Claude’s AI Watermarks and the Limits of Detecting Generated Content

It can be difficult to tell whether text or code was created with AI. Familiar stylistic habits are not proof of authorship, but the difficulty has made people worry about a flood of misleading or low-quality content. Anthropic's plans for machine-readable marks make that problem concrete for people who use Claude to write and code.

The discussion is connected to the EU AI Act and its transparency framework. Anthropic says supported Claude models will embed watermarks in generated text and add signed provenance metadata to supported files. I worry that applying a marking scheme to text and code will not achieve the goals people expect of it.

The EU page I show distinguishes a voluntary code of practice from the AI Act's legal transparency obligations. It describes one section for providers on marking and detection and another for deployers on disclosure. Article 50(2) refers to machine-readable marking and qualifications around technical feasibility; its precise legal application depends on the law and context.

The provision also describes exceptions, including certain standard editing assistance and cases where the input or its meaning is not substantially altered. I interpret this as a distinction between modest assistive editing and generated output. A specific use case needs to be assessed against the actual wording, not a blanket rule that every edit is exempt.

To explain the technical problem, I start with an obviously absurd image and compare versions that look alike but use different file formats. An image contains a lot of data, and changes to its encoding need not produce an obvious visual difference. That gives a marking system room to embed a signal, but also creates problems for preserving it.

Imagine altering a small number of pixels in a repeated pattern, or changing a color value by a tiny amount. A viewer might not notice, while a detector that knows the pattern could look for it. This is a simplified illustration, not a description or test of a particular commercial watermark.

The difficulty is making the signal survive normal processing. Lossy compression, resizing and other transformations change image data while trying to preserve what people see. A simple pixel-level pattern can be damaged in the process. The resilience of an actual watermark depends on its design and the transformation; this toy example doesn't establish that every image watermark fails.

I mention Google's SynthID and show a visible noise-pattern illustration, but I don't know the complete detection method. My demonstration with filters and resizing shows what can happen to that illustrative pattern; it does not independently measure the robustness of SynthID or prove how Google's or another company's detector works.

Text presents a different challenge. It contains much less redundant information than an image, and changes to a short sentence can be conspicuous. A long passage offers more material for a statistical signal than a very short one, but preserving meaning while making the signal detectable is still a tradeoff.

The Anthropic page describes markings across supported models and products, including Claude Code and the API, and says the company is working on older models too. These statements are about supported models, platforms and rollout, not proof that all historical Claude output is marked. The documentation can change as the rollout proceeds.

Anthropic describes two complementary mechanisms: a watermark embedded in generated text and signed provenance metadata on supported files. It says a text mark travels with copied text and may persist through some editing. A file credential records a provenance claim and can help detect changes to the signed content.

A detected Claude mark is a signal that the content may have been processed by Claude, not a complete history of who authored it. A person might have supplied the original ideas or text and used Claude to translate, summarize or proofread it. The content may also have changed after processing.

The absence of a detected mark also does not prove that content was human-made. Anthropic lists possible reasons such as unsupported models or formats, short passages, extensive editing or translation, and metadata removed during file processing. Detection therefore has limitations in both directions.

My concern is that a determined person can alter material or use an unmarked model, while direct copy-and-paste may remain easier to identify. I am skeptical that marking will stop sophisticated misuse. That is a judgment about incentives and robustness, not a measurement proving that minor edits defeat every implementation.

I also discuss a post by Sean Goedecke on why text watermarking is difficult. The basic problem resembles steganography: a signal must be concealed in ordinary text without making that text unusable. An obvious fixed-letter pattern would distort the writing, while more subtle methods face different tradeoffs.

One alternative might be to compare a passage with predictions from a model, but stylistic similarity can produce false positives and running many models may be expensive. People can naturally write in patterns that a model also uses. A distinctive watermark aims to provide a different kind of signal from an ordinary style detector.

Goedecke uses SynthID as an example of statistical marking. A language model chooses among possible next tokens during generation; a watermarking method can bias those choices in a way that produces a detectable aggregate pattern. This is an explanation of one family of techniques, not a claim about Claude's undisclosed implementation.

He also considers visually similar Unicode characters as a possible way to hide information. Such a pattern would differ from a statistical watermark, and the presence of an unusual space alone does not establish why it appeared. Speculation about Unicode characters is not evidence that they are the mechanism Anthropic uses for Claude's announced marks.

Editing and paraphrasing may weaken a statistical signal, and file conversion may remove metadata. How much modification defeats a given detector is an empirical question. I argue that people who want to evade detection have incentives to keep trying, while readers and platforms need to understand false positives and false negatives.

The discussion also raises a tension between interoperable verification and keeping a marking method hard to evade. I see this as an open design challenge. Interoperability does not by itself prove that a provider must publish secret keys or every detail of its implementation.

C2PA takes a different approach: a file can carry digitally signed provenance information, sometimes called Content Credentials. A valid signature can help verify that the information came from a signing entity and that bound content has not changed in ways that invalidate the credential. It does not independently prove that every claim in the metadata is true or that an image depicts reality.

I find the prospect of recording camera or human-origin provenance more promising than trying to detect every fabricated image. But missing credentials do not prove that an image is fake: genuine material may never have been signed or may have lost its credentials. Trust also depends on the issuer and the capture and editing chain.

Signed file metadata is also different from a watermark embedded in plain text. File formats can carry a credential alongside the content, while copied chat text doesn't automatically retain a file's provenance record. The question of which generated files carry credentials depends on the supported formats and platform.

I show a repository that claims to handle several types of provenance marks, illustrating my concern that a determined user may try to alter or remove signals. The existence of such a tool is not evidence that it defeats every watermark or preserves every document's meaning. Different approaches need independent testing.

I see this as a cat-and-mouse problem: a robust, inexpensive signal that survives useful editing but is difficult to evade is hard to design. I am pessimistic that text watermarks alone will stop deliberate deception. That doesn't mean a particular implementation has been tested here or that all detection is useless.

We should be clear about the goal. Is it identifying unedited copied output, discouraging school cheating, or limiting organized propaganda? Each is a different problem with a different adversary. I expect the technique to be more useful against low-effort copying than against people prepared to adapt their process.

My preferred long-term direction is stronger provenance for real media combined with public education about convincing synthetic content. Even then, provenance is evidence about a file's history, not a guarantee of truth. I appreciate the intention behind transparency efforts, but remain doubtful that watermarking on its own can meet the expectations being placed on it.