Future Claude models will generate text that contains a watermark. This is a way of determining the likelihood that Claude was involved in writing the text, and we, along with several other major AI providers, are implementing this change to comply with the EU AI Act.<\/p>\n
In this article, we share answers to some of the questions we\u2019ve received about how our chosen watermarking method works, whether it affects Claude\u2019s outputs, and why we\u2019re making this change. To summarize:<\/p>\n
We use a method of watermarking that does not have any practical impact on the quality or content of Claude\u2019s outputs;The difference between watermarked and un-watermarked text will not be distinguishable to readers;Nothing is added to the text and there are no hidden characters;Watermarking doesn\u2019t require extra tokens, and will not be more expensive;Watermarking carries no identifying information and can\u2019t be traced to a specific person, organization, or chat;Watermarking won\u2019t be specific to Claude. As of August 2, the EU requires AI providers serving its market to mark AI-generated content. Other major model developers have signed the same Code of Practice and will be implementing their own watermarks.What is watermarking?<\/p>\n
Large language models like Claude work by generating one word at a time. Each time the model decides on the next word, it chooses among a list of potential candidates, ultimately selecting the most sensible or likely based on the preceding text. Take the sentence \u201cThe weather today was cold and\u2026\u201d. The next word is very unlikely to be \u201csugary.\u201d But it is quite likely to be \u201covercast\u201d or \u201cgrey.\u201d Under most circumstances, it doesn\u2019t matter much to the reader which of these latter two words the model ultimately chooses\u2014the meaning of the sentence is largely the same either way. In cases like this, the choice is settled by a random number.<\/p>\n
Watermarking uses low-stakes choices like these\u2014which occur many times over a piece of generated text\u2014to leave a pattern in Claude\u2019s responses. That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it. When watermarking is used, choices are still made at random, but the source of the randomness is different. Instead of using an arbitrary random number generator to pick the next word, watermarking uses the key and a few words that come before to settle what word the model should pick. That is, the words that Claude picks are still random, but now, one can check the sequence of words and see if it\u2019s consistent with the choices Claude would make if it was using the key. If it is, one can assign a probability that the text was generated by Claude.<\/p>\n
Importantly, it isn\u2019t that the model will now always be biased toward overcast or grey. Just as with non-watermarked text, overcast might be selected in one sentence, grey in the next, depending on the words that came before. And it\u2019s not the case that the watermarking method pushes Claude to choose a word it wouldn\u2019t have considered anyway (for instance, it wouldn\u2019t make Claude pick a word like \u201cnubilous\u201d\u2014an obscure1 synonym for overcast or grey that Claude almost certainly wouldn\u2019t use under normal circumstances).<\/p>\n
How does watermarking affect Claude\u2019s outputs?<\/p>\n
Watermarking does not impact the quality of Claude\u2019s output. To a reader, a watermarked response is indistinguishable from an unwatermarked one (in this way, AI watermarks differ substantially from their namesakes on banknotes, other physical objects, and some digital documents, which are visible to the naked eye).<\/p>\n
In internal testing, we\u2019ve seen no impact of watermarking on the content, level of creativity, or readability of Claude\u2019s text. In the SynthID-Text paper<\/a>, which introduced the technique we use, Google DeepMind tested this impact by serving a model that used watermarking to a portion of their Gemini traffic and comparing thumbs-up and thumbs-down ratings. They found no statistically significant differences from the unwatermarked model. And in a controlled study, human raters comparing watermarked and unwatermarked answers side-by-side saw no difference in quality.<\/p>\n A useful analogy is to imagine you\u2019re playing a game like Monopoly. On each turn, each player moves a random number of spaces around the board according to the roll of a die. Suppose that, instead of rolling the die to get this randomness, we decided to use a book of the digits of pi.2 We start from a randomly-chosen digit (say, the 1,012,845th after the decimal place, which happens to be a 6), and from that point on each player simply uses the next digit in the sequence as their next \u201croll.”<\/p>\n For all intents and purposes, the moves are still random: it makes no difference to the players\u2014or to the outcome of the game\u2014whether the randomness comes from pi or from dice rolls each time. But if we could see the sequence of all the moves after the game (and we knew the value of pi), we could work out whether this was a game that likely used pi to determine its moves. The game that used pi is, in a sense, \u201cwatermarked.”