最新 Anthropic Claude 模型内置 AI 文本水印：技术原理、行业影响与合规动向
英文标题：🔶 The Latest Anthropic Claude Models Contain AI Text Watermarks
为满足《欧盟人工智能法案》及加州相关法规的合规要求，Anthropic 宣布在其最新的全系 Claude 模型输出中全面集成 AI 文本水印，涵盖 Web 端、Claude Code 及 API 等所有调用途径。该技术采用基于 Google DeepMind 开源的 SynthID-Text 隐写采样算法，在模型选择近义词时引入伪随机扰动来嵌入不可见标识，既不增加 Token 消耗，也保证了生成质量与用户匿名性。随着 OpenAI（textGrain 技术）与 Google 等厂商协同推进，AI 水印正迅速成为防范深度伪造与确认内容真实性的全行业技术标配。
28.5 KB
10.8 KB
8.7 KB
3.3 KB
2.0 KB
321.1 KB
中文
如果你是 O’Reilly 线上培训平台的讲师，就必须随时做好应对突发状况的准备。作为开发者，我们都很清楚那种情况：某个在自己电脑上测试过一千次的 Demo，偏偏在面向现场观众演示时轻易就莫名其妙地崩了。我们都经历过这种场面。当然，任何课程中最大的不可控因素当属实时问答（Q&A）环节，因为我们一直积极鼓励学员提出他们脑海中浮现的任何问题。
在 Anthropic 宣布将为其最新模型生成的所有文本输出添加 AI 水印后不久，我在一门完全不相关的 Claude Agent 课程的 Q&A 环节中被各种提问淹没了。提问区里的几乎每个人都想了解 AI 水印究竟是如何运作的，以及这会对他们产生什么影响。
鉴于大家对此的高度关注，我借此机会来帮大家解释一下：AI 水印对你而言究竟意味着什么。
Anthropic 官方究竟宣布了什么？
我不想歪曲任何人的意思，因此直接逐字引用 Anthropic 在 2026 年 8 月的官方公告：
未来的 Claude 模型生成的文本将包含水印。这是确定 Claude 是否参与文本撰写的一种方法。我们正与多家主要 AI 提供商一起落实这一改动，以遵守《欧盟人工智能法案》（EU AI Act）。
以下是该公告中的另一段引述：
水印并不是 Claude 独有的。自 8 月 2 日起，欧盟要求面向该市场提供服务的 AI 提供商必须标记 AI 生成的内容。其他主要模型开发者也签署了同一份《实践守则》（Code of Practice），并将实施他们自己的水印机制。
（截至本文撰写时）在其生成的所有输出中包含 AI 文本水印的 Claude 模型列表如下：
- Claude Mythos 5.1
- Claude Fable 5.1
- Claude Fable 5
- Claude Opus 5.5
- Claude Opus 5
- Claude Opus 4.8
- Claude Sonnet 5.5
- Claude Sonnet 5
- Claude Haiku 5.5
无论你使用的是 Claude Desktop、Claude Code 还是 API，结果都没有区别，因为 Claude 的所有输出都会包含 AI 水印。因此，你使用 Claude 编写的任何代码、电子邮件、博客、文章、新闻通讯或白皮书都将带有水印，任何拥有 AI 水印检测器的人都可以轻松识别该内容是否由 AI 生成。
密码学（Cryptography）与隐写术（Steganography）有何区别？
现在我们来谈谈与 AI 水印密切相关的两个术语：密码学（cryptography）和隐写术（steganography）。密码学是你每天在访问 HTTPS 而非 HTTP 网站时都会遇到的技术。你的 Web 浏览器会自动为你处理加密和解密，其核心作用是让你发送或接收的任何内容在没有解密密钥的情况下变得无法辨识。因此，你可以在注册 O’Reilly 订阅时安全地输入信用卡号，因为我们（正如互联网上其他主流网站一样）在网站上使用 HTTPS，以确保外界无法获取你的信用卡信息。所以，哪怕有居心不良的人截获了你在 HTTPS 连接中传输的内容，其内容也是经过加密且毫无意义的乱码。
隐写术则完全不同，而它正是 Claude AI 水印技术所采用的技术。隐写术是将信息隐藏在特定的合适位置，让知道去哪里寻找的人可以发现它。隐写术并不是密码学，因为消息本身的全部内容都在明处。然而，你必须更深入地观察消息本身，才能找出被隐藏或遮盖的内容。最常见的例子就是大面额纸币（比如 100 美元钞票）。如果你将钞票对着光观察，就会看到一条“安全防伪线”以及印有本杰明·富兰克林头像的水印。
那么在技术层面上，AI 水印究竟是如何工作的？
Claude 的 AI 水印采用了一种基于 Google DeepMind 开源项目 SynthID-Text 的隐写技术。SynthID-Text 之所以属于隐写术，是因为信号（你想寻找的信息）直接隐藏在看似普通的段落的用词选择之中。因此，即使你把 AI 生成的代码复制粘贴到你常用的代码编辑器中，或者将 AI 生成的段落放入 Word 文档、电子邮件或 Slack 消息中，AI 水印也会一同附带传递。
根据 Anthropic 的说明，水印仅仅改变了模型在选择近似同义词时所采用的随机性来源，因此不会在文本中添加任何额外字符。AI 生成的文本内部不会被插入隐藏字符，也不会消耗额外的 Token。此外，水印不携带关于你的任何信息。这意味着 AI 水印检测器只能判断文本是否由 AI 生成，但无法确定是哪个用户的 Claude 账号生成了该文本。
SynthID-Text 采用了一种名为“锦标赛采样”（tournament sampling）的技术。在生成的每个位置上，模型会抽取若干候选 Token，并将它们放入一个类似淘汰赛的流程中。每一轮的胜出者由一个伪随机分数（g-value）决定，该分数是通过将前几个 Token 与一个秘密密钥进行联合哈希计算得出的。在一段包含数百个单词的文本中，文本最终会以一种只有密钥持有者才能观察到、而人类阅读绝不可能发现的模式，略微偏向具有高 g-value 的 Token。
这里的关键词是“略微偏向”。例如，在单词“big”和“large”之间做选择并不会改变大多数句子的意思，因此将选择轻微倾向于其中某一个，绝不会以任何你能察觉的方式改变你的文本。Google 在大约 2000 万次 Gemini 回复中测试了这一技术，点赞率（thumbs-up rate）差异仅为 0.01%（带水印的模型甚至略微领先）。
还有谁在为 AI 生成内容添加水印？
如前所述，Anthropic 在其内容上添加 AI 水印的决定是受到 2026 年生效的欧盟法律法规强制要求的。Anthropic 绝非唯一遵守该法规的公司。根据欧盟委员会网站，已有数百家公司同意遵守要求添加 AI 水印的规定。
