Anthropic Claims it Can’t Track Individuals With New Watermarks in Texts

Anthropic has finally explained how its new text watermark works, after the plan set off a revolt among paying Claude users. The backlash surfaced first on an updated support page, then spilled onto X and Reddit, where some customers said they were cancelling. The loudest complaints came from people who use Claude to tidy up their own writing, and from developers worried about what this might do to generated code.

The trick is simple in theory and fiddly in practice. A language model often faces several words that would fit a sentence equally well, so one option is chosen at random. Anthropic says the watermark hijacks that moment. Instead of an arbitrary pick, the surrounding words and a secret key decide which synonym gets used. Over a longer stretch of text, those choices form a pattern that can later be checked against the key.

The company insists that this stays invisible in normal use. It says the model is not being pushed toward specific words all the time, and it is not inventing strange phrasing just to leave a trace. There are no hidden characters, no extra tokens, no added delay. Anthropic also says the method cannot be used to draw conclusions about a particular person, organisation or chat.

There are obvious limits. Where a sentence has only one correct form, the watermark has nowhere to hide. That is why code is a bad fit: the mark can mostly live in comments, not in the code itself. If someone only asks Claude to proofread a text, there may be too little model-authored wording left for detection to work. But translations should carry the mark well, because every word comes from the model.

Anthropic is using the EU AI Act as the public reason for doing this, alongside the transparency code it signed with around 190 other companies. But there is a second motive that is harder to ignore: if a model can recognise its own text on the open web, it can throw that text out of future training data. That matters because the web is already filling up with AI output, and models trained on too much of their own exhaust start to eat their own tail. The company has also announced a detection API, though it is not available yet, and it has not said what it will cost.