses while it writes. Instead of hiding additional data between the letters, the words themselves become part of the signal.

Imagine that Claude reaches a point where "large", "significant", "substantial" and "considerable" would all make sense. A watermarking system could slightly favour one set of valid token choices over another according to a secret pattern. One individual choice tells you essentially nothing. Across hundreds of tokens, however, those tiny decisions can form a statistical signature.

That example illustrates how this class of watermark can work, rather than confirming Anthropic's undisclosed implementation. What Anthropic has confirmed is the important part: the mark is imperceptible, embedded into the generated text itself and designed to remain detectable through at least some common transformations.

Changing a few words may not be enough

This is where text watermarking becomes much more powerful than simply attaching metadata to a document.

If a watermark were stored as metadata in a Word document, PDF or image, separating the content from the original file could potentially remove it. Copy the text into a new document and the metadata is gone. A watermark encoded into the statistical properties of the language behaves differently because the signal travels with the words.

Changing one sentence therefore doesn't necessarily destroy it. Neither does replacing a handful of words. If enough of the original statistical pattern remains, a detector may still have enough information to conclude that the text contains Claude's watermark.

This isn't only theoretical. Research into robust language-model watermarking has repeatedly looked at exactly this problem: what happens when humans edit AI-generated text? A 2025 ACL paper examining attacks against watermarks found that traces could remain after hundreds of perturbations, while research published in 2024 demonstrated detection techniques specifically designed to recover watermark signals from text that had been partially edited by humans.

That doesn't mean a Claude watermark is permanent. Anthropic itself acknowledges limitations. Heavy rewriting, extensive paraphrasing, translation or combining generated text with enough unrelated material can weaken or remove a watermark. The system isn't an indestructible fingerprint attached to every sentence forever.

But it does change the threshold considerably. "I changed a few words" can no longer be assumed to mean "there is no longer any detectable connection to the AI output."

The watermark doesn't prove that Claude wrote the entire document

There's an important problem hiding inside that distinction.

Suppose someone writes a 1,500-word article themselves and asks Claude to improve the grammar of three paragraphs. Or a developer writes a function and asks Claude Code to clean it up. Or a company feeds an existing press release into Claude and asks it to make the wording more concise.

If Claude generates replacement text during that process, the resulting document may contain watermarked material even though the underlying work originated with a human.

That means detection can't automatically be interpreted as proof that "Claude wrote this." At most, it can establish that the detected text contains a signal associated with Claude-generated output.

The opposite problem exists too. If no watermark is detected, that doesn't prove a human wrote the text. It could have been generated by an older model, another AI system, a model that doesn't watermark its output, or Claude text that was transformed enough to destroy the detectable signal.

Watermark detection is therefore fundamentally different from the AI detectors that became popular after ChatGPT launched. Those systems typically try to guess whether prose looks like AI writing. A genuine model-level watermark instead tries to identify a deliberately embedded signal. That's a much stronger form of evidence, but it still needs to be interpreted carefully.

Why Anthropic is doing this now

The timing isn't accidental. On August 2, 2026, new transparency provisions of the EU AI Act became applicable. Article 50 requires providers of generative AI systems to make generated or manipulated content identifiable in a machine-readable way, where technically feasible.

The European Commission's accompanying Code of Practice goes further into how companies can satisfy those obligations. The goal is straightforward: if synthetic text, images, video or audio are moving around the internet, there should be technical mechanisms that allow platforms, researchers and other systems to identify their artificial origin.

For text, that's a particularly difficult requirement. An image can carry metadata. A video file can contain provenance information. Both can potentially carry invisible signals in pixel data. Plain text is different. Once a sentence has been copied into a text box, there is almost nothing left except the actual sequence of characters.

So if the watermark needs to survive copy-paste, the provenance signal effectively has to become part of the language itself.

Images and files get a different kind of provenance

Anthropic isn't relying on the same technique for every type of output. Supported generated files and images can carry digitally signed provenance information based on C2PA, an industry standard designed to record where digital content came from and how it has been modified.

That creates an important distinction. C2PA provenance is attached to the digital asset and can provide structured information about its origin. Claude's text watermark, by contrast, has to survive in an environment where users routinely strip away everything except the words.

The text implementation is arguably the more technically interesting of the two for exactly that reason. A paragraph can move from Claude to a clipboard, into Google Docs, through an email, onto a CMS and finally into a web page. If the watermark survives that chain, there's no special Claude file left to inspect. There are only words.

Claude Code makes the question much bigger

The consequences also extend beyond students submitting AI-written essays or publishers trying to identify machine-generated books. Claude is increasingly used as a professional tool, and Claude Code in particular can generate substantial amounts of production software.

A model-level watermarking system therefore raises an obvious question: what happens when the generated content is code?

Natural language gives a model enormous freedom. There are dozens of ways to express the same idea. Source code is much more constrained. Changing a token can change how a program behaves, introduce a bug or prevent it from compiling altogether.

