How Claude's Invisible Text Watermark Actually Works: Inside SynthID-Text

On August 2, 2026, without a product launch event or a splashy demo, Anthropic quietly changed something about every new sentence Claude writes. The company confirmed it publicly on August 11, in a post explaining that new Claude models now embed an invisible, machine-readable watermark directly into their text output [1]. You cannot see it. It does not change what Claude says, how it says it, or how many tokens the response costs. But if you have the right cryptographic key, you can now check whether a given piece of text was very likely produced by Claude at all.

The trigger was regulatory, not a research breakthrough Anthropic decided to ship on a whim. Article 50 of the EU AI Act requires providers of generative AI systems to mark their text, image, audio, and video outputs in a way that is both machine-readable and detectable as AI-generated, and that obligation took effect on August 2, 2026 [2]. Anthropic had signed the EU's Code of Practice on Transparency of AI-Generated Content the same summer, alongside roughly 190 other signatories, which made the compliance deadline concrete rather than aspirational [1]. Coverage from TechCrunch [3], Fortune [4], and Forbes [5] all landed on the same framing within days of each other: this is Anthropic trying to get ahead of an AI-generated content problem the whole internet already has, using a regulatory deadline as the forcing function.

This post is a walkthrough of how the underlying mechanism, SynthID-Text, actually works, with runnable code for both halves of the system: the sampling change that embeds the watermark, and the statistical test that detects it later.

Step 1: What Actually Changed on August 2

The rollout is narrower than "all Claude text everywhere, forever." A few specifics matter if you are trying to reason about what a watermark check will or will not tell you.

Every new Claude model generates watermarked text going forward, across the API, Claude.ai, Claude Code, Claude Cowork, and deployments through AWS Bedrock, Google Cloud Vertex AI, and Microsoft Foundry [1]. Older, already-released models are not retroactively watermarked. Anthropic's own language is that it is "working to add watermarking for those models as well," with that work "rolled out over the coming months" rather than on day one [1]. So a watermark check performed today on text from an older model, or from before August 2, will correctly find nothing, and that absence tells you nothing about whether a human or an AI wrote it.

The scope is also global rather than EU-only, which is a deliberate choice, not an oversight. Anthropic's stated reasoning is that it does not yet have "a durable way to scope it by region" [1], so a law written for the EU market ends up shaping how Claude behaves for every user on the planet. This is a familiar pattern in tech regulation, often nicknamed the Brussels effect, where a single jurisdiction's rules become the de facto global default because building two different products is more expensive than building one.

Images and files get a different mechanism entirely. Rather than an embedded, invisible signal, Claude-generated images and files carry Content Credentials using the C2PA standard, a cryptographically signed metadata record attached to the file rather than hidden inside the pixels [1]. Code is barely watermarked at all, and deliberately so: code has almost no room for the kind of "either word works equally well" ambiguity the text watermark depends on, since a variable name or function call usually has exactly one correct answer. Anthropic notes the watermark mostly shows up in comments, where a model genuinely does have some freedom in phrasing [1].

Step 2: The Sampling Problem This Actually Solves

To understand why embedding a watermark in text is hard, it helps to be specific about what a language model is actually doing at each step of generation. At every position in a response, the model does not pick one word. It computes a probability distribution over its entire vocabulary, something like 35 percent "result," 30 percent "response," 20 percent "answer," 15 percent "output," and then samples one according to those odds. Do this correctly and unwatermarked, and the resulting text reads completely naturally, because that is literally how the model was trained to write.

The naive way to hide a signal in this process is to cheat the odds: silently boost a fixed "green list" of words at every step, so the model favors them slightly more than it otherwise would, then check later whether a text uses suspiciously many green-list words. This is roughly the approach from an earlier, widely cited watermarking scheme sometimes called KGW, after its authors [6]. It works, but it has a real cost: it distorts the model's actual output distribution, nudging word choice away from what the model would naturally have produced, which can be detectable as a subtle shift in style or word frequency if you look closely enough, and can measurably affect quality on tasks where word choice really matters, like poetry or technical writing with a narrow correct vocabulary.

SynthID-Text, the method Anthropic uses and describes by name, takes a different approach designed specifically to avoid that distortion [1]. It comes from a 2024 Nature paper by Dathathri, See, Ghaisas, and colleagues at Google DeepMind, titled "Scalable watermarking for identifying large language model outputs" [7], and it traces its core idea back further, to a 2022 proposal by computer scientist Scott Aaronson while he was working on watermarking during a stint at OpenAI [1].

