Anthropic to watermark all future Claude text

On 11 August, Anthropic announced that all future Claude models will generate text carrying a watermark that identifies it as AI-generated. Anthropic is not alone: Google already has its own text watermark, called SynthID-Text, which it applies to output from its Gemini models and on which Anthropic's new watermark is based, though Anthropic has not detailed what it changed. OpenAI has yet to introduce a text watermark of its own but says it plans to.

The push is driven in part by the EU AI Act, which requires watermarks on AI models released after 2 August 2026, alongside other regulations aimed at curbing deceptive or manipulative AI-generated content. Watermarks for AI images, audio and video have existed for years and, while debate continues over how well they work as a full solution, can reach detection rates above 99 percent; image and video watermarks specifically are already deployed by OpenAI, Google and Meta (Anthropic does not offer an image generator). Text watermarks have spread far more slowly, and not everyone agrees they can work without compromising the quality of a model's response.

John Gruber, the technology writer and co-creator of the Markdown language, calls text watermarking a "perversion of writing" and disputes Anthropic's claim that a watermark does not change the meaning or quality of a response. He notes that images consist of millions of pixels, while a text reply often runs to only dozens or hundreds of words. John Kirchenbauer, a postdoctoral fellow at the Vector Institute and co-author of a 2023 paper that was among the first to describe a practical text-watermarking method, disagrees with the premise: "[A watermark] wouldn't be detectable if there wasn't a change. This is a very fundamental point," he says, framing the real question as whether that unavoidable change affects the utility of the text to the reader, not whether a change exists at all.

A large language model assigns a probability to every possible next word at each step of a response (the article uses "words" loosely for tokens, which also cover punctuation and numbers): a likely word might get a 40 percent probability, a plausible alternative 10 percent, and an unlikely one a fraction of a percent, and the model then samples a word at random, weighted by those odds, so the most probable choice usually wins but not always. Kirchenbauer's 2023 method exploits that randomness by sorting the vocabulary into a "red list" and a "green list" for each step and nudging green-list words to be slightly more probable; sampled over many words, the output leans toward the up-weighted green-list set in a way that is invisible to a reader but statistically detectable with the right key. Kirchenbauer and his co-authors reported a 98.4 percent detection rate with zero false positives on responses of about 200 tokens, and found that removing the watermark from a long response requires changing roughly a quarter or more of its words, so ordinary paraphrasing will not erase it.

The strongest evidence that watermarking does not hurt quality comes from a 2024 paper by a Google team that introduced SynthID-Text: the authors randomly routed Gemini user queries to watermarked and non-watermarked variants of Google's text models and compared the feedback each got, finding no significant difference in user feedback across 20 million responses.

Other researchers remain skeptical, pointing to edge cases where the tradeoff gets harder. Vinu Sankar Sadasivan, an AI research scientist at Meta and co-author of a widely cited paper on detecting AI text watermarks, says the technique struggles most when a response offers few plausible word choices: a 20-word tweet, he says, would need 50 to 60 percent of its words drawn from the green list to be reliably detected, and a short piece of generated code runs into the same problem. "This is where I have a disagreement with some of the PR posts from Anthropic, where they say it has no quality change," Sadasivan says. He notes that a watermark's strength can be dialed up or down to protect quality in hard cases, but doing so can also weaken detection: Google's own SynthID-Text paper includes a graph showing detection reaching up to 95 percent in the best case but falling below 50 percent for short replies. Anthropic declined to give IEEE Spectrum additional detail on how it balances quality against watermark strength.

At bottom, Gruber's objection is that altering a model's output at all is unacceptable because it makes the reply different from what the model would otherwise have produced; the EU AI Act, by contrast, treats some alteration as acceptable if it tells readers they are looking at AI-generated text. The dispute is also widening beyond simple labeling. A 2026 paper co-authored by Kirchenbauer found that an AI model trained on watermarked text will itself reproduce that watermark in its own output, which means a content owner who watermarks documents before publishing them could later point to that trace as statistical evidence their text ended up in a model's training data. The reverse use also applies: an AI company training a new model could use watermark detection to strip prior-generation AI output out of its training set, a safeguard against "model collapse," in which models recycle and amplify their own errors. As Kirchenbauer puts it, the goal is shifting away from catching individual "you used AI" cases and toward using the watermark as a piece of metadata attached to content that lets anyone trace where it goes.

