Anthropic plans Claude text-watermark detection API

• Claude’s future text outputs will carry a global watermark, and says a detection API is planned but remains unspecified.
• The signal comes from keyed sampling among plausible next words, with no hidden characters, extra tokens, or user identifiers, as WesRoth's overview describes.
• A positive result will estimate Claude’s involvement, not prove authorship. elder_plinius's thread also flags the practical boundary: light edits may leave a signal, while a complete rewrite removes it.
• A GitHub project aimed at scrubbing provenance marks reached 10,000 stars within days, AiBreakfast's post reported, while its statistical-watermark path relies on rewriting text.

Anthropic’s technical FAQ says exact code and factual prose offer fewer interchangeable choices, so they carry a thinner signal. The method is a version of the approach described in Google DeepMind’s SynthID-Text paper.

The watermark is created during token selection. A secret key and preceding words supply the randomness that resolves a choice among outputs Claude already considers plausible; enough such choices form a statistical signature across a passage.

The mechanism leaves word choice readable and avoids attaching an explicit marker to the response. Anthropic says it also carries no information about the user, organization, or chat.

Anthropic says it will soon offer a detection API, but has not published the endpoint’s input requirements, confidence format, limits, or access model.

The proposed result is a likelihood that Claude partly wrote or processed a passage. It cannot identify a human author, prove that Claude originated the text, or detect another model’s separate watermark. Confidence increases with passage length.

The key remains private. In rasbt's reply, the researcher argued that reconstructing a token-dependent pattern would need a very large corpus plus model distributions, which Claude’s API no longer exposes.

Watermark density depends on how many low-stakes choices the model gets to make. Factual passages have fewer of those positions, and proofreading may change too few words for Claude’s contribution to register.

Code follows the same constraint: exact syntax and identifiers generally leave little room for alternate tokens. Comments can carry a mark because their phrasing admits more variation, according to the technical FAQ. A translation, by contrast, gives Claude control over every generated word.

Anthropic says light editing will probably preserve part of the signal, while replacing every word removes it. That boundary explains the mismatch between metadata scrubbing and text-watermark removal: one deletes a container field; the other has to alter the carrier text.

The watermarks-remover repository separates its work into three layers:

• Layer A: deterministic removal of invisible Unicode, exotic spaces, bidi characters, and tags.
• Layer B: an optional agent rewrite hook for statistical text watermarks.
• Files: cleaners for C2PA, EXIF, XMP, and document properties.

Its own documentation frames Layer B as best-effort and warns that no tool can certify failure against an official detector. The project’s popularity moved quickly: kimmonismus's screenshot put it at roughly 11,000 GitHub stars shortly after the announcement.

Claude uses a separate provenance mechanism for supported files including PNG, JPG, and SVG. It adds a small cryptographically signed C2PA content credential saying the file was made or processed with Claude, the Anthropic FAQ says.

Any C2PA-aware tool can read that metadata, and Anthropic says it will provide its own file checker. The credential records Claude involvement without user or organization identity, which makes it a distinct artifact from the keyed statistical signal in text.