Does Claude watermark its text? Who can detect it, and what it means for research papers

Yes. Anthropic now writes an invisible watermark into the text that most Claude models produce, in its own apps and API and on cloud platforms, for users everywhere. Its release notes first record the watermark on 1 September 2026, for two models launched that day, and on 3 November 2026 they add three older models: Claude Mythos 5, Claude Opus 4.7 and Claude Sonnet 4.6.⁴ As of 12 November, Anthropic's help-centre table shows a text watermark on 14 of the 18 models it lists. Claude Opus 4.6, Opus 4.5, Sonnet 4.5 and Haiku 4.5 do not carry one yet.² The watermark is a statistical pattern in Claude's choice of words, with no hidden characters, and today only organisations admitted to Anthropic's private-preview detection service can test text for it.

Several things are not established. A newsfeed reported on 3 November that the watermark was in effect for all models, which Anthropic's own pages do not show. A detected watermark indicates that Claude was likely involved in producing a text. Anthropic says it cannot separate writing from heavy editing and says nothing about authorship or ownership, and a detection is not a finding of misconduct. No public tool can test text for Claude's mark, we found no independent test of the deployed watermark, and we found no journal or publisher saying that it uses Anthropic's detection service.

Below: which models are covered and since when, how the watermark works, what EU law requires, who can check a manuscript, what proofreading, translation and editing do to the mark, what a detection shows, how it differs from AI detectors and file credentials, what OpenAI and Google do, and what journals still ask of authors. Every source was checked on 12 November 2026.

Does Claude watermark its text, and for which models?#

Anthropic explained the change on 14 August 2026 in "How Claude's text watermark works", updated on 1 September. The reason is legal: Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026, as did other major providers, to meet the EU AI Act's duty to mark AI-generated content. It applies the mark worldwide "because we don't yet have a durable way to scope it by region."¹

The current list of models is in a help-centre article, "How Claude marks AI-generated content", last changed on 9 November. It says that models launched on or after 2 August 2026 support marking at launch, and that marks cover Claude, Claude Code, Claude Cowork, Claude Tag and the API: "Marking will apply to output from supported models wherever Claude is offered, worldwide."²

Models	API launch, per the release notes	Text watermark in Anthropic's apps and API	On AWS, Google Cloud and Microsoft Foundry
Fable 5.1, Mythos 5.1	1 September 2026	Yes, recorded at launch	Yes
Opus 5.5, Sonnet 5.5, Haiku 5.5	22 September to 7 October 2026	Yes	Yes
Fable 5.2, Mythos 5.2	9 November 2026	Yes	Yes
Opus 4.8, Fable 5, Sonnet 5, Opus 5	28 May to 24 July 2026	Yes, already shown on 2 November	Yes
Mythos 5, Opus 4.7, Sonnet 4.6	17 February to 9 June 2026	Yes, from 3 November (Sonnet 4.6 with a caveat)	Yes, with Amazon Bedrock by 10 November
Opus 4.6, Opus 4.5, Sonnet 4.5, Haiku 4.5	September 2025 to February 2026	No	No

The release notes give no date for the four models in the fourth row, all launched before August; the help-centre table saved by the Internet Archive on 2 November already marked them.³ The caveat for Sonnet 4.6 concerns sampling settings, the parameters temperature, top_p and top_k that control how freely a model picks among likely next words. On Sonnet 4.6, a request that sets any of them to a non-default value "might not carry the watermark", and Anthropic's developer documentation advises leaving all three out if you rely on the mark.⁵

Is every model covered? The Proofs and Prompts newsfeed headed its 3 November item "Watermark for Claude outputs in effect for all models" and added: "Previously, this feature has only existed for their newer models, those released since August."⁸ Anthropic's pages differ on both points. Four models in the table carry no text watermark. Three of them, Opus 4.6, Opus 4.5 and Haiku 4.5, are listed as active on the API, and Sonnet 4.5 is due to retire on 30 November 2026.⁶ And four models launched before August were marked before 3 November. What the table marks on all 18 models is a separate system for files, Content Credentials. For the older models, the help centre says: "Anthropic is adding watermarks to outputs from models released before August 2, 2026."²

How does Claude's text watermark work?#

A language model writes one token at a time; a token is a word or a piece of a word. When several next words would fit about equally well, a random number settles the choice. After "The weather today was cold and", Anthropic notes, "overcast" and "grey" are both likely. A watermark replaces the source of that randomness: a secret key and the few words before decide the pick. The choices still look random to a reader, but someone holding the key can test whether a passage follows the key's pattern more often than chance would, and give a probability that Claude produced it.¹

Anthropic calls its method "a version of the SynthID-Text approach" that Google DeepMind published in Nature in 2024, in a family that goes back to a 2022 proposal by Scott Aaronson. In all of them, "the watermark only changes the source of the randomness used to pick among words." Anthropic adds that "Nothing is added to the text and there are no hidden characters", that the mark costs no extra tokens, and that it "carries no identifying information and can't be traced to a specific person, organization, or chat."