Step 3: Tournament Sampling, or How to Watermark Without Distorting Anything

The key insight is this: instead of changing which words are more likely, change the source of randomness used to break ties among equally likely words, without changing the underlying probabilities at all.

Here is the mechanism in more concrete terms. Normally, when a model samples from its probability distribution, it uses a genuinely random number generator, effectively a fresh, unpredictable coin flip at every step. SynthID-Text replaces that fresh randomness with a pseudorandom number that is deterministically derived from two things: a secret watermarking key, and the handful of words that already came immediately before this position in the text [1]. Anthropic's own plain-language description is that the method uses "the key and a few words that come before to settle what word the model should pick."

The company's own analogy is worth repeating because it is genuinely clarifying: this is like a board game that uses the digits of pi instead of a physical die. If you did not know that in advance, the game would feel completely normal, every roll would look random and fair, and the odds of any outcome would be exactly the same as a real die. But someone who does know the trick, and has the same starting reference point, can reconstruct every single roll after the fact [1].

The specific sampling technique that makes this mathematically sound is called the Gumbel-max trick, and it is what SynthID-Text's "tournament sampling" is built on. Here is a simplified, illustrative version:

python
/code
import hashlib

def context_seed(key: str, previous_tokens: list[str], window: int = 4) -> int:
    """Derive a deterministic pseudorandom seed from a secret key plus the
    last few tokens already generated. Anthropic describes this as using
    "the key and a few words that come before to settle what word the
    model should pick." Because the seed only depends on text that is
    already fixed, both the writer (the model, holding the key) and a
    later verifier (holding the same key) can recompute the exact same
    seed for the exact same position in the text."""
    context = " ".join(previous_tokens[-window:])
    digest = hashlib.sha256(f"{key}:{context}".encode()).hexdigest()
    return int(digest, 16)

# Two different contexts produce two unrelated seeds, and the same
# context with the same key always reproduces the same seed.
print(context_seed("anthropic-demo-key", ["the", "quick", "brown", "fox"]))
print(context_seed("anthropic-demo-key", ["the", "lazy", "brown", "dog"]))
print(context_seed("anthropic-demo-key", ["the", "quick", "brown", "fox"]))  # matches line 1

Given that deterministic-but-unpredictable seed, the actual token selection works by adding Gumbel-distributed noise, derived from the seed, to the log-probability of each candidate word, then picking whichever candidate has the highest combined score:

python
/code
import hashlib
import math

def context_seed(key: str, previous_tokens: list[str], window: int = 4) -> int:
    context = " ".join(previous_tokens[-window:])
    digest = hashlib.sha256(f"{key}:{context}".encode()).hexdigest()
    return int(digest, 16)

def pseudorandom_unit(key: str, context: list[str], candidate: str) -> float:
    """A deterministic pseudorandom number in [0, 1) for one candidate
    word at one position, derived from the same key and context every
    verifier will also have access to."""
    seed = context_seed(key, context) ^ hash(candidate)
    return (seed % 10_000_000) / 10_000_000

def watermarked_sample(key: str, context: list[str], candidates: dict[str, float]) -> str:
    """A simplified, illustrative version of SynthID-Text's tournament
    sampling. Real next-token probabilities from the model (candidates)
    are combined with a per-candidate pseudorandom score using the
    Gumbel-max trick: argmax(log(p) + gumbel_noise) samples exactly from
    the model's own distribution, so the output text reads no differently
    than unwatermarked text, but the specific word chosen at each
    position is now a deterministic function of the key once you already
    know the context. This is what makes the scheme 'distortion-free':
    unlike a scheme that manually boosts a fixed subset of words, nothing
    is added or removed from the model's actual distribution of choices."""
    best_token, best_score = None, float("-inf")
    for token, prob in candidates.items():
        u = pseudorandom_unit(key, context, token)
        gumbel_noise = -math.log(-math.log(u + 1e-12))
        score = math.log(prob + 1e-12) + gumbel_noise
        if score > best_score:
            best_token, best_score = token, score
    return best_token

context = ["the", "model", "produced", "a"]
candidates = {"result": 0.35, "response": 0.30, "answer": 0.20, "output": 0.15}
chosen = watermarked_sample("anthropic-demo-key", context, candidates)
print(f"watermarked choice: {chosen}")

The reason this preserves the original probability distribution, rather than distorting it the way a green-list boost does, is a property of the Gumbel-max trick itself: sampling by adding independent Gumbel noise to log-probabilities and taking the argmax is mathematically equivalent to sampling directly from the softmax distribution. Swap out "independent random Gumbel noise" for "Gumbel noise derived from a deterministic seed," and you get exactly the same output distribution over many generations, but now the specific choice at any one position is reproducible by anyone holding the key. That is the technical meaning behind calling this scheme "distortion-free": averaged across enough text, a watermarked model and an unwatermarked model produce statistically indistinguishable writing, even though any individual watermarked response was chosen using the key rather than pure chance.

