News · 2026-08-16

The Claude watermark barely touches the code it writes

Anthropic has published the mechanism behind Claude's text watermark, and the most consequential detail is what it does not cover. The watermark works by steering the model's choice between words that are equally good, which means it barely applies to code, where an exact token is usually the only correct one. Anyone hoping this becomes a way to detect AI-written source code in a repository should read the post carefully.

Key facts

• Anthropic published "How Claude's text watermark works" on August 14, 2026, explaining the method for the first time.
• The technique is a version of SynthID-Text, published by Google DeepMind in Nature in 2024.
• Anthropic is applying the watermark globally at launch, not only in the European Union.
• Around 190 signatories, including several major model providers, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026.
• Primary source: Anthropic's announcement.

Ground Truth covered the arrival of the watermark itself last week, when Anthropic's support documentation quietly confirmed that Claude marks plain prose and not just images. The mechanism was missing then. Now it is on the record, and it settles several arguments that had been running on speculation.

Start with how a language model writes. It produces one word at a time, and at each step it holds a ranked list of candidates. Anthropic uses the example sentence "The weather today was cold and...". The next word is very unlikely to be "sugary". It is quite likely to be "overcast" or "grey", and to the reader it makes almost no difference which one appears. Normally that tie is broken by a random number. Watermarking replaces the source of that randomness with a secret key combined with the few words that came before.

The words are still effectively random. But someone holding the key can replay the sequence and ask whether the choices look like the ones Claude would have made using that key. If enough of them line up, you can assign a probability that Claude wrote the passage. Anthropic's own analogy is a game of Monopoly where players use successive digits of pi instead of dice. The game plays identically, and nobody at the table can tell, but afterwards anyone who knows the digits can work out that this particular game was not rolled.

That design is why code is largely exempt. The watermark needs a genuine choice to hide in. Anthropic gives the example of a model that has just written "2 + 2 =", where there is no second answer that is equally as good as "4". The nudge simply is not applied there. Extending the same logic, the post states that code "has generally less watermarking than some other forms of text", and that where the watermark can appear at all inside code, it is in arbitrary wording such as comments, where "it will have a negligible effect on the actual code produced."

The same limit applies to two other cases people had assumed were covered. Factual writing carries a sparser watermark, because a sentence like "Isaac Newton's most famous work was called Principia..." has only one correct continuation. And proofreading barely registers at all: when Claude edits a person's grammar and punctuation, nearly every word is still the person's, so there is almost nothing for the mark to attach to. Translations, by contrast, are fully watermarked, because Claude chooses every word.

Anthropic is also blunt about removal. Light editing probably will not strip the watermark; a complete rewrite where every word is replaced will. As the company notes, at that point it is arguable whether the text is still AI-generated at all. Detection is weak on short samples too, since fewer word choices means less signal, and confidence grows with passage length.

Two claims in the post are worth separating from the marketing. First, quality: Anthropic says internal testing showed no impact on content, creativity, or readability, and cites DeepMind's Nature paper, where a watermarked model was served to a portion of live Gemini traffic and produced no statistically significant difference in thumbs-up and thumbs-down ratings. Second, privacy: the watermark carries no identifying information, and nothing in it or its key can recover anything about a user, an organization, or a conversation.

Files work differently. When Claude produces a supported file type such as a .png, .jpg, or .svg, it attaches a C2PA content credential, a small cryptographically signed note in the file's metadata saying the file was made or processed with Claude. Nothing inside the file changes. That is metadata provenance, an entirely different mechanism from the statistical watermark in text, and one that is trivially stripped by any tool that rewrites metadata.

The honest caveat is what a detected watermark actually proves. Anthropic states it cannot distinguish "Claude wrote this" from "Claude heavily edited this", cannot show that text was human-written, and cannot identify text from a different AI, which would use a different key or a different scheme entirely. A watermark detection API is promised but not yet shipped, and models launched before August 2, 2026 are still inside the EU's transition period, with watermarking to be added over the coming months.

So the practical read for developers is narrower than the headlines suggested. If you are shipping AI-written prose, assume it is marked. If you are shipping AI-written code, this is not the provenance tag you were told it was. For the underlying ideas, see our explainers on content provenance and watermarking and how a model picks its next word.

Primary source, verified: read the paper →

Ground Truth. (2026, August 16). The Claude watermark barely touches the code it writes. Ground Truth. https://groundtruth.day/news/the-claude-watermark-barely-touches-the-code-it-writes.html

@misc{groundtruth:the-claude-watermark-barely-touches-the-code-it-writes,
  title  = {The Claude watermark barely touches the code it writes},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {aug},
  url    = {https://groundtruth.day/news/the-claude-watermark-barely-touches-the-code-it-writes.html}
}

Topics: watermarking · provenance · anthropic · eu-ai-act · transparency · policy