Key facts

On 11 August, Anthropic announced that all future Claude models will generate text carrying a watermark identifying it as AI-generated, following Google's Gemini (whose SynthID-Text scheme Anthropic's watermark is based on); OpenAI has no text watermark yet but says it plans one.
The move tracks the EU AI Act, which mandates watermarks on AI models released after 2 August 2026, part of a wider push against deceptive AI-generated content; image and video watermarks, already deployed by OpenAI, Google and Meta, reach detection rates above 99 percent.
Kirchenbauer's 2023 red-list and green-list watermarking method reported 98.4 percent detection with zero false positives on responses of about 200 tokens; erasing it from a long reply requires changing roughly a quarter or more of its words.
Google's 2024 SynthID-Text study found no significant difference in user feedback across 20 million watermarked versus non-watermarked Gemini responses, though the same paper's own graph shows detection falling below 50 percent for short replies against up to 95 percent in the best case.
A 2026 paper co-authored by Kirchenbauer found that models trained on watermarked text reproduce the watermark themselves, opening two new uses: content owners could point to their own watermark as evidence their text entered a model's training data, and AI companies could use detection to filter earlier AI-generated text out of future training sets.

Why it matters

This is the moment text watermarking stops being an experiment and becomes default behavior at the top AI labs: Anthropic's 11 August announcement means all future Claude output carries an embedded, statistically detectable marker, Google already does the same for Gemini through its SynthID-Text scheme (which Anthropic's watermark is based on), and OpenAI says a text watermark is coming. The trigger is regulatory: the EU AI Act requires watermarks on AI models released after 2 August 2026, part of a broader push against deceptive or manipulative AI content. Image and video watermarks have existed for years and already reach detection rates above 99 percent at companies including OpenAI, Google and Meta (Anthropic has no image generator), but text is a much harder medium to mark: a reply may run to only dozens or hundreds of words, compared with the millions of pixels in an image, leaving far less room to hide a detectable pattern without visibly changing the writing. That gap is why, unlike image watermarking, text watermarking is shipping into a live, unresolved argument about whether it costs quality.

Who it affects

Every user of Gemini now reads AI output that carries an invisible statistical fingerprint, with Claude and ChatGPT users set to join them once Anthropic and OpenAI ship their watermarks; none of them will see any visible change or get a way to opt out. Writers and critics who care about the exact wording of AI text, the position John Gruber stakes out, are affected because the model's word choices are deliberately biased away from what it would otherwise have produced. Researchers who study or build detection methods, such as John Kirchenbauer at the Vector Institute and Vinu Sankar Sadasivan at Meta, are the ones defining how well any of this actually works. And two groups gain a new lever from the same technology: content owners who watermark their own writing before publishing it, who could later use a detected trace as evidence their text trained a model, and AI companies themselves, who could use watermark detection to keep earlier AI-generated text out of future training data.

How to use it

Nothing changes in how anyone uses Claude or Gemini day to day: the watermark lives in the statistics of word choice, not in visible text, metadata or a toggle, so a reply reads normally and there is no setting to switch it off. Checking whether a given piece of text is watermarked requires the vendor's own detection key; neither readers nor independent third parties can verify it themselves from the text alone. Paraphrasing is a weak workaround: Kirchenbauer's research found that erasing a watermark from a long response takes changing roughly a quarter or more of its words. The one deliberate use case in the piece is for content owners and AI developers: watermarking your own material before publishing it creates a trace that could later serve as statistical evidence it was used to train a model, and AI companies can run the same detection the other way, to filter previous-generation AI text out of new training data.

How solid is it

The technical claims rest on named, on-the-record researchers and published papers rather than company promises alone. Kirchenbauer's 2023 method is published and reports concrete numbers: 98.4 percent detection with zero false positives on roughly 200-token responses. Google's 2024 SynthID-Text paper is the largest piece of real-world evidence on quality: a randomized comparison of user feedback across 20 million actual Gemini responses found no significant difference between watermarked and unwatermarked output. But the same paper's own detection-rate graph tempers that reassurance: accuracy reaches up to 95 percent in the best case but falls below 50 percent for short replies, exactly the case Sadasivan says is hardest. Anthropic's own watermark has the least independent evidence behind it: the company has confirmed only that it is based on SynthID-Text with unspecified alterations, and it declined to answer further questions for this article, so its own quality-versus-strength tradeoff rests on Google's evidence for a related but different watermark rather than on published data of its own.

Risks and caveats

The clearest weak spot is short or low-entropy text: tweets, one-line answers and small code snippets give a watermark few plausible word substitutions to work with, so it ends up either too weak to detect reliably or strong enough to visibly bend word choice; Google's own graph and Sadasivan's tweet example both point to detection rates below 50 percent in exactly these cases. Because Anthropic declined to answer further questions for this piece, its quality-versus-strength tradeoff is asserted rather than shown with its own data. The underlying disagreement is partly about values, not just measurement: Gruber opposes any deliberate alteration of a model's output on principle, while the EU AI Act treats some alteration as an acceptable cost of disclosure. Watermarking is also being extended well past labeling a single reply, toward tracing whether specific text trained a model and toward filtering AI-generated text out of future training data, uses that carry their own data-provenance implications beyond the original AI-disclosure purpose.

“[A watermark] wouldn't be detectable if there wasn't a change. This is a very fundamental point.”

— John Kirchenbauer, postdoctoral fellow at the Vector Institute