Why It's Called a "Tournament" and Not Just a Coin Flip

The single-Gumbel-draw version above is a fair simplification for a first pass, but the actual SynthID-Text paper runs a small tournament of multiple independent scoring rounds rather than one draw, and understanding why clarifies a real tradeoff Anthropic had to make. In the paper's design, each candidate token at each position is scored by several independent pseudorandom functions, not just one, each seeded slightly differently from the same key and context. Those scores compete in a bracket: pairs of candidates are compared, the higher-scoring one advances, and the process repeats until one token wins the whole round [7]. Running more tournament rounds makes the eventual detection statistic sharper and more reliable, since more independent pseudorandom comparisons accumulate more evidence about whether the key was actually involved. But more rounds also mean the sampling procedure deviates further from a single clean draw from the model's raw distribution, which is the exact tradeoff the paper spends real effort quantifying: detectability against distortion, tuned by a single depth parameter rather than a fixed either-or choice. Anthropic's production deployment picks a specific point on that curve, favoring low distortion, which is consistent with the company's own claim that output quality is unaffected in practice [1].

This tournament structure is also what makes the scheme reasonably robust to a model occasionally reusing common short phrases. A pure single-draw version would leak more signal on extremely common word sequences, where many different generations legitimately want to pick the same word regardless of any watermark. Averaging across multiple independent tournament rounds smooths that out, so the aggregate detection statistic reflects a genuine pattern across many decisions rather than a fluke on a handful of very predictable words.

Case Study: What a Real Detection Check Would Actually Show

Walking through a concrete scenario makes the statistics above less abstract. Suppose a university receives a suspicious essay and wants to check whether it was written by Claude.

A verifier with detection access runs the essay's text through the same per-token scoring function used in generation, recomputing what each already-chosen word's pseudorandom score would have been if it came from the watermarking key. For a roughly 800-word essay, that yields somewhere in the range of 600 to 700 scoreable word-choice decisions once short function words and highly constrained spans are filtered out. If the essay is genuinely unedited Claude output, those scores cluster high enough that the aggregate z-score clears a pre-set significance threshold by a wide margin, similar to the gap shown in the code example above between watermarked-style text and unrelated text. If the essay is human-written, or from a different, unwatermarked model, the scores scatter close to what pure chance would produce, and the z-score stays near zero.

The more interesting, and more common, real-world case sits in between. Suppose a student wrote a rough draft, then asked Claude to "clean up the grammar and tighten the wording" on three paragraphs out of ten. A detection check on the full essay would likely show a weak, inconsistent signal: strong in the three edited paragraphs, essentially absent in the other seven. This is exactly the scenario Anthropic's own limitations language is warning about: a hit does not mean "Claude wrote this," it means "Claude's sampling process touched at least some of these specific words," and a careful reader of a detection report has to interpret partial or patchy signal as exactly that, not as binary proof of anything.

Step 4: How Detection Actually Works

Generating watermarked text is only half the system. The other half is a detector that can look at a piece of text later and estimate whether it was produced this way.

The idea mirrors generation almost exactly. A verifier with the same key walks through the text, and at each position, recomputes the same pseudorandom score that generation would have used for the word that actually appears there. In real watermarked text, those recomputed scores trend systematically high, because the sampler was specifically choosing high-scoring options at generation time. In ordinary human writing, or text from an unrelated model, there was no such optimization, so the scores look uniformly random, centered around whatever the baseline expectation is.

