How Claude Could Watermark Text Without Invisible Characters | James O'Reilly
Back to blog
Aug 11, 2026
•<br>3 min read
How Claude Could Watermark Text Without Invisible Characters
Claude said they’ll be watermarking the text it generates as part of the EU AI Act for transparancy. Not a simple “AI generated” label, and not some invisible characters hidden between words either. I think the watermark will be baked into the text itself.
Every time an LLM generates text, it’s choosing between a bunch of possible next tokens. Roughly:
cat 9%<br>dog 7%<br>kitten 3%<br>animal 2%<br>A watermark could in theory nudge those choices. Give certain tokens a tiny edge based on some secret pattern only the model (and whoever built it) knows about. You’d never notice a single choice being off, but string together a few hundred or a few thousand tokens and you get a statistical fingerprint. Essentially, statisical but imperceptible word choices is the watermark.
Anthropic hasn’t said exactly how they’re doing it, so take the above as “one way this could work” rather than “here’s what Claude does.” Their docs don’t go much deeper than the marketing version either.
The thing that sticks out to me is that it survives copy and paste. People online are already thinking “just copy/paste it into a text editor and delete the invisible characters” but if the signal is the words themselves, good luck. Anthropic says it can survive some editing as well.
It’s not bullet proof though. Modify the text enough and the signal probably falls apart pretty quickly. Which makes sense if you’re relying on a very specific statistical pattern in word selection.
The bit I actually care about is code, and it isn’t clear to me how it’ll work there. Prose has a ton of ways to say the same thing, plenty of room for a model to quietly prefer one token over another without you ever noticing. Code doesn’t give you that luxury.
if user.isAuthenticated {<br>await syncData()<br>Not a lot of wiggle room there. Claude can’t just swap tokens around for the sake of a fingerprint if doing so breaks the syntax or changes behaviour. Anthropic says watermarketing includes Claude Code and API usage, but how that actually holds up in something as constrained as code, I have no idea. That’s the part I want to see more on.
Follow along
Occasional notes about building software with and without AI.
Enter your email<br>Subscribe
No spam. Unsubscribe anytime.
Powered by Buttondown.