例如，OpenAI 最近宣布支持为其 AI 生成的输出添加水印。以下是其公告中的引述：
在接下来的几周内，我们将向欧盟境内符合条件的 ChatGPT 和 Codex 文本输出中添加不可见水印。
OpenAI 的文本水印技术被称为“textGrain”，灵感来源于微雕艺术“米雕”。现在你可能会问：“究竟需要多少 AI 文本才能成功嵌入水印？”好消息是，OpenAI 公布了他们自己测试 AI 文本水印检测的统计数据：对于包含 400 个 Token 的文本段落，其 AI 文本水印检测器的准确率达到了 95%。这让你大致有个概念：只需要几段文字就足以嵌入水印。
然而，由于欧盟的规定适用于各类 AI 生成内容（而不仅仅是文本），OpenAI 更进一步推出了一个网站，让任何人都能查验非文本媒体（如图像和音频）是否由其模型生成。我亲自测试过该网站，它能在几秒钟内准确识别出水印。
对 AI 水印的法规监管并不只局限在欧盟。加州通过的 SB-942 加州 AI 透明度法案 同样要求为 AI 生成内容添加水印。这些法规共同构成了对 AI 生成文本、图像、音频和视频的全面水印合规要求。
Google 的模型输出同样包含 AI 水印
Google 多年前就已遵守《欧盟人工智能法案》，因此其模型自 2024 年起就已集成了 SynthID 文本水印。与此同时，他们也紧跟 OpenAI 的步伐，推出了公开网站 SynthID.com，允许任何人检测任何非文本媒体（例如图像、音频和视频）是否包含 SynthID AI 水印。Google 的 AI 水印检测器支持检测来自多家 AI 提供商的水印，包括 OpenAI、Nvidia、Kakao，当然还有 Google 自身。
给所有 AI 生成内容添加水印未必是件坏事
在我最近的一次经历中，我为一家正在进行风投融资的公司担任顾问。在融资消息公开宣布后，公司内部的某些员工接到了“CEO”的联络，对方编造借口要求他们从个人账户转账。而实际上，这是一伙诈骗分子利用 LinkedIn 获取了公司员工名单，随后冒充 CEO 试图诱骗员工将资金转入诈骗分子的银行账户。好在我们大多数人都具备足够的科技常识，明白这是一套显而易见的骗术。骗子之所以露馅，是因为他们使用的邮箱域名并不属于这家初创公司，因此欺诈企图很容易被识破。
然而，当今的技术仅凭一个人几秒钟的声音样本就能轻松完成声音克隆。如果发生了一场更复杂的“矛式钓鱼”（spear phishing），攻击者决定利用 AI 克隆 CEO 的声音呢？如果假 CEO 开始直接给员工打电话（而不是发邮件）呢？这可能会导致更加糟糕的局面：员工以为自己正在与 CEO 沟通并遵从其指令，进而被迫做出可能造成严重财务损失的事情。
这对你意味着什么
所有主流大语言模型（LLM）都在为其 AI 生成内容添加水印，并且在近期法规的推动下，这一趋势不可逆转。如今不法分子可以利用 AI 对公众发起严重的攻击，因此在任何 AI 生成的内容（文本、图像、音频或视频）中嵌入 AI 水印，都是核实内容真实性极其有用的工具。
如果你想亲自观看关于 AI 水印如何应用以及如何自主检测的实时演示，请务必关注 O’Reilly 独家课程 深入理解 AI 文本水印。
English / 原文
If you’re an instructor for the O’Reilly live training platform, you’ve got to be prepared for the unexpected. As a developer I think we all can understand the situation when a demo (you know, the one that you’ve tested a thousand times on your machine) easily decides on its own to go wrong while being demonstrated to a live audience. We’ve all been there. And of course, the biggest variable in the equation is the live Q&A portion of any course, because we actively encourage course participants to ask any question that’s on their mind.
Shortly after Anthropic announced that they were going to include AI watermarking in all text-based outputs from their latest models, I was flooded with questions during a Q&A session in a completely unrelated course about Claude Agents. Nearly everyone who posted a question in the Q&A box wanted to know more about how AI watermarking worked, and how it would affect them.
In light of that interest, I am taking this opportunity to help explain what watermarking means for you.
What did Anthropic officially announce?
I don’t want to put words in anyone’s mouth, so I’ll just quote Anthropic verbatim from its announcement in August 2026 :
Future Claude models will generate text that contains a watermark. This is a way of determining the likelihood that Claude was involved in writing the text, and we, along with several other major AI providers, are implementing this change to comply with the EU AI Act.
Here’s another quote from the same announcement:
