Anthropic Claude Watermarking Explained: How It Works, Can You Remove It With Edits, and What It Means for Code

TL;DR

Anthropic's new watermarking for Claude subtly biases word and token choices during generation to create a statistically detectable signal that is invisible to users but verifiable through Anthropic's detection tools.
The watermark survives light editing and copy-pasting but can be weakened or removed by heavy paraphrasing, translation, or aggressive human rewriting, and it is not designed to be tamper-proof.
For developers, watermarking is tuned to avoid breaking functionality in code and other deterministic outputs, with minimal impact on quality and an option to detect or disclose AI-generated content via API.

How Claude's Invisible Watermark Actually Works

Anthropic has pulled back the curtain on the watermarking system it has been quietly testing inside Claude, offering the clearest look yet at how the company plans to make AI-generated text identifiable without changing the user experience.

Unlike a visible logo or metadata tag that can be stripped with a click, Claude's watermark is embedded directly into the text itself. The system works at the token level — the small chunks of words and characters that a large language model uses to generate responses.

During generation, Claude uses a cryptographic key to pseudo-randomly split its vocabulary into two lists — often described as a "green list" and a "red list" — for each position in the text. The model is then subtly biased to favor words from the green list. To a human reader, the output looks completely normal. There are no odd word choices, extra spaces, or hidden characters. But over a long enough passage, the statistical preference for green-list tokens creates a pattern that is highly unlikely to occur naturally.

That pattern can then be detected by a tool that knows the key. Anthropic says detection is done through an internal system and a forthcoming API for approved partners, researchers, and enterprise customers, not by public inspection. The company emphasizes that the watermark does not contain user information and is not used to track individuals — it only signals that text was likely generated by Claude.

Crucially, the watermark is applied by default on the server side, meaning users don't need to enable anything and can't see any difference in latency or style.

Can You Remove It With Paraphrasing or Edits?

This is the question everyone is asking, and Anthropic's answer is nuanced: the watermark is robust, but not indestructible.

According to the details shared, the watermark is designed to survive the kinds of casual edits people make every day. Copying a paragraph, trimming a sentence, fixing typos, or changing a few words will not erase the signal. The statistical bias is spread across the entire document, so detection remains reliable even after light human touch-ups. In internal tests, Anthropic reported high detection accuracy for documents longer than about 200-300 tokens, even after minor edits.

However, the company is clear that the watermark is not a forensic guarantee. Heavy transformations will degrade and eventually destroy it. That includes:

Heavy paraphrasing: Running Claude's output through another AI to completely rewrite it in different words, or having a human substantially rewrite every sentence, can dilute the green-list bias below the detection threshold.
Translation loops: Translating text into another language and back again tends to scramble token-level patterns.
Truncation and mixing: If you take a small snippet of Claude-generated text and bury it inside a much larger human-written document, the signal becomes too weak to confidently detect.

Anthropic frames the system as a tool for increasing transparency at scale, not as a DRM lock. A determined actor trying to hide AI use can still do so with enough effort, but casual, large-scale misattribution — like passing off AI-written articles, reviews, or essays as purely human — becomes much easier to spot.

What It Means for Developers and Generated Code

For developers using Claude via API to generate code, the watermark update comes with important caveats.

Anthropic acknowledges that code is a special case. Unlike natural language, code has strict syntax and functional requirements where even a subtle bias toward a different token could break compilation, introduce bugs, or make the output less efficient. Forcing a watermark onto a Python function or SQL query could do more harm than good.

To address this, Anthropic says its watermarking system is context-aware. For highly deterministic tasks — including code generation, mathematical outputs, and certain structured data formats like JSON — the watermark is either significantly weakened or automatically disabled to preserve correctness and utility. The model prioritizes functional accuracy over watermark strength.

That means if you ask Claude to write a React component or a data processing script, that output is far less likely to carry a strong watermark signal than an essay or marketing copy of the same length. Detection confidence for code will be lower by design.

For product teams, the implications are practical. If you are building on Claude and need to prove provenance for compliance, trust and safety, or content disclosure reasons, you will need to use Anthropic's detection API and understand its confidence scores rather than relying on a binary yes/no. Anthropic also notes that the watermark does not affect model quality benchmarks and adds negligible computational overhead.

The company is positioning watermarking as part of a broader provenance strategy that also includes C2PA metadata and classifier-based detection, rather than a single silver bullet. For developers, the takeaway is that watermarking adds a layer of accountability for long-form text without interfering with Claude's core utility as a coding assistant — but it should not be treated as an infallible audit trail for every output.