Newer Claude models watermark their text. Detection still cannot establish authorship

Anthropic says text produced by Claude models released after 2 August 2026 carries an invisible watermark. The company describes it as a numerical way to estimate whether Claude was involved in writing a piece of text. People reading the output cannot see the mark, and most users cannot query it: the associated detection API is in private preview for selected regulators, law-enforcement bodies, media organisations, fact-checkers, researchers, educational institutions, civil-society groups and enterprises with related compliance duties.[1]

That makes the watermark a machine-readable signal rather than a visible label or a public authorship certificate. Anthropic says it contains no information about the user, organisation or conversation and has no practical effect on the output’s quality or content. The announcement does not publish a universal detection threshold, false-positive rate, robustness table or guarantee that edited text will remain detectable.[1]

A likelihood score is evidence about a signal, not a verdict about a person

A detector may estimate that a passage resembles watermarked Claude output. That does not establish who submitted the prompt, whether a person substantially rewrote the result, whether several systems contributed, or whether the final publication is deceptive. It also does not establish that unmarked text is human-written. A model released before the relevant date, another provider, a transformed output or a failure of detection can all produce an absent result.[1][3]

The distinction resembles a laboratory test more than a signature on a contract. Interpretation requires the test’s error rates, the population being tested and the decision being made. A newsroom checking one suspicious article, a university screening thousands of submissions and a regulator investigating a named system operate with different prior probabilities and different costs for false accusation. One threshold cannot be assumed to fit every use.

The EU rule has two different actors

The European Commission separates provider marking duties from deployer disclosure duties. Providers of in-scope generative systems must make synthetic content machine-readable and detectable, within the rule’s technical conditions. Deployers have separate duties for deepfakes and public-interest text. For that text, substantive human review or editorial control can provide an exemption when a person or entity holds editorial responsibility; a spelling check alone does not qualify. A hidden provider watermark and a publication disclosure therefore serve different legal functions.[2][3][4]

The Code of Practice is voluntary, while the underlying Article 50 transparency duties are legal obligations. The Commission says the code offers a recognised way for signatories to demonstrate compliance, but adherence is not conclusive proof of compliance. It also describes exclusions and transitional details, including treatment of systems placed on the market before 2 August 2026.[2][3]

A useful public detector needs a public operating envelope

Before a detection score is used for discipline, moderation or public accusation, the operator should know how the system performs on untouched output, short passages, heavily edited text, translation, quotations, mixed human–AI documents and outputs from unrelated models. Results should be reported by language, length and transformation, with confidence intervals and the exact threshold. The people affected need a route to challenge the result and present other evidence.

Those are evaluation requirements, not claims about tests Anthropic has or has not run. The launch article establishes that a watermark and private detector exist and describes their intended compliance role. It does not supply enough public evidence to treat the detector as a general-purpose authorship tribunal.

Text watermarking is most valuable when it creates one more inspectable signal in an evidence chain: provider mark, visible disclosure, document history, source citations and human accountability. Its weakest use would be to replace that chain with a single score whose threshold and error costs remain hidden.

Report an error or suggest a correction