AI Watermarks: "Processed" Is Not "Written"
Since 11 August 2026, everything Claude produces carries a mark. Not a logo, not a footer disclaimer: an invisible statistical skew in word choice, embedded at the model level itself. Image files get signed provenance metadata under the open C2PA standard.
The measure is global — "wherever Claude is offered" — and it covers the API, the app, the coding assistant, all of it. No opt-out is mentioned. The model itself doesn't know it's being marked.
The trigger is regulatory: Article 50 of the EU AI Act, in force since 2 August 2026, which requires AI-generated content to be flagged. Fines reach €15 million or 3% of global revenue. Anthropic chose to apply European compliance everywhere, not just in the Union. That's the familiar pattern: Brussels legislates, the world falls in line, because maintaining two pipelines costs more than complying once.
So far, nothing surprising. The interesting part is elsewhere, and almost nobody will pick it up.
What the mark actually proves
Anthropic says it in its own documentation, and it's the sentence everyone will skim past: the mark attests that Claude processed the content. Not that it wrote it.
The difference isn't rhetorical.
You write a piece end to end, alone, by hand. You paste it into Claude and ask it to fix your typos. What comes back is marked. It will carry the same signal as text generated wholesale by the machine.
Two radically different acts — writing and proofreading — produce the same binary verdict. And the mark says nothing about proportion: text that was 2% touched and text that was 100% generated both come back "marked."
Anthropic acknowledges two further limits, just as important:
- No mark ≠ human-written. An older model, a passage that's too short, an edited text carry no signal. Detecting nothing proves nothing.
- Detection didn't exist yet when the announcement went out. Technical documentation and an API are promised "soon."
That last point is what makes this theoretical today and urgent tomorrow.
It's not a stamp, it's an accent
An ink stamp is visible and can be cut out. This kind of mark is nothing like that — and the right image explains what destroys it.
It's a regional accent. Inaudible across three sentences. Identifiable across an hour of recording, by someone who knows how to listen. And if you translate the speech into another language, the accent vanishes entirely.
In practice, what survives and what doesn't:
| Survives | Destroys the signal | |---|---| | Copy-paste between windows | Paraphrasing or deep rewriting | | Light editing | Translation | | | Passages that are too short |
Nothing is hidden inside the text. No invisible characters to strip, no metadata to clean. It's a statistical property of the word sequence. The immediate corollary, and it should be stated plainly: it can't be cleaned, only drowned. Any substantial rewrite carries the signal away.
A note on the state of knowledge, in fairness. Anthropic has published neither a paper nor a specification of its scheme. The public academic literature describes a well-documented family of techniques dating back to 2023, and a comparable system runs in production at another major lab. But reasoning by analogy isn't measuring: what we know about the family doesn't automatically apply to Anthropic's system, which remains a black box.
The case of code
One point deserves stating, with its caveat attached.
Authors in the public literature document a property: the strength of this kind of marking depends on entropy. Where there are many equally valid ways to say the same thing, the skew settles in unnoticed. Where choices are constrained, there's barely any room to carry a signal.
Code is structurally constrained. Syntax isn't negotiable, API names are imposed, a loop doesn't get written ten different ways. The remaining degrees of freedom — variable names, comments, the ordering of independent blocks — are thin.
So the reasonable expectation is: near-zero signal on a short diff, possibly present in a large generated file with its documentation. But that's an expectation, not a measurement. It becomes testable the day the detection API ships: a raw generated file, the same file after an autoformatter, a forty-line diff. Three submissions, one answer.
On top of that comes destruction by the production chain: automatic formatting, human review, refactors, branch merges. Code that goes through a real pipeline has been reworked several times before it lands anywhere.
And one thing this marking does not change: ownership of the code. It's a regulatory provenance marker, not a claim. At best it says "a model touched this text."
Our position, written before anyone asks
An uncomfortable thing has to be said: erasing this mark requires no expertise at all. The mechanism is published, and the consequence follows in one sentence.
We won't write it here, and we won't automate it anywhere. For two reasons, only one of which is moral.
The first is positioning: you can't advocate for content traceability and publish an evasion manual. The two cancel each other out.
The second is simpler — we have no need for it. This blog is signed. Code passes through tools that destroy the signal long before publication. There's nothing to hide, so nothing to erase.
The real stake is elsewhere, and it's neither legal nor technical: it's perception. The day the detection API goes public, anyone will be able to test any public text — an article, a post, a newsletter. The test will return a binary signal, with no context. It won't distinguish "written by an AI" from "proofread by an AI."
The general public will read the second as the first. That's mechanical.
The right answer isn't to change methods to slip under the radar. It's to state your own in writing and first, rather than have it assigned to you. We write with models, every day, and we verify everything that comes out. That's something to claim, not to hide.
What to take away
A provenance mark doesn't answer the question people think they're asking it. It doesn't say "who wrote this text." It says "this text went through here."
Conflating the two turns a transparency tool into a machine for false accusations. The distinction fits in one word, and that word is already in the official documentation: processed, not written.
The rest — the detection API, the real limits on code, actual robustness — will be measurable in a few months. Until then, the only defensible position is the one you can state out loud.
On deterministic guardrails and why detection is never enough, see Detection Is Not Defense. On the cryptographic deadlines arriving through the same regulatory door, see Q-Day: The Cryptographic Deadline.