Anthropic adds hidden watermarks to text from four more Claude models

Anthropic, the San Francisco AI company, will add an invisible watermark to text from four more of its Claude AI models, it told customers in an email, The Decoder reported Oct. 31. The models are Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. Models released since Aug. 2 already carry the mark, according to Anthropic's help center.

Anthropic says it is doing this to meet the European Union's AI Act, a law that requires AI-made content to be marked in a way machines can detect. The deadline for older models is December, The Decoder reported.

How a text watermark works

A photo watermark is a visible logo. A text watermark is hidden in the words themselves. An AI chatbot writes one small chunk at a time, called a token, which is a word or part of a word. At each step it chooses from many likely options. A watermark quietly nudges those choices.

In the best-known design, published in 2023 by University of Maryland researchers, the system uses a secret key and the previous word to randomly split the vocabulary into a "green list" and a "red list" before each new word, then gives green words a slight boost. A reader sees normal writing. A detector that knows the key counts the green words. A person writing naturally lands on green words only about as often as chance predicts, while watermarked text lands on them far more often, and that gap can be measured with a standard statistics test. The researchers said the mark could be detected in as few as 25 tokens, with a very small chance of wrongly flagging human writing.

Anthropic uses a version of SynthID, a method from Google DeepMind, The Decoder reported. Google says SynthID works the same basic way, adjusting the odds of each word choice with a secret key, and its detector answers "watermarked," "not watermarked" or "uncertain." Anthropic says its mark adds no extra characters, does not change price or meaning, and carries no information about the user.

How well it survives editing

Small edits usually do not remove it. Google says SynthID holds up when text is trimmed, a few words are changed or it is lightly reworded. In the 2023 Maryland study, an automated tool that swapped out 10% of the words barely reduced detection. The researchers estimated that scrubbing the mark from a long passage takes changing roughly a quarter of the words or more, and heavier rewriting by machine noticeably hurt the quality of the text.

Big rewrites weaken it. Google says confidence is "greatly reduced" when text is thoroughly rewritten or translated into another language. Anthropic's help center says a mark may not be found if text was heavily edited, paraphrased, translated, mixed with other writing or is very short. Length helps the detector, though. In a 2023 follow-up study, the Maryland team had people rewrite watermarked passages on purpose to erase the mark. The mark could still usually be found once there was enough text, on average about 800 tokens, or several paragraphs. A short watermarked passage pasted into a longer human-written document was also usually caught. When watermarked text made up only a small share of a short document, detection became much less reliable.

There are other limits. Watermarks work poorly on answers with few possible wordings, such as a short fact or a famous quote, Google and the Maryland researchers say. The Maryland team warned that if a secret key leaked, someone could remove the mark completely, and Google says SynthID is not built to stop a determined attacker. A detected mark also does not prove someone cheated: Claude may only have proofread or translated the writing, Anthropic says.

How this differs from what people use now

Today, teachers and others who want to spot AI writing mostly rely on detector websites such as GPTZero, which guess from writing style. A 2023 Stanford study found seven popular detectors labeled more than half of essays by non-native English speakers as AI-written, while a simple request asking ChatGPT to make its writing fancier let most AI-written essays slip past them. A watermark is different because the AI company plants a signal when the text is created, so the detector looks for that signal instead of guessing. But only someone with the company's key or detection tool can check it.

For files such as images and documents, Claude instead adds Content Credentials, a labeling standard known as C2PA that attaches a record of how a file was made. Anyone can check those labels with Anthropic's free Claude Content Checker, but the label can be lost when a file is converted, re-saved or screenshotted, Anthropic says.

Loophole and who can check

On Opus 4.6 and Sonnet 4.6, developers who change settings that control how random the wording is get unmarked text, The Decoder reported. Otherwise customers cannot turn the mark off. Anthropic's text detector is in a private test open only to groups such as regulators, police, journalists, fact-checkers, researchers and educators. Rival OpenAI turns on its text watermark by default only for ChatGPT and Codex users in the EU, and Google has built SynthID into its Gemini chatbot, The Decoder reported.

For students and workers, that means text from newer Claude models pasted into an essay or report may carry a mark that a school or regulator with access to a detector could find, even after light editing.

Source: The Decoder, Oct. 31, 2026, Claude Help Center, Google SynthID documentation, Kirchenbauer and others, "A Watermark for Large Language Models" and "On the Reliability of Watermarks for Large Language Models", and Liang and others, "GPT detectors are biased against non-native English writers".