That random number is the part watermarking replaces. The model instead derives it from a key and the few words immediately preceding, so the key and that run-up together settle which candidate arrives. Someone with the key can then check the finished sequence against what it would have produced. But to a reader the choice is still random. The model is not left generally biased toward overcast or toward grey either, since which one turns up still depends on the words that came before.

The other example is a sentence with nothing spare in it: “Isaac Newton’s most famous work was called Principia…”. Mathematica is the only right answer. Nothing there is free for the watermark to act on. How much watermark a passage carries comes down to two things: how many of the words Claude picked, and how free each of those picks was. The more of both, the more there is to find.

Text with only one right answer

The watermark runs sparser through factual passages, where accuracy leaves fewer choices free. What makes a given choice constrained is the surrounding context. Once the model has written “2 + 2 =”, there is no answer equally as good as 4 if it is completing the sum, and none equally as good as 5 if the subject is George Orwell’s Nineteen Eighty-Four. The nudge of the watermark is not applied in either case.

Code has to be exact most of the time, so it sits at that end of the range: where a different term would make the output factually wrong or break the code, the watermark is not applied, and code carries generally less of it than other kinds of text. But what stays open is the prose inside a file: “in areas where there is an arbitrary choice between particular words or terms within the code, the watermark can be used, such as comments within code.” Whatever lands there barely changes the code.

Words Claude chose

The other condition is a count. “The watermark only applies to words Claude chooses.” Detection also works poorly on small samples, because there are fewer word choices in them to read, and a paragraph offers more places for the pattern to show up than a sentence does.

Hand Claude a finished piece of writing and ask it to fix grammar and punctuation and nothing else, and the corrections are all it has to work with, which may be too few to register. How much registers, though, depends on how heavy the edit was and on how long the text is, because the more Claude writes, the more decisions it makes, and the more room there is for a mark.

Translation runs the other way, and it separates the two conditions. The source text fixes what the output has to mean while leaving open which words carry that meaning, and there are usually several that would, so every word in the output ends up being one Claude picked. That is why a translation carries a watermark.

Someone wanting the mark gone has to take the words back. “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.” But by then it is arguable whether the text can be described as AI-generated at all.

What it does not change

Nothing is added to the text and there are no hidden characters. No extra tokens are produced, so the model costs the same to serve and to use. The impact on model speed is negligible. Nothing in the mark or its key identifies a person, an organization, or a chat.

On output quality Anthropic says it saw “no impact of watermarking on the content, level of creativity, or readability of Claude’s text” in internal testing. The method is older than this announcement: it is a version of SynthID-Text, published by Google DeepMind in Nature in 2024, and part of a family going back to a proposal by Scott Aaronson in 2022. That paper puts the change in the same place: a method that “does not affect LLM training and modifies only the sampling procedure”. On standard benchmarks and in human side-by-side ratings the paper reports no change in the models’ capabilities. The authors also ran the watermark live on Gemini and gathered feedback on nearly 20 million responses. They read that as confirming text quality held up.

What a result would say

A long piece of prose Claude wrote from a short instruction runs high on both counts. A source file runs low on freedom, a light proofread runs low on the count, and both come out thin. But between them sits the wide middle where most real documents land. A draft you sketched and Claude filled out, or a Claude draft you rewrote half of, is the ordinary case, and it is the case a check says least about: a watermark “can only determine that Claude was likely involved with the content at some point”, and it cannot tell “Claude wrote this” from “Claude heavily edited this.”

Nobody outside Anthropic can run that check today. Anthropic says it will offer a detection API soon and is still working out how to implement it. Models launched before 2 August 2026 fall under a transition period in the EU law. Anthropic says watermarking will be added to them over the coming months. Until the API ships nobody can answer that question about a specific document, whether it is one you received or one Claude wrote for you.

The above is Anthropic’s own account of a method I have no way to test from outside, read alongside the SynthID-Text paper it points to. Both pages were read on 25 August 2026. The part I would want from the detection API, when it arrives, is what it says about a document a person and a model wrote together, because that is where most working documents sit and where this method is thinnest by its own account.

