Claude's Global Watermark Measures Token Choice, Not Authorship
Give Claude a human-written essay and ask for a translation. The result can carry a strong watermark because Claude selected every output token. Give Claude the same essay for light proofreading and its involvement may be too sparse to detect.
That inversion is the useful way to understand Anthropic's new text-watermarking policy. The mark does not measure who had the ideas, who owns the document, or who is responsible for publishing it. It estimates whether Claude made enough token choices to leave a keyed statistical pattern.
Anthropic says future and supported Claude models will apply that pattern worldwide to comply with the EU AI Act. The worldwide part is an engineering choice: Anthropic says it cannot yet scope the behavior durably by region. A rule written in Brussels is therefore changing the sampling loop seen by API customers far outside Europe.
The obvious product would be an is_ai detector. It would also be the wrong one. Long prose, code, proofreading, mixed-model agent output, rewritten text, and signed files all produce different evidence. Builders need a provenance workflow that can preserve uncertainty—not a Boolean that turns a probability into an accusation.
The headline needs careful wording. Anthropic says future Claude models will generate watermarked text. Its operational support guide says newly launched models in the EU support marking at launch and older models are being updated during the legal transition. Anthropic has not published a definitive matrix showing every current model ID and its exact marking status.
For supported models, text marking applies across Claude, the Claude API, Claude Code, Cowork, Tag, and distribution through AWS, Google Cloud, and Microsoft Foundry. The model behavior follows the model through those routes. File-level credentials can still vary with product and platform support.
Anthropic makes five practical claims about the text mark:
The first three describe the design. The latency, price, and quality statements are provider claims until Claude-specific independent measurements are published.
There is useful evidence for the algorithm family. Anthropic's design is based on Google DeepMind's SynthID-Text. The 2024 Nature paper reports a live Gemini test spanning nearly 20 million responses, with no statistically significant change in thumbs-up or thumbs-down rates. In one Gemma 7B configuration, the paper measured a 0.57% per-token latency increase. Those numbers make the approach plausible at scale, but they are not benchmarks of Anthropic's production implementation.
An LLM rarely has only one acceptable next token. In a sentence about cold weather, several words may preserve the same meaning and quality. Normal generation uses randomness to choose among plausible candidates. SynthID-Text changes the source of that randomness using a secret key and recent context, creating a pattern across many otherwise ordinary choices.
Nothing is appended after generation. There is no zero-width character to find and no metadata field to strip from copied prose. Detection asks whether the observed sequence is unusually consistent with choices produced under the provider's key.
That makes length and entropy part of the evidence contract.
Long, freely written prose gives the model many harmless choices and gives a detector many observations. A short answer offers fewer. A factual completion may have one clearly correct continuation. Source code is constrained by syntax, identifiers, APIs, tests, and exact values. In those places, nudging the next token would risk making the output worse, so the signal is sparse or absent.
Three provenance rails, three different failure modes. Production systems need all the evidence they can preserve.
The Google DeepMind reference implementation illustrates another important detail: detector thresholds must be calibrated for sample length and a desired false-positive rate. The repository offers more than one detector approach and explicitly warns that its code is not a production implementation. Anthropic has not disclosed its detector family, calibration, keys, or production parameters.
That missing contract matters more than the watermark's cleverness. A detector score has no operational meaning without the model coverage, sample requirements, threshold policy, and failure state that produced it.
The translation-versus-proofreading example exposes the gap between generation provenance and intellectual authorship.
In a translation, the human may supply every fact, argument, and paragraph structure. Claude still chooses every word in the target language, so the output can accumulate a strong mark. In light proofreading, the human supplies nearly every token while Claude changes punctuation or a handful of phrases. That may leave too little statistical evidence to register.
Signal strength and intellectual contribution can therefore move in opposite directions.
This is where careless policy becomes dangerous. A university, publisher, employer, or hiring platform could read a positive result as proof that a person did not write the underlying work. That conclusion does not follow. The result may describe translation, editing, or partial processing. A negative result is equally easy to misuse: it can reflect short length, an older model, heavy rewriting, mixed text, code, low-entropy content, or simple detector unavailability.
