Watermarking arrives in text: how AI learned to sign its own writing

Anthropic published a blog post on 14 August to answer the questions its own announcement had raised days earlier: every text generated by Claude now carries an invisible watermark. The backlash was immediate. On Reddit, one poster called it a conspiracy against ordinary users; another replied that the only reason to object was a wish to deceive. Business Insider reported dozens of users on X claiming to have cancelled their subscriptions. The measure is not a corporate whim. It implements the code of practice attached to the European Union's AI Act, whose transparency obligations came into force on 2 August and whose penalties reach 15 million euros or 3 percent of worldwide turnover.

Loaded dice instead of chance

The technique is SynthID-Text, and it comes from a direct competitor: Google DeepMind designed it, published it in Nature in late 2024, and built it on an idea the researcher Scott Aaronson floated in 2022. It works inside the act of writing itself. Whenever a model picks the next word, it chooses among several equally plausible candidates — 'overcast' or 'grey' for a sky — and that choice carries an element of randomness. The watermark replaces that randomness with a sequence derived from a secret key. Anthropic offers its own analogy: a game of Monopoly in which the dice are replaced by the decimals of pi. The moves stay unpredictable to the players, but anyone holding the key can verify afterwards that the game bears the signature.

Watermarking does not impact the quality of Claude's output. To a reader, a watermarked response is indistinguishable from an unwatermarked one.

The company's own mapping of what does and does not get marked is the most practically useful part of the post. A translation comes out watermarked, since every word is still chosen by the model. A light proofread of your own prose leaves little or nothing behind: if nearly all the words remain yours, there is almost nothing for the mark to attach to. Code is marked poorly, because working software rarely offers several equally valid phrasings; the signal falls back onto comments, with what Anthropic calls a negligible effect on the code itself. As for removal, the company concedes that a complete rewrite, word by word, erases the mark — while arguing that at that point, calling the text AI-generated becomes debatable in the first place.

What the mark does not say

Three limits deserve to be stated plainly, because they determine what the tool is worth in practice. Detection is collective: it reveals that a model was involved, never which account or which person. The absence of a mark proves nothing, since short or heavily edited text dilutes the signal until it disappears. And the rollout is global rather than European — Anthropic acknowledges it has no reliable way to confine the system to the jurisdiction that demanded it.

The industry's track record argues for caution. OpenAI launched its own text classifier in January 2023 and pulled it six months later: it correctly identified 26 percent of AI-generated text while falsely accusing humans 9 percent of the time. The two commercial references in the field, GPTZero and Pangram, hunt for stylistic tells instead — Anthropic itself cites the 'this isn't X, it's Y' construction among its model's habits. Those false positives fall hardest on people writing English as a second language. Watermarking belongs to a different category: where a detector guesses after the fact, the mark is applied at the source and checked with a key. DeepMind says it ran SynthID across nearly twenty million Gemini responses without measurable loss of user satisfaction — a figure that comes from the method's own authors, and should be read as such.

Google, meanwhile, is removing its visible marks

The opposite move came from Google in the same week. Users can now switch off the visible watermark — the sparkle in the corner of images, videos and music produced by its Nano Banana and Omni models — through a new 'Media watermark' setting in Gemini and in Flow, the company's video generator. Josh Woodward, vice president of Google Labs, Gemini and AI Studio, stressed that invisible SynthID marks and C2PA metadata remain embedded, so a user can still ask Gemini or Search whether a file was machine-made. The toggle will not ship in countries that require a visible watermark.

The reasoning is blunt: many users were already editing the sparkle out by hand, and the main competitors never applied one. OpenAI relies on SynthID and C2PA; Meta launched its own Content Seal standard. A visible mark that only the compliant kept was no longer a signal — merely a handicap.

• Marked: text from Claude models released since 2 August, translations included.
• Barely marked: light editing of your own writing, and source code outside comments.
• Erased: by a complete, word-by-word rewrite of the generated text.
• Invisible but present: at Google, SynthID and C2PA survive even when the sparkle is gone.

What it changes for companies

For any organisation producing AI-assisted content, the consequence is concrete. Disclosure is no longer the user's decision: it is applied at the source, by the provider, under a European legal obligation. Anthropic notes that other major developers who signed the same code of practice will roll out their own watermarks. The question will soon stop being whether a text is marked, and become who holds the key to check it — and what that check will be allowed to prove in front of an employer, an examination board or a court. Anthropic has promised a detection API; the whole arrangement should be judged on its accuracy, not on its announcements.