The mark needs room to work. Anthropic writes that "Detecting a watermark also doesn't work well on small samples", that confidence rises with length, and that factual passages and code carry less of it, because a correct fact or a working line of code leaves few free choices. The EU Code of Practice treats text under 200 tokens as "very short text" that providers need not watermark.¹⁸

On quality, Anthropic reports no effect in internal testing. The SynthID-Text paper ran a live experiment on nearly 20 million Gemini responses and found that thumbs-up and thumbs-down rates differed by 0.01% and 0.02%, differences it calls statistically insignificant.⁹ The only independent test we found is a preprint of 9 September 2026 by Alexander Nemecek, Vipin Chaudhary and Erman Ayday. They ran the open-source SynthID-Text on two open-weight models "because no public tool can test the deployed systems". "On prose, the measured effect of the watermark does not exceed that of changing the sampling seed." On code they measured a loss of three points of correctness on one model and none measurable on the other, with detection near chance. Their main conclusion is that "neither the objections nor the assurances can currently be verified".²⁵ It is a preprint, not yet peer reviewed, and did not test Claude.

What does the EU AI Act require, and from when?#

Article 50(2) of the AI Act says that providers of AI systems generating synthetic text "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated." Their solutions must be effective, interoperable, robust and reliable "as far as this is technically feasible". The duty does not apply where a system performs "an assistive function for standard editing" or does not substantially alter the input.¹⁵ It has applied since 2 August 2026.¹⁷ For systems already on the market before that date, Article 111(4), as amended by the Digital Omnibus on AI, sets a later deadline: providers "shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026."¹⁶ That is the date by which older Claude models must comply.

The Code of Practice is the voluntary route to showing compliance. The Commission published the final text on 10 June 2026,¹⁹ and the Commission and the AI Board have confirmed it as adequate.¹⁷ About 190 organisations had signed by the end of July, among them Anthropic, Google and OpenAI in its section for providers.²⁰ Three of its measures matter here.¹⁸

• Text above 200 tokens is watermarked: "For free-form text longer than 200 tokens, watermarking still needs to be applied, even though it may have lower reliability compared to that of watermarking very long text."
• Detection is free: "Signatories will make the detection solution available free of charge", with unlimited access for groups that include "independent researchers, educational and research institutions".
• Text detection may be restricted for now: because text watermarks are less reliable, access "may be restricted to verified expert users", and "Any restriction to the access will be limited in time".

The Commission's guidelines on Article 50, dated 5 November 2026 in the version we read, explain the editing exception.²¹ Standard editing includes "Grammar correction and spellchecking, linguistic and minor stylistic polishing that do not change the substance, meaning, style or messaging of text, AI-generated translations of text". Marking is required for "AI-generated summaries of text; paraphrasing or rewriting text that changes style, structure and meaning beyond mere grammatical and minor stylistic correction".

A second duty, in Article 50(4), requires whoever publishes AI-generated text "with the purpose of informing the public on matters of public interest" to disclose it, unless the text has had human review or editorial control and someone holds editorial responsibility. The guidelines count scientific developments that may be the subject of public debate as matters of public interest, and give "academic peer review or professional validation chains" as examples of human review. Spell-checking alone does not count. Whether a given paper falls under this duty is a legal question; journal policies apply in any case.

Can a journal, university or reviewer check my manuscript for it?#

Only through Anthropic's detection API, which is in private preview. It is available "to eligible organizations as required under EU law (such as regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, and EU civil society groups)", and to enterprises that must verify watermarks for their own compliance. Interest is registered through a form, and "We plan to expand access to the detection API over time."¹

Universities fit the description "educational organizations", and researchers studying provenance may qualify as independent researchers. Journals and publishers are not named in the list, so whether a publisher qualifies is for Anthropic to decide. We found no journal or publisher that says it has access. Anthropic's free Claude Content Checker reads files only: "The tool does not check text."⁷ The newsfeed put the result plainly: "At least initially it is impossible for individuals to check if their outputs will be flagged, even after modifications."⁸ That includes the author of the text.

