Claude’s new text watermark can tell us something useful about where a piece of text came from. It cannot tell us who did the thinking, who should be considered the author, or whether using AI was appropriate.
That distinction is easy to lose.
Since Anthropic announced the watermark, I’ve had several conversations with colleagues and friends about the same questions: How do you watermark plain text? Will it make Claude’s output worse? And if someone can edit the text afterward, will the watermark be useful at all?
I went back through Anthropic’s explanation, Google DeepMind’s SynthID-Text research (the original paper that described the technique), and the “Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models.” paper on the limits of strong watermarking.
My view after reading them is fairly simple: the mechanism is clever, the quality concerns are probably overstated, and the interpretation problem matters more than the watermark itself, especially in higher education.
The first thing to understand is that the watermark isn’t added to the finished paragraph.
There are no hidden characters or special punctuation. For plain text, there’s no metadata attached to the words. Anthropic is changing how Claude chooses tokens while it generates them.
Large language models produce text one token at a time. Suppose Claude has started a sentence with:
“After the storm passed, the streets were…”
Depending on the surrounding text, several next words might work: “quiet,” “empty,” “glistening,” “still.” The model assigns probabilities to possible next tokens and samples from that distribution.
Compare that with:
“The capital of Japan is…”
There’s very little room for variation if the answer is going to be correct.
That difference gives watermarking room to operate. When several choices are reasonable, the sampling process can influence which acceptable token gets selected without noticeably changing the response.
Anthropic says its approach is based on Google DeepMind’s SynthID-Text, published in Nature in 2024. SynthID changes the sampling process rather than retraining the underlying model.
The technique uses a secret watermarking key together with recent context to influence token selection. One choice tells us almost nothing. Over hundreds of choices, though, a statistical pattern begins to accumulate.
A musical analogy helped me understand it.
Imagine a pianist improvising. At many points, several next notes would sound perfectly natural. Now imagine that a private set of instructions subtly influences which acceptable note the pianist chooses. The piece still sounds normal, but someone who knows those instructions can later examine enough of the choices and look for the pattern.
SynthID’s implementation is more sophisticated than that analogy. It uses Tournament sampling, where candidate tokens are drawn from the model’s probability distribution and then selected through pseudorandom scoring functions tied to the watermarking key and recent context.
The practical result is that the generated text carries a statistical signal that someone with the appropriate key can later test for, without rerunning the underlying LLM.
That makes watermarking quite different from conventional AI-writing detectors. Those tools try to infer whether text looks like AI-generated writing. A watermark detector looks for a signal deliberately introduced during generation.
There’s one practical limitation today: Anthropic says a detection API is coming, but it isn’t available yet. Institutions shouldn’t read the announcement as meaning there is already an official Claude detector they can use on student work.
There’s also a separate mechanism for files. Anthropic is using C2PA content credentials for supported file types such as images, where provenance information can be stored in cryptographically signed metadata. That is different from the statistical watermark embedded in generated text.
This was my first concern, and the evidence so far is reassuring.
A badly designed watermark could clearly hurt quality. If the system had to choose an inferior word simply because that word strengthened the watermark, the writing would suffer.
But SynthID can operate in what its researchers call a non-distortionary configuration.
Google tested that version at production scale across nearly 20 million watermarked and unwatermarked Gemini responses. The differences in thumbs-up and thumbs-down feedback were not statistically significant.
The researchers also ran a separate controlled study using Gemma 7B-IT responses to 3,000 ELI5 questions. Human raters compared watermarked and unwatermarked answers on grammaticality/coherence, relevance, correctness, helpfulness, and overall quality. Again, they found no statistically significant preference for either version.
Automated benchmarks told the same story.
The intuition is straightforward. If “lengthy,” “extended,” and “long” are all good continuations in a particular sentence, influencing which one gets selected doesn’t necessarily make the sentence worse.
There is still a trade-off. SynthID can be configured more aggressively to strengthen detectability, and the paper explicitly describes a distortionary configuration that trades some quality for a stronger signal.
So I wouldn’t say watermarking has no effect on quality. The more defensible conclusion is that Google has shown, at meaningful scale, that a non-distortionary watermark can preserve quality while still producing detectable evidence.
Watermarking needs choices.
If Claude is writing open-ended prose and has several equally reasonable ways to continue, there are plenty of opportunities to encode a signal. If it is answering a highly constrained factual question, producing code, or making a handful of grammar corrections, there may be far fewer.
The SynthID paper describes this in terms of entropy. Higher-entropy generation gives the watermark more room to operate; low-entropy generation gives it less.
Length matters for the same reason. A long passage gives the detector many token choices to evaluate. A short response may not provide enough evidence for a confident judgment.
That already tells us why watermarking shouldn’t be treated as a binary “AI or human” test.
A positive Claude watermark would indicate that Claude was probably involved in generating or substantially processing the text. It would not identify the person who used Claude, establish ownership, or determine whether the use complied with a policy. Anthropic also says the watermark contains no identifying information tied to a person, organization, or conversation.
A negative result has just as many limitations. Short text may not contain enough evidence. Light proofreading may leave too little Claude-generated language. Older Claude models are still being retrofitted. Another provider may have generated the text. An open model may not watermark at all.
And editing can weaken the signal.
All of that matters, but for higher education, there is a more important interpretation problem.
Consider two students.
