The Invisible Watermark in AI Text: What It Can and Can't Prove

The panic usually starts with a question. "If I publish this, will people be able to tell an AI wrote it?"

For text, the honest answer used to be "probably not, reliably." That is changing. Anthropic has started embedding an invisible watermark into text generated by new Claude models, and the rollout is global, Japan included. A Japanese creator on note, AI director ZEN, recently walked through what this means in practice. The short version is less dramatic than the headlines suggest: the watermark is real, but it is nowhere near a proof-of-slop detector.

Here is what the mark actually is, what detection can and cannot establish, and why you should not rebuild your workflow around the fear of being caught.

The mark is invisible by design

A watermark sounds visual, like a logo burned into a corner. Text watermarking is not that. Nothing gets added to the output: no hidden characters, no extra symbols, no change in length. The mark lives in the pattern of word choices.

Language models pick each next word from a set of plausible candidates, and the tie is usually broken with randomness. The watermark changes the source of that randomness. Choices still look normal, but they follow a pattern that anyone holding the right key can recognize. Anthropic compares it to swapping dice rolls for a fixed book of digits in Monopoly: the moves still look random, the game plays the same, but afterwards an observer with the key can tell which book was used.

Claude implements this with a technique called SynthID-Text, published by Google DeepMind in Nature in 2024. Readers notice nothing. Anthropic says internal testing found no impact on quality, creativity, or readability, and Google's A/B tests on real Gemini traffic found no statistically significant difference.

The important part, because it gets lost in every discussion: the text looks identical, copies identically, and can be edited. The mark is a statistical pattern, not a stamp on the file.

It is global, and it is not about catching you

The watermark exists because of the EU AI Act. Anthropic signed the Code of Practice on Transparency of AI-Generated Content in July 2026, one of around 190 signatories in total. New Claude models launching after August 2, 2026 carry the mark at launch. Older models are being brought into scope over the following months.

Anthropic applies the mark everywhere, not just in EU markets, because there is no durable way to scope watermarking by region. So the Japanese read is correct: Japan is covered, the API is covered, Claude Code and the other surfaces are covered, wherever Claude is offered.

Two things follow that most people miss.

First, the mark carries no identity. It cannot be traced to a person, an organization, or a chat. It only says something about Claude's involvement with the text.

Second, it is not specific to Claude. Other major providers signed the same code and will ship their own watermarks. The future this points at is a generic "an AI was probably involved" signal, not a per-model surveillance tool.

What detection can actually prove, and what it can't

This is where the useful knowledge lives, because the limits of detection are more interesting than the watermark's existence.

A detector holding the right key can answer exactly one question: what is the likelihood that Claude was involved in writing this text? Read that sentence closely, because it deliberately does not say what people want it to say.

It cannot confirm the text was written by a human. It cannot tell you a different AI wrote it, even a watermarked one: other providers use different keys and possibly different methods. It cannot separate "Claude wrote this" from "Claude heavily edited this," and it carries no ownership or authorship information. A detected mark says Claude touched the text at some point, and little more.

The statistical pattern also weakens in exactly the places people use AI for help:

• Short passages. Fewer word choices means less signal. Confidence drops with sample size.
• Factual text. Fewer valid word choices usually produce less watermark signal.
• Proofreading. If you hand Claude your text for grammar fixes, nearly all the words are yours. A handful of corrections may be too few to register. The more Claude writes, the stronger the mark.
• Code. Code generally carries less watermark signal, while comments and other arbitrary text can still carry it.
• Translation. The edge case: a translation is entirely Claude's word choices, so it carries the mark even though the meaning belongs to the original author.

And the honest counterpoint, straight from Anthropic: light editing probably won't remove the mark, but rewriting every word will. At that point, as they note, calling the result AI-generated gets strained anyway.

That last point matters more than it looks. The mark only persists when the model's phrasing largely remains. It is a record of how much of the surface text came from Claude, not a verdict on the person behind it.

Detection software is not watermarking

Services like Pangram and other "AI text detectors" work on a completely different principle. They do not have the key, so they look for stylistic tells: the "not X, but Y" constructions, the strange preference for "quietly," the even, slightly generic rhythm. That is pattern-matching, not watermark checking, and it has a well-earned reputation for false positives on non-native English and formal writing.

So when a commercial detector flags your text, no watermark was involved. The watermark is a statistical signature checked against a key; the detector is a guessing game about style. Conflating them is how creators end up arguing with unreliable evidence.

What this means for creators

The Japanese article lands the conclusion right: this technology records AI involvement, it does not measure your effort, your thinking, or the workload behind a piece. A mark in the output says nothing about whether you briefed, edited, fact-checked, and rebuilt the draft. That is where most of the actual work in professional AI-assisted writing happens.

The practical stance:

• Stop building your process around evasion. If your goal is your own quality bar, you will edit heavily anyway, and you are writing for readers, not detectors.
• Keep the human layer visible: structure, voice, fact-checking, cuts. Those survive a rewrite, and no watermark can capture them.
• Disclose when the platform or client demands it. Transparency commitments treat marking as a positive signal, not an admission.
• Treat style-based detection tools as untrustworthy evidence. A probability score is not proof, and you do not need to argue with it.

The watermark removes one fantasy: perfect deniability for fresh Claude output. Everything else, the quality of the writing, the editorial judgment, the direction, still belongs to the person who signs the piece.