Editors who screen manuscripts today use AI detectors, a different technology. In September 2025, Nature reported that the American Association for Cancer Research had screened submissions with a tool from Pangram Labs. It flagged probable AI-generated text in 23% of abstracts submitted to its journals in 2024, and found that fewer than 25% of authors disclosed AI use.²⁷ A detector of this kind cannot read Claude's watermark, because it does not hold Anthropic's key.

What if Claude only proofread, edited or translated my own text?#

It depends on how many of the words Claude chose: "The watermark only applies to words Claude chooses." When Claude proofreads a person's text, nearly all the words stay the person's, so there may be too little for a detector to find. "The more Claude writes, the more decisions it has to make, and the more space there is for a watermark." Translations are a different case: "A translation produced by Claude carries a watermark, because in this case every word is chosen by Claude."¹

The help centre draws the consequence: "Claude may not be the original author." People use Claude to proofread, translate, summarise or convert files, and the output can carry a mark even when the ideas, text or data came from elsewhere.²

Here the watermark reaches further than the legal duty. The Commission's guidelines treat grammar correction and AI-generated translation as standard editing, outside the marking duty.²¹ Claude's watermark is applied by the model whenever it picks words, and Anthropic says translations carry it. A paper you wrote in one language and had Claude translate may therefore test positive, with every idea your own. Several publishers already ask authors to declare AI translation; our comparison of AI disclosure policies lists which.

Does editing remove Claude's watermark?#

Partly. Anthropic's explainer answers the question directly: "To some extent, yes. Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will."¹ The help centre says the mark "may persist through some editing", and lists cases where Claude's text may carry no detectable mark: when it was "heavily edited, paraphrased, translated, or mixed into other writing", when the passage is very short, or when it came from a model or platform without marking.² None of the pages we read gives detection rates for Claude's watermark.

Research on related methods points the same way. The SynthID-Text paper states that "generative watermarks are weakened by edits to the text, such as through LLM paraphrasing", and lists a "vulnerability to stealing, spoofing and scrubbing attacks" as an open problem.⁹ Google's developer documentation adds: "Detector confidence scores can be greatly reduced when an AI-generated text is thoroughly rewritten, or translated to another language."¹⁰

Studies of other schemes give a mixed picture. Kirchenbauer and colleagues (ICLR 2024) found for their scheme that "watermarks remain detectable even after human and machine paraphrasing", given enough text: after strong human paraphrasing, about 800 tokens on average at a false-positive rate of one in 100,000.²² Krishna and colleagues (NeurIPS 2023) found that a paraphrasing model evaded several detectors, watermarking among them.²³ Jovanović, Staab and Vechev (ICML 2024) showed that "for under $50 an attacker can both spoof and scrub state-of-the-art schemes previously considered safe". Spoofing means making text appear watermarked, which matters for anyone who treats a detection as evidence.²⁴

OpenAI has published figures for its own text watermark. On 400-token passages, replacing 10% of the words with synonyms lowered detection from about 92% to 66%, and replacing 25% lowered it to 17%. Detection was "substantially lower" for mathematics than for psychology, because mathematical writing leaves fewer free word choices.¹³ None of these studies tested Claude's deployed watermark.

What does a detected watermark establish, and what does it not?#

A detection is a probability about one passage. In Anthropic's words, a watermark "can only determine that Claude was likely involved with the content at some point", and it cannot tell Claude writing a text from Claude heavily editing it. On ownership and responsibility, Anthropic writes: "It doesn't say anything about ownership or authorship".¹ The help centre calls a detected mark "a signal that content was processed by Claude, but is not fully conclusive", and adds the reverse case: "Lack of a detected mark doesn't mean the content wasn't AI-generated or processed."²

OpenAI lists the same limits for its own watermark: "A watermark does not measure human contribution." It does not establish ownership or responsibility, identify the user or verify accuracy, and "The absence of a detected watermark does not prove human authorship."¹³

For a research paper, that leaves four questions a detection cannot answer: who used Claude, which parts are the authors' own thinking, whether the text is correct, and whether its use broke any rule. The journal policies we compared in October allow AI help when it is disclosed. A positive result on a paper with an AI statement is consistent with that statement. On a paper without one, it is a question for the editor under the journal's own process, and the answer may be proofreading or translation.

