How AI Text Watermarks Work, and Why Claude Shipped Them Before ChatGPT

Hello, this is Ryuta Hamamoto from TIMEWELL.

A lot of people in Japan have been asking me about Claude’s new “squash.” Speech-to-text turns sukashi (watermark) into squash with depressing reliability. What they mean is an invisible mark. Nothing shows up on the screen. Copy the answer into another window, and a machine-readable signal can come along for the ride. Anthropic started doing this on new Claude models from August 2026¹.

I first pictured a faint logo stamped on a page. That is the wrong picture. A text watermark does not sit on top of the words. It lives in the dice the model rolls when it picks the next token. Today I want to walk through how that bias is built, why the industry suddenly had to ship it, and why ChatGPT and Grok have not put the same thing on text.

If you want a snapshot of how far your own team has actually gotten with generative AI, take the AI literacy check first. The second half of this piece is really about what you should and should not trust.

The news is Claude. The calendar is Brussels.

Anthropic’s help center is unusually plain. Claude models launched in the EU on or after 2 August 2026 will mark content from day one. Generated text gets an embedded watermark. Supported files get digitally signed provenance metadata. The mark applies on Claude itself, the API, Claude Code, Claude Cowork, and through AWS, Google Cloud, and Microsoft Foundry. It is not an EU-only switch. It applies wherever Claude is offered¹.

Older models get a grace period. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking rule. Anthropic says it is working on those older models as well¹.

The date is not a product whim. Article 50(2) of the EU AI Act (Regulation 2024/1689) requires providers of systems that generate synthetic audio, image, video, or text to mark outputs in a machine-readable format so they can be detected as artificially generated or manipulated. That clause applied from 2 August 2026². I wrote about how Japanese companies get pulled into the Act’s extra-territorial reach in a separate piece on the 2 August general application date. This one is only about what “mark the output” did to the engineering stack.

The statute does not say “put a watermark on it.” It is technology-neutral. Recital 133 lists watermarks, metadata identifiers, cryptographic methods for proving provenance, logging methods, and fingerprints. What the law asks for is a solution that is effective, interoperable, robust, and reliable as far as this is technically feasible². Perfect resistance to a determined attacker is not the legal test.

On 10 June 2026 the Commission and the AI Office published the final Code of Practice on Transparency of AI-generated Content. By the end of July about 190 organisations had signed. Named examples in Section 1 include Aleph Alpha, Anthropic, Cohere, Google, Meta, Microsoft, Mistral, and OpenAI. xAI is not on the official list updated on 12 August 2026³. Signing is voluntary. Article 50 still applies if you do not sign.

Fines need a careful reading too. The Act’s headline ceiling is EUR 35 million or 7 percent of worldwide turnover. Obligations in the Article 50 class sit in the middle band of Article 99: EUR 15 million or 3 percent, whichever is higher⁴. Either way, a research topic became a shipping item in the summer of 2026.

The mark is hidden in the next-word choice

There are only three serious ways to tell AI text from human text. The SynthID-Text paper lays this out cleanly⁵.

Retrieval: the provider stores every generation and looks it up later. Reliable, and brutal for privacy. Post-hoc detection: a classifier guesses “how AI this sounds.” DetectGPT and its cousins live here. You do not have to touch the generator. You also inherit a well-documented bias against non-native English writing, and the method gets weaker as models get better. Watermarking: you intervene at generation time and leave a statistical signal. Detection can then be explained with a p-value, and in some designs a third party only needs the secret key and the tokenizer, not the model weights.

Kirchenbauer et al. (ICML 2023) gave the field its working vocabulary. When an LLM picks the next token, it scores the whole vocabulary. Hash the previous token with a secret key, use that as a seed, and split the vocabulary into a green list and a red list. Nudge the green tokens up a little, then sample. A detector with the same key rebuilds the lists and counts how many green tokens landed. Unmarked text sits near half green. Marked text sits higher. The difference becomes a z-statistic. You do not get “80 percent AI.” You get “the chance this happened by accident is under one in a million”⁶.

Think of a loaded die, not a logo on letterhead. One roll tells you nothing. Fifty rolls and the sixes look wrong. The detector is just counting those sixes.