Preserve the exact text, detector response, model context, and content hash. Ask what role Claude played before applying policy. Do not infer ownership, intent, truth, or full authorship.
The sample may be human, but it may also be short, edited, mixed, old, unsupported, low-entropy, or generated by another provider. Never present non-detection as a human certificate.
Unsupported models, insufficient text, API failure, rate limits, unknown versions, and unverifiable files need named states. An abstention is a result, not an engineering error to coerce into false.
Article 50(2) of the EU AI Act requires providers of systems that generate synthetic audio, images, video, or text to make outputs machine-readable and detectable as artificially generated or manipulated. The law qualifies that duty by technical feasibility, content limitations, implementation cost, and the state of the art. It also contains exceptions for standard editing and outputs that do not substantially alter the input or its meaning.
The obligations began applying on August 2, 2026. The Commission's current Article 50 FAQ describes a limited transition until December 2 for systems already on the market. The binding rule is Article 50; the Transparency Code of Practice is a voluntary compliance path that Anthropic and many other providers signed.
Anthropic's response is globally significant because the company says it does not yet have a durable way to turn marking on only for the EU. For supported models, Anthropic applies the behavior worldwide; newer models receive it at launch, while older models are being updated during the transition.
That is a subtle change in how regulation travels. The compliance boundary is no longer just a regional terms page, cookie banner, or endpoint. It can sit inside the model's token-selection process. A US startup using Claude through AWS and a Singaporean team using a direct API route may inherit behavior triggered by European law even when their local law does not demand it.
This may become the normal pattern for model-level obligations. Maintaining geographically different inference binaries is expensive, hard to audit, and easy to route around. When the performance cost is low, providers have an incentive to ship the strictest viable behavior globally.
The final date points to the next problem. Shared regulation and a shared SynthID lineage do not create a shared trust network. Each provider can use different keys, thresholds, detector versions, and even different marking methods. A Claude detector cannot certify that text came from Gemini, GPT, an open model, or a human.
The likely endpoint is issuer routing: a gateway that identifies which provider detectors can evaluate a sample, calls them under a common policy, and preserves separate results. That is less magical than a universal AI detector. It is also much more defensible.
Anthropic says marking applies to supported models used through Claude Code. That product statement should not become the claim that a generated repository will be reliably detectable.
Code is a hostile medium for statistical watermarking. Correct syntax, package names, variable references, schemas, serialized JSON, SQL, test fixtures, and exact constants all narrow the model's safe choices. Comments and prose documentation may carry more signal, but that does not make the executable artifact uniformly marked.
The Commission's current Article 50 FAQ lists source code among outputs outside the marking obligation's scope. Product coverage, legal scope, and technical detectability are three separate questions.
For coding agents, repository-level detection is the wrong granularity anyway. An agent can combine a human issue, retrieved documentation, model-written code, copied tool output, generated comments, formatter changes, a second model's review, and a maintainer's patch. A final verdict cannot localize which actor produced a disputed line.
This extends the argument in our analysis of Anthropic's multiagent safety patterns: once several agents and tools contribute to an artifact, provenance has to follow steps and ingredients, not merely the final blob. It also complements our look at Claude Code self-hosted enterprise runners. Execution location and model-output provenance are different control planes.
Anthropic is using two provider-side marking systems. Applications need a third.
| Evidence rail | What it can support | Where it breaks | Builder response |
|---|---|---|---|
| Statistical text mark | Claude likely selected enough tokens to leave its keyed pattern | Short, exact, edited, mixed, low-entropy, or unsupported text | Keep probabilistic states and detector context |
| C2PA Content Credential | A trusted signer attached tamper-evident provenance assertions to a supported file | Metadata can be removed; conversions can invalidate or omit it | Preserve originals and record transformations |
| Application custody log | Which model, route, user, tool, and transformation touched an artifact | Incomplete logging, mutable records, or movement outside the system | Hash artifacts and make receipts append-only |
For supported PNG, JPG, and SVG files, Anthropic says Claude will attach a cryptographically signed C2PA Content Credential stating that the file was made or processed with Claude. This is richer than a statistical score because it can carry signed provenance assertions. It also fails differently: re-saving, conversion, stripping, or use of a non-C2PA-aware tool can remove or invalidate the metadata.
