Anthropic began watermarking Claude's text output globally on 2 August, with no opt-out. The mechanism is worth understanding, because most of the argument about it turns on a technical detail that is rarely explained.
How the mark is made
A large language model generates text one token at a time, choosing each from a probability distribution over its vocabulary.
Watermarking works by biasing that selection, nudging the model's choice among statistically near-equivalent next tokens according to a secret key, so the resulting distribution carries a detectable signature over a long enough passage.
The vocabulary is partitioned into "green" and "red" tokens using a pseudorandom hash seeded by the preceding context, and sampling is tilted slightly towards the green ones.
The bias is small enough to be invisible and large enough to be measurable in aggregate.
That is why two apparently contradictory claims are both true.
Quality is unaffected because the competing choices really are near-equivalent, and short passages carry no reliable signal because there are not enough decisions to accumulate statistical confidence.
Why it is not metadata
The mark is not attached to the file, it is part of the text, so it survives copying and pasting and may persist through some editing.
Retyping into a content management system will not remove it.
Substantial paraphrasing will, because rewriting destroys the distribution the watermark depends on.
Images are handled differently, using signed provenance metadata under the C2PA standard, which can be stripped by format conversion, re-saving, or a screenshot.
The authorship problem
This is the objection with the most substance behind it.
If a person writes a document and asks Claude to restructure the prose, the text is regenerated token by token and can carry the mark even though every idea is the human's.
Anthropic states the point plainly, that Claude may not be the original author.
A watermark records that text passed through a model, not who thought of it.
Any process that treats the mark as proof of authorship is misreading what it measures.
Coders have raised a separate complaint, arguing that biased token selection could degrade generated code or create problems downstream in a software pipeline.
What cannot currently be checked
Anthropic has not published the hash function, the green-list fraction, the strength of the sampling bias, or the key rotation policy, and no public verification endpoint for text has been reported.
Without those, no independent party can build a detector.
That has two consequences that pull in opposite directions.
Outside parties cannot use the watermark to audit documents, scan code repositories for generated material, or build intellectual property claims on it.
But the capability sits entirely with whoever holds the key, and its scope is limited by policy rather than by technology.
The regulatory framing
The policy is driven by Article 50 of the EU AI Act, which mandates transparency for AI outputs and took effect this month.
The law does not require worldwide application to every output.
The statute concedes its own limits, with an "as far as technically feasible" clause and a carve-out for very short content.
Applying the mark globally and universally is therefore a choice, and a defensible one.
Users are entitled to know it was a choice.
