Claude's watermark: detection is weakest on code

Anthropic followed its August 11 announcement with the mechanics. Claude's text watermark is a version of SynthID-Text, the technique Google DeepMind published in a peer-reviewed Nature paper in 2024. The important part is not that it exists — we covered that when Anthropic confirmed Claude marks its output. The important part is where it stops working, and Anthropic said so plainly.

What actually happened

Per Anthropic's own write-up, published August 14, the watermark does not add characters or post-process the finished response. When the model picks among several equally plausible next words, it replaces the arbitrary randomness in that choice with randomness derived from a secret key plus the preceding words. The signal lives in the word choices themselves. No extra tokens, no cost or latency change, no identifying information about the user.

That design dictates the failure modes, and Anthropic listed them:

• Short text offers too few word choices to test against. Detection is unreliable.
• Factual output constrains the model to one correct answer, which removes the arbitrary choices the mark needs.
• Code is the extreme case. The watermark "can attach to arbitrary choices like comments" but has a negligible effect on the code itself — so detection on source is weak by design.
• A light edit probably will not remove it. A full rewrite will.

A watermark detection API is planned, as TechCrunch reported, with implementation details still open. Users cannot turn the marking off.

Why AI watermark detection matters for your business

Nobody is going to detect AI in your codebase this way. If you have been worried about shipping Claude-written code to a client with a no-AI clause, or hoping to catch a contractor doing it to you, the mechanism does not support either position. Comments may carry a faint signal; the functional code does not. Write the disclosure into the contract, because the technology is not going to arbitrate it.

Your marketing copy is the opposite case. Long-form prose is exactly where the mark is strongest — plenty of word choices, few correctness constraints. Product descriptions, blog posts, and email sequences generated and shipped raw are the most detectable content you own. Assume a marketplace or search engine can check once the detection API ships.

Light editing does not launder it, and that is fine. The honest workflow was always to treat model output as a draft that a human materially rewrites. That standard now happens to line up with the mark's behaviour. Teams that were doing a cosmetic pass to feel better about it should know the pass does not change anything.

Do not build a policy on a detector with published blind spots. Anthropic states the mark cannot distinguish text Claude wrote from text Claude heavily edited. Any HR or academic-integrity process built on that will produce confident wrong answers in both directions — the same trap as AI text detectors that miss styled writing.

Sources: Anthropic, TechCrunch.