Start with the smallest claim the detector can support
A positive result is not “Claude wrote this.” The defensible claim is narrower: under a named detector version, threshold, model-coverage policy, and sample boundary, the text contains a statistical pattern consistent with compatible Claude generation or processing.
Anthropic announced the watermark on August 14, 2026. New Claude models alter token sampling among plausible next words using a secret key and the preceding text. The company says the mark is imperceptible, does not insert hidden characters, and does not add extra tokens. Its stated detector estimates the likelihood that Claude partly generated or processed a sample. Anthropic also explicitly separates that estimate from human authorship, ownership, responsibility, or liability.
That distinction matters because documents have histories. A person may ask Claude to draft a paragraph, copy it into a report, rewrite half, add verified figures, and obtain legal approval. Another person may paste human text into Claude for proofreading, creating a detectable contribution without transferring authorship. A third may receive watermarked text from a colleague and quote it correctly. The same detector outcome can therefore describe very different conduct.
Use four separate questions: Was a compatible generator likely involved? Which spans and transformations are in scope? Was that use permitted and disclosed under the applicable policy? Is the document accurate and fit for its decision? Watermarking can inform the first two. Logs, document history, interviews, policy, and substantive review answer the rest.
A detector estimates a signal in text. It does not reconstruct the social process that produced the document.
Current search suggestions cluster around “Claude text watermark,” “detector,” “how does it work,” “check,” and “remover.” That is useful evidence of user questions, not proof of successful evasion. The right engineering response is to publish detector limits and design a review process that remains fair when the signal is absent, uncertain, mixed, or transformed.
The watermark changes sampling probabilities, not visible formatting
A language model assigns probabilities to candidate next tokens. Ordinary decoding samples or selects from that distribution. SynthID-Text derives a pseudorandom scoring function from a key and a window of earlier tokens, then subtly favors candidate continuations associated with that function. The resulting sentence should remain semantically plausible, but over enough tokens it accumulates a pattern a matching detector can test.
The Nature paper describing SynthID-Text presents the technique as a sampling-time method: it does not require retraining the model, and detection can be computed efficiently. Google’s implementation documentation exposes a useful design tradeoff through the ngram_len parameter. A short context can make the signal more robust to edits but less unique; a longer context can reduce false detections but is more easily disrupted by local changes. Claude’s production settings and key are not public, so examples using the open repository explain the mechanism, not the exact Claude deployment.
# Conceptual generation, not Anthropic production code
context = tokens[-ngram_len:]
seed = keyed_hash(secret_key, context)
for candidate in plausible_next_tokens(model_logits):
candidate.score += watermark_bias(seed, candidate.id)
next_token = sample(adjusted_distribution)
tokens.append(next_token)
The detector applies a compatible scoring rule across the observed token sequence and aggregates the result. It then compares the score with calibrated boundaries. More eligible tokens usually give the test more evidence. Short responses, source-constrained factual prose, code, tables, names, and lightly edited fragments provide fewer degrees of freedom, so Anthropic warns that confidence can be weaker there.
No individual word is a watermark bit that an analyst can highlight. A familiar AI-sounding phrase is not proof. Stylistic clichés can occur in human text, and a statistical watermark can be present without obvious style. Operational systems should reject browser extensions or manual review practices that claim to identify Claude from vocabulary alone.
A detector needs three outcomes and a published error budget
Google’s SynthID documentation recommends thinking in three states: watermarked, not watermarked, and uncertain. That is more honest than forcing every score into yes or no. A production service should keep the raw score, eligible-token count, detector and policy versions, threshold profile, model coverage, sampling assumptions, and error calibration. The user-facing label is only a view over that evidence.
| Decision state | Meaning | Allowed action |
|---|
| Consistent signal | Score exceeds the positive threshold for this sample class | Preserve evidence and corroborate; never auto-punish |
| Uncertain | Signal, length, coverage, or transformation prevents a reliable classification | Request more context or use other provenance evidence |
| No detected signal | Score is below the negative boundary | Do not conclude “human-written” or “no AI” |
Thresholds trade false positives against false negatives. Lowering the positive boundary detects more watermarked samples but increases the chance that ordinary text crosses it. Raising it protects against false accusation but misses more short or edited samples. The acceptable tradeoff depends on use. Content-platform labeling may tolerate an uncertain queue; employment discipline, academic sanctions, fraud findings, and legal evidence require much stronger corroboration and due process.
