Anthropic Explains How Claude's SynthID-Text Watermarks Work

Anthropic published a technical blog post on August 15 clarifying the mechanics behind Claude's forthcoming text watermarking, which the company is implementing to comply with the EU AI Act's Transparency Code. The specification matters immediately to any developer shipping Claude-generated content: watermark behaviour differs across prose, lightly edited text, and code in ways that require deliberate testing before production rollout.

The Underlying Mechanism: SynthID-Text

Rather than building a proprietary detection layer, Anthropic confirmed it will use the SynthID-Text approach that Google DeepMind published in 2024. The technique operates by biasing token selection at inference time during semantically equivalent word choices — the canonical example Anthropic gives is selecting "overcast" versus "grey" to describe weather. These micro-decisions encode a pattern keyed to a secret; the reader cannot distinguish a watermarked response from an unwatermarked one, but anyone holding the detection key can. Anthropic also stated it plans to release a watermark detection API, so verification won't be gated behind Anthropic's own tooling.

This is architecturally distinct from heuristic AI-detection products — like those offered by Pangram — that hunt for stylistic tells (such as "this isn't [X], it's [Y]" constructions). Anthropic is explicit: "Picking up on these patterns is fundamentally different from checking for a watermark." Statistical style-pattern detection and cryptographic watermark verification are separate signal classes; conflating them in a detection workflow will produce unreliable results.

Edit Resistance and the Rewrite Threshold

The most operationally significant detail is how watermark survival scales with editing intensity. Light editing probably won't fully strip the watermark, because the underlying token-selection pattern persists across most of the output. A complete rewrite — every word replaced — will remove it, though Anthropic's own framing acknowledges that at that point "it's arguable whether the text can any longer be described as AI-generated." The middle case is the one developers need to model: partial rewrites, paraphrasing passes, and post-processing pipelines that substitute synonyms or restructure sentences may degrade but not eliminate the signal.

For content that Claude only proofread or lightly edited from a human draft, watermark presence depends on both text length and the proportion of Claude's word choices that survived. Where "nearly all the words" remain the human author's, there is little or nothing for the watermark to attach to.

Code Output: Structural Constraints Reduce Watermark Density

Code generation imposes hard correctness constraints that compress the vocabulary of valid token choices. Because working code cannot substitute an arbitrary synonym for a variable name or operator, Claude has far fewer degrees of freedom in which to embed the watermark signal. Anthropic states the effect on actual code produced will be "negligible."

The exception is free-form text within code: comments, docstrings, and arbitrary string literals represent genuinely unconstrained word choices, and Anthropic confirms the watermark can be embedded there. Developers auditing watermark presence in code output should focus detection testing on comment blocks rather than on executable logic.

Ecosystem Context

Anthropic notes Claude will not be the only watermarked model: other major model developers have signed the same EU AI Act Code of Practice and are implementing their own watermark schemes. For teams building on Claude today, the immediate action item is integrating the forthcoming detection API into content-review pipelines and stress-testing edit thresholds against whatever post-processing transforms live between Claude's output and the end user — a provenance problem that intersects with broader concerns about AI agents operating in production infrastructure.