Claude's writing now leaves a fingerprint

• If you hand over a full draft, it stays. The more words Claude decided on, the more spots there are for a marker to attach to.
• If you have it polish your own writing, almost nothing remains. Most of the words are still yours.
• Translations are entirely subject to it. In a translation, Claude picks every single word anew.
• It's sparse in factual sentences. In "Isaac Newton's masterwork is the Principia ___," the blank has only one answer: "Mathematica." Any other word just produces a wrong sentence.
• Code is rarely affected. Anthropic doesn't apply it at all where precise output is required. However, it can appear in places where anything goes, such as the code comments Anthropic cited as an example. Claims that "code gets watermarked" are an exaggeration.
• Short pieces of writing can't be caught. Since the number of word choices is itself the amount of signal, confidence rises the longer the text is.

The example Anthropic gave captures this principle concisely. The answer to "2 + 2 = ___" is only 4. But in the middle of a story about George Orwell's 1984, 5 might be the correct answer. The moment context narrows the answer to just one, the watermark has nowhere to stand.

An important limitation is worth noting here too. The watermark cannot distinguish between "Claude wrote this" and "Claude heavily edited this." Conversely, the absence of a marker doesn't mean AI wasn't used — other companies' AI models use different keys. Ownership works the same way. Anthropic explicitly states that the watermark says nothing about copyright or authorship, and it doesn't change any rights under the terms of service.

Images and files are a different story. This is a point many English-language outlets got wrong. Files like .png, .jpg, and .svg don't get a pixel-altering watermark but rather a C2PA Content Credential — put simply, a tamper-evident digital tag attached to the file's metadata. It's an open standard also used by camera makers and photo-editing software, so the image itself remains untouched. But because it's just a tag, it carries the weakness that it can simply be stripped off.

Not adding characters — changing the dice

When an AI picks its next word, it probabilistically selects one candidate from several. In "Today's weather is cold and ___," "sugary" can't fit, but "cloudy" and "gray" are both natural. Whichever one is chosen, the meaning doesn't change. Such choices where either option is fine occur hundreds of times in a long piece of text.

Watermarking doesn't forcibly change the outcome of this choice. What it changes is the "dice" used to make the choice. Instead of using ordinary randomness, it determines the next word using a number generated by combining a secret key with the preceding few words. It still looks random on the surface, but anyone holding the key can trace back and find a regularity that can't be explained by chance.

Anthropic's own analogy is apt. Imagine that in a board game, instead of rolling dice, you read the digits of pi in sequence to move your piece. During the game, this is indistinguishable from rolling dice. But afterward, looking at the full record, anyone who knows pi can calculate whether the game used it.

One misconception should be addressed here. This method doesn't twist Claude's preferences so it always picks "cloudy." Anthropic has explicitly stated that it doesn't force in obscure synonyms Claude wouldn't normally use either. It's not shuffling the ranking of candidates but changing the seed of the lottery draw.

The underlying technology is Google DeepMind's SynthID-Text. It was published in the journal Nature in October 2024 under the title "Scalable watermarking for identifying large language model outputs." It uses a tournament sampling method that pits candidate words against each other one-on-one, like a tournament bracket (30 rounds by default) to determine a final winner, with the secret key hidden in the rule that decides who wins each matchup. In a configuration where the probability of each word being selected is preserved as originally intended, quality shouldn't degrade in principle. DeepMind reported comparing user reactions across roughly 20 million actual Gemini responses and found essentially no difference — a 0.01 percentage point difference in "likes" and 0.02 in "dislikes." Anthropic also stated that its internal testing showed no impact.

Entirely different from commercial "AI detectors"

This is where the most confusion arises. Services like GPTZero or Pangram, which detect AI text, have no key. So they instead look at writing habits. Anthropic itself gave an amusing example: AI models are unusually fond of constructions like "This isn't X, it's Y," and use the adverb "quietly" far more often than humans do.

Watermark detection works the opposite way. Because it calculates using a key rather than examining style, well-written text isn't flagged as more suspicious. But only Anthropic, which holds the key, can do the checking. Teachers, companies, and even writers themselves have no way to verify it yet — the detection API is described only as "coming soon."

Can it be erased? Academics disagree.

The common belief that "rewriting in different words erases it" is only half true.

In 2023, Krishna et al. used a dedicated paraphrasing AI (11 billion parameters) to rewrite entire sentences, dropping the accuracy of a leading detector from 70.3% to as low as 4.6%. On the other hand, a University of Maryland team led by Kirchenbauer reached the opposite conclusion in a June 2023 paper (ICLR 2024). Even after heavy human editing, they found that gathering an average of 800 tokens (a "token" being the unit an AI uses to process text, roughly a word fragment) was enough for detection even under a strict threshold with a false-positive rate of one in 100,000. This is because fragments of the original word groupings survive scattered throughout the rewritten text.

