EU AI Act Forces Anthropic's Hand: Claude Now Carries Invisible Text Watermark

Every piece of text that Claude generates now carries an invisible statistical signal — not appended to the output, not hidden in metadata, but woven into the specific word choices the model makes as it writes. Anthropic deployed the system globally on August 2, 2026 to comply with the EU AI Act, and on August 14 published a full technical explanation of how it works. A private-preview detection API for authorized organizations followed on September 1. The deployment makes Anthropic the first major frontier AI lab to run production-scale text watermarking across its entire output surface — a position OpenAI has conspicuously avoided despite holding the technology for more than two years.

The most important thing to understand about Claude's watermark is what it cannot tell you. It indicates that Claude was involved in producing or processing text; it says nothing about whether a human or an AI wrote the underlying ideas. And it disappears entirely if the text is paraphrased through another language model. That asymmetry — the watermark catches honest use, not evasion — is the central tension in AI content provenance that the EU's regulation has now made urgent.

Read more: Anthropic's Claude Fable 5.1 launches with agentic gains and EU compliance features

How Statistical Text Watermarking Works Inside Claude's Sampling Process

Large language models generate text token by token, choosing each word from a probability distribution over their entire vocabulary. For most words in a typical sentence, the model's preference is broad: the sentence "The weather today was cold and..." could reasonably continue with "overcast," "grey," "damp," or dozens of other options. These are the positions — high-entropy, low-stakes choices where one word is roughly as good as another — that watermarking exploits.

Claude's implementation is based on SynthID-Text, a system published by Google DeepMind in Nature in October 2024 and written by Sumanth Dathathri, Abigail See, and colleagues. SynthID-Text belongs to a lineage of watermarking schemes that traces to a 2022 proposal by computer scientist Scott Aaronson, then at OpenAI. Aaronson's original "Gumbel-Softmax" scheme replaced the model's random number generator with a deterministic sequence derived from a secret key, so the pattern of choices could later be checked by anyone with that key. Google DeepMind's refinement, which Anthropic adapted, uses a more sophisticated sampling mechanism called tournament sampling rather than modifying the probability distribution directly.

In tournament sampling, each time the model reaches a high-entropy token position, it generates a set of candidate tokens and runs them through a series of comparisons. A pseudorandom function — seeded by the secret key and by the few tokens that came immediately before — assigns each candidate a score called a G-value. The scores determine which candidate wins each pairwise match. After multiple layers of these comparisons, the token that emerges is still a plausible, contextually appropriate word; it is not a bizarre or forced choice. What makes it a watermark is that the specific pattern of which words win, across a long stretch of text, is statistically consistent with what a detector holding the secret key would expect.

Anthropic describes this using a Monopoly analogy: instead of rolling a die to determine how far to move, players use digits of pi — starting from a randomly chosen position. The moves look random to observers, but anyone who knows which digit sequence was used can verify the game is consistent with that source. The text reads normally to any human; the pattern is visible only to the verifier.

The Entropy Constraint That Limits Where Watermarking Applies

The mechanism is not applied uniformly. Watermarking only works where there is genuine choice — where different words would produce equally valid, semantically equivalent outputs. Where there is no real choice, the system does nothing.

This has several important consequences. Code, by nature, is mostly deterministic: a variable name must match its declaration, a bracket must close, a function must return the correct type. As Anthropic's blog explains, once a model has written "2 + 2 =", there is no meaningful alternative to "4" — and the watermark is not applied. Code comments, where vocabulary is freer, may carry watermark signal; the functional logic usually will not. Similarly, factual statements with a single correct answer ("Isaac Newton's most famous work was called Principia...") leave the model no room to choose, so those tokens are unmarked.

The practical consequence for developers building code-generation tools on Claude is that the watermark signal in code output will be sparse and unreliable. For prose, the signal accumulates with length — meaning short outputs, social media posts, and brief replies may not carry enough signal to detect reliably. Research by Google DeepMind's team found that at around 400 tokens, SynthID-Text achieves a true positive rate of roughly 80 to 90 percent at a 1 percent false positive rate. At 20 to 30 tokens, the signal is too faint to use. Anthropic has not published its own detection performance figures, and its specific implementation details remain unpublished.

What the Anthropic Watermark Does Not Say About Authorship

Perhaps the most consequential design choice is what the watermark records: Claude's involvement in processing the text, not Claude's role as the originator. When a writer asks Claude to proofread a 2,000-word essay, the returned text carries a watermark even though every idea and most of the sentences came from the human. When a developer asks Claude to translate documentation, the translation is watermarked because Claude chose every word.