python
/code
import hashlib
import math

def context_seed(key: str, previous_tokens: list[str], window: int = 4) -> int:
    context = " ".join(previous_tokens[-window:])
    digest = hashlib.sha256(f"{key}:{context}".encode()).hexdigest()
    return int(digest, 16)

def pseudorandom_unit(key: str, context: list[str], candidate: str) -> float:
    seed = context_seed(key, context) ^ hash(candidate)
    return (seed % 10_000_000) / 10_000_000

def detection_score(key: str, text_tokens: list[str], window: int = 4) -> float:
    """Given a candidate text and the same key used to generate it, a
    verifier recomputes the pseudorandom value that each already-chosen
    token 'won' with at its position. In genuinely watermarked text, that
    value trends high, since the sampler picked high-scoring options on
    purpose. In ordinary human text or text from a different model, the
    value looks uniformly random, since nobody was optimizing for it.
    Aggregating those per-token values into a single running mean and
    comparing it to the 0.5 you'd expect from pure chance is the same
    idea behind Anthropic's detection API, described as checking whether
    'the sequence of words is consistent with the choices Claude would
    make if it was using the key.'"""
    scores = []
    for i in range(window, len(text_tokens)):
        context = text_tokens[i - window:i]
        scores.append(pseudorandom_unit(key, context, text_tokens[i]))
    mean_score = sum(scores) / len(scores)
    # A rough z-score against the null hypothesis of uniform random text
    n = len(scores)
    z = (mean_score - 0.5) * math.sqrt(12 * n)
    return z

watermarked_text = "the model produced a result that closely matched".split()
random_text = "colorless green ideas sleep furiously today somehow".split()

print(f"z-score, watermarked-style text: {detection_score('anthropic-demo-key', watermarked_text):.2f}")
print(f"z-score, unrelated text:         {detection_score('anthropic-demo-key', random_text):.2f}")
# A real detector flags text as watermarked once z clears a fixed
# threshold, the same way a p-value crosses a significance cutoff.

Aggregate those per-token scores across a whole passage, and you get a running statistic, essentially a z-score, that tells you how far the observed pattern deviates from pure chance. Anthropic describes this exact idea in plain terms: checking whether "the sequence of words is consistent with the choices Claude would make if it was using the key" [1]. The company has said it will "soon be offering a watermark detection API," though as of this writing the implementation details of the production version have not been published in full [1].

One detail worth sitting with: detection needs the key. This is not a public, anyone-can-check-it feature the way a visible "Made with AI" badge is. It is closer to a forensic tool, available through Anthropic's own detection API, which means the practical trustworthiness of any given "this was AI-generated" claim depends on who is running the check and whether they actually have legitimate access to the key infrastructure behind it.

Step 5: Where Detection Breaks Down

A watermarking scheme is only useful if people understand its actual limits, and Anthropic has been unusually direct about several specific failure modes [1].

The most important nuance is the difference between "Claude wrote this" and "Claude touched this." If you paste a paragraph you wrote yourself and ask Claude to proofread it, fixing a handful of words, the resulting text is mostly your original tokens with a light edit layered on top. Very few of the words in the final text actually passed through Claude's own sampling process, so there is very little watermark signal to detect, even though Claude was genuinely involved. Anthropic is explicit that a watermark hit only means content "may have been processed by Claude," not that Claude authored it outright [1]. Text that originated as pure human writing and passed through Claude for translation or light editing could still carry a detectable watermark, and text that Claude wrote from scratch but a human then heavily rewrote could carry none at all.

Factually dense, highly constrained text is another failure mode, and it follows directly from the mechanism itself. Consider a sentence like "Isaac Newton's most famous work was called Principia." There is essentially one correct way to finish that sentence. When there is no real ambiguity in word choice, there is nowhere for the pseudorandom tie-breaking to actually operate, so that span of text carries little to no embeddable signal, regardless of whether a model or a person wrote it [1]. This is also why very short text samples are unreliable to check at all: the detection statistic needs enough independent word-choice decisions to average out random noise into a clear signal, and a single sentence rarely provides that.

Paraphrasing and rewriting are the most direct attack on the scheme, and this is true of every text watermarking method, not just SynthID-Text. If someone runs watermarked text through a second model to rephrase it entirely, or manually rewrites it word for word, the original token choices the detector depends on are gone. The watermark does not travel with the meaning of the text, it travels with the specific words, so replacing those words removes it.