<\/p>\n It\u2019s the same for Claude-generated text. Watermarking doesn\u2019t change the meaning or experience for the person reading it, but if you wanted to check after the fact whether the text was likely generated by Claude, the watermark allows you to do so.<\/p>\n Which specific method of watermarking do you use?<\/p>\n Claude\u2019s text watermark is a version of the SynthID-Text approach published by Google DeepMind in a Nature paper<\/a> in 2024. It belongs to a family of approaches that go back to a proposal by Scott Aaronson in 2022, all of which share the same design principle that we described above\u2014the watermark only changes the source of the randomness used to pick among words. <\/p>\n There are limitations to the effectiveness of watermarking. Using our key, one can only answer the question \u201cWhat is the likelihood this was partly written by Claude?\u201d It doesn\u2019t confirm whether the text was human-written, and it can\u2019t tell whether the text was written by a different AI (even if that other AI uses watermarking, it would have a different key; it might also use a different watermarking method altogether). Detecting a watermark also doesn\u2019t work well on small samples, where there are fewer word choices and thus less information to go on. As a passage increases in length, confidence about Claude\u2019s involvement increases too.<\/p>\n Watermarking is sparser on factual passages where there are fewer choices that can be made without decreasing the accuracy of the text. For example, take the sentence \u201cIsaac Newton\u2019s most famous work was called Principia\u2026\u201d. It really matters whether the next word is \u201cMathematica\u201d (it\u2019s the only right answer), so the watermark would have nothing to act on. The same is true for proofreading. If you hand Claude a piece of writing and ask it to edit only the grammar and punctuation and nothing else, the watermark can only live in the handful of corrections, which might be too few to register.<\/p>\n What about cases where Claude has proofread or edited human text?<\/p>\n The watermark only applies to words Claude chooses. When Claude proofreads text written by a person, what it gives back has generally only been lightly edited; because nearly all the words are the person\u2019s, there\u2019s very little (if anything) for the watermark to attach to. Depending on the length of the text and how heavily Claude has edited it, those changes might not be enough to make Claude\u2019s involvement detectable. The more Claude writes, the more decisions it has to make, and the more space there is for a watermark.<\/p>\n What about code?\u00a0<\/p>\n As we noted above, AI watermarking takes advantage of decisions where either choice of a word would be equally good. Where an exact output is required\u2014where there isn\u2019t a choice, and something would be factually wrong or a piece of code would break if a different term was chosen\u2014the watermark isn\u2019t applied.<\/p>\n For example, once the model has written \u201c2 + 2 =\u201d, there is a very clear best choice for the next token (if the model is completing the sum, there isn\u2019t an answer that\u2019s equally as good as \u201c4\u201d; if it\u2019s talking about George Orwell\u2019s Nineteen Eighty-Four, there isn\u2019t an answer that\u2019s equally as good as \u201c5\u201d). The \u201cnudge\u201d of the watermark wouldn\u2019t be applied here. For the same reason, code\u2014which in very many cases has to be exact\u2014has generally less watermarking than some other forms of text.<\/p>\n Having said that, in areas where there is an arbitrary choice between particular words or terms within the code, the watermark can be used, such as comments within code. But by definition, it will have a negligible effect on the actual code produced.<\/p>\n What does this mean for users? No. Watermarking has a negligible impact on the speed of models, and because it produces no extra tokens, the model is the same price to serve and use.<\/p>\n Can a watermark be traced back to me or my organization?<\/p>\n No. The watermarking applies to Claude and its outputs. It doesn\u2019t identify anything to do with individual users. There\u2019s nothing in the watermark, or its key, that would allow anyone to recover any information about the user, their organization, or their chats with Claude.<\/p>\n Why are you watermarking Claude\u2019s outputs?<\/p>\n We\u2019re implementing watermarking to comply with the EU AI Act. Anthropic, along with several other major AI model providers and around 190 total signatories<\/a>, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. This requires AI system providers to use methods of \u201cmarking\u201d AI-generated text. We\u2019re applying watermarking globally at launch because we don’t yet have a durable way to scope it by region. However, we will continue to evaluate different approaches, and will share updates when we have them.<\/p>\n Other questionsHow do I check if a piece of text was written by Claude?<\/p>\n We will soon be offering a watermark detection API. We\u2019re in the process of working out the details of its implementation.<\/p>\n What about images and other files?<\/p>\n
Does this slow the model down, or make it more expensive?<\/p>\n