That is also why the method dies when the next word is obvious. After “Barack,” the model almost has to say “Obama.” Force anything else and the sentence breaks. A watermark feeds on the model’s uncertainty. Low entropy, weak signal. The paper calls this spike entropy⁶. Code, runs of proper nouns, and short greetings are weak for the same reason.

Google DeepMind’s SynthID-Text keeps the same kind of randomness source and changes the sampling. Tournament sampling. Draw candidates, run them through secret scoring functions, keep the winners, repeat. The surviving token tends to have a high secret score. Detection looks at the average. The default is 30 layers. On about 20 million live Gemini responses, the thumbs-up rate moved by 0.01 percent. Latency rose 0.57 percent. That is the real claim: you can put this in production without wrecking quality⁵.

Berkeley’s Mark My Words then beat the methods up on quality, the number of tokens you need, and tamper resistance. In the temperature range people actually use, the Kirchenbauer-style shift is strongest. About 50 to 60 tokens, roughly 40 English words, is enough to detect. On code, accuracy drops and detection gets shaky. A GPT-3.5 paraphrase removes the mark more than 60 percent of the time, even on the best scheme they tested⁷.

Anthropic has not published the exact algorithm. Green list, tournament, something else: the help page only says the mark is woven into the text, does not change meaning or quality, and can survive a copy-paste¹. The shared idea since 2023 is the same. You do not hide a special character. You hide a bias in the statistics of word choice.

Files are a different layer. SVG, PNG, and JPG from Claude can carry C2PA signed provenance¹. That is an envelope on the file, not a bias in the tokens. A screenshot usually strips it. The Code of Practice’s two-layer picture (embedded mark plus signed metadata) exists because each layer fails in a different way.

Why ChatGPT and Grok have not shipped this for text

It is easy to read this as a morality play. Claude did the right thing; everyone else is late. I do not buy that. The public record shows different constraints, not different ethics.

OpenAI said in May 2024 that it already had a text watermark. The August update is blunt. The method survives local paraphrase. It fails against translation, a rewrite by another model, or the cheap trick of inserting a special character between every word and deleting it later. Trivial for a motivated attacker. The same note warns that the mark could stigmatize non-native English speakers who use the model as a writing aid⁸. At the time, the company put images and audio first. Those were the higher-risk modalities for deception.

The August 2026 help page has not really moved on text. Images carry C2PA metadata and a SynthID watermark. Audio carries SynthID. Text is a goal: expand provenance signals to all modalities, including text⁹. OpenAI signed the Code³. Signing is not the same as putting a text watermark into ChatGPT. Article 50 is technology-neutral, so another machine-readable method could still satisfy 50(2). The help page does not say which one they will use. “No text watermark” is not the same sentence as “illegal.”

Google already put SynthID-Text into Gemini in 2024 and published the paper⁵. Claude is not the first production text watermark. It is the first time a chatbot that Japanese knowledge workers live in all day started marking the body of the reply. That is why it feels sudden.

Grok is thinner on the record. xAI is not on the Commission’s Section 1 list as of 12 August 2026³. I also cannot find an Anthropic-style help article that says Grok embeds a text watermark. I am going to stop there. Absence from the Code is not an exemption. If you offer a generative system in the EU, Article 50 still applies. The Code is a smoother way to show conformity, not a waiver. Whether xAI marks some other way, is using the grace period for older models, or will ship later is not something I can split from public documents.

My own read: the delay is not “the science is missing.” It is “text lies less easily than pixels.” An image watermark can hide in many pixels. A text watermark has a small set of next-word choices, and one paraphrase can wreck the statistic. OpenAI’s 2024 worries line up with later papers. Jovanović, Staab, and Vechev showed you can approximate a secret watermarking rule from a public API for under $50, and push scrubbing success above 80 percent¹⁰. Zhang et al. proved that, under natural assumptions, strong watermarking is impossible¹¹.

So I will not pick a hero. The lab that shipped first matched the regulatory calendar and published the limitations next to the feature. The lab that has not shipped may be looking for a mark that fails less stupidly. Both stories fit the evidence we have.

Where the mark disappears

Anthropic says this first, which I respect. A detected mark does not mean Claude wrote the original ideas. People use it to proofread, translate, summarize, or convert a file. No mark does not mean the text is human. Old models, heavy edits, translation, mixing with other writing, very short passages, stripped file metadata: all of those can come back clean¹.

