On August 14th (local time), Anthropic explained how the digital watermark that is embedded in the text generated by Claude works. Based on Google DeepMind's ``SynthID-Text,'' it leaves a statistical pattern by replacing the source of random numbers when selecting words with a private key and the previous context. Since no characters are added to the text, quality, speed, and prices are not affected.
Complying with “EU AI Act” but applicable globally
The company indicated on its support page that it will gradually embed digital watermarks that are imperceptible to humans in the text generated by Claude, in line with the company's signing of the EU AI Act's code of conduct regarding transparency obligations. The scope of application is not limited to the EU, but extends to models and products from all over the world, including Japan.
In its explanation, the company said, ``At launch, watermarks will be applied globally as there is still no reliable way to limit the scope of application by region.'' Approximately 190 organizations, including the company, have signed on to the EU code of conduct, and other major developers are expected to implement their own watermarks as well.
Overview of generation method
LLM generates text one word (token) at a time. As an example, Anthropic points to "overcast" and "grey" (both English words for cloudy) as words that follow "The weather today was cold and", explaining that low-risk choices that appear many times in a text have no difference in meaning to the reader. Normally, this selection is determined by random numbers, but when using watermarks, random numbers are generated from the private key and the previous few words, leaving a pattern that can only be detected by the party holding the key.
He emphasizes that the model is not always biased towards specific words, nor does it force you to choose unusual words that you would not normally choose. Because "nothing is added to the text, there are no hidden characters," "there is no need for extra tokens for watermarking, there is no price increase," and the impact on speed is negligible. Watermarks and keys do not contain information that can identify users, organizations, or chats.
Detection is a dedicated API, and it is difficult to enter formulas or code.
To detect digital watermarks, the company will use an API that it plans to provide soon, and will measure the probability that Claude was involved by verifying the sequence of words using a private key. Implementation details are currently being finalized.
Note that in sentences where the degree of freedom (entropy) in word selection is low, there is less room for embedding a watermark. For example, there is no room for watermarks to work in factual statements where there is only one correct answer, such as the word (mathematica) that follows ``Isaac Newton's most famous work is ``Principia...''. The same goes for formulas like "2+2=".
Even in programming code that requires strictness, watermarks are not applied in situations where it would not work if a different word were chosen, and watermarks are used only in parts where arbitrary selection is possible, such as comments in the code.
Proofreading, which only corrects grammar and punctuation, may not be able to detect enough words because Claude chose fewer words. On the other hand, in the translation, all the words are selected by Claude, so there is a watermark.
It cannot be erased with light editing, but it can be erased with a complete rewrite.
This watermark also has its limitations. Regarding resistance to alteration, the company says, ``It probably won't be completely erased with light editing, but it will disappear with a complete rewrite that replaces all the words.'' In that case, it is debatable whether it can be called AI-generated or not.
The watermark only indicates the possibility that Claude was involved in some way, and cannot distinguish between ``Claude wrote it'' and ``Claude significantly edited it.'' It does not prove that it was written by a human, nor can it be determined whether it was generated by another company's AI model. Accuracy decreases for short sentences with fewer word selections, and accuracy increases for longer sentences.
Images are C2PA compliant metadata
When Claude generates files such as ``.png'', ``.jpg'', and ``.svg'', it uses a different method from that of text. A short record (content credential) with a cryptographic signature indicating that Claude created or processed the file's metadata is attached to the file's metadata, and it complies with the industry standard "C2PA" for recording the provenance of content. It is the same standard used by camera manufacturers and photo editing software, and can be read by C2PA compatible tools. The company will also offer its own verification tools. The company says this is different from a watermark in that nothing is embedded in the file itself.
There are legal transitional measures for existing models released before August 2, 2026, when Article 50 (transparency obligation) of the EU AI Act begins to apply, and the addition of watermarks will be rolled out over the coming months.