How is a watermark different from an AI detector?#

A watermark check asks whether a text follows one provider's key. An AI detector asks whether a text looks machine-written. Anthropic explains that detection services such as Pangram work differently "because the companies that provide it don't have our key", and look instead for stylistic habits common in AI writing.¹ A detector can run on text from any model, and it can be wrong about human writing. A 2023 study by Weixin Liang and colleagues found that several widely used detectors "consistently misclassify non-native English writing samples as AI-generated".²⁶

Content Credentials are a third thing. When Claude produces a supported file, such as a PNG or SVG, it attaches a signed note in the file's metadata under the open C2PA standard, saying the file was made or processed with Claude. Anyone can read it with a C2PA tool, including Anthropic's free checker,⁷ and format conversion, re-saving or a screenshot can strip it.²

Signal	What it shows	Who can check	What it cannot show
Claude's text watermark	That Claude was likely involved in choosing the words, with more confidence for longer text	Holders of Anthropic's key: today, organisations admitted to the private-preview API	Who used Claude, writing versus heavy editing, accuracy; light proofreading may leave too little to detect; absence proves nothing
AI detector (such as Pangram)	A classifier's estimate, from style, that text looks machine-written	Anyone who uses the tool	Which model, if any; it can misjudge human writing, more often for non-native English writers in one study
C2PA Content Credential	A signed note in a file's metadata that Claude made or processed the file	Anyone with a C2PA reader, including Anthropic's free checker	Text pasted from a chat; a file whose metadata was stripped
Written disclosure statement	What the authors say AI did, with which tool and model, and who checked it	Every editor, reviewer and reader	Whether the account is complete; it is the authors' own statement

What do OpenAI and Google do?#

OpenAI described its approach on 5 October 2026.¹³ Its text watermark, textGrain, applies to ChatGPT and Codex text in the EU only: "We are not making text watermarking a global default at launch." API customers anywhere can opt in for select models. Its detector is open by application to approved researchers and expert organisations, and "Given the risk of missed watermarks and false positives, we are not making it publicly available at launch." Images and audio can be checked publicly at openai.com/verify.¹⁴

Google has watermarked Gemini text with SynthID-Text since 2024, when the Nature paper described it as deployed in "Gemini and Gemini Advanced".⁹ Google's SynthID page says the watermark covers "text generated by the Gemini app and web experience", and that its public SynthID Detector, opened to everyone after testing with journalists and media professionals, checks images, video and audio.¹¹ The May 2025 announcement of the portal included text, with a waitlist for journalists, media professionals and researchers.¹² The pages we read do not say whether anyone can now check Gemini text.

Provider	Text watermark	Where text is marked	Who can test text	Other provenance signals
Anthropic	A version of SynthID-Text	Claude apps, API and cloud platforms, worldwide; 14 of 18 listed models	Private-preview API for eligible organisations and obligated enterprises	C2PA credentials on supported files; free file checker
OpenAI	textGrain	ChatGPT and Codex in the EU; API by opt-in worldwide, select models	Approved researchers and expert organisations, by application	C2PA and SynthID on images, SynthID on audio; public checker for both
Google	SynthID-Text	Gemini app and web, per Google's pages	Not stated for text on the pages we read; open-source code for developers' own models	SynthID on images, audio and video; public SynthID Detector for those

What do journal policies say about AI disclosure?#

They ask authors to say how they used AI, and a watermark changes none of that. Publishers differ on whether grammar-only help needs a statement and on how to treat translation, as our October comparison of disclosure policies shows. Several ask for the model's name and version, which we cover in how to report the AI model version.

A disclosure and a watermark answer different questions. The disclosure is the authors' account of what Claude did and who checked it. The watermark is a provider's statistical signal, which someone with a key may or may not test. Where Claude drafted, summarised or translated part of a paper, a statement that says so gives editors the context a detection result lacks.

What this means for a research record#

The 3 November change shows why dates and model names matter. In Anthropic's own apps and API, Sonnet 4.6 produced unmarked text on 2 November and, with default sampling settings, marked text on 4 November. A useful note for each use of Claude records the model the app showed, the date, what Claude did (drafting, summarising, translating, proofreading) and in which sections, which version of the text a person then approved, and who checked it.

