Anthropic has signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, and published how it plans to implement it. Two mechanisms, one of which is straightforward and one of which is genuinely hard.
The commitments, in their own words:
- New models mark from day one. Claude models launched on or after August 2, 2026 support machine-readable marking at launch.
- Everywhere, not just the EU. Marks apply across Claude Platform (API), Claude, Claude Code, Claude Cowork and Claude Tag, "wherever Claude is offered, worldwide." AWS, Google Cloud and Microsoft Foundry carry the text watermarks; signed metadata varies by platform.
- Detection tooling is promised so third parties can check whether text or a file carries a Claude mark.
- Older models are being retrofitted under the law's transition period.
Two things are being marked, and they are not equally difficult.
Files: solved, and boring in a good way
For SVG, PNG and JPG, Claude attaches signed provenance metadata following the C2PA standard — the same Coalition for Content Provenance and Authenticity work behind camera and Adobe provenance. A cryptographic signature travels in the file's metadata, and anyone with the public key can verify it.
This part is well-understood engineering. It is also trivially strippable: one pass through an image optimiser, a screenshot, or exiftool -all= and the metadata is gone. C2PA never claimed otherwise — it proves presence, not absence.
Worth noting for anyone running a publication: SVG is on that list. Every hero image on this site is an SVG, so if you generate diagrams with Claude, signed provenance is coming along for the ride whether or not you asked for it.
Text: the interesting problem
Here the announcement says what but not how: "an imperceptible watermark directly into the text itself" that "will travel with the text when it's copied and pasted elsewhere, and may persist through some editing."
No technical detail has been published yet. So the rest of this is informed speculation about the available approaches — clearly labelled as such, because Anthropic has committed to publishing specifics later and this may not be what they picked.
The naive option: invisible characters
The obvious approach is to hide a signal in characters the reader never sees — zero-width spaces, or homoglyphs: swapping an apostrophe or a Latin letter for a visually identical Unicode codepoint.
This is not hypothetical for Anthropic. In March 2026 Claude Code shipped exactly that: it checked the local timezone for Asia/Shanghai or Asia/Urumqi, scanned any active proxy URL against a list of Chinese AI-lab domains, and on a match altered the date format and swapped the apostrophe in "Today's date is" for a lookalike. Portions were XOR-obfuscated with the key 91. An engineer on the Claude Code team described it as an experiment "meant to prevent account abuse from unauthorized resellers and protect against distillation." It was removed in the July 1 release.
Which tells you both that the technique is on the menu, and why it will not be the answer here. A homoglyph mark dies to a one-line sed. It also cannot survive the thing the announcement explicitly promises — persistence "through some editing."
KGW: bias the vocabulary
The first serious family comes from Kirchenbauer, Geiping, Wen et al., usually shortened to KGW. At each step, hash the secret key together with the preceding tokens and use that to split the vocabulary into a green list and a red list. Add a small bias δ to every green logit. The model still writes fluent text, but green tokens win slightly more often than chance.
To detect, recompute the same split with the key and count green tokens. A run of natural text sits near 50%; a watermarked run sits measurably above, and a z-test turns that into a confidence.
The cost is right there in the mechanism: it distorts the distribution. The model no longer emits what it would otherwise have emitted. Small δ is hard to detect in short passages; large δ is robust but makes the model write oddly.
Christ and SynthID-Text: bias the sampler instead
The second family, from Christ, Gunn and Zamir, tries to embed a signal without changing the output distribution. The deployed example is SynthID-Text, which Google uses in Gemini, built on tournament sampling.
It works like a knockout bracket. Draw 2^m candidate tokens from the model's true distribution and pair them off. Each round computes a bit per candidate:
hash(key, preceding tokens, round number, token id) -> 0 or 1The candidate scoring 1 advances. After m rounds one winner remains and becomes the next token. Because candidates are drawn from the real distribution, the scheme can be tuned to preserve it in expectation — the model is not pushed toward "wrong" tokens the way δ pushes it.
It is not free either: repeated tournaments reduce diversity across different answers to the same prompt. The bracket keeps picking the same winners.
Why neither survives a determined user
Both families share a weakness that no amount of cleverness fixes: the mark lives in token choice, so changing the tokens destroys it. Paste the output into any local model and ask it to rephrase, and the watermark is gone. That costs a motivated person one prompt on hardware they already own — the kind of setup we measure regularly here.
Because the key is fixed and the scheme deterministic, there is also a research literature on attacking it directly:
- Watermark stealing — probe the API enough and you can estimate the green/red split well enough to forge marks, or strip them precisely.
- Watermark distillation — train a student model on watermarked output and the watermark behaviour can transfer, which is awkward given that anti-distillation was the motivation for the Claude Code experiment in the first place.
The limits Anthropic states itself
To their credit, the help-centre article does not oversell it:
- A detected mark "provides a signal that content was processed by Claude, but is not fully conclusive."
- Claude may not be the author at all — it may have proofread, translated, summarised or converted someone else's work.
- Absence of a mark proves nothing: heavy editing, an older model, or an unsupported platform all remove it.
That last point deserves emphasis, because it is where public understanding will break. A mark means Claude touched it. No mark means nothing whatsoever. Any policy built on "we scanned it and found no watermark, therefore a human wrote it" is built on sand.
Checking it yourself, today
We went looking on our own site. Every hero illustration here is an SVG, several written by Claude, and the social images are PNGs generated from them — so if file marking were in effect we would expect to find it. We checked all 17 SVGs for provenance markup and both recent OG images for a C2PA manifest, and scanned this article's own text for zero-width characters and homoglyph substitutions.
Nothing. No C2PA box in any PNG, no provenance element in any SVG, no invisible characters in the prose. Which is the expected result rather than a contradiction: marking applies to models launched on or after 2 August 2026, retrofitting is still in progress, and these particular files came out of an API response and a Python script rather than a surface that signs downloads.
That last point exposes a boundary the announcement does not address. An SVG that a model emits as text in a response is text, not a file. It arrives as XML in a chat completion, gets written to disk by your own code, and never passes through anything that could attach a signature. So does it carry the text watermark, the C2PA signature, or neither? For anyone whose diagrams, configs or code are generated this way — which is most developer use — that is the case that matters, and it is unanswered until the technical documentation lands.
You can run the same checks without installing anything:
# C2PA manifests live in a JUