Text flows from large language models one token at a time. Each choice carries probabilities shaped by training data and the prompt at hand. Most readers see only the finished sentence. A handful of researchers and now major labs see something else: a pattern hidden inside those choices.
Anthropic began rolling out such patterns this month. New Claude models launched in the European Union on or after August 2, 2026, embed machine-readable watermarks directly into generated text. The marks travel with copy-and-paste operations and may survive light editing. They apply worldwide across the Claude app, API, Claude Code, and other surfaces. Anthropic’s own support page spells out the commitments.
But the technique itself dates back years. Researchers realized early that language models don’t pick words deterministically. They sample from a distribution. At many points in a sentence several options fit equally well. That slack creates room for a statistical nudge.
One early approach appeared in a 2023 paper. John Kirchenbauer and colleagues at the University of Maryland proposed splitting candidate tokens into two groups using a secret key, then gently biasing the sampling toward one group. The resulting text reads normally. Yet anyone with the key can replay the split and count how often the favored group appears. Too many hits and the text almost certainly came from a marked model. The paper, titled A Watermark for Large Language Models, appeared at ICML 2023.
Google took a similar idea into production. Its SynthID system for text, detailed in a 2024 Nature paper by Dathathri et al., uses a tournament method that preserves the model’s original probabilities on average while still encoding a detectable signal. Scott Aaronson, working with OpenAI, explored schemes that derive the random seed itself from the key. Different math. Same core insight: the mark lives in the probabilities, not the pixels or characters.
A visual guide published this week walks through the mechanics with interactive demos. It shows how a model at each fork in a sentence rolls weighted dice among plausible next words. A secret key colors those candidates green or red based on recent context, then tilts the dice slightly toward green. The tilt stays mild. A red word can still win. Over hundreds of such decisions the bias accumulates. The guide from declaude.org lets readers test keys on sample paragraphs and watch green counts swing from chance levels to near certainty.
Detection requires the key. Without it the coloring makes no sense and the count falls to a coin flip. That privacy property matters. Teachers, editors, or third-party detectors cannot run the test on their own. Only the model provider or an authorized service can. Anthropic says it will release detection tooling. Google already offers limited access to a SynthID detector portal.
Yet the signal comes with sharp limits. Short passages carry too little evidence. Code, lists, and highly constrained text offer few genuine forks for the bias to exploit. Heavy rewriting destroys the pattern. The declaude guide demonstrates this with a slider. Light edits leave long runs of original wording intact; the detector still sees the mark. Full recomposition from meaning erases the statistical trail. Experiments cited in the guide show detection accuracy collapsing from near perfect to random after aggressive paraphrasing.
Zhao et al. explored adaptive attacks in a paper accepted to ACL Findings 2026. Their evolutionary paraphrase method systematically breaks earlier watermark schemes. The literature, including follow-up work by Kirchenbauer at ICLR 2024, shows that robustness improves with more text but never becomes absolute. Sadasivan and colleagues argued in 2023 that reliable detection of AI text without watermarks remains elusive. Watermarks change the equation, but only for unmarked originals and only when the provider cooperates.
Anthropic’s announcement ties directly to regulation. The company signed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content. The code took effect August 2. New models must mark content from launch. Older ones follow during a transition period. The marks cover text and, for supported image and vector formats, signed provenance metadata that follows the C2PA standard. TechCrunch reported that the policy applies globally even though the immediate trigger was European law. Other firms including OpenAI, Google, Meta, and Microsoft have made similar pledges.
Executives at Anthropic stress what the mark does not prove. A detected watermark shows the text was processed by Claude. It does not prove Claude wrote the ideas. A human draft proofread or summarized by the model picks up the signal. Nor does absence of a mark clear the text. Older models, heavy edits, or very short outputs can strip the evidence. The support page states plainly: “A detected mark provides a signal that content was processed by Claude, but is not fully conclusive.”
Industry watchers see broader implications. Publishers worry about floods of unmarked or misattributed content. Regulators want tools to trace deepfakes and disinformation. Yet researchers who broke multiple watermark schemes last year caution against overconfidence. A University of Maryland team led by Soheil Feizi concluded in 2025 that current image watermarks fail under realistic attacks. Text schemes face analogous threats once adversaries study them closely.
Practical deployment raises fresh questions. Will courts accept watermark evidence? How will detection services scale without exposing keys? What happens when models from different providers use incompatible schemes? Anthropic has not published its exact algorithm. The declaude guide notes that production implementations likely use gentler biases than the demo, requiring longer documents for confident detection. A 1,500-word essay might flag at roughly 55 percent green under mild settings. Statistical power grows with length.
And editing changes everything. The mark depends on local context. Each token’s color derives from a short window of preceding words. Break those windows and the signal vanishes at those positions. Only surviving runs contribute evidence. Light polishing leaves most runs untouched. A complete rewrite from an outline or human revision leaves almost none. The guide’s experiments on open implementations of KGW and EXP schemes show detection dropping to chance after full recomposition.
Some schemes resist rewriting better. Those that key on the token itself rather than preceding context can survive meaning-preserving paraphrases. Their drawback: an attacker with enough output might reverse-engineer the coloring rule. Meaning-space watermarks, still largely experimental, would require regeneration at the concept level to erase. No production system uses them yet.
The rollout comes at a moment of intense scrutiny. AI-generated novels, news articles, and student papers have tested detection tools built on style analysis. Those tools remain unreliable. Watermarks offer a different proposition: a deliberate, cryptographic-grade signal rather than a guess about prose quality. But only when the provider holds the key and shares detection capability.
Business Insider noted that the feature could complicate efforts to publish AI-assisted books without disclosure. Morning Brew highlighted the global reach despite the EU origin. TechXplore and Interesting Engineering covered the announcement in similar terms, all within the past few days. The timing aligns precisely with the EU code’s enforcement date.
Researchers continue to refine the underlying methods. New papers explore adaptive attacks, multi-model collusion, and hybrid approaches that combine statistical watermarks with metadata. The declaude guide cites six key academic works plus Anthropic’s documentation. It also reports its own tests: open KGW and EXP watermarks collapse under aggressive rewriting while certain unigram schemes retain partial strength.
For now the marks represent a pragmatic compromise. They give platforms and regulators a tool without altering the user experience. The text reads the same. Quality stays intact. The signal appears only to those authorized to look. But the limitations remain real. A watermark says “processed by,” not “authored by.” Absence says even less.
That distinction will shape how publishers, educators, and courts use the technology. Some will treat a positive detection as strong evidence. Others will demand corroboration. The statistical nature invites debate over thresholds and false positives. Human text run through light Claude editing carries the mark. Heavily revised AI text sheds it.
Anthropic promises further technical documentation on detection. Until then the system operates in partial view. New models already mark. Older ones will follow. The invisible patterns accumulate with every generation. They persist through copy and paste. They fade under determined rewriting. And they force a conversation about what provenance actually means in an era when machines help shape nearly every sentence.
The dice keep rolling. The bias stays hidden. The count, when performed with the right key, tells its own quiet story.