Claude Is Getting an LLM Watermark. But What Exactly Are We Trying to Detect?

This week, Anthropic’s announcement that supported Claude models will mark AI-generated content drew extensive coverage and discussion.

Much of that coverage went immediately to cheating. The Telegraph ran the headline AI cheating to be exposed by watermarks. TechCrunch focused on Claude users worried about being exposed at work and in class, while the New York Post similarly emphasized students.

But the more interesting question is not whether a watermark will catch someone using Claude. It is: What exactly are we trying to detect, and what do we hope to learn from detecting it?

That question is harder than it sounds.

First, what is an LLM watermark?

An LLM watermark is a machine-detectable signal embedded in text generated by a language model. Text watermarking can take different forms. One influential statistical approach was introduced by John Kirchenbauer and colleagues in their 2023 ICML paper, “A Watermark for Large Language Models.”

When a language model generates text, it repeatedly chooses the next token from a probability distribution. A watermarking system can subtly favor certain possible tokens according to a secret rule. Each choice looks ordinary, but over a sufficiently long passage those choices can accumulate into a detectable statistical signal.

The detector can then ask a hypothesis-testing question: If this text had not been produced by the watermarked model, how surprising would it be to observe this many favored tokens?

This is where statisticians have made particularly interesting contributions. Xiang Li, Feng Ruan, Huiyuan Wang, Qi Long, and Weijie Su developed a general statistical framework for LLM watermarks. Instead of asking only whether a watermark “works,” they formulate detection in terms of Type I error, Type II error, statistical power, pivotal statistics, and optimal detection rules.

The questions become:

• How often will we falsely declare human text to be watermarked?
• How often will we fail to detect genuinely watermarked text?
• How much text do we need before the signal becomes distinguishable from noise?
• How do paraphrasing and editing change statistical power?
• What is the most powerful detection rule under a particular threat model?

These are important research questions. But there is another question that statistics cannot answer for us: What does a positive detection actually mean?

Anthropic has not publicly specified enough technical detail to establish that Claude uses the particular token-biasing scheme described above; it says technical documentation on its detection mechanisms is forthcoming. The statistical framework is therefore a useful explanation of how text watermarking can work, not a description of Claude’s implementation.

What Anthropic announced

Anthropic says that models launched in the European Union on or after August 2, 2026, include marking at launch, while existing models will transition over time. For supported models, the marking applies worldwide rather than only in the EU.

For text, Anthropic describes a watermark woven into generated language that survives copying and pasting and may remain detectable after some editing. It also states the limitations clearly: a detected mark indicates that content may have been processed by Claude. A failed detection does not prove that Claude or another AI system was absent.

That wording matters. Suppose I write 1,500 words myself and ask Claude to polish the grammar without changing my ideas. Or I give Claude my own 30-page report and ask for a 500-word summary. Or I design an analysis, specify the variables and statistical model, and ask Claude to implement my design in code.

Claude has participated in all three processes. But “Claude participated” is very different from “Claude created the intellectual content.” A watermark provides evidence about a process, not ownership of the content.

The sore-throat problem

Imagine using a sore throat as a screening signal for an illness. It might be informative in a population where sore throats are rare and strongly associated with the condition. Among lecturers who speak for hours each day, the same symptom may be much less informative. Nothing about the observable signal changed; its relationship to the thing we care about did.

LLM watermarking may face a similar problem. In 2023, “Was AI involved in producing this?” was a relatively meaningful distinction. Generative AI was novel, and AI-generated text was often imagined as a separate category from human-generated text.

In 2026, AI is embedded in ordinary intellectual work. People use it to proofread, translate, summarize, code, calculate, search, reorganize, brainstorm, format, and draft. In my own work, AI may do much of the coding, computing, or drafting based on my designs, while I review, debug, challenge assumptions, revise, and sometimes start again. A single artifact may pass between a human and several AI systems many times before anyone sees it.

The more useful description is often not who “generated” the final product but the division of labor: what the human decided, what the AI executed, where judgment and verification remained essential, and who is accountable when something goes wrong. If a watermark detects that Claude touched a piece of work, the next question is: So what?

Why does the EU want this signal?

The motivation behind the policy becomes clearer when we return to the problem the rules are meant to address. Article 50 of the EU AI Act establishes transparency obligations for certain AI-generated and AI-manipulated content. The European Commission’s guidance frames the concern in terms of manipulation, deception, misinformation, fraud, impersonation, and consumer deception.

Generative AI makes realistic synthetic content extraordinarily cheap to produce at scale. Bad actors can exploit ambiguity about its origins: consider a fake recording of a political candidate or a fabricated photograph presented as documentary evidence. In these settings, provenance is valuable.

Article 50(2) therefore requires providers of systems that generate synthetic text, audio, images, or video to make their outputs machine-readable and detectable as artificially generated or manipulated, where technically feasible. The provision excludes systems performing only standard assistive editing or not substantially altering the input or its meaning. Article 50(4) separately addresses disclosure of certain public-interest text and recognizes human review, editorial control, and responsibility.

The regulatory concern is not simply “AI touched this.” It is closer to: Can people be deceived about the origin or authenticity of information? Those are not the same variable.

What can a Claude watermark tell us?

A detected Claude watermark can provide one useful piece of evidence: Claude was probably involved somewhere in the production process.

