Starting August 2, every new Claude model weaves an invisible watermark into the words it generates. Copy it, paste it into an email, a blog post, a college essay — the watermark travels with the text. Anthropic will publish detection tools so anyone can check. Your professor, your boss, the platform you post on can all run the same test you can.
Google has been doing this with Gemini since 2024. SynthID-Text has been watermarking every Gemini response for two years. Google barely mentioned it, and never released a public detection tool — you need Google’s key to check it. Claude joining means the two most-used writing models on earth now sign their own work.
Neither company did this voluntarily. The EU AI Act Article 50 made it law on August 2, 2026. AI providers must mark generated content so users know when they’re interacting with a machine. The transparency obligation applies to any AI system operating in the EU, which in practice means any AI system that matters globally.
How It Works
The mechanism is quieter than you’d expect. When Claude generates text, it uses a secret key to slightly bias its choice of the next word. The model doesn’t change what it says — it tilts how it says it. Across a few hundred words, those tilts form a statistical pattern that a detector can confirm. The writing carries its own confession in the sentence structure.
Anthropic is also attaching C2PA provenance metadata to files Claude generates — JPEGs, PNGs, SVGs. C2PA is the same content authenticity standard used by Adobe and the BBC. It digitally signs the file to record that an Anthropic model was involved in creating it.
Google’s SynthID works similarly — statistical watermarking embedded at the model level, not added by an application. The watermark survives copy-paste. It survives formatting changes. It does not survive aggressive paraphrasing.
What It Ends
The appeal of AI writing was always deniability. A cover letter, a LinkedIn post, a term paper, an apology email — nobody could prove a machine wrote it, and everyone quietly relied on that. The labs themselves just decided to hand out the proof.
Not because they wanted to. Because the EU required it. And because the alternative — a world where nobody can distinguish AI text from human text — was becoming a problem for trust in everything from academic credentials to news articles.
The default just flipped. AI text used to be innocent until proven guilty. Now, if it came from Claude, it ships pre-confessed.
The Split
Here’s where it gets interesting for anyone following the open models debate.
Cloud AI now self-identifies. Local AI doesn’t.
GLM-5.2, Qwen 3.8-27B, Llama variants running on your own hardware — none of them watermark their output. They can’t be forced to, because they run on your machine with no provider in the loop. You can download the model, run it offline, and the text it produces is indistinguishable from human writing. No secret key. No statistical signature. No confession in the sentence structure.
This creates a two-tier system. Text from cloud AI is traceable. Text from local AI is not. Text from cloud AI carries its origin like a fingerprint. Text from local AI carries nothing.
For the companies building cloud AI, this is a feature. It differentiates their product. “Our AI is transparent — you can verify it.” For the open-source community, it’s another line in the sand. The same regulators who want watermarking are the ones pushing to restrict open models — and the argument writes itself: if a model can’t be watermarked because there’s no provider in the loop, maybe it shouldn’t be open.
The Limitations
The watermark is not a lie detector. Anthropic says so explicitly: detecting a Claude mark does not prove Claude authored the content. It proves Claude was involved. Someone could use Claude to draft, then heavily edit. The watermark fragments. Someone could paraphrase. A University of Maryland study found that simple paraphrasing dropped detection rates below 50 per cent for leading watermarking techniques.
Short snippets slip through entirely. A single sentence, a paragraph — the statistical pattern needs length to become detectable. The watermark is designed for longer-form generation, the kind of thing someone might pass off as original work.
And there’s the obvious gap: the watermark only works on models from August 2 onward. Older Claude outputs, older Gemini outputs, and every open model ever released carry nothing. The archive of untraceable AI text is already vast and growing.
What This Means
For educators, this is the first real tool they’ve been given. For two years, AI detection has been a joke — false positives, false negatives, students falsely accused. A watermark built into the model is fundamentally more reliable than a third-party detector guessing based on perplexity and burst.
For platforms — LinkedIn, Medium, academic journals — it’s an enforcement mechanism. If Anthropic publishes the detection API, platforms can flag watermarked content automatically. Google could do the same with SynthID if they ever release a public tool.
For the open models debate, it’s ammunition. The same regulatory framework that requires watermarking also wants to restrict models that can’t be watermarked. The EU AI Act’s transparency obligations and the push to limit open-weight releases come from the same impulse: make AI accountable by making it traceable. Open models can’t be traced. Therefore, the argument goes, open models are a transparency risk.
The counter-argument hasn’t changed: traceability is control. A watermark that lets your boss check your writing also lets a government check your writing. The same mechanism that catches a student cheating catches a dissident organising. The difference between transparency and surveillance depends on who’s holding the detector.
The split is now permanent. Cloud AI signs its work. Local AI doesn’t. Which side of that line you want to be on is becoming the defining choice of the AI era.
❓ FAQ
Can I detect Claude watermarks myself? Not yet. Anthropic says detection tools and technical documentation will be published soon. When they ship, third parties will be able to check text for Claude marks.
Can the watermark be removed? Aggressive paraphrasing reduces detection rates significantly. The watermark is designed for longer-form text and needs sufficient length to produce a detectable statistical pattern. It’s not unbreakable, but it’s harder to remove than a metadata tag.
Do open-source models watermark their output? No. Models running locally on your own hardware have no provider in the loop to embed a watermark. There’s no mechanism to force them to, which is part of the regulatory concern about open-weight releases.
Is Google’s SynthID the same thing? Conceptually similar — statistical watermarking embedded at the model level. But Google hasn’t published a public detection tool, so in practice, only Google can verify SynthID marks. Anthropic’s approach is more transparent.
Does this affect code generation? Anthropic’s watermarking applies to text output. Code is text, but the practical detectability of watermarks in code — which is often reformatted, refactored, and mixed with human-written code — remains an open question.
📰 Sources
- Anthropic Help Center — How Claude marks AI-generated content
- Google DeepMind — SynthID
- EU AI Act Article 50 — Transparency obligations
- Aakash Gupta (@aakashgupta) — X post on watermarking
— CJ Murden, editor of Singularity.Kiwi. Former digital technologies teacher, author of AI-focused books. Writing with a New Zealand focus.
