Claude Now Watermarks Everything It Writes, and There Is No Flag to Turn It Off

The headline that went round on 11 August was about students getting caught, and I nearly scrolled past it. Then I remembered that the terminal in my other tab had a Claude Code session halfway through a Symfony refactor, that this site's whole content pipeline runs with a model in the loop, and that every article here carries a button which opens it inside Claude. If Anthropic has started signing Claude's output, the mark is already in my repository and somewhere in my pages. So I read the technical explainer Anthropic put out on 15 August properly, then went back to the Nature paper it is built on. The mechanism is more interesting — and a great deal narrower — than the headline suggests.

The short version: the watermark is not something added to the text, it is a change to how the next token gets chosen. No hidden characters, no zero-width spaces, no extra tokens on your bill. And no way to switch it off.

The watermark replaces the sampler's randomness with a keyed choice

At every generation step a model holds a probability distribution over the next token and samples from it. Plenty of those choices are near-ties — "overcast" against "grey", a comma against a full stop — and the sampler resolves them with a random number that carries no meaning.

Watermarking spends that randomness instead of wasting it. The random source becomes a function of a secret key and the preceding few tokens. The output still looks random to a reader, and it still follows the model's distribution, but a holder of the key can recompute which choices a keyed model would have favoured and score a passage against them. Anthropic's own analogy is dice rolled from the digits of π: indistinguishable from real dice unless you know you are looking at π.

If that shape feels familiar, it is the same trick as keyed message authentication with HMAC — the artefact is worthless to anyone without the key, and cheap to verify for anyone with it. You can watch the property yourself in the HMAC generator: change one byte of the key and the whole output moves, while the message stays readable. Watermark detection is the statistical cousin of that check, with a probability instead of a boolean.

The underlying scheme is SynthID-Text, published by Google DeepMind in Nature in October 2024. It uses what the authors call Tournament sampling: draw candidate tokens, score each with a pseudo-random watermarking function seeded by key plus context, and run knockout rounds until one survives. The paper's experiments use m = 30 tournament layers, each layer adding evidence a detector can accumulate.

Two numbers from that paper are the reason "no impact on quality" is a measurable claim rather than a press line. In the non-distortionary configuration, repeated context masking guarantees the single-token distribution matches the unwatermarked model — quality preservation is a property of the algorithm, not an observation. And in live deployment across roughly 20 million Gemini responses, watermarked and unwatermarked variants differed by 0.01% in thumbs-up rate. Latency overhead with 30 layers measured 0.57% on Gemma 7B-IT, against 0.26% for the Gumbel baseline it was compared with.

What carries the mark, and what does not

The mark needs choice. Where Claude has no freedom over wording, there is nothing to encode into.

The rollout dates are specific: models launched on or after 2 August 2026 ship with it, and older models get it over the coming months under the EU transition period. That date is not arbitrary — 2 August 2026 is when Article 50 of the EU AI Act starts applying, and Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026 alongside roughly 190 other signatories. The obligation is European; the deployment is global, because scoping it by region was not practical.

There is no opt-out, which is the part that matters if you ship Claude output

Every surface is covered: the Claude Platform API, claude.ai, Claude Code, Claude Cowork, Claude Tag, and Claude models served through AWS, Google Cloud and Microsoft Foundry. There is no request parameter that asks for unmarked output, no enterprise tier that removes it, and no paid exception.

Work through what that means for a product rather than a chat window. If your application generates support replies, product descriptions, release notes or documentation through Claude and hands them to a user, that text arrives at the user marked. You did not choose it, your customer did not consent to it, and unless you say so in your interface, neither of them knows. The same applies to anything Claude Code writes into your repository — the code itself carries close to nothing, but the comments, the docblocks and the commit bodies are prose. When I wrote up the habits that cut my Claude Code token spend the interesting variable was cost; the variable I would add now is provenance, because a repository is a durable record and nobody rewrites its history for the sake of a statistical property.

My position on this is straightforward: disclose it before somebody detects it. A one-line note that a page or a reply was drafted with AI assistance costs nothing and removes the entire category of accusation. Search engines have never penalised AI assistance as such — the ranking factors are the ones I went through in why SEO fundamentals still win as AI eats search — but being caught concealing it is a trust problem that no ranking factor fixes.