detector_policy: claude-watermark-review/v1
positive_threshold_profile: high_precision_2026_09
minimum_eligible_tokens: 800
outcomes: [consistent, uncertain, not_detected]
required_receipt:
- sample_sha256
- sample_boundaries
- detector_version
- policy_version
- score_and_thresholds
- eligible_token_count
- model_coverage_statement
consequential_use:
automatic_adverse_action: prohibited
corroborating_sources_required: 2
human_reviewer: required
appeal_and_retest: required
Never copy a threshold from a paper into production without a local evaluation. The Nature results establish that a method can achieve useful true-positive rates at chosen false-positive rates under studied conditions. They do not certify your document population, language mix, preprocessing, model release, or decision cost. Calibrate on representative human text, compatible watermarked text, mixed documents, edits, translations, code, and adversarial transformations.
Build an evidence service, not a detector button
1. IntakePreserve the exact file, encoding, selected span, hash, collector, time, and legal basis.
2. EligibilityMeasure length and content class; record model and detector coverage instead of silently forcing a result.
3. DetectionCall the approved detector, bind response to version and threshold policy, and store a signed receipt.
4. CorroborationCompare document history, platform metadata, declared AI use, source records, and substantive facts.
5. ReviewA qualified person assesses the bounded claim, policy context, uncertainty, and alternative explanations.
6. AppealRetain the original, permit correction and retest, and audit outcomes by language and document class.
Anthropic says detector access is currently a private preview for eligible organizations and enterprises. Do not ship code that assumes a public unauthenticated endpoint. Put a provider adapter behind your evidence interface so access, response schema, model coverage, keys, and calibration can change without rewriting case policy.
async function assessProvenance(sample, caseContext) {
const artifact = await evidence.freeze(sample);
const eligibility = policy.classifySample(artifact);
if (!eligibility.testable) return review("uncertain", eligibility);
const result = await approvedDetector.test(artifact.bytes);
const receipt = await evidence.sign({
sampleHash: artifact.sha256,
boundaries: artifact.boundaries,
detectorVersion: result.version,
score: result.score,
thresholdPolicy: policy.version,
eligibleTokens: result.eligibleTokens
});
const state = policy.mapScore(result);
const corroboration = await collectAuthorizedEvidence(caseContext);
return humanQueue.open({ state, receipt, corroboration,
prohibitedInference: "authorship_or_misconduct" });
}
Separate storage for detector evidence from the document body when privacy demands it. Minimize access, retention, and secondary use. A detector request can itself disclose sensitive text to a vendor. Record the lawful and contractual basis, redact where methodologically valid, and do not send privileged, health, employee, or customer material merely because someone wants a label.
For image outputs, Anthropic describes C2PA metadata in supported PNG, JPEG, and SVG files. That is a different signal: signed content credentials can carry tool and edit provenance, while the text watermark is embedded statistically in token choices. Preserve both when present. Stripping metadata does not prove that a text signal is absent; detecting a text signal does not reconstruct an image edit history.
Five cases show why the same score cannot decide the case
1. A long, unedited Claude draft
A 2,000-word draft from a covered model retains its original wording. It is the favorable detection case: sufficient eligible text and minimal transformation. A consistent result supports “compatible Claude contributed to this sample.” The reviewer still checks account history, declaration, sources, and whether policy allowed drafting.
2. Human text sent through proofreading
An employee writes a report, then asks Claude to improve clarity without changing facts. Claude may resample much of the prose and leave a signal. The employee remains the responsible author under many workplace definitions. A policy that prohibits undisclosed generation but permits proofreading needs document history, not a detector-only verdict.
3. Code and configuration
Syntax, identifiers, APIs, and correct literals constrain token choice. Anthropic identifies code as a weaker case. Mark the sample uncertain or not eligible under the organization’s policy; use repository commits, tool receipts, review history, tests, and disclosure instead.
4. Translation or complete rewrite
A user translates or heavily paraphrases a watermarked passage. Both Anthropic and Google describe substantial rewriting or translation as transformations that can reduce confidence. A negative result does not establish a human origin. Independent attack repositories can help design evaluation cases, but a reproduction using its own key is not evidence that Claude’s secret-key deployment was defeated.
5. A mixed document
A policy includes human-written requirements, a Claude-generated summary, quotations, tables, and later edits. Whole-document scoring can dilute or blur the signal. Preserve structural boundaries and test sufficiently long eligible sections under a predefined segmentation policy. Report which span was tested; never project one paragraph’s result onto the entire file.