It cannot, by itself, tell us who developed the ideas, how much work Claude performed, whether Claude drafted or merely polished the text, whether a human reviewed it carefully, whether the evidence is valid, whether the calculations are correct, whether the author understands the submission, whether the content is original, or whether the result is reliable.

This is a fundamental distinction between provenance and epistemic quality. The C2PA explainer for content provenance makes the same point: provenance can provide evidence about a digital artifact’s origin and history, but it cannot by itself establish that the content is true, accurate, or factual.

This is not a cheating detector

The distinction matters particularly in higher education, where some coverage has framed watermarking as a new weapon against student cheating. That interpretation is tempting but unsafe. If an instructor detects a Claude watermark in a student’s paper, the result establishes little beyond Claude’s involvement in the process.

The student may have asked Claude to write the entire paper and submitted it unchanged. But the student may instead have written the paper and used Claude to improve the grammar, turn a dictated argument into readable prose, summarize paragraphs already written, or edit the work in a way the instructor expressly permitted. The watermark cannot distinguish among these cases.

More importantly, “Did this student use AI?” is increasingly the wrong educational question. Educators should ask what intellectual work the student was expected to do, which parts could appropriately be delegated, what evidence demonstrates understanding, which judgments must remain the student’s own, how AI output should be verified, and what responsible human–AI collaboration looks like in the discipline. Those are questions of assessment design and stated expectations, not detection alone.

Where watermarks may still help

Watermarks may be useful to model providers. Anthropic says it uses detection and monitoring to enforce its policies and builds classifiers and behavioral fingerprints to identify model-extraction campaigns. It has also described watermarking as a way for developers to certify that text came from a specific model, while emphasizing the technique’s limitations. These sources do not establish that provider-side auditing motivated the current rollout, but they do support it as a plausible use.

Watermarks may also be more valuable at the ecosystem level than as verdicts about individual artifacts. Daniel Susser, John Thickstun, and Gili Vidan make this argument in their 2026 paper, “From Forensics to Ecosystems: Rethinking Watermarks for Generative AI Oversight.” Even an imperfect signal could help researchers estimate how much synthetic content is circulating, where it is concentrated, how it spreads, and whether coordinated networks are producing it at scale.

This reframing does not require us to pretend that detecting AI involvement reveals who “really wrote” something. It treats watermarking as a tool for studying an information ecosystem rather than passing judgment on individual authorship.

More research is needed

Watermarking is no longer only a theoretical proposal. It is being openly built into deployed models, creating an opportunity—and a responsibility—to study how it works in practice. The question is shifting from whether AI involvement can be detected to when that detection is actually useful.

Technical research should continue to improve false-positive control, statistical power, uncertainty quantification, robustness to editing and adversarial attacks, and performance across languages, formats, and content types. But utility cannot be measured by detection accuracy alone. Researchers also need to examine how people interpret results and what decisions they make because of them.

The effects may be positive: watermarks could strengthen provenance, support disclosure, help identify coordinated synthetic-content campaigns, and reduce some forms of deception. They may also be harmful if a mark is treated as proof of cheating, low quality, or falsehood; if legitimate AI-assisted work is stigmatized; or if errors fall unevenly across users and contexts.

Deployment should therefore be treated as an ongoing empirical research program. Providers should document limitations, publish evidence about accuracy and robustness, study user behavior, and provide ways to contest consequential interpretations. The goal is not simply to make watermarks easier to detect, but to make them genuinely useful—and to identify the settings in which they should not be used.

Focus on what matters

A watermark does not detect cheating. It detects a signal consistent with a model’s involvement, not whether that involvement violated a rule or displaced the intellectual work a person was expected to do. The signal can still be useful—as evidence about provenance, for platform governance and security, or for ecosystem research—as long as we are clear about what it cannot establish. The presence of a mark does not prove misuse, and its absence cannot reliably rule out AI involvement.

The underlying research is interesting, especially as a statistical problem. But the harder challenge is building meaningful human–AI collaboration around the things that matter for any work: reliability, accountability, authenticity, and quality. Reliability asks whether the evidence, reasoning, calculations, and conclusions hold up. Accountability asks who stands behind the result and will correct it. Authenticity asks whether its origins are represented honestly. Quality asks whether the work meets the standards of its purpose and context.

A watermark may contribute one piece of evidence. Answering the questions that matter still requires clear expectations, human judgment, verification, and responsibility.

References and further reading

• Anthropic, “How Claude marks AI-generated content.”

• European Union, Artificial Intelligence Act, Article 50, and European Commission, “Guidelines on transparency obligations for providers and deployers of certain AI systems.”

• John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein (2023), “A Watermark for Large Language Models,” Proceedings of the 40th International Conference on Machine Learning.

• Xiang Li, Feng Ruan, Huiyuan Wang, Qi Long, and Weijie J. Su (2024), “A Statistical Framework of Watermarks for Large Language Models: Pivot, Detection Efficiency and Optimal Rules.”

• John Kirchenbauer et al. (2023), “On the Reliability of Watermarks for Large Language Models.”

• Daniel Susser, John Thickstun, and Gili Vidan (2026), “From Forensics to Ecosystems: Rethinking Watermarks for Generative AI Oversight.”

• Huy Phan et al. (2026), “A Survey on LLM Watermarking: Theory and Deployment.”

• C2PA, “C2PA and Content Credentials Explainer.”

• For additional coverage of Anthropic’s rollout, see Axios and TechCrunch.