Watermarking Claude: Every Text Now Carries an Invisible Signature, Everywhere in the World

There will be no banner, no legal notice at the bottom of the page, no small “AI-generated” badge tucked into a corner. The marking Anthropic is rolling out across content produced by Claude is invisible by design, and that is exactly what makes it worth examining. Since the AI Act’s transparency obligations came into force, every text produced by a recent Claude model carries a statistical signature woven into the choice of words themselves. Not a piece of metadata you can strip, not a tag you can delete: an imperceptible bias in how the machine selects its tokens, detectable after the fact by a statistical test.

The announcement went almost unnoticed in the French-language press, reduced to a handful of summaries of the Anthropic support page that documents it. It deserves better, because it brings together three things nobody is treating as a single story: a technical mechanism whose limits are already well established in the academic literature, a European regulatory instrument that goes global purely by the vendor’s own choice, and a signal its own designers describe as inconclusive but that institutions will read as proof.

I argued here last March that AI text detectors are tools that should never have existed. The argument was mathematical: a language model is trained to minimize the gap between its output distribution and that of human writing, so its explicit objective is to make statistical discrimination impossible. In that piece, only one technical approach struck me as serious: watermarking. It is now deployed. Time to look at what it actually changes, and what it will never change.

What Anthropic Signed, and Why

The starting point is Article 50 of the European AI Act. This is the transparency layer of the regulation: tell people when they are talking to a machine, mark generated content in a machine-readable way, flag deepfakes. It does not apply only to high-risk systems or general-purpose models. It applies to everyone, the moment synthetic content is produced.

To make the obligation workable, the Commission had independent experts draft a Code of Practice on Transparency of AI-Generated Content. The Code is a voluntary instrument, meant to let providers and deployers of generative AI systems demonstrate compliance with Articles 50(2) and 50(4). It is split into two distinct sections: the first covers providers, machine-readable marking of content, and the associated detection mechanisms; the second covers deployers.

The timeline matters. On July 8 and 9, 2026, the European Commission and then the AI Board concluded that the Code was adequate to support the practical implementation of Article 50. First-wave signatories had to file their form by July 22, 2026 to appear on the list published before the obligations took effect. Anthropic is among them: the Section 1 signatories include Aleph Alpha, Anthropic, Black Forest Labs, Cohere, Google, Meta, Microsoft, Mistral, OpenAI, and Synthesia. In other words, very nearly the entire Western generative model industry.

The commercial logic is transparent. Signing gives companies predictable enforcement, legal certainty across the Union, and a lighter administrative load, regardless of where they are established. Facing a regulator that now holds real sanctioning power, a negotiated framework beats twenty-seven national interpretations. The Code is not a constraint imposed on the industry. It is shelter.

Then there is the wrinkle, for those who like their dates clean. Article 50(4) obligations have applied since August 2, 2026, but those under Article 50(2), which is precisely the provider marking duty, were pushed back to December 2, 2026 by the omnibus regulation. Anthropic is therefore shipping ahead of the legal deadline that actually binds it. You can read that as good faith. You can also read it as an engineering decision: marking at the model level, once and for all, costs less than maintaining two behaviors and two sets of weights depending on jurisdiction.

Under the Hood: Watermarking a Text Without Changing a Word

This is the part the summaries skip, and it is the only part that lets you form a judgment.

A language model generates text one token at a time. At each step it produces a probability distribution across the entire vocabulary, then samples from it. Statistical watermarking works by intervening in that sampling step.

The foundational method, published by Kirchenbauer and colleagues in 2023, works like this. At each token, the preceding context seeds a pseudorandom generator, which partitions the vocabulary into two lists, one “green” and one “red.” A small bonus is then added to the logits of the green tokens, making them slightly more likely without ever forcing their selection. A human reader notices nothing, because language offers dozens of perfectly natural continuations at any given moment and the model is simply favoring some of them. But across a long enough text, the proportion of green tokens drifts away from what chance would produce. A detector holding the key recomputes the partitions and runs a statistical test, typically a z-score. Past a threshold, the verdict lands.

Three properties follow, and they explain everything else.

• The signal lives in the text, not in a container. This is the fundamental difference from metadata. Paste a Claude output into Word, into a note, into a CMS, into an email: the signal comes along, because it is made of the words themselves. No amount of format juggling touches it.
• The signal is probabilistic, so it needs length. Across three sentences, the statistical drift is indistinguishable from noise. Across two thousand words, it becomes overwhelming. This is why Anthropic acknowledges that a very short passage yields no reliable signal. That is not an implementation flaw. It is the nature of the thing.
• The signal degrades when the text is reworked. And here the literature is considerably more interesting than the marketing. A robustness evaluation published in 2024 found that a single rewriting pass by a strong model drops detection rates for every scheme tested below 0.3, and that after a few rounds of iterative paraphrasing, even the most resilient methods fall below 0.15. Kirchenbauer’s team, by contrast, showed that watermarks remain detectable after both human and machine paraphrasing, because a reformulation statistically leaks n-grams from the original, producing high-confidence detections once enough tokens are observed: roughly 800 on average after human paraphrasing, at a false positive rate set to 1e-5.