TL;DR： 未來的 Claude 模型產生的文字會帶浮水印，不過讀起來不會有差別：沒有加字、沒有隱藏字元，不多花 token 也不變貴，而且查不到是誰用的。能查出來的只有一件事，那就是 Claude 大概參與過這段文字。

浮水印的做法

文字浮水印所改變的，就是亂數的來源。不再拿一般的亂數產生器來挑下一個字，改成用一把鑰匙、加上前面幾個字，算出最後要挑哪一個。挑出來的字對使用者來說看起來還是隨機的，有的句子用了 overcast，下一句就換成 grey，端看前面接了什麼；差別在於，手上有同一把鑰匙的人回頭看整段文字，可以算出整串字有多像是照那把鑰匙挑出來的，然後給出一個機率。這套方法出自 SynthID-Text，Google DeepMind 在 2024 年的 Nature 論文上發表，再往前可以追到 Scott Aaronson 2022 年的提案，這類方法的共同點就是只換掉挑字用的亂數來源。

浮水印沒有把任何東西加進文字裡，也沒有隱藏字元，讀的人分不出來差別。速度上的影響完全可以忽略；因為沒有多產出任何 token，服務和使用的價格也跟以前一樣。Anthropic 的內部測試中沒有看到內容、創意或可讀性上的任何影響。

適用和不適用的地方

浮水印只跟著 Claude 自己挑的字。所以同一段文字裡，模型在哪個位置愈沒得選，就越不適合使用。

牛頓有一本書叫 Principia，後面接的只能是 Mathematica，換成別的字就是錯的，浮水印在這裡沒有東西可以動。2 + 2 = 之後也一樣，算數學時沒有別的答案跟 4 一樣好；但如果講的是歐威爾的《一九八四》，也沒有別的答案能跟 5 一樣好。

程式碼多半也屬於這一類。要求精確的地方沒有選擇可言，換個名字就跑不動，所以程式碼裡的浮水印通常比其他形式的文字少。真的有得用的地方可能是註解，因為這對跑出來的程式本身影響可以忽略，描述上人類或 AI 也看得懂。

翻譯剛好相反，整篇文章、整個段落每個字都是 Claude 輸出的。校稿那邊相對也較少：把一篇人寫的東西交給 Claude，如果只改文法跟標點、其他都不動，輸出的字幾乎都還是原作者的，能產生浮水印的地方就只剩那幾處改動，甚至有可能少到量不出來。

查詢範圍

如果拿鑰匙去計算，得到的答案會是：這段文字有多大機率跟 Claude 有關。這個方式不能證明某段文字是否是人寫的，也認不出別家 AI，畢竟別家用的是不同把鑰匙，方法可能也不一樣，當然別家也不能知道是否是 Claude寫的。如果輸入樣本太短的時候也不行，選擇少，能拿來計算比對的資訊就不夠，文章愈長把握才愈高。至於是否是編輯過或是完全是 Claude 寫的，浮水印分不出「Claude 寫的」和「Claude 大幅編輯過的」。關於隱私的部分，Anthropic 說這是無法知道原本使用者的，浮水印和鑰匙裡都沒有能還原使用者、組織或對話的資訊。

值得注意的是，這跟市面上那些看文風抓 AI 的偵測軟體不一樣。那類服務偵測的是文字本身露出來的文字破綻。像是AI 模型特別偏愛 this isn’t [X], it’s [Y] 這種句型，或是常見的連續破折號，另外也有 quietly 出現的頻率也比預期高這種。

不過呢現在還無法驗出。浮水印偵測 API 也是以後才會提供；這個公告說的日期八月二號之前推出的舊模型還在過渡期，因此浮水印的工作會分幾個月陸續推出。

如果使用者很在意的話，改寫倒是有辦法解決，輕微修改可能只會有少量改變，但如果文章整篇每個字都換過的話就可以改變，但如果每個字都換的話，可能要想想如何適合的導入 AI 寫文章了。但是上面說的改到那個地步之後，這段文字到底還算不算 AI 生成的呢，Anthropic 說這件事可以爭論。

額外說明檔案上的做法

Claude 產出 png 、 jpg 、 svg 這類的圖檔時，會在 metadata 裡附一張加密簽章過的小紙條，說明檔案是 Claude 製作或處理過的，用 C2PA 相機廠和修圖軟體都在用的公開標準。但不像是文字，檔案本身是沒有被改動。

歐盟規定

Anthropic 連同其他幾家主要的模型供應商，在 2026 年 7 月簽了 EU Code of Practice on Transparency of AI-Generated Content。而歐盟的要求是從八月二號起算：在歐盟市場提供服務的 AI 供應商，都必須標記 AI 生成的內容。其他開發商也會著手做自己的浮水印。

浮水印一開始就是全球適用。Anthropic 說目前還沒有穩定的辦法可以按地區劃分，之後他們會繼續評估別的做法，有進展再隨時更新。

這篇文章主要是照著 Anthropic text watermark 這篇 news 寫的，大家在意的偵測 API 目前還沒開放，也沒辦法自己檢驗確認。在這個大量 AI 產出文章的新時代裡，身為提供內容的人更要去思考該如何與 AI 共存，才能持續寫出真的有意義以及自己風格的文章。

資料來源

• How Claude’s text watermark works（Anthropic，2026-08-14）