Watermarking won’t be specific to Claude. As of August 2, the EU requires AI providers serving its market to mark AI-generated content. Other major model developers have signed the same Code of Practice and will be implementing their own watermarks.
The list of Claude models (at the time of this writing) that include AI text watermarks in all generated outputs are:
- Claude Mythos 5.1
- Claude Fable 5.1
- Claude Fable 5
- Claude Opus 5.5
- Claude Opus 5
- Claude Opus 4.8
- Claude Sonnet 5.5
- Claude Sonnet 5
- Claude Haiku 5.5
It won’t matter if you use Claude Desktop, Claude Code, or the API, because all of Claude’s outputs will contain the AI watermark. As a result, any code, email, blog, article, newsletter, or white paper that you write using Claude will contain a watermark, and anyone who has an AI watermark detector can easily determine if that content was AI generated.
What’s the difference between cryptography and steganography?
Now let’s talk about two related terms that apply to what we’re dealing with when it comes to the AI watermarks: cryptography and steganography. Cryptography is something you encounter every day when you visit a website that uses HTTPS instead of HTTP. Your web browser automatically handles the encrypting and the decrypting for you, but what it simply does is make the content of anything that you send or receive unintelligible unless you have the key to decrypt the message. As a result, you can (for example) securely type in your credit card to sign up for an O’Reilly subscription, because we (like every other major website on the internet) use HTTPS on our website to ensure that no outsider can obtain your credit card information. Therefore, if an unscrupulous person intercepts something you send over an HTTPS connection, the contents will be encrypted and meaningless.
Steganography is completely different, and it’s what the Claude AI watermarking technology uses. Steganography is about hiding something in the right place for someone who knows where to look for it. Steganography is not cryptography, because everything about the message is in plain sight. However, you have to look deeper at the message itself to find the contents that have been hidden or obscured. The most common example would be any paper currency of a large denomination (like the $100 dollar bill). If you hold the bill up to a light, then you’ll see a “security thread” as well as a watermark of Benjamin Franklin’s face.
So, technically, how does the AI watermark actually work?
The Claude AI watermark uses a type of steganography based upon SynthID-Text , an open source project by Google DeepMind. SynthID-Text is a form of steganography because the signal (the information that you are looking for) hides inside the word choices of an ordinary-looking paragraph. Consequently, you can copy/paste the AI-generated code in your favorite code editor, or put an AI-generated paragraph into a Word document, an email, or a Slack message, and the AI watermark comes along for the ride.
