The Claude Text Watermark: What It Proves and What It Cannot

Published August 19, 2026

Since 2 August 2026, the text Claude writes for you carries a digital watermark. Not a visible label, not a disclaimer at the foot of the page: a statistical signal shaped by which words the model picked, sitting inside the prose itself. Paste that paragraph into an email, a court filing or a slide deck and the signal travels with it, because it never lived in the file to begin with.

Most of the coverage got that far. The part that matters if you have to prove something is the part that got left out. The signal can already be thinned or wiped by rewriting, and there is no public tool today that lets you check whether a text is marked at all. Anthropic has said a detection API is coming. Until it does, the only party who can answer the question is the company that raised it. Open source projects claiming to strip provenance marks from several vendors have appeared in the meantime, and their own authors admit they cannot verify that the official check would fail.

Hence the argument this article makes. A watermark records how a piece of content was born, not what that content proves. It survives copying. It does not survive rewriting. If you need to demonstrate the origin of something to a counterparty, an auditor or a judge, marking is not the mechanism that will carry you there.

What Anthropic announced and when it takes effect

Anthropic marks Claude’s output with two complementary techniques that keep getting reported as one: a statistical watermark inside generated text, and cryptographically signed provenance metadata attached to generated files. They protect different things and they break in different ways.

Two mechanisms: a signal in the text, signed credentials in the file

The text watermark is a statistical mark carried by word choice, based on SynthID-Text, the technique Google DeepMind published in Nature in 2024. The file credentials are something else: images generated in .png, .jpg and .svg receive signed provenance metadata following the C2PA standard, the same one camera manufacturers use. The file content is not altered, only the metadata around it. One mechanism lives in language and follows the text anywhere you paste it. The other lives in the container and stays behind the moment the container is replaced. Anthropic’s explanation of how Claude’s text watermarking works keeps the two apart. Several outlets did not, and described the text watermark as if it were C2PA.

Models, surfaces and dates

Models launched from 2 August 2026 support marking from the day they ship. Global application, not restricted to the European Union, started on 14 August 2026. Models released before 2 August fall under the EU transition period and will receive marking, in Anthropic’s phrasing, in the coming months. Coverage is wide: the Claude app, the Claude Platform API, Claude Code, Claude Cowork, Claude Tag, plus access through AWS, Google Cloud and Microsoft Foundry. The documentation lists no exemptions and no opt-out, not for API customers and not for enterprise accounts. If Claude runs anywhere in your stack, the output is marked.

How the text watermark works

The mark is not a hidden character, not invisible Unicode, not a header in the file. It sits in the sequence of decisions the model makes while writing.

Word choice as the carrier of the signal

A text watermark is a statistical signal placed in the model’s word selection. While generating, the model constantly picks between alternatives; the watermark changes the source of randomness behind those picks, using a key and the preceding words. The signal lives in which words were chosen.

The idea did not begin at Google. Scott Aaronson, a computer scientist at UT Austin, started arguing for watermarking language models in the summer of 2022, shortly after joining OpenAI’s Alignment team. Other research groups carried the scheme further, and the version Google DeepMind published in Nature is the one Anthropic uses today.

Anthropic explains it with a game of Monopoly. Swap the dice for the digits of pi and the moves stay unpredictable to the players, while anyone who knows the rule can check afterwards that the sequence was never random. A paragraph works the same way: the choices look ordinary to a reader, and to a verifier holding the key they form a pattern. Because that pattern is made of words, content provenance behaves here unlike anything attached to a file. Reformatting leaves it intact, and so do PDF conversion and a paste into a different application.

What the verifier actually does is worth stating plainly. Aaronson’s own account of the scheme describes detection as a threshold: a sum is computed across the tokens, and if it clears a certain value the conclusion is that the model probably produced the text. Probably is the whole answer. The verdict is probabilistic by construction, and no choice of threshold turns it into a yes or a no.

Why it is invisible and does not change meaning

The watermark only intervenes where the alternatives would be equally valid. If two phrasings serve the sentence equally well, the mechanism decides between them; where only one word fits, nothing is imposed. That constraint keeps the output readable and the quality unaffected, and it is also why the signal is uneven. You cannot perceive it while reading, and neither can the person who receives your document.