Step 6: How This Compares to Other Watermarking Approaches

It is worth being precise about what C2PA is, since it gets mentioned alongside text watermarking constantly but works on a completely different principle. C2PA, the Coalition for Content Provenance and Authenticity, does not hide anything inside the pixels of an image or the waveform of an audio file. It attaches a cryptographically signed metadata record, sometimes visualized as a small "Content Credentials" icon, that states things like which tool created a file and what edits were made to it [1]. That signature is verifiable by the public without a private key, which is a meaningfully different trust model than SynthID-Text's key-gated detection. The tradeoff is that C2PA metadata is only as durable as the file it is attached to. Strip the metadata, or recompress the image aggressively enough, and the credential can be lost, whereas a text watermark embedded in the actual word choices is harder to strip without rewriting the content outright.

Google Already Ran This Experiment at Scale

Anthropic did not invent SynthID-Text, and it is not the first company to actually ship it in a production chatbot. Google DeepMind built the technique and open-sourced the underlying tooling in October 2024, and Google had already deployed it live inside Gemini and Gemini Advanced, watermarking effectively every response the assistant generates [9]. That earlier rollout is useful context precisely because it is not a small pilot: Google DeepMind's own analysis covered roughly 20 million watermarked and unwatermarked chatbot responses and found no meaningful difference in how users rated quality and usefulness between the two groups [10]. That is a meaningfully large real-world test of the "distortion-free" claim, run before Anthropic's own deployment, and it lines up with the same limitations Anthropic later documented independently: weaker confidence on heavily rewritten or translated text, and weaker signal on narrowly factual responses where there is little genuine word-choice freedom to work with [10]. In other words, Anthropic's August 2026 rollout is best understood as a second major lab adopting an already-battle-tested technique under new legal pressure, not as a novel experiment with unknown risk.

Why This Matters for Creators, Not Just Compliance Teams

It is tempting to file this under "regulatory news that only affects lawyers," but the practical stakes reach much further than that, especially for anyone publishing content at scale. YouTube, TikTok, and Instagram have all been building out their own AI-content disclosure requirements over the past two years, and a platform that can reliably detect AI-authored text has a much stronger foundation for enforcing those policies consistently, rather than relying on creators to self-report honestly. We cover the platform side of that question directly in AI vs human content: what Google actually prefers in 2026, which is worth reading alongside this post. If you already label AI-assisted work transparently, most of this changes very little for you. If your workflow depends on quietly passing off AI-drafted scripts, descriptions, or captions as fully human-written, an infrastructure layer that can check that claim, even imperfectly, is a real shift worth planning around.

If you found the sampling mechanics here interesting, the same category of "change one narrow part of how a model generates tokens, get a large practical effect" shows up in our explainer on speculative decoding, which covers the inference-speed side of that same design space, and in our Claude Opus 5 vs Sonnet 5 breakdown if you want the wider context on the model family this watermarking change now applies to.

This same visibility question runs through video and image content, not just text, which is exactly why C2PA content credentials matter for creators using AI image and video tools. A pipeline like Text2Shorts in Miraflow AI, which turns a topic into a script, then scene visuals, then a finished vertical video, sits right at this intersection: the script-writing step increasingly runs through language models that may carry exactly this kind of text watermark, while the visual generation step increasingly carries C2PA-style credentials. Understanding both mechanisms, rather than treating "AI detection" as one vague, monolithic thing, is what actually lets a creator make informed decisions about disclosure. The same applies to tools like Miraflow's AI Clipping, where auto-generated captions and summaries are exactly the kind of short, high-volume text output where these watermarking mechanics matter at scale.

Here is a video generation prompt built around the core mechanism described above, useful if you want to illustrate the concept visually rather than just describe it:

A close-up shot of an ordinary sheet of paper with typed text on it, camera slowly pushing in as a soft ultraviolet-style light sweeps across the page from left to right, revealing a faint repeating wave pattern woven invisibly through the ink that was not visible under normal light, then the light passes and the page returns to looking completely ordinary. Clean scientific documentary style, soft studio lighting, shallow depth of field, no readable text, no logos, no people, smooth steady camera movement.

Common Mistakes When Reasoning About AI Text Watermarks

• Treating a "no watermark detected" result as proof a text is human-written. It could just as easily be from an older, unwatermarked model, from before August 2, 2026, or from a different provider entirely.
• Assuming a detected watermark proves a human did not write the underlying ideas. It only reflects which specific words Claude's sampling process actually chose, not who came up with the argument or structure.
• Assuming the watermark is a visible or user-facing feature. It is designed to be completely invisible to a normal reader, and checking for it requires access to detection tooling and the underlying key.
• Assuming this scheme is unique to Claude. SynthID-Text originated at Google DeepMind and is openly published research; other providers can and likely will adopt similar distortion-free watermarking as their own EU AI Act deadlines arrive.
• Assuming watermarking solves AI content moderation on its own. It is one signal among many, easily defeated by paraphrasing, and Anthropic itself frames it as a piece of a larger transparency effort, not a complete solution.