It also creates commercial questions. Developers routinely take AI-generated code, modify it, combine it with human-written code and commit the result to repositories that may live for years. If watermarking techniques can reliably identify portions of that output later, companies will need to understand exactly what a positive detection means and, equally importantly, what it doesn't mean.

A watermark is evidence of provenance, not automatically evidence about copyright ownership, authorship or how much human work went into the final product.

For schools, AI detection could become much less speculative

Education is one of the areas where this technology could have the biggest immediate impact.

Current AI detectors have a fundamental weakness: they generally don't know where a piece of text came from. They analyse it and calculate how much it resembles machine-generated language. That can produce false positives, including situations where genuinely human writing is incorrectly labelled as AI.

A watermark inserted by the model itself changes the problem. Instead of asking, "Does this look like Claude?", a detector can ask, "Does this contain the signal Claude deliberately puts into its output?"

That's a much more concrete question.

But it still doesn't solve the academic-integrity problem completely. A student could write an essay and use Claude to improve its grammar. Another could generate the entire assignment and then rewrite it heavily. The first could retain a detectable watermark despite doing most of the intellectual work themselves, while the second could potentially remove enough of the signal to avoid detection.

So even reliable watermarking doesn't produce a simple machine that can decide whether someone cheated. It produces evidence that needs context.

Only Anthropic currently knows exactly what to look for

There's another unusual aspect to the system: detection.

Anthropic has said it is working on support that will allow third parties to verify its watermarks, including detection tooling. But the full technical details of the text watermark haven't yet been made public.

For now, that creates an asymmetry. Users can receive text containing a machine-readable signal that they themselves can't see, while the company that generated it knows how that signal works.

That has already triggered debate among developers and other Claude users. Watermarking can make the information ecosystem more transparent, but it also means AI companies are deliberately placing persistent provenance signals into generated material. How those signals can be queried, who gets access to detection tools and how false positives are handled will matter just as much as the watermark itself.

A public detector could make verification widely accessible. A restricted detector could give Anthropic much more control over who can establish that a document contains Claude-generated material.

And then there is the internet's AI training problem

There is another reason AI companies have spent years researching watermarking that has little to do with catching students or identifying AI-written blog posts.

The internet is filling up with AI-generated material, and the next generation of AI systems is trained on enormous quantities of data collected from that same internet.

That creates the possibility of models increasingly training on the output of other models, or even indirectly training on their own previous output. Researchers generally refer to the broader problem as synthetic data contamination, and uncontrolled feedback loops can make it harder to distinguish original human-created information from material that has already passed through generative systems.

Reliable provenance gives AI companies another signal they can potentially use when constructing future training datasets. If a crawler can recognise that a page contains large amounts of watermarked synthetic text, that material can be treated differently from content whose origin is unknown.

In other words, watermarking isn't only about telling humans what's AI-generated. It may become increasingly important for allowing machines to recognise the work of other machines.

Claude probably won't be the last

Anthropic's decision matters partly because the underlying regulatory requirement isn't specific to Anthropic.

The EU's rules apply broadly to providers of generative AI systems operating in the European market. Google has already developed SynthID technology for watermarking AI-generated content, including text, and the pressure on major AI providers to develop reliable machine-readable provenance systems is only increasing.

That means invisible text watermarking could move from an unusual Claude feature to a normal part of using generative AI.

If that happens, the internet could end up with something resembling invisible fingerprints from different AI systems woven throughout ordinary language. A paragraph might look completely normal to a person while software can determine that portions of it carry a statistical signal associated with a particular model or provider.

The technology still has limits. Watermarks can be weakened. Text can be rewritten. Different models will use different approaches. Short pieces of text may not contain enough information to produce a reliable statistical conclusion. And any detection system powerful enough to make claims about authorship will need extremely careful handling of false positives.

The bigger picture

The most interesting thing about Claude's invisible watermark isn't that Anthropic has found a clever way to catch people copying AI text. It's that we're moving into a period where the origin of digital content is becoming part of the content itself.

For years, AI detection has largely been an outside process. A teacher, publisher, search engine or employer receives a piece of writing and asks another system to guess whether a machine created it. Watermarking reverses that relationship. The AI model deliberately leaves evidence behind while generating the content.

And because the signal can be embedded in the statistical structure of the language rather than attached as a visible label, deleting the Claude conversation or copying the text into another application doesn't necessarily break that connection. Even changing a handful of words may leave enough of the original pattern intact to detect.

That doesn't make Claude-generated text permanently traceable, and it doesn't turn watermark detection into unquestionable proof of authorship. Heavy rewriting can weaken the signal, detection has technical limitations, and Anthropic still needs to explain more about exactly how its implementation works.

But the direction is clear. AI-generated text is starting to carry provenance in a way ordinary users can't see. The sentence on your screen may look exactly the same as it did yesterday. To another machine, it may no longer be anonymous.