Where the signal thins out: short texts, factual texts, code, proofreading

Anthropic publishes the limits itself, which is unusual enough to be worth reading in the original. Detection does not work effectively on short samples. The mark is sparser in factual writing, where fewer choices exist: the example given is a sentence about Isaac Newton and the Principia, where the facts leave little room to vary. Code is generally less marked, since precision leaves fewer equivalent alternatives. Proofreading produces almost no signal, because most of the words stay the author’s. Full rewriting removes the mark. Translation, by contrast, carries it, because Claude chooses every word again.

There is a mathematical reason under that list, and it makes those limits structural. The amount of text detection needs scales with the inverse square of the average entropy per token, that is, with how much genuine choice the model had. The fewer equivalent alternatives a passage allows, the more of it a verifier has to see before the sum means anything. Legal definitions, factual answers and source code sit at the bottom of that scale, and they are exactly the texts whose origin would matter most.

The help centre documentation states the consequence plainly: detecting a Claude mark indicates that content may have been processed by Claude, and on its own does not confirm the full provenance of that content. Marks can disappear through edits, format conversion or heavy rewriting. There is a second consequence that cuts the other way, and it gets far less attention. Upload your own text, ask Claude to revise it, and the output can carry the mark even though the ideas, the wording and the data were yours. The mark records that processing happened. About authorship it says nothing at all.

Why Anthropic shipped it now

The timing is regulatory rather than technical. Two jurisdictions converged on the same date, and a vendor with global infrastructure does not maintain one behaviour per territory.

AI Act Article 50 and the transparency code of practice

Article 50 of the AI Act sets transparency obligations that apply from 2 August 2026. Providers of generative AI systems must mark their outputs in machine-readable format and make synthetic content recognisable. In July 2026 roughly 190 companies signed the EU code of practice on transparency for AI-generated content. Anthropic’s announcement lands on the article’s application date, which nobody has presented as a coincidence.

California’s transparency law and the text it leaves uncovered

The California AI Transparency Act, SB 942, had its start date moved by AB 853 from 1 January to 2 August 2026 specifically to align with the European timetable. It applies to anyone operating a publicly accessible generative AI system with more than one million monthly users in California, and requires latent, durable, machine-readable markers plus a free public verification tool.

Then there is the detail that deserved more attention than it got. SB 942 covers images, video and audio. Text is not in scope. A legislature that spent two years on provenance rules left written content out, and the most reasonable reading is that text provenance was judged technically immature. The technology Anthropic has just deployed worldwide is the one California declined to mandate.

One global product instead of two

Once the European obligation is unavoidable, the alternative to marking everywhere is running separate pipelines per region, with routing decisions per request and a compliance surface that grows with each new jurisdiction. As Euronews put it, this is EU compliance delivered globally. The engineering economics point where the legal calendar already pointed, and users outside Europe inherit a rule written for Europe.

The debate: who defends it and who objects

Reaction split immediately, along lines that have little to do with the technology. The case in favour is about honesty. The case against is about accuracy, credit and control.

The case in favour

Supporters make a compact argument: transparency about machine involvement stops being personal etiquette and becomes part of the infrastructure. One widely circulated comment put it bluntly, that the only reason to object is wanting to mislead people. A narrower version of the same point survives scrutiny better. A claim that was previously impossible to substantiate either way now has some form of evidence attached, and evidence nobody has to remember to add is worth more than a policy resting on goodwill.

The objections: false positives, authorship, cancellations

The backlash was fast and hard across Reddit, X and LinkedIn, with users announcing cancelled paid subscriptions and complaints arriving from students, journalists, writers and programmers. TechCrunch covered the reaction as it built.

Three objections deserve separating. First, false positives in the practical sense: someone who uses Claude to tidy a paragraph or condense a transcript fears being flagged for legitimate work, since a text written by a person and merely polished can come back positive. Second, authorship. One programmer’s version of it is hard to dismiss: he supplied the instructions, the context, the decisions and countless refinements, Claude was the instrument, so what exactly is the mark claiming. Third, the feel of the thing, which critics keep describing as a scarlet letter, a mark that stays on the text long after it has left the platform. John Gruber’s objection is that a hidden watermark distorts the craft of writing itself. Underneath all three runs a perceived inconsistency, since the marked output comes from a model trained on unmarked work by other people.

The missing detector

The structural problem is none of those objections. It is that you can be marked and cannot check. No public detector exists today, and Anthropic has said a detection API will follow. Until it does, AI-generated text detection against this watermark depends entirely on the vendor’s oracle, and whoever is holding the document has no way to run the test.