Anthropic states this directly: "A watermark only helps test whether Claude might have produced or processed the content. It cannot distinguish 'Claude wrote this' from 'Claude heavily edited this.'" The detection API is designed to answer the question "Was Claude involved?" — not "Did an AI write this?" Those are different questions, but institutional enforcers — plagiarism detection software, academic integrity offices, employment screening — may treat the first answer as evidence for the second.

This matters because the population most affected by false positives is not people trying to deceive anyone. Non-native English speakers who use Claude to help write more fluently, employees who use Claude to draft and then substantially rewrite professional communications, and students who use Claude for research assistance and then write their own essays will all produce text that may carry watermark signal they did not realize was present and cannot remove without rewriting the entire document. Academic integrity researchers have documented that AI detection systems consistently produce higher false positive rates for non-native speakers; watermark-based detection avoids classifier bias but introduces a different risk: the watermark's presence becomes de facto evidence of "AI use" regardless of the nature of that use.

OpenAI Chose Not to Deploy: The Industry Collective Action Problem the EU Solved

Claude's watermark is notable not just for what it does, but for what it does that competitors have declined to do.

OpenAI developed internal text watermarking capability in 2022 and has held it since. Reporting by the Wall Street Journal documented internal debates that have continued for years, with product teams raising concerns about false positives, user attrition, and the competitive disadvantage of watermarking when rivals do not. A survey OpenAI commissioned found that 30 percent of ChatGPT users said they would use the product less if it deployed text watermarks. No text watermarking appears in any public ChatGPT output as of this writing. OpenAI's August 2026 EU compliance statement acknowledged that text watermarking "remains technically harder and not yet widely deployed at scale."

Google DeepMind took the opposite path. SynthID-Text has been running inside Gemini since 2024 — before any regulatory requirement existed — and Google reported by May 2025 that it had marked more than 10 billion pieces of content across text, images, audio, and video with SynthID technology. The open-source reference implementation went onto GitHub under Apache 2.0 in October 2024 and was integrated into Hugging Face Transformers, making the detection and generation code available for research.

The EU's Code of Practice on Transparency of AI-Generated Content, which became enforceable August 2, 2026, broke the collective action problem that had kept text watermarking voluntary and thus absent. By requiring all providers serving EU users to implement machine-readable marking, the regulation eliminated the competitive disadvantage of being the only company that watermarks. Around 190 organizations signed the Code by the end of July 2026, including Anthropic, Google, Meta, Microsoft, and OpenAI — the last of which signed despite having no deployed text watermarking system. Non-compliance carries fines of up to €15 million or 3 percent of worldwide annual turnover, whichever is larger.

Anthropic went further than the law requires by deploying globally rather than only for EU-bound outputs. The company's Help Center states that watermarking applies "wherever Claude is offered, worldwide," a decision it attributed to the absence of a reliable technical method for scoping marks by recipient geography.

Tournament Sampling vs. Older Schemes: Why the Mechanism Matters

Earlier watermarking proposals, including the Kirchenbauer et al. system published at ICML 2023, worked by directly modifying the model's logit distribution — boosting the probability of "green" tokens and suppressing "red" tokens using a pseudorandom partitioning scheme. The approach worked, but it introduced a measurable distortion: because it adjusted the probabilities before sampling, it could force the model toward words it would otherwise have downweighted, occasionally producing slightly awkward phrasing.

SynthID-Text's tournament sampling avoids modifying the probability distribution directly. Instead, it samples candidates from the model's existing distribution — so every word entering the tournament is one the model genuinely considered plausible — and then uses the secret-key-derived G-values to break ties within that candidate set. The model's underlying vocabulary preferences are preserved; only the tiebreaking rule is changed. Google's production experiments across Gemini, covering close to 20 million responses, found no statistically significant difference in user thumbs-up and thumbs-down ratings between watermarked and unwatermarked output. Anthropic reports equivalent internal testing results, though it has not published the data independently.

For researchers building on this infrastructure, the important technical detail is that SynthID-Text is not purely "distortion-free" in the strict theoretical sense — it belongs to a family that academic analysis has characterized as sitting between non-distortionary and distortionary schemes, achieving the practical benefits of non-distortion while maintaining stronger detection properties than pure non-distortionary approaches. The ETH Zurich Security and Privacy Lab published analysis in late 2024 showing that SynthID-Text's detection signal is, from a mathematical perspective, equivalent to a red-green scheme with variable logit biases — meaning the same class of detection tests applies.

The Paraphrase Attack: What Defeats the Watermark and Who Uses It

A watermark embedded in the pattern of word choices is destroyed when the pattern changes. Any substantial rewriting — whether by the user, by a translator, or by asking a different language model to rephrase the text — replaces the original token sequence with a new one that does not follow the key-derived distribution.