The C2PA explainer is precise about the trust boundary. A valid credential can show that assertions are associated with an asset and have not been tampered with. It does not decide whether the content or the assertions are true, accurate, responsible, or complete.
We made the same point when OpenAI added SynthID to supported live audio in our earlier provenance analysis: a provider mark can strengthen origin evidence, but the application still owns chain of custody, failure states, privacy, and the policy action that follows.
Statistical marks survive copy and paste but weaken under transformation. C2PA carries richer signed history but can be stripped. Application logs can record transformations but only inside systems that actually log them. The rails are complementary because their failure modes are different.
Anthropic says a watermark-detection API is coming soon. It has not published the endpoint, launch date, authentication scheme, price, quotas, retention policy, thresholds, model coverage, regional availability, output schema, or whether results can localize marked spans in mixed text.
Those are not administrative details. They determine whether the detector can be used safely.
An unlimited public detector can become an oracle. Repeated near-duplicate submissions can reveal whether small edits strengthen or weaken a score, helping an attacker iteratively scrub or spoof a mark. A detector locked behind opaque access, on the other hand, makes independent verification and interoperability difficult. Anthropic has to balance abuse resistance with the public value of checking provenance.
I expect authenticated access, rate limits, abuse monitoring, detector versioning, and explicit abstention states. For enterprise use, signed verification receipts would be better than screenshots of a web result. A receipt could bind the content hash, detector version, timestamp, provider, and result without claiming more than the detector knows.
The privacy review also matters. Customers may submit unpublished articles, source code, legal drafts, medical text, or incident reports for detection. Before integrating the API, teams need answers about retention, training use, access controls, data residency, and deletion. A provenance service can easily become a new repository of sensitive material.
Do not wait for the API documentation to decide what your evidence model looks like. Build the states and logs first; map Anthropic's eventual response into them later.
A useful eval does not report one average detection rate. It produces a matrix by content type, length, model ID, generation date, edit level, language, and cloud route. It includes older models and deliberately unsupported inputs. It tests API downtime and rate limits as seriously as positive detections.
Your data model should also preserve the difference between expected marking support and observed detector outcome. If a model was not yet covered on the generation date, a negative result says very little. A detector queried months later cannot reconstruct the route, configuration, or rollout state unless your application logged them.
Watermarking looks like a model feature. In production it will behave more like identity and observability infrastructure.
First, AI gateways will add provenance receipts beside cost, latency, safety, and tool traces. The model transaction will not end with text; it will produce evidence about which provider route ran, what marking support was expected, and which transformations followed.
Second, interoperability will mean routing among issuers, not declaring one universal machine judge. The February 2027 milestone in the Code points toward common APIs, public signposts, or consortium gateways. Provider-specific results will remain separate because the keys and calibration remain provider-specific.
Third, the earliest serious disputes will concern mixed authorship and over-enforcement. A human-origin document translated through Claude may be labelled “AI written.” A short model-generated answer or code patch may be treated as human because the mark is absent. The failure will not be that the math never worked. It will be that institutions asked the math a social question it was not built to answer.
Fourth, managed inference gains a new procurement advantage. A hosted provider can enforce a model-level mark and protect a detection key. Operators of downloadable weights can modify or disable sampling logic. For provenance-critical workflows, some buyers will value managed or attested inference even when open weights provide more control elsewhere.
Anthropic's rollout is meaningful. A keyed, model-level signal is stronger than guessing from writing style, and applying it across first-party products and cloud routes gives builders a consistent new provenance input. C2PA credentials add a second, richer rail for supported files. EU pressure is moving provenance from research papers into production systems.
But the system becomes useful only when its limits survive contact with product policy.
“Claude likely selected enough of these tokens to leave a signal” is a defensible result.
“AI wrote this” is not.
The gap between those statements is where builders now have work to do: preserve the original artifact, log the route, represent abstention, protect the detector, record transformations, and put human judgment between a probabilistic signal and a consequential decision.
Claude's watermark may begin inside the sampling loop. Trust will still be assembled outside it.