That asymmetry is not an oversight of an early deployment. Aaronson, who proposed the scheme, lists it among the reasons OpenAI never shipped a detector of its own. Publish the detector, and anyone intent on evading it can keep editing a document until the check stops firing. Keep it closed, and somebody has to decide who is entitled to verify: universities, newsrooms, employers, courts. Either way, whoever holds the document does not automatically get to run the test.

Organisations that must produce usable evidence do not wait for that oracle. They use forensic certification at source to obtain an origin they can assert, instead of a statistical probability they would have to defend.

Why every watermark can be removed

Any mark applied to content after the content exists can be attacked, and the attacks are not exotic. What makes this case unusual is that the people building removal tools are the ones telling you the results cannot be confirmed.

Barak and colleagues proved it in 2023 as an impossibility result: move at random across the set of documents that say the same thing and any watermark comes away, provided the quality of the text survives the walk. So removability is not a flaw in Anthropic’s implementation. Any scheme that marks content by choosing among equivalent renderings can be undone by moving through those equivalents again.

The known attacks: rewriting and back-translation

Two categories behave very differently. The first is verifiable removal: stripping invisible characters, EXIF and XMP metadata and C2PA blocks from files. Those elements are either present or absent, so the outcome can be checked by direct comparison. The second is statistical rewriting: having another model rework the text, changing vocabulary, clause order, connectives and sentence boundaries to disturb the pattern. This second category is the one that attacks the watermark itself, and the standard attacks in the literature are paraphrase and back-translation, meaning translation out of the language and back again.

Both carry a cost. Rewriting flattens the tone and the precision of the original, while light edits may leave the signal completely intact. You trade the quality of the text for an effect you cannot measure.

The public removal projects and the limit their own authors admit

Public open source projects now advertise the removal of provenance marks across several vendors. Their documentation contains the most honest sentence in this whole debate: what they do is a best effort attack, not verified erasure, and until vendors release public detectors and specifications, no tool can honestly certify that the official check will fail.

Turn that around and it reads as a warning. These projects aim at a target they cannot see and report hits they cannot confirm. Anyone selling certainty about stripped watermarks is selling something the underlying technology does not currently support.

The asymmetry between marking, verifying and erasing

Everyone in this system occupies one of three positions, and only one of them can see anything. The party who marks knows the mark is there. The party who receives the content cannot check, and the party who wants the mark gone cannot tell whether they succeeded. A system of proof in which no participant can independently verify the outcome is not a system of proof. It is a declaration by one company about its own products, which may well be accurate and still cannot be tested by the people who need it.

C2PA metadata and the fragility of files

Signed credentials on files fail for a simpler reason than watermarks: they are not in the content. C2PA metadata lives in the file container, not in the pixels, and anything that produces a new container drops it. The structural limits of the C2PA standard are documented at length, and the practical ones are obvious to anyone who has moved an image around.

A screenshot erases provenance

Screenshot a certified image, save it as a new file, and the manifest is gone. Not degraded, gone. Recompression, resizing and format conversion have the same effect for the same reason: each produces a new container, and the signed metadata belonged to the old one. What you see on screen is identical and carries nothing, so provenance disappears through ordinary use rather than through attack. An Imatag study in 2018 found that 80% of images uploaded to websites had already had their metadata removed, well before signed credentials were widely deployed.

How much actually survives online

In 2026 the figure is effectively 100% on the large social platforms. Instagram, X, LinkedIn, TikTok and Facebook strip manifests systematically at upload, so a credential does not survive publication: it exists only between the tool that made the file and the first platform that touches it. By the time a contested image reaches a newsroom or a court, it has passed through at least one of them, and the manifest is no longer attached to anything.

Durable credentials and why they do not close the loop

The standard’s answer is Durable Content Credentials: weak hooks, an invisible watermark or a content fingerprint, that let the credential be recovered after it has been stripped from the file. That reintroduces the same fragilities, and it still needs a queryable registry and the cooperation of the platforms. A RAND Corporation analysis from June 2025, Overpromising on Digital Provenance and Security, made the general point: C2PA depends on end-to-end conformance by every element of the ecosystem, and in an open ecosystem that is not realistic. Once provenance metadata is removed by a screenshot or a reconversion, forensic certification of the acquisition itself remains the only verifiable element, and that is the approach TrueScreen takes.