Combine signals that answer different questions
| Signal | Best-supported claim | Primary weakness |
|---|
| Statistical text watermark | Compatible keyed generation likely contributed to eligible text | Short, constrained, mixed, or transformed samples |
| Stylometric AI detector | Text resembles a learned distribution | Domain and language shift; no generator-bound secret |
| C2PA/content credentials | A signed tool or actor made recorded edits | Metadata can be absent; chain ends outside participating tools |
| Platform audit log | An account submitted a prompt and received an output | Does not prove the final document copied that output |
| Document version history | Text entered or changed at a particular step | Can be incomplete or outside controlled editors |
| Source and fact review | Claims are supported and fit for purpose | Does not identify generation method |
Article 50 of the EU AI Act applies from August 2, 2026, and the Commission’s transparency code describes machine-readable, effective, interoperable, robust, and reliable marking where technically feasible. Compliance teams should map the final legal text, applicable roles, exceptions, and adopted code to their product. Technical marking can support transparency, but it does not replace the provider’s disclosure duties or the deployer’s context-specific obligations.
Failure modes to block before deployment
| Failure | Why it misleads | Control |
|---|
| Positive equals authorship | Processing, quotation, collaboration, and permitted assistance remain possible | Use the bounded provenance claim and corroborate |
| Negative equals human | Unsupported models, edits, translation, and short text can erase evidence | Label “not detected,” never “human-written” |
| Binary threshold | Borderline and ineligible samples are forced into certainty | Publish an uncertain state and minimum evidence rules |
| Unversioned receipt | Later calibration cannot reproduce the decision | Store detector, policy, score, thresholds, and sample hash |
| Whole-file projection | Mixed provenance is flattened | Freeze and report exact tested spans |
| Secret-text leakage | Detection becomes an unauthorized disclosure | Data classification, minimization, approved provider, retention limits |
| Unrepresentative benchmark | Published accuracy hides local language and document mix | Local stratified evaluation and ongoing drift monitoring |
| Automatic punishment | A probabilistic signal bypasses context and appeal | Human review, corroboration, notice, and retest |
Run a shadow evaluation before any consequential use
Build a consented test corpus with known provenance. Include untouched human text, covered-model outputs, unsupported-model outputs, human-plus-Claude proofreading, quotations, mixed documents, code, factual answers, several languages, short and long samples, copy edits, paragraph deletion, paraphrase, and translation. Freeze generator, settings, timestamps, and transformation recipes.
Pre-register outcomesDefine consistent, uncertain, not detected, and ineligible before observing scores.
Measure by stratumReport false positives, false negatives, abstention, and confidence by language, length, domain, and transformation.
Test base ratesCalculate positive predictive value at the real prevalence of covered Claude text, not a balanced lab set.
Audit reviewersMeasure disagreement, confirmation bias, time to decision, reversals, and appeal outcomes.
Freeze versionsRetest after detector, threshold, tokenizer, model coverage, or preprocessing changes.
Start non-enforcementUse results for measurement only until accuracy, privacy, fairness, and governance gates pass.
Report both technical and decision metrics. A detector can have a low false-positive rate yet generate many incorrect accusations when covered Claude text is rare. Conversely, a conservative threshold can miss most edited text while still being useful for aggregate platform labeling. Match the metric to the decision and publish what the system abstains from deciding.
The launch gate should require an accountable owner, documented purpose, data protection review, detector access agreement, representative validation, signed receipts, retention limits, reviewer training, an appeal path, incident rollback, and a public explanation proportional to the consequence. If the team cannot explain “uncertain” to an affected person, it is not ready to use the detector against them.
Frequently asked questions
Does a Claude watermark prove Claude wrote the document?
No. It can support a bounded claim about compatible Claude generation or processing in the tested text. It cannot identify the human author, intent, ownership, responsibility, or policy violation.
Can editing remove the watermark?
Light editing may retain enough signal, while complete rewriting or translation can reduce detection confidence. Results also depend on sample length, content constraints, model coverage, and thresholds.
Is the detector publicly available?
Anthropic’s help center describes private-preview access for eligible organizations and enterprises. Teams should confirm access and current terms directly rather than assume a public API.
What does a negative result mean?
Only that the approved detector did not find enough evidence under the recorded policy. It does not mean human-written, AI-free, or generated by another specific model.
What should an organization store?
Store the authorized sample or controlled reference, exact boundaries and hash, detector and policy versions, raw score, thresholds, token eligibility, result, corroborating evidence, reviewer decision, and appeal history.
Sources and further reading
Current documentation, repository metadata, community discussions, and regulatory pages were checked online on September 3, 2026.