One writes an essay entirely in English, then asks Claude to clean up grammar and punctuation. Most of the wording remains theirs, so there may be relatively little watermark evidence.
Another student writes an essay entirely on their own in Spanish, Mandarin, Arabic, French, or another language, then asks Claude to translate it into English.
Anthropic says translations are watermarked because Claude is choosing every word in the translated output.
The second paper could therefore carry a much stronger watermark even though the student supplied the argument, evidence, organization, reasoning, and original prose.
Now reverse the scenario.
A student spends an hour with Claude brainstorming ideas, comparing arguments, testing counterarguments, and developing an outline. Then the student closes Claude and writes the final essay independently.
AI may have played a substantial role in shaping the thinking, yet the final text may contain no Claude watermark at all.
The watermark measures Claude’s involvement in producing the final language. It does not measure Claude’s contribution to the underlying intellectual work.
That distinction matters for academic integrity, multilingual learners, accessibility tools, writing support, and authorship.
A strong watermark is not evidence that a student outsourced the assignment. A weak watermark isn’t evidence that AI played only a minor role. No watermark doesn’t establish that AI wasn’t used.
The relevant question is still the policy question: What kind of AI assistance was allowed for this assignment, and what work was the student expected to do?
Watermark evidence could contribute to that inquiry. It cannot answer it by itself.
False positives also deserve attention when the consequence might be a misconduct allegation. Watermarks in the Sand makes this point explicitly in the education context: when professors apply a detector across hundreds or thousands of submissions, even a low false-positive rate can result in students being incorrectly accused.
For high-stakes academic decisions, a statistical signal should be evidence to examine, not a verdict.
Yes, although the answer is more nuanced than “just change a few words.”
Anthropic says light editing probably won’t remove the watermark completely. A full rewrite that replaces every word can remove the signal. Anthropic then makes a useful observation: if every word has been rewritten, it becomes debatable whether the resulting text should still be described as AI-generated.
That gets to the heart of the problem.
The paper Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models examines whether a watermark could survive a determined attacker who wants to remove it without sacrificing output quality.
Its result is pessimistic. Under the paper’s assumptions, strong watermarking is impossible even when the detection key is secret.
The intuition is easier to understand than the proof.
Suppose you ask a model to write an 800-word argument for expanding public transportation. There are countless good answers to that prompt.
If the first essay is watermarked, someone trying to remove the watermark doesn’t need the same essay with different words. They only need another essay of comparable quality that answers the same prompt.
The paper models an attacker making small modifications and keeping only those that preserve quality. Over time, that process moves the response through a large space of acceptable outputs and away from the particular choices that carried the original watermark.
The researchers tested the approach against three language-model watermarking schemes: KGW, EXP, and Unigram. Their attack substantially reduced detectability while measured quality remained relatively stable.
There’s a fundamental tension here. A watermark needs the model to have multiple good ways to say something so it can encode a signal without hurting quality. But those same alternatives give a motivated person room to move away from the signal.
That doesn’t make watermarking useless. Weak watermarks can still help with provenance, identifying substantially unmodified synthetic content at scale, and reducing accidental contamination of training datasets. The authors of Watermarks in the Sand make essentially that point themselves.
What they cannot give us is permanent, tamper-proof proof of AI involvement.
One ecosystem point is worth keeping in mind. Anthropic isn’t acting alone: other major AI developers have signed the EU Code of Practice on Transparency of AI-Generated Content and are expected to implement their own marking approaches. That means the gap between large commercial providers may narrow over time, even if their methods and detection keys differ. The harder gap is open models, where centralized enforcement is much more difficult. Anthropic is also applying watermarking globally at launch because it does not yet have a durable way to scope the feature by region, so institutions should treat the current rollout as subject to change.
After going through the research, quality is the part I’m least worried about. There’s credible evidence that this kind of watermark can operate without noticeably degrading normal text generation.
I also think the watermark will be useful. A provider-controlled statistical signal is a stronger basis for provenance than trying to guess whether prose “sounds like AI.”
Where I’m more cautious is interpretation, especially in education.
Watermarking tells us something about the production history of the words in front of us. That is valuable information. But it doesn’t tell us who developed the ideas, how AI was used along the way, or whether that use was appropriate.
For higher education, the question shouldn’t be “Can we finally detect AI-generated assignments?”
A better question is: What can this new provenance signal legitimately tell us, and what decisions are we willing to make based on it?
That is a narrower question, but I think it is the one that matters.
Anthropic. “How Claude’s Text Watermark Works.” August 14, 2026.
Dathathri, S., See, A., Ghaisas, S., Huang, P.-S., McAdam, R., Welbl, J., et al. “Scalable Watermarking for Identifying Large Language Model Outputs.” Nature, Vol. 634, October 24, 2024. DOI: 10.1038/s41586-024-08025-4.
Zhang, H., Edelman, B. L., Francati, D., Venturi, D., Ateniese, G., & Barak, B. “Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models.” Proceedings of the 41st International Conference on Machine Learning, 2024; updated arXiv version, May 2025.
Raschka, Sebastian. “How Claude’s Text Watermarking Works.” 2026 YouTube video.
Originally posted by Alpha Hamadou Ibrahim on LinkedIn. Be sure to follow him there to catch all his great industry insights.
Share Article:
© Copyright 2026, The Tambellini Group. All Rights Reserved.
Get exclusive access to higher education analysts, rich research, premium publications, and advisory services.