Marking origin versus proving it: two different problems

A watermark answers the question “did a machine write this?”. Evidence answers a different one: “is this content authentic, and can I assert it against someone?”. No amount of improvement to the first answer produces the second.

What a watermark says and what it will never say

Marks are applied by the model vendor, in the vendor’s compliance interest, after the content already exists. Certification at source is applied by the author, in the author’s evidentiary interest, at the moment of acquisition. That difference decides everything else, starting with what happens when the content is challenged.

The last column is where the difference stops being philosophical. The first two describe labels applied by someone else for someone else’s purposes. The third describes a record made by the party who will need it.

What certifying content at source actually means

TrueScreen, the Data Authenticity Platform, works on the opposite problem: instead of establishing whether a model generated a text, it fixes verifiably how and when that content was acquired. The method is forensic rather than declarative. Content is captured at source with forensic methodology, its integrity and authenticity are verified, and the result is certified with a qualified timestamp and an electronic seal issued by a third-party QTSP integrated through the TrueScreen API. What comes out is not a statement about the content’s history but a record of the acquisition act, created as it happens and independent of whatever later becomes of the copy in circulation. That is what the Data Authenticity Platform exists to do, through the certification platform and the mobile app for teams acquiring content in the field.

Picture a newsroom that receives a document from a source who says a model produced it. A detector returns a probability. The watermark, if there ever was one, did not survive the tool that translated the document out of English, because that tool rewrote every word. What stays verifiable is not the origin of the text but the acquisition act: when the document arrived, from which screen, in what state. In a proceeding, that is the element the other side has to argue with.

Preparing for a world where origin cannot be reconstructed afterwards

Origin is not recoverable after the fact. Either it is fixed as the content comes into existence, with a qualified timestamp and an electronic seal from a third-party QTSP, or the information is gone and no later analysis brings it back.

The decisions to make now

Start by splitting your content in two: what merely has to be published, and what may one day have to survive a challenge. The second pile is smaller than people expect, and it is the only one that calls for action taken before the dispute rather than during it.

Then stop treating detector output as a finding. A probability from an AI-generated text detection tool is not a fact about a document, and where the watermark is the thing being tested, no independent check is currently possible. A decision about a person, a contract or a claim that rests on that output rests on nothing you can defend.

Last, be explicit internally about what the marks cover. Anthropic’s watermark tells you a model may have been involved. It does not tell you who wrote the argument, whether the facts are true, or whether the document in front of you is the one originally produced. Those questions were never the watermark’s job, and the gap tends to reveal itself at the worst possible moment.

FAQ: watermarking and content origin

How does SynthID-Text work?
+

SynthID-Text, published by Google DeepMind in Nature in 2024, marks generated text through word choice. While generating, the model changes the source of randomness behind its selections, using a key and the preceding words. The signal lives in which words were chosen, so it survives copying and pasting.

How can you tell whether a text was written by an AI?
+

Largely you cannot, with certainty. Anthropic’s documentation states that detecting a Claude mark indicates content may have been processed by Claude and does not on its own confirm full provenance. No public detector exists yet, and marks disappear through rewriting, format conversion or heavy editing.

Can the watermark be removed from AI-generated text?
+

Rewriting removes it: replace every word and the signal is gone. Paraphrase and back-translation are the standard attacks. Public removal projects describe their own results as best effort rather than verified erasure, because without a public detector nobody can confirm whether the official check would fail.

Does Claude’s watermark apply outside the European Union?
+

Yes. Anthropic applied marking globally from 14 August 2026, not only in the European Union. Models launched from 2 August 2026 support it at launch, and earlier models fall under the EU transition period, with marking expected in the coming months. The documentation lists no exemptions and no opt-out.

Is there a public tool to verify a Claude watermark?
+

Not today. Anthropic has said it will offer a detection API, which is not available yet. The result is an asymmetry: whoever marks knows the mark exists, whoever receives the content cannot check, and whoever tries to remove it cannot confirm success.

How do you tell whether an image was created with AI?
+

Files generated in .png, .jpg and .svg receive signed C2PA provenance metadata. That metadata sits in the file container, so a screenshot, a recompression or an upload to a social platform removes it. Instagram, X, LinkedIn, TikTok and Facebook strip manifests systematically at upload.