Anthropic acknowledges this directly: "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will." In cases of complete rewriting, the company notes, "it's arguable whether the text can any longer be described as AI-generated." A forensic evaluation submitted to the AAAI/ACM Conference on AI, Ethics, and Society in 2026 tested leading watermark schemes including a SynthID-Text implementation against meaning-preserving paraphrase across 846 runs; the reported removal rate for SynthID-Text was 98.3 percent after a single paraphrase pass, according to the study's preprint. (Note: this study is an unreviewed preprint and has not yet undergone independent peer review.) Anthropic has not published its own robustness figures.

This creates a systemic problem. The users who do not know the watermark exists — those who use Claude straightforwardly and submit the output — will produce detectably watermarked text. The users who do know — those who deliberately want to obscure AI involvement and run the output through a paraphrase tool — will produce unwatermarked text indistinguishable from human writing. A detection system built on this watermark therefore catches compliant behavior more reliably than it catches evasion, which inverts the enforcement purpose.

The open-source ecosystem amplifies this gap. Every open-weight language model — Llama, Qwen, Mistral, Falcon, and their derivatives — generates text with no watermark whatsoever, because watermarking requires controlling the sampling process during inference on the server side. A document that mixes Claude output with output from a locally run open-weight model, or with human writing, will carry Claude's mark only on the Claude-originated segments. A detector without complete provenance information cannot resolve which parts are which. Open-source tools to strip watermarks from text generated by Claude, SynthID-Text-based Gemini, and other providers appeared on GitHub within days of Anthropic's technical disclosure and accumulated thousands of stars within weeks.

The Detection API Gap and What Developers Must Do Now

Anthropic's deployment on August 2 created a situation in which the watermark exists universally but detection does not exist publicly. The detection API launched on September 1, 2026 remains in private preview, accessible only to organizations the EU law designates as authorized: regulators, law enforcement, media organizations, fact-checkers, independent researchers, educational institutions, EU civil society groups, and enterprises under their own EU compliance obligations.

That means the vast majority of Claude API developers — who automatically receive watermarked output from every call — cannot yet verify whether their pipeline produces watermarked content, what false positive rates look like in their specific use case, or how to build watermark-checking into their compliance systems. Anthropic's own guidance to developers is explicit about this gap: "If you deploy Claude in your own product, you should independently assess what Article 50 requires of your products and services." The watermark satisfies Anthropic's provider-level obligation under the Code of Practice. It does not satisfy the separate deployer obligation to disclose to end users that an AI system is involved. An enterprise that has built a customer service chatbot on Claude, served it to EU users, and not disclosed the AI involvement has a watermarked product but not a compliant one.

The February 2027 interoperability deadline adds another layer of complexity. By that date, EU law requires that watermark detection work across providers — meaning a tool that can detect a Claude watermark should also be able to detect a Gemini watermark or any other compliant watermark. No cross-provider detection standard exists yet. SynthID watermarks currently can only be detected using Google-authorized infrastructure. Claude's marks will presumably require Anthropic's detection API. Building the interoperability layer that connects these proprietary systems is a multi-stakeholder engineering problem with less than six months to solve.

The Provenance Asymmetry That No Single Provider Can Fix

Anthropic's deployment is the most comprehensive production-scale text watermarking system that any frontier AI provider has made public. It covers every Claude model launched on or after August 2, 2026, across every product surface — claude.ai, Claude Code, the Claude API, and Claude accessed through major cloud providers. The mark travels with text when it is copied and pasted. For images and other files, a separate C2PA cryptographic credential is attached to the metadata, following the open standard that more than 6,000 organizations including Adobe, Microsoft, and Google have adopted.

The system's real limitation is not what Anthropic built — it is what Anthropic cannot control. The open-source ecosystem, which includes some of the most capable models available, sits permanently outside any watermarking requirement. The EU AI Act applies to providers placing systems on the EU market; a researcher running Llama on their own hardware is subject to no such obligation. A publisher, academic institution, or employer that uses watermark detection as its primary tool for identifying AI-generated content will correctly identify Claude output from compliant users while missing output from anyone using open-weight models or paraphrase tools. That gap does not shrink as watermarking becomes more widespread; it widens, because the asymmetry between what is detectable and what is not creates stronger incentives to route through undetectable channels.

The February 2027 interoperability deadline and the ongoing work of the EU's Code of Practice task forces will determine whether provenance infrastructure can be built that is robust enough to survive the adversarial pressure already accumulating against it. Scott Aaronson, who first proposed the cryptographic approach in 2022, has argued publicly that watermarking remains the most practical available tool for content provenance despite its limitations — more reliable than classifier-based detection, less gameable than visible labels. Whether a fragmented system of proprietary keys and provider-specific detection APIs can deliver on that promise before the stripping tools become ubiquitous is the open question that will define the next phase of AI content governance.