The axis along which these two conclusions diverge is text length. Short text gets erased; long text survives. Anthropic's own explanation stays within these bounds — "Light editing won't completely erase it, but a full rewrite that changes every word will. Of course, if you've gone that far, whether the piece can even be called 'AI-written' becomes debatable in itself."

There's a more fundamental problem too. In 2024, researchers at ETH Zurich succeeded in both removing and forging the watermark simply by repeatedly querying the API to reverse-engineer its rules. The forging scenario is especially troubling — maliciously embedding a fake signal into human-written text to frame it as AI-generated is far harder to deal with than simply failing to detect AI text. GPTZero's Alex Cui also stated that "it won't survive strong paraphrasing that attacks both word choice and syntax together" — meaning that overhauling both wording and sentence structure at once defeats it.

Why now — a nearly four-year-old technology meets regulation

Watermarking isn't a sudden idea. A technique that had been circulating in academia met regulation and rose to prominence all at once.

November 2022. Theoretical computer scientist Scott Aaronson, who was on leave working at OpenAI at the time, revealed his main project in a talk at UT Austin. The concept: use a secret rule known only to OpenAI to generate random numbers for picking words — the prototype of the very method Anthropic has now turned on. He also acknowledged that while the signal is detectable within a few hundred tokens, rewriting with another AI breaks it.

January 2023. "A Watermark for Large Language Models" by the Kirchenbauer team at the University of Maryland won the Best Paper Award at that year's ICML AI conference (one of 6 out of roughly 1,800 accepted papers). This method divides words into two groups in advance and detects which group was used more heavily — and it was at this point that the limitation of not being able to apply it to sentences with no alternative wording was first pointed out. The same team also produced the "survives if long enough" paper discussed in the previous section.

2023–2024. Google DeepMind applied SynthID to images in August 2023, then to Gemini's text in May 2024. In October, alongside the Nature paper, it open-sourced the code on Hugging Face for anyone to use. This was the moment the technology went from being one company's proprietary asset to a shared industry component.

And the choice OpenAI made not to turn it on. In August 2024, the Wall Street Journal reported that OpenAI had built a text watermarking system with 99.9% confidence but had delayed its release for nearly a year. A major factor was an internal survey from April 2023 in which about 30% of users said they would use ChatGPT less if OpenAI watermarked its output while competitors didn't. Another reason OpenAI publicly cited on the same day was even weightier — that watermarking could stigmatize people who aren't native English speakers.

August 2, 2026. The transparency obligations under Article 50 of the EU AI Act took effect. Providers of systems that generate AI content must ensure that outputs are marked in a machine-readable format. Anthropic signed the "Code of Practice for Transparency of AI-Generated Content" in July 2026, and roughly 190 organizations have signed on. Violations carry fines of up to €15 million or 3% of global revenue.

The most contentious point emerges here. Anthropic turned the watermark on not just in Europe, but worldwide. The reason is given in a single line: "there is no robust way yet to scope this by region." It's a textbook case of the so-called "Brussels effect," where a regulation created in Europe becomes a de facto global standard.

South Korea is different — watermarking isn't mandatory

The AI Framework Act took effect on January 22, 2026. Article 31, Paragraph 2 requires that generative AI outputs be marked as such, and Article 23, Paragraph 2 of the enforcement decree specifies the method as either a human-perceptible label or a machine-readable marker — meaning either one suffices. Even if a company chooses the machine-readable option, it must still notify humans at least once.

In other words, South Korea has not made watermarking mandatory — a point where it diverges from the EU. The administrative fine (up to 30 million won) is also triggered by violating the advance-notice obligation under Article 31, Paragraph 1, not by simply failing to mark the output itself — a point that is frequently misread.

	EU	South Korea	China	California, USA
Effective date	2026-08-02	2026-01-22	2025-09-01	2026-08-02
Machine-readable marking	Mandatory	Optional	Mandatory	Mandatory
Human-visible label	Distributor's responsibility	Mandatory	Mandatory	User's choice
Obligation on the user	None	None	Yes	None

China alone is unusually thorough, placing obligations not only on developers but also on users and distribution platforms. California will also require detection capability from platforms starting January 2027.

The relevant statutes are Article 50 of the EU AI Act, Article 31 of South Korea's AI Framework Act, China's "Measures for the Labeling of AI-Generated Content," and California's SB 942. The marking methods differ slightly — China designates an "implicit label" embedded in file metadata, and California an "latent disclosure," while California's human-visible label carries the caveat "to the extent technically feasible."

The same day, Google went the other way

On the very day Anthropic's explanation came out, Google announced the opposite move.

Josh Woodward, Vice President of Google Labs, announced on August 14 (10:39 p.m. Korea time) that Gemini and Flow now have a switch to turn visible watermarks on and off. This applies across Nano Banana (images), Omni (video), and Lyria (music). The criterion wasn't subscription tier but whether the user's country legally requires the watermark to remain on.