According to Anthropic, the watermark changes only the source of randomness that the model uses when it picks among near-equivalent words, so nothing is added to the text. There are no hidden characters placed inside the AI generated text, and no extra tokens are consumed. Also, the watermark carries no information about you. This means simply that the AI watermark detector can determine if text is AI-generated, but it cannot determine whose Claude account was used to generate the text.
SynthID-Text uses a technique called tournament sampling. At each position, the model draws several candidate tokens and runs them through essentially what is a knockout bracket. The winner of each round is decided by a pseudorandom score (g-values) that comes from hashing the previous handful of tokens together with a secret key. In a body of text with hundreds of words, the text ends up slightly favoring tokens with high g-values in a pattern that only the key holder can see, and that you would never spot by reading.
“Slightly favoring” is the key phrase here. For example, the choice between the words “big” and “large” doesn’t change the meaning of most sentences, so nudging that choice to one of the two doesn’t change your text in any way you’d notice. Google tested this on roughly 20 million Gemini responses , and the thumbs-up rate differed by 0.01% (with the watermarked model slightly ahead).
Who else is watermarking their AI-generated content?
As previously stated, Anthropic’s decision to put AI watermarking on its content is mandated by EU laws and regulations that took effect in 2026. Anthropic is not the only company that has complied with this regulation and, according to the EU Commission website , hundreds of companies have agreed to comply with the regulations that require AI watermarks.
For example, OpenAI has recently announced their support for watermarking AI-generated outputs. Here’s a quote from their announcement:
Over the coming weeks, we will add an invisible watermark to eligible ChatGPT and Codex text output in the European Union.
OpenAI’s text watermarking technology is called “textGrain,” and it’s inspired by the art of writing text on a grain of rice. Now, you may be asking yourself, “How much AI text is needed in order to place the watermark itself?” The good news is that OpenAI has published statistics from their own tests for AI text watermark detection. Their AI text watermark detector has 95% accuracy for passages that contain 400-tokens of text. This gives you an idea that only a few paragraphs of text is all that’s needed in order to embed the watermark.
However, since the EU mandate applies to AI-generated content (not just text), OpenAI has gone even further and released a website to let anyone know if their models have generated non-textual media, such as images and audio. I’ve tried the website myself and it correctly identifies a watermark within a few seconds.
The regulation dictating AI watermarks is not just an EU thing. The SB-942 California AI Transparency Act also requires watermarks on AI-generated content. These regulations, combined, not only apply to AI-generated text but also to images, audio, and video.
Google’s model outputs also contain AI-watermarks
Google complied with the EU AI Act years ago, so their models have included the SynthID Text Watermark since 2024. However, they’ve followed suit with OpenAI and released a public website, SynthID.com, to allow anyone to check if any non-text media (such as images, audio, and video) contains the SynthID AI watermark. Google’s AI watermark detector allows you to check for a watermark from multiple AI providers such as OpenAI, Nvidia, Kakao, and of course, Google themselves.
Watermarking all AI-generated content is not necessarily a bad thing
In my most recent experience, I worked as a consultant for a company that was undergoing a VC-backed funding round. After the funding was publicly announced, certain people at the company were being contacted by the “CEO,” who asked them to perform a bank transfer from their personal accounts because of some made-up situation. In reality, it was a group of scammers that used LinkedIn to find the names of employees of the company, and then posed as the CEO so that employees would send money into the scammer’s bank account. Most of us were tech-savvy enough to understand that this was an obvious ploy driven by unscrupulous people. The scammers gave themselves away because they were using email domains that were not owned by the startup, so in this case, the fraud attempt was easily detectable.
However, the technology exists today where voice cloning can be easily accomplished with only a few samples of a person’s voice. So what if a more sophisticated “spear phishing” attempt was done where the attacker decided to use AI in order to clone the CEO’s voice? And what if the fake CEO started calling people (instead of sending emails)? This could lead to a much worse situation where employees think they’re interacting with (and obeying) the CEO and feel compelled to do something that could have grave financial consequences.
What this means for you
All the major LLMs are including watermarking in their AI-generated content, and due to recent regulations, that’s not going away. Bad actors can use AI today to perform serious attacks on the public, so having an AI watermark on any AI-generated content (text, images, audio, or video) is a very useful tool to determine authenticity.
If you want to see a live demonstration on how AI watermarks can be applied and detected on your own, be sure to attend the course Understanding AI Text Watermarking, only on O’Reilly.