Putting Claude’s watermarking to the test - by andrea saez

Drea Says Product Things

SubscribeSign in

Putting Claude’s watermarking to the test

andrea saez<br>Aug 11, 2026

Share

Anthropic has just started marking Claude’s output and has signed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, confirming it started embedding machine-readable watermarks in text from new Claude models on August 2, 2026.<br>That announcement is a good excuse to actually explain how this category of technology works, because most people assume watermarking means hidden code slipped into the content, a few invisible characters or sneaky whitespace tucked in like a barcode.<br>It doesn’t work that way.<br>The watermark is the content, it’s the actual words the model chose. Once you see how that works, you start noticing where the whole system gets shakier than it sounds.<br>Anthropic hasn’t published the exact mechanism behind Claude’s watermark, so it is unclear how this will affect output.<br>What follows is grounded in Google’s SynthID, the clearest publicly documented example of this category of technology, and the open C2PA standard, which is the closest public reference point we have for what Claude’s system likely resembles.<br>TL;DR

AI watermarking doesn’t hide anything inside the text. It shapes which words a model picks at each step, using a secret key that turns “random” token selection into a specific, checkable pattern.

Google’s SynthID does this with a keyed hash function, and it’s resilient enough to survive editing, cropping, and partial rewrites.

Anthropic confirmed that Claude now does something in the same category, embedding watermarks in text and C2PA-compliant metadata in files to comply with the EU AI Act, though it hasn’t disclosed the exact mechanism.

The open standard C2PA tackles a related but different problem: content provenance rather than token-level fingerprinting.

All of these approaches have real limits, and the gap between “this can be detected” and “this will always be detected” is bigger than most explainers let on.

What is watermarking?

Every few weeks someone asks if AI companies are hiding invisible Unicode characters or zero-width spaces in generated text, a kind of digital secret handshake you could strip out with a find-and-replace. That approach exists in some contexts, and it’s trivially defeated. Copy the text into a plain text editor, and the “watermark” is gone.<br>That’s not what the serious players are doing.<br>Google built SynthID for this. OpenAI has adopted it too, for the images and audio it generates, though not yet confirmed for text. There’s also a separate open industry standard called C2PA (Coalition for Content Provenance and Authenticity) that tackles adjacent territory.<br>Anthropic has confirmed that Claude now marks its output too, using a text watermark for generated text and C2PA-compliant metadata for generated files, as part of signing the EU AI Act’s Article 50(2) Code of Practice, effective August 2, 2026.<br>The company hasn’t published how its text watermark actually works at the technical level, so what it shares with SynthID under the hood is unconfirmed. None of it depends on hidden characters, because hidden characters don’t survive the first paraphrase, screenshot, or platform that strips formatting.<br>How context-hash watermarking works

The actual mechanism is easiest to see through Gemini and SynthID, the clearest public example available. A language model doesn’t pick one exact next word. At every step, it scores a set of plausible candidates and normally samples from among the strongest ones, with some randomness controlled by “temperature.”<br>SynthID changes how that sampling happens. At each generation step, the model provider holds a secret 256-bit key. That key gets combined with the preceding tokens and run through a hash function, and the hash output deterministically splits the vocabulary into a “green” list and a “red” list.<br>Instead of sampling freely across all its top candidates, the model gets nudged toward whichever of those candidates fall on the green list. Do this at every step, across a long enough passage, and the text ends up containing more green-list tokens than chance alone would ever produce, a pattern invisible to a reader but recoverable by anyone holding the same key.<br>To anyone without the key, this looks exactly like ordinary random sampling, because the green and red lists reshuffle unpredictably at every step and there’s no way to tell which candidates were “nudged” without the key doing the sorting.<br>Functionally, it is random. The watermark doesn’t cost you output quality, because the model is still choosing from its top candidates either way. It’s just letting a secret key decide which of those top candidates gets the edge, instead of a dice roll.<br>A worked example

The following is a simplified version:<br>Say a model is completing “I love cake. My favorite dessert is ___” and the top candidates are...