Map that onto the research and the failure modes are boringly specific. Short text. Code. Strings of proper nouns. Structured JSON. A determined paraphrase. Open-weight models run locally. There is no practical way to force a watermark onto a model someone else downloaded. The SynthID-Text authors say so themselves⁵.

It still does useful work. Casual copy-paste gets more expensive. Platforms can filter at scale. A provider can find its own outputs later. And it is a concrete way to implement “machine-readable marking.” Mark My Words is honest about the threat model: a student trying to skip homework is unlikely to translate, rewrite with a second model, and sprinkle special characters⁷. Not a vault. A speed bump.

The stealing paper is nastier because removal and spoofing arrive together. If an attacker stamps hate speech with “that company’s watermark,” the blame slides toward the provider¹⁰. This is not an ID check. I keep coming back to a seatbelt. It will not stop the crash. Driving without one makes the crash worse.

I would also not transplant the English token counts into Japanese without blinking. Tokenization is different. A particle can split a phrase. “Detectable at 50 to 60 tokens” is an English result. Until Claude’s detector is public, the honest operating rule is: long prose keeps the signal, a two-line Slack reply probably does not.

Treat it like a seatbelt

If I were writing the internal policy, I would start here: do not let a detector decide a hiring, academic, or legal outcome by itself. Job applications, papers, press drafts, customer letters. A hit or a miss is not enough. Short text misses. Light editing still hits. Both are in the vendor’s own docs¹.

Hold two layers instead. A statistical mark in the text, and signed metadata on the file (C2PA). That is the stack the Code of Practice is pushing. For anything that leaves the company as an image or a slide, ask whether a screenshot or a re-save will strip the envelope. For text, log which model, when, and from which prompt. The watermark is a backup. It is not the system of record.

We are also past the point of judging writing by whether it “sounds like AI.” I wrote about that uncanny tone problem separately. Better models close the gap. Post-hoc detectors have already hurt non-native writers. That is why providers started marking at generation time. I think that move is right. Over-reading the mark creates the next accident: treating watermarked prose as dirty prose. That is exactly the stigma OpenAI flagged in 2024⁸.

If I had to bet on the rest of 2026, the fight will not be “who watermarked first.” It will be “who is allowed to use a detection result, and for what.” Universities, recruiters, newsrooms, platforms. The cost of a false positive is different in each room. The Commission says the Code’s task forces start in September 2026³. Japanese companies should be in that conversation with operational language, not just a translated FAQ.

The harder job sits in front of the watermark: how the company treats model output, and which human still owns it. That is the work we do in WARP. Model choice and prompts, yes, but also provenance, internal rules, and the literacy of the people who hit send. If “we’ll just buy a detector” already feels thin, start from a conversation.

Invisible marks will become plumbing. Once they are plumbing, the valuable skill is not owning the mark. It is knowing how to read it.

References

Footnotes

1. Anthropic, How Claude marks AI-generated content (Claude Help Center) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

2. Regulation (EU) 2024/1689, Article 50 / Recital 133 ↩ ↩²

3. European Commission, Strong backing for the Code of Practice on Transparency of AI-generated Content (published 31 July 2026, updated 12 August 2026) ↩ ↩² ↩³ ↩⁴

4. Regulation (EU) 2024/1689, Article 99 ↩

5. Dathathri, S. et al. (2024). Scalable watermarking for identifying large language model outputs. Nature 634, 818–823. DOI: 10.1038/s41586-024-08025-4 ↩ ↩² ↩³ ↩⁴

6. Kirchenbauer, J. et al. (2023). A Watermark for Large Language Models. ICML 2023. arXiv:2301.10226 ↩ ↩²

7. Piet, J. et al. (2025). Mark My Words: Analyzing and Evaluating Language Model Watermarks. IEEE SaTML 2025. arXiv:2312.00273 ↩ ↩²

8. OpenAI, Understanding the source of what we see and hear online (7 May 2024, updated 4 August 2024) ↩ ↩²

9. OpenAI Help, Provenance signals (Content Credentials, SynthID) in OpenAI-generated content ↩

10. Jovanović, N., Staab, R., & Vechev, M. (2024). Watermark Stealing in Large Language Models. ICML 2024. arXiv:2402.19361 ↩ ↩²

11. Zhang, H. et al. (2024). Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models. ICML 2024. arXiv:2311.04378 ↩