Anthropic is labelling AI-generated text. The era of copy-and-paste is coming to an end

Anthropic will apply a watermark to text generated by its artificial intelligence models in order to comply with European regulations.

The company has confirmed the adoption of this measure on an official page. The European AI Act, with Article 50 coming into force on 2 August, requires companies in the sector to label content generated or modified by AI in such a way that other systems can identify it. The watermark would not be a label hidden within the file, but a small statistical imprint embedded directly in the way the model selects words. For this reason, at least in theory, it survives copy-and-paste operations.

Let’s start from the beginning: an LLM doesn’t write a sentence all at once. It proceeds one token at a time, like someone crossing a stream by hopping from one stone to the next. In practice, the model operates on a probabilistic basis, assigning a statistical value to words and then constructing the sentence. In essence, it intervenes at the level of word choice; it does not use the word it would have selected without the ‘watermark’. The watermark, therefore, is not a digital element or metadata, but must be detected at the token level. In the literature, there are several text-based methods, but the basic logic is to prompt the model to choose words that serve as ‘evidence’ of the generated text. What makes this system complex is that there is no dictionary of the terms used by the AI. The system recalculates every term, so the signature is based on the statistical selection of tokens. The detector, knowing the key and algorithm, reconstructs which tokens were favoured. If many more of these appear in the text than expected, the watermark becomes statistically visible. Google, with SynthID-Text, uses a more sophisticated mechanism: multiple candidate tokens are placed in a sort of tournament. The model’s normal probabilities are combined with pseudo-random scores linked to the key and context. One candidate wins. Repeated hundreds of times, this micro-preference leaves a trace. It is like a slightly rigged coin. It takes many tosses to realise if there is anything suspicious. The real challenge, therefore, is not to find invisible writing in the document. It is to recognise a statistical fingerprint left as the text is created.

It works best with long, conversational texts. It performs less well with code, formulae, quotations, numbers and short answers, where the model has less freedom. Translations, paraphrases and extensive rewrites can also weaken or eliminate the signal. Then there is the problem of false positives. As Anthropic writes, ‘the absence of a distinctive marker does not mean that the content was not generated or processed by AI’. Content generated by Claude may not display a detectable distinctive marker if, for example, it was generated by a model released before support for labelling was implemented. As stipulated in Article 50 of the AI Act, there will be a transitional period to bring output labelling into compliance by 2 December 2026. To date, therefore, the application of watermarks will cover various products, including the Claude platform’s APIs, Claude, Claude Code, Claude Cowork and Claude Tag. By the end of the year, it will also be extended to Opus 5 and Sonnet 5. Another instance where the watermark may not be detected is if ‘a file’s metadata has been removed through format conversion, repeated saving, screenshots or other means’. And if ‘it was produced via a platform, feature or file type where a particular type of marking was not supported’.

The system adopted by Anthropic uses the open standard C2PA. As well as text, it also supports images; Anthropic will also sign files such as SVG, PNG or JPEG.