Production Best Practices for Working With Watermarked Text

If you build products on top of Claude, or any model that adopts a similar scheme, a few practical habits follow directly from how the mechanism works. Do not rely on watermark presence or absence as a hard gate in an automated moderation pipeline, since both false negatives, from heavy editing, and blind spots, from older models, are built into the design, not edge cases. If you are building disclosure tooling for your own platform, communicate detection results as probabilistic evidence, similar to how a spam filter score should be treated as a signal to weigh, not a binary verdict to enforce blindly. And if data provenance genuinely matters for your use case, whether that is academic integrity, journalism, or content moderation at platform scale, plan for a defense-in-depth approach that combines text watermarking, C2PA credentials for visual media, and traditional stylometric or metadata analysis, rather than betting everything on any single mechanism holding up against a determined adversary.

Frequently Asked Questions

Can I see or turn off Claude's text watermark? No. It is designed to be invisible to readers and does not appear as a badge, character, or formatting change anywhere in the response, and there is no user-facing setting to disable it.

Does the watermark make Claude's responses slower or more expensive? No. Anthropic states the technique adds no extra tokens, no additional cost, and no meaningful latency, since it only changes which word wins a tie among already-equally-likely candidates.

Will this affect older Claude models like Opus 4.8 or earlier? Not immediately. Anthropic has said watermarking support for older models is planned to roll out over the following months, not on the August 2 effective date.

Does this only apply to users in the EU? No. Anthropic applies the watermark globally, since it does not currently have a reliable way to scope the feature by region, so it affects Claude output everywhere, not just for EU-based accounts.

Can someone remove the watermark by paraphrasing the text? Heavy rewriting or paraphrasing removes most of the detectable signal, since the watermark depends on the specific word choices Claude's sampler made, not on the underlying meaning of the text.

Is SynthID-Text the same technology used for Google's AI images? It is a related but distinct member of the same SynthID family from Google DeepMind. SynthID-Text is specifically built for language model text output using this sampling-based approach, separate from the pixel-level watermarking Google uses for images.

Does a watermark hit prove content is fully AI-generated with no human involvement? No. Anthropic is explicit that detection only shows text "may have been processed by Claude," which covers translation, heavy editing, and proofreading, not just fully original generation.

Conclusion

The headline, "Claude now watermarks everything it writes," undersells how genuinely clever the underlying mechanism is. SynthID-Text does not bolt a visible tag onto AI text or quietly nudge word choice toward a suspicious-looking pattern. It replaces one specific, narrow ingredient, the source of randomness used to break ties between equally good words, with a deterministic function of a secret key and recent context, which makes the text statistically indistinguishable from unwatermarked writing while still being verifiable after the fact by anyone holding that key. The EU AI Act's August 2 deadline is what forced this into production at Anthropic's scale, but the technique itself, tournament sampling built on the Gumbel-max trick, is a genuinely elegant piece of applied cryptography and statistics that is worth understanding well beyond the specific compliance story that shipped it. As more providers face the same regulatory deadline, expect variations on this same idea, distortion-free, key-gated, statistically detectable watermarking, to become a standard, mostly invisible layer underneath most of the AI-generated text you read from here on.

References and Sources

[1] Anthropic. "How Claude's text watermarking works."

[2] European Commission, Shaping Europe's Digital Future. "Transparency obligations under Article 50 of the AI Act."

[3] TechCrunch. "Anthropic says it will watermark text generated by its AI models."

[4] Fortune. "Anthropic plans to add an invisible mark to AI text, as the industry scrambles to police AI slop."

[5] Forbes. "Claude Will Now Leave A Watermark On Everything It Writes. What Does That Mean?"

[6] Kirchenbauer, J., Geiping, J., Wen, Y., et al. "A Watermark for Large Language Models."

[7] Dathathri, S., See, A., Ghaisas, S., et al. "Scalable watermarking for identifying large language model outputs." Nature 634, 818-823 (2026).

[8] Anthropic Help Center. "How Claude marks AI-generated content."

[9] Google DeepMind. "Watermarking AI-generated text and video with SynthID."

[10] MIT Technology Review. "Google DeepMind is making its AI text watermark open source."