South Korea comes up here. Google Flow's help documentation states plainly that residents of India, South Korea, and Vietnam have the visible watermark applied automatically. In practice, though, country, subscription plan, and account type overlap — Digital Trends reported that even in these three countries, paid AI Ultra subscribers can turn it off, while work and school accounts don't have the setting at all.

More important is the caveat Woodward attached. Only the visible watermark can be turned off — the invisible SynthID and the digital tag attached to files both remain regardless. The volume of content Google has marked grew from 10 billion in May 2025 to over 100 billion for images and video alone by May 2026.

The two companies' moves look opposite but point in the same direction: removing human-visible labels while shifting toward machine-readable markers. OpenAI also introduced SynthID for images in May 2026 and extended it to audio in late July — though it still does not apply it to text. Since Google turned on text watermarking first, what makes Anthropic's move novel isn't the technology but the justification. It's the first case of turning it on worldwide citing regulatory compliance as the reason.

The real reason people are angry

The way the announcement was made was itself part of the problem. Anthropic first revealed this not through a news announcement but through a quiet help document. It spread after gaining 449 points on the developer community Hacker News on August 10, and TechCrunch, Forbes, and Euronews picked it up the following day. But the document didn't explain how the marking actually works. IT columnist John Gruber (Daring Fireball) hit this gap on August 11 in a post titled "Anthropic explains 'how Claude marks AI content' without explaining how it marks it." His criticism: if it worked by inserting invisible characters, the character count would bloat on platforms with length limits, and if it worked by skewing word choice, that would contradict Anthropic's own claim that it doesn't change "meaning, quality, or readability."

It was the community that filled in the blank first. Developer John J. Wang scanned 7.2 million characters of Claude-written text on August 12 and confirmed that no invisible special characters were mixed in, concluding that "it's likely a method that alters word choice using a secret key." But he explicitly noted that he hadn't proven it was SynthID specifically — a gap Anthropic filled on August 14. The nature of this whole episode is that it was a post-hoc explanation issued after four days of backlash, not a proactive announcement.

The backlash split into two strands. The first is a "catching cheaters" framing. TechCrunch summarized the reaction on August 12 as coming from "users angry that using AI at work or in class could get exposed." One camp argued "I directed and edited it, so Claude was just a tool," while the other countered "I only gave instructions — Claude actually made it." The argument in favor was simple: "The only reason you wouldn't want this is to deceive someone."

The second strand is far weightier: people who use Claude as a proofreading tool. Radio host Erick Erickson wrote, "I switched from Grammarly to Claude because it proofreads better, and now my own writing gets watermarked as if Claude wrote it." A widely cited reaction on Hacker News was even more direct: "I'm autistic, ADHD, and dyslexic. Just getting my meaning across clearly is hard enough — now I have to worry about a watermark too? The shame society already piles on is enough." This lands on exactly the same point as the "non-native speaker stigma" concern OpenAI raised two years ago when it shelved its release.

Anthropic's response is that "light proofreading leaves almost no marker." The principle is sound. But neither where the line for "light editing" sits, nor any procedure for disputing a mistaken flag, has been made public. What happens when a probabilistic signal like this flows unchecked into schools and workplaces is exactly what the years-long saga of AI detectors falsely flagging human writing as AI-written has already shown us.

Editor's take

The core of this decision isn't detection — it's the distribution of accountability. What Anthropic gains is regulatory compliance; what it loses is the trust of users who relied on Claude as a proofreading tool. The gap in between — thresholds, dispute procedures, remedies for false positives — has been left unfilled by anyone. What ultimately matters will be when and under what criteria a detection API is released.

Three practical takeaways for now. ① Handing over a full draft leaves a marker; using it to polish your own writing leaves almost none. ② Code is largely unaffected — comments being the exception. ③ Translations are entirely subject to the marker, so if you ever publish translated output under your own name, it's worth checking now.

What's changed isn't the technology. Between Aaronson's 2022 proposal, OpenAI's 2023 hesitation, and Anthropic's 2026 rollout, what changed was the regulatory and competitive landscape. OpenAI judged that turning it on alone would cost it users; now, roughly 190 companies are aligned under the EU's code of practice. Watermarking was always a coordination problem, not an algorithmic one — exactly as the Nature paper noted in its section on limitations, stating that "cooperation among watermarking parties is a precondition."

Still, optimism is premature. Once a technology that academics have already demonstrated can be forged and removed starts being used as grounds for judging an individual's honesty, the harm falls first on those who follow the rules. The question the watermark needs to answer isn't "did AI write this" but "is it acceptable to punish a person based on this marker." Anthropic's explainer offers no answer to the latter — not yet.