A detected watermark does not mean Claude wrote it

This is the failure mode I expect to cause the most damage in practice, and Anthropic states it plainly: the mark indicates that content may have been generated or processed by Claude. Processing counts.

Paste your own paragraph in and ask for a tighter version, and the words that come back are Claude's word choices over your ideas. Ask for a translation and every output token is the model's. Both come out carrying signal. A non-native speaker who runs their own writing through Claude for grammar produces marked text that is, in every sense that matters, their own work. A detector that reports "this text carries a Claude watermark" is answering a question about the generation pipeline, not about authorship, and the two get conflated the moment the result reaches a disciplinary panel or an editorial policy.

The watermark also contains no identity. No account, no organisation, no conversation ID — it is a single bit of probabilistic provenance, and Anthropic says the detection tool will report a likelihood rather than a verdict. An engineer confirmed on 12 August that a text detection API "that you can use yourself" is coming; pricing and rate limits are unpublished as of today.

Detection needs length, and most real snippets are too short

Detection accumulates evidence per token, so accuracy is a function of passage length. The Nature paper reports its results as TPR at a fixed 1% false-positive rate and shows the curve climbing with length; the independent evaluations that followed worked with samples of roughly 800 to 1,000 tokens.

Scale that down to what people actually argue about. A 40-word forum comment, a commit subject, a Stack Overflow answer that is two sentences and a snippet — none of these carry enough choices for a detector to say anything with a defensible false-positive rate. Before treating a detection result as evidence, count the text. A thousand tokens is roughly 750 English words, and that is where the claim starts getting sturdy — the word and character counter settles it in a second. Anyone presenting a confident verdict on a paragraph is over-reading their tool.

Independent probing says it holds against accidents, not against attackers

The ETH Zurich SRI Lab published a probing study of SynthID-Text, and the numbers are the honest frame for what this technology buys.

On spoofing — forging text that a detector wrongly attributes to the watermarked model — the improvement is real. A basic LeftHash scheme fell to spoofing 82% of the time; adding Tournament sampling dropped that to 30%; full SynthID-Text held at 4%. But tripling the attacker's query budget from 30,000 to 90,000 pushed success back up to 15%. The defence raises cost, it does not close the door.

On scrubbing — removing the mark — the picture is worse. Off-the-shelf paraphrasers achieved over 90% removal against individual components, and near 100% when combined with watermark-stealing techniques. Anthropic does not dispute the principle; its own explainer concedes that a complete rewrite replacing every word removes the mark, with the fair observation that such a text is arguably no longer AI-generated.

The C2PA manifests on generated images are the softer half still. They are cryptographically signed and tamper-evident, which sounds strong until you notice they live in file metadata: re-save the PNG in any editor, convert the format, take a screenshot, or upload it to a platform that rewrites metadata, and the manifest is gone. That is a provenance record for cooperative pipelines, not a tracker.

Put together, the design goal reads clearly enough. This catches undisclosed AI text in the ordinary case — the copy-paste, the lightly-edited draft, the bulk-generated page — and it will not catch anybody who has read one paper and spent four minutes running the output through a second model.

What I Changed After Reading the Paper

Three things, all cheap:

An AI-assistance disclosure went onto my writing checklist as a required field rather than a nice-to-have, because the marginal cost of saying it first is zero and the cost of being caught concealing it is not.

I stopped routing other people's text through Claude for proofreading when provenance matters — a contributor's guest paragraph, a quoted email, anything I might later need to defend as human-written. Grammar assistance is not worth handing a third party a statistical claim over somebody else's words.

And I now treat any detector output on a passage shorter than a few hundred words as an opinion, not evidence, whoever is holding it. That rule applies in both directions: I will not use one to accuse a contributor, and I will not accept one used against me.

The watermark is a good piece of engineering aimed at an honest problem, deployed under a regulation with a hard date. It is also a probabilistic signal about a pipeline, dressed by every headline this week as proof of authorship. Those are not the same claim, and the gap between them is where the damage will happen.