Anthropic will watermark Claude output at launch. The same guide shows how a rewrite erases it.

In an August 12 announcement, Anthropic said new Claude models would mark AI-generated content from launch, with embedded watermarks in generated text ^[1]. James Padolsey, founder of the AI risk measurement startup NOPE, has published an interactive guide explaining where that mark hides, how its owner detects it, and why a rewrite can make it disappear ^[2].

The scope matters for anyone shipping text. Anthropic says Claude models launched in the EU on or after August 2, 2026 will support machine-readable marking at launch, and that markings for supported models will apply wherever Claude is offered worldwide ^[3][4]. This is not a regional feature flag you can route around by calling a US endpoint.

The mechanism is worth understanding because it determines which of your pipeline steps break it. A text watermark of this kind needs no hidden characters, no formatting tricks and no metadata; it is introduced while the model picks each successive token ^[5]. Following the 2023 watermarking paper by John Kirchenbauer and co-authors, a secret key splits the plausible next tokens into groups, and generation gently favors one group, often called "green", without making the alternatives impossible ^[6]. One choice proves nothing, but across hundreds or thousands of tokens the favored group appears more often than chance, and a detector holding the same key can reconstruct the pattern and score it ^[7]. Because the coloring can depend on the words immediately preceding a token, the same word is green in one context and red in another, which defeats vocabulary-list guessing and lets ordinary prose carry the signal through copy and paste ^[8]. Google DeepMind's SynthID Text is more elaborate but works on the same principle, and Google has watermarked text in the Gemini app and web experience since 2024, later publishing a reference implementation on GitHub ^[9].

Padolsey's guide is unusually direct about where the signal fails, which is also the sales pitch for his rewriting tool, Declaude ^[10][11]. Evidence accumulates with length, so short answers, quotations, code and factual lists carry fewer opportunities for a reliable signal ^[12]. Light editing dilutes a mark but leaves enough original sequences that detection can recover across a longer document ^[13]. A full recomposition attacks the dependency between neighboring words: rebuild the prose from its meaning and the original token windows vanish, leaving the detector counting choices unrelated to the key pattern ^[14]. Declaude routes submitted text through other models and checks the output with an evaluation harness ^[15]. In tests cited in the guide against open KGW and EXP watermark implementations, the full-rewrite route left about 0.5% of original detector windows intact and pushed detection accuracy from near certainty to roughly chance ^[16], meaning roughly 99.5% of the windows were gone ^[17].

Do not read that as a Claude result. Anthropic has not published its production algorithm, key structure, thresholds or detector performance, and Padolsey flags that boundary himself: his numbers cover open implementations NOPE can test ^[18][19].

The operational consequence is a distinction most content workflows have never had to make. Copyedit an AI draft and provenance survives ^[13]; run it through a second model for tone or translation and, on the implementations that have been measured, provenance is gone ^[14][16]. That line now sits inside marketing, support macros, documentation and localisation, and nobody has priced what it costs to know which side of it a given artifact fell on.

Watch whether Anthropic publishes thresholds or detector performance, or gives customers a detector at all, since it has published none of that so far ^[18]. Watch whether anyone replicates the 0.5% figure against production Claude rather than open implementations ^[16][19]. And watch whether other vendors follow Google's route of shipping a reference implementation, which is what makes third-party measurement possible in the first place ^[9].