A Papex record keeps that account as the researcher states it, with the AI apps and models as reported, and the accountable person signs one exact version, which carries its date. An AI app can prepare a private draft; only the person can sign or publish it (how AI apps work with Papex). A record does not show which model ran, whether a text carries a watermark, or that the work is right.

A note on interests: this post is about an Anthropic product. It was drafted with Claude, an Anthropic model, so parts of its wording may carry the watermark it describes. Readers should weigh it with that in mind and check the sources below.

Sources#

1. Anthropic, How Claude's text watermark works (14 August 2026, updated 1 September 2026), checked 12 November 2026 ↩ a b c d e f g
2. Claude Help Center, How Claude marks AI-generated content (last changed 9 November 2026), checked 12 November 2026 ↩ a b c d e f g
3. Claude Help Center, How Claude marks AI-generated content, Internet Archive copy of 2 November 2026, checked 12 November 2026 ↩
4. Anthropic, Claude Platform release notes (entries of 1 September and 3 November 2026), checked 12 November 2026 ↩
5. Anthropic, Claude Platform Docs: Text watermark, checked 12 November 2026 ↩
6. Anthropic, Claude Platform Docs: Model deprecations and model status, checked 12 November 2026 ↩
7. Anthropic, Check if a file was made with Claude (Claude Content Checker), checked 12 November 2026 ↩ a b
8. Proofs and Prompts, Newsfeed, item of 3 November 2026, checked 12 November 2026 ↩ a b
9. Sumanth Dathathri and colleagues, Scalable watermarking for identifying large language model outputs (Nature, 23 October 2024), checked 12 November 2026 ↩ a b c
10. Google AI for Developers, SynthID: Tools for watermarking and detecting LLM-generated text (updated 9 April 2025), checked 12 November 2026 ↩
11. Google DeepMind, SynthID, checked 12 November 2026 ↩
12. Google, SynthID Detector: a new portal to help identify AI-generated content (20 May 2025), checked 12 November 2026 ↩
13. OpenAI, Our approach to EU text provenance rules (5 October 2026), read through the Internet Archive copy of 26 October 2026, checked 12 November 2026 ↩ a b c
14. OpenAI Help Center, Provenance signals in OpenAI-generated content, read through the Internet Archive copy of 8 October 2026, checked 12 November 2026 ↩
15. AI Act, Article 50: Transparency obligations (AI Act Service Desk, consolidated text as at 27 July 2026), checked 12 November 2026 ↩
16. AI Act, Article 111, as amended by the Digital Omnibus on AI (AI Act Service Desk), checked 12 November 2026 ↩
17. European Commission, Code of Practice on Transparency of AI-generated Content (policy page, updated 19 October 2026), checked 12 November 2026 ↩ a b
18. European Commission, Code of Practice on Transparency of AI-Generated Content, full text (PDF), checked 12 November 2026 ↩ a b
19. European Commission, Commission publishes Code of Practice on marking and labelling AI-generated content (10 June 2026), checked 12 November 2026 ↩
20. European Commission, Strong backing for the Code of Practice on Transparency of AI-generated Content (31 July 2026, updated 24 September 2026), checked 12 November 2026 ↩
21. European Commission, Guidelines on the implementation of the transparency obligations under Article 50 of the AI Act, C(2026) 7702 (PDF dated 5 November 2026), checked 12 November 2026 ↩ a b
22. John Kirchenbauer and colleagues, On the Reliability of Watermarks for Large Language Models (ICLR 2024), arXiv:2306.04634, checked 12 November 2026 ↩
23. Kalpesh Krishna and colleagues, Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense (NeurIPS 2023), arXiv:2303.13408, checked 12 November 2026 ↩
24. Nikola Jovanović, Robin Staab and Martin Vechev, Watermark Stealing in Large Language Models (ICML 2024), arXiv:2402.19361, checked 12 November 2026 ↩
25. Alexander Nemecek, Vipin Chaudhary and Erman Ayday, Watermarks Without Verification: AI Text Watermarking After the EU AI Act, arXiv:2609.09604 (9 September 2026), checked 12 November 2026 ↩
26. Weixin Liang and colleagues, GPT detectors are biased against non-native English writers (Patterns, 2023), arXiv:2304.02819, checked 12 November 2026 ↩
27. Library Journal infoDOCKET, Report: AI Tool Detects LLM-Generated Text in Research Papers and Peer Reviews (11 September 2025), summarising Nature's report, checked 12 November 2026 ↩