The two findings do not contradict each other. They describe the same reality from opposite ends. Paraphrasing dilutes the signal, it does not erase it; you simply need more text to reach the same confidence. The decisive variable is not “was the text modified” but “how many words can the detector see.” A three-thousand-word blog post rewritten by hand probably remains detectable. A reworded LinkedIn paragraph does not.

Translation, however, plays in another league entirely, and it is currently the most destructive workaround against classic token-level schemes. The reason is structural rather than incidental: the watermark is anchored in tokens, and a translation replaces every single token. Where paraphrasing leaves fragments of the original intact, and therefore leaves traces, crossing into another language preserves nothing of the text’s surface. The meaning survives. The carrier holding the signal disappears completely.

The most recent research is trying to escape precisely this limitation by anchoring the watermark in semantic space rather than in tokens. It reports true positive rates of around 65% at a 1% false positive rate after translation from English into German, and that result is presented as meaningful progress, which it is. But translate it back into plain terms: in the best documented case, in the lab, between two closely related and well-resourced languages, a third of translated texts slip through. On a more distant language pair, on a short text, with a machine translator other than the one tested, nobody knows.

It is worth sitting with what that implies for a system billed as global. Marking at the model level and applying it across the entire planet, while knowing that crossing a single language boundary is enough to erase the signal, means deploying an instrument that is most effective on monolingual use, which is to say on the least troubling cases. An English text written and read in English stays marked. A coordinated influence operation, which translates by definition, does not. The system is strongest exactly where the stakes are lowest.

For files, Anthropic takes a different route: cryptographically signed provenance metadata under the open C2PA standard, attached to supported formats such as PNG, JPG, and SVG. The mechanism is cryptographically sound, it lets you verify that a file has not been altered since signing, and it is utterly fragile in practice. One screenshot, one format conversion, one re-save in any editor, and the metadata is gone. I covered this in detail in my piece on AI image generation in 2026 and the collapse of visual proof: C2PA is a provenance standard for those who want to be traced, not an attribution tool against an adversary.

A European Law, a Global Watermark

Here is the point I have not seen made anywhere, and it strikes me as the most important one.

The obligation originates in a European regulation. The Code of Practice is a Commission instrument. The marking, however, will apply everywhere Claude is offered, worldwide, across every surface: the app, the API, Claude Code, Cowork, and access through partner clouds. A Brazilian developer, a Japanese copywriter, an American consultant will all have their text watermarked as a consequence of a rule voted on in Strasbourg, without a single one of their own legislators ever weighing in.

This is the Brussels effect in its purest form, and here it operates without passing through law at all. Nobody requires Anthropic to mark outside the Union. But once marking is implemented at the model level, inside the sampling loop itself, shipping an unmarked variant for the rest of the world would mean maintaining two models, two evaluation pipelines, two surfaces for bugs. The marginal cost of uniformity is negative. The norm follows the infrastructure, and the infrastructure belongs to a handful of companies.

Anyone who cares about digital sovereignty should sit with what that means. We are happy to celebrate the Brussels effect when it imposes the GDPR on Silicon Valley. We find it rather less cheering when it embeds an origin marker in every text produced on the planet, through the channel of a private American company applying a voluntary European code. The question is not whether marking is a good thing. The question is who decides, and by what mechanism. The answer here: a regulator with no jurisdiction over most of the affected users, relayed by a vendor whose economics demand uniformity. No vote anywhere.

This is exactly the machinery I described in writing about European sanctions applied without a judge. The constraint does not descend from a court onto a defendant. It travels through the technical intermediary, which applies it to everyone because that is simpler.

What a Watermark Proves, and Above All What It Doesn’t

Anthropic is honest on this point, and credit where it is due: the documentation says plainly that detecting a mark indicates the content may have passed through Claude, not that Claude wrote it.

Let’s walk through the concrete scenario, because it applies to just about everyone who works with these tools. You write a text. Your ideas, your structure, your sentences, your labor. You ask Claude for a proofread, or to smooth out two clumsy paragraphs, or for a translation. The output is marked. Your text now carries the signature of a machine that thought nothing, built nothing, decided nothing. It fixed some agreement errors.

The reverse asymmetry holds just as firmly. The absence of a mark proves nothing either: the text might come from a model predating the system, from a competitor that does not mark, from a local model, or it might simply have been reworked enough for the signal to dissolve. To say nothing of the trivial workaround available to anyone: run Claude’s output through an open model on your own machine and have it reword the text. The signal collapses, the user installs nothing sophisticated, and the entire apparatus now constrains only honest use.

What we have, then, is a signal that supports no firm conclusion in either direction. Technically rigorous, epistemologically hollow.

And this is where my concern starts, because it is already documented. In my piece on detectors, the central problem was never the poor quality of the tools. It was the institutional confusion between probability and proof. A university disciplinary panel, an employer, an editorial desk, a platform, an admissions committee: none of these actors has the time, the training, or the appetite to reason in terms of likelihood ratios. They want a binary answer. Until now they were handed a percentage with no mathematical foundation. They are about to be handed a statistically valid test whose result does not answer their question.

The improvement is real on the tooling side. It is nil on the usage side. A system that says “this text probably passed through Claude” will be read as “this text was written by an AI,” which will be read as “this person cheated.” Two leaps, neither justified, both inevitable.

It also has to be said that the new tool will not replace the old one. It will sit alongside it. That is the part that should worry us most, because the old tool’s defect is thoroughly documented: classifier-based detectors systematically penalize people writing in a language that is not their own. The mechanism is well understood, and cruel in its logic. These detectors measure perplexity and lexical variability, essentially how predictable a text is. A non-native speaker writes with a narrower vocabulary and more regular structures, which are precisely the properties the classifier associates with machines. Published work on English-as-a-foreign-language exam essays found staggering rates of false accusation, against a population whose only offense was not having been born into English.

A technical clarification is needed here, because it separates two problems that are certain to get conflated. This bias does not carry over to watermarking as such. Watermark detection is a hypothesis test on the proportion of green tokens, and human text, native or not, has no reason to produce that proportion. The false positive rate is set by the threshold and does not depend on the author’s style. Watermarking genuinely fixes that particular flaw, and that deserves to be said.

Except the length requirement does not go away. On a short text, a translated text, a heavily reworked text, the watermark says nothing at all. And when the rigorous tool falls silent, the institution in a hurry does not abandon its question. It reopens the tab with the classifier, the one that always answers and always accuses the same people. Watermarking does not disarm the bad tool. It leaves it the entire terrain where it does the most damage. That is the precise definition of progress that fails to progress.

Longtime readers know I am wary of the hammer metaphor and the supposed neutrality of technical tools. Watermarking illustrates the point sharply: the object is neutral, its social meaning is not, and it is the latter that will produce the effects.

The Blind Spots

Three shadows remain, and they are substantial.

• The detector does not exist publicly. Anthropic says it will let users and third parties verify its marks, and points to technical documentation still to come. As of today we know neither the algorithm, nor the false positive rate on human text, nor the length threshold below which the test is unusable, nor how the detector behaves on multilingual material. We are being asked to trust a signal whose reliability no outsider can measure. This is a transitional state, but for as long as it lasts, no institution should give this system any decision-making weight whatsoever.
• We do not know who will get access to the detector. Open to all, available through a public API, restricted to accredited third parties, priced per use? Each answer produces a radically different balance of power. A public detector makes the system symmetric: anyone can check, including to clear their own name. A restricted detector installs a durable asymmetry between those who can accuse and those who must defend themselves without an instrument. It is worth noting that the Code of Practice requires signatories to the provider section to make detection mechanisms available, which argues for openness. The form it takes remains to be seen.
• Marking mechanically creates value in unmarked text. This is the least discussed consequence and possibly the most structural. If the entire Western industry marks its outputs, and locally run open models mark nothing, then unmarked text becomes a signal in its own right. Depending on who is reading, it will be taken as suspicious (“why does this text escape the system?”) or as premium (“this text never passed through a third party’s servers”). Both readings will coexist, and both reinforce the argument I made in Sovereign AI: why local open source became the only real independence and that Jensen Huang’s case for open models restated in his own way. Running your own models used to be a question of cost, confidentiality, and dependence. It is now also a question of traceability over your own intellectual output.

The logic has to be followed to its conclusion, because that conclusion is dizzying. A locally run open model does not merely fail to mark. It erases. A seven-billion-parameter model running on a developer’s machine is enough to reword a text, and that single operation degrades the watermark past the point of usefulness. No special skill required, no clandestine tool, no service to purchase. The workaround is the ordinary use of freely downloadable software, and it sits, by construction, beyond the reach of any regulation: you do not sign a code of practice with weights published on a repository.

The system therefore produces a hierarchy it almost certainly did not intend. Those who use proprietary models in good faith are marked. Those with local infrastructure are not, and can additionally launder whatever comes from elsewhere. The ability to run your own models stops being a technical preference and becomes a quiet privilege: the privilege of producing text whose origin cannot be read. We had sovereignty over our data. We are discovering sovereignty over our signature.

I am not writing this as a how-to, and the obvious use one could make of it does not interest me. I am writing it because a transparency mechanism that separates not the honest from the dishonest but those with infrastructure from those without produces the exact opposite of the transparency it promises.

What This Changes If You Build on Claude

A short section, for those of us who sell software.

The marking applies to the API. That means any product built on Claude delivers watermarked content to its own customers, who are not necessarily told. If your SaaS generates product descriptions, meeting summaries, support replies, or articles for your users, that content carries the mark, and a third party may one day detect it.

Anthropic explicitly refers each deployer to their own Article 50 analysis. That is legally correct and operationally uncomfortable: compliance is not inherited from the vendor, it is assessed at the level of your product. Three questions worth working through now if this touches you: what disclosure obligations do you carry toward your end user under Article 50(4), what do your terms of service say about the nature of the content you deliver, and do your customers know that what you are selling them is marked?

There is a second question, more technical, and I have not seen anyone raise it. Watermarking works by biasing logits, which means altering the probability distribution at sampling time. On prose, the operation is painless: at every position, language offers a dozen equally acceptable continuations, and preferring one over another costs nothing. On code and structured output, the situation is exactly inverted. A closing brace, an already-declared variable name, a comma in a JSON payload, a column identifier in a SQL query: these are near-zero-entropy positions, where a single continuation is correct and every alternative produces a syntax error.

In theory, a well-designed watermarking scheme never touches those positions, precisely because the bonus applied to green-list tokens is far too small to overturn an overwhelming probability. That is the expected behavior, and it also explains why the signal is naturally weaker in code than in prose: less entropy, less room to hide a watermark. But “in theory” is not “in practice,” and until the chosen parameters are published, no outsider can verify that the bonus is calibrated low enough never to flip a constrained position. The risk is not a model that becomes bad. It is rare, nondeterministic, hard-to-reproduce regressions in exactly the kind of task where you have stopped inspecting every output because you trust it. If you generate JSON at volume, SQL that executes automatically, or code applied without review, your schema validation and your compilation tests just became more important than they were last month.

To be clear, this is a matter for vigilance rather than accusation. No regression of this kind has been reported to date. But it is a question that legitimately belongs in the forthcoming technical documentation, and I find it more interesting than the legal compliance angle, because it concerns what the system does to the product rather than what it does to the law.

The Watermark Does Not Answer the Question We Are Actually Asking

The system deserves credit for what is solid about it. It is technically well founded, unlike the detectors it replaces. It is applied at the model level, which makes it coherent and hard to sidestep by simply switching surfaces. It ships with an honest list of limitations written by its own author, which is not as common as it should be. And it answers a genuine legal obligation, within a negotiated framework rather than an imposed one.

It simply does not answer the question people care about. What we want to know, when we ask whether a text is “AI,” is not which tool touched it. It is who thought, who worked, who made the decisions, who stands behind what is written. No statistical watermark measures that, and none ever will, because it is not a property of the text.

There is a continuity with what I wrote about LLMs as the ultimate copyright laundering machine, and it is close to ironic. These systems were built on works whose origins were never traced, credited, or paid for. They are now required to sign their output. The laundering machine marks what it produces, never what it consumed. Traceability stops precisely where it would start costing money.

What happens next depends entirely on a document that has not yet been published: the technical documentation for detection. If it arrives with measured false positive rates, an explicit length threshold, a detector open to everyone, and firm communication about what the signal does not prove, this will be a useful and modest transparency tool. If it arrives late, incomplete, with restricted access and vague language, it will become a suspicion machine, and I will have to rewrite this piece in a considerably less charitable register.

See you then.

Sources

• Anthropic, How Claude marks AI-generated content: support.claude.com
• European Commission, Code of Practice on Transparency of AI-generated Content: digital-strategy.ec.europa.eu
• European Commission, signatory list and adequacy assessment: digital-strategy.ec.europa.eu
• Reed Smith, analysis of the adequacy decision and the final Article 50 guidelines: reedsmith.com
• Bird & Bird, detailed reading of the Code of Practice: twobirds.com
• Kirchenbauer et al., On the Reliability of Watermarks for Large Language Models (robustness to paraphrasing)
• Watermark under Fire: A Robustness Evaluation of LLM Watermarking: arxiv.org/pdf/2411.13425
• Liang et al., GPT detectors are biased against non-native English writers, Patterns (2023)
• Robust Text Watermarking for Large Language Models via Dual Semantic Embeddings (resistance to translation): arxiv.org/html/2606.31602