Anthropic won’t say exactly how it watermarks Claude’s text output, but a close read of two of its own web pages, combined with a 2026 research paper, points to a specific candidate technique — and it isn’t the kind of watermarking most people picture.

The company’s watermarking announcement lists six properties of the system: it’s embedded directly in the generated text, invisible to a reader, doesn’t change the meaning or quality of the output, gets applied at the model level, can still be detected after the text is edited, and can be verified by users and third parties. Separately, Anthropic’s transparency page was quietly updated on July 23rd to say it has “worked across industry and academia” on watermarking — a sentence that replaced language stating Anthropic did not offer any watermarking at all. That single change is a meaningful clue: it means the technology likely didn’t originate inside Anthropic, and companies that license watermarking from outside researchers are usually working with a university.

Two research candidates, one clear front-runner

There are two recent academic approaches worth comparing against Anthropic’s six-point description. The first, MCmark, is an “unbiased” watermarking method that embeds a hidden statistical signal during token generation while preserving the model’s original output distribution, so quality stays essentially unchanged. It’s detectable without access to the original prompt or model, and it survives some editing — a reasonable match, but not a perfect one. Under heavy paraphrasing, MCmark’s true-positive detection rate drops to roughly 11% at a 1% false-positive rate, and even under lighter GPT-based rephrasing it only reaches 48%. That weakness against paraphrasing keeps it from lining up cleanly with Anthropic’s claim of surviving edits.

The stronger match is MirrorMark, a 2026 paper from George Mason University. Its authors previously published StealthInk, a 2025 watermarking method that traded reliability for other advantages in short text sequences — a tradeoff MirrorMark appears designed to correct. MirrorMark also degrades under heavy paraphrasing, with true-positive rates falling to about 57.8% at a 1% false-positive rate, but it holds up meaningfully better than MCmark under the same kind of adversarial rewriting, even though the two papers didn’t use identical testing methods.

How MirrorMark actually inserts the watermark

Large language models don’t always pick the single most probable next word — there’s a built-in randomness to how they sample from likely candidates. MirrorMark works by mirroring that existing randomness rather than adding a separate, detectable layer on top of it. The process runs in three steps: a “mod-1 mirroring transformation” encodes a symbol by reflecting a value around a message-specific pivot; a Context-Anchored Balanced Scheduler (CABS) decides which symbol gets embedded at each generation step, tied to the surrounding context so the pattern is harder to break; and at detection time, CABS is replayed to recover the token-to-position assignments and reconstruct the hidden message. Because the watermark rides inside sampling randomness that was already part of how the model generates text, the output stays statistically indistinguishable from unwatermarked text.

Lined up against Anthropic’s six stated qualities, MirrorMark matches all of them. It’s embedded at the point of token generation, not added afterward. It’s distortion-free, meaning it doesn’t alter the token probability distribution, so a reader can’t perceive it. The paper explicitly states it “preserves natural linguistic diversity,” addressing the meaning-and-readability requirement. It operates at the model level, during generation rather than as a post-processing step. It’s built to survive copy-paste, deletion, insertion, substitution, and paraphrasing — the paper notes that even paraphrased text often “preserves underlying semantic and statistical patterns that still carry weak watermark signals,” which is enough for detection. And decoding is a defined, documented process: a text is flagged as watermarked when its score crosses a set threshold.

One more detail strengthens the case: all three MirrorMark researchers are affiliated with George Mason’s InvisibleID, an entity set up specifically to commercialize this kind of technology — exactly the licensing arrangement that would explain Anthropic’s newly worded transparency language.

Why this matters even without confirmation

Anthropic has not confirmed which method it uses, and it may end up being MCmark, MirrorMark, or something unpublished entirely. What the comparison does show is that AI text watermarking is moving past simple statistical patterns layered onto output, toward methods that manipulate the model’s own token-sampling randomness to hide a recoverable signal inside text that looks and reads exactly like ungenerated writing. That distinction matters for anyone evaluating AI content detection claims, since a watermark built this way is far harder to strip through casual editing than older detection approaches assumed. Anthropic’s broader move toward text marking connects directly to its EU AI Act compliance work, detailed in Anthropic’s plan to mark Claude text and files under the EU AI Act code, and to the practical question of what a watermark can actually prove, covered in what a Claude watermark can and can’t tell you about authorship. Anthropic has since disclosed further detail on the mechanism, which we break down in what Anthropic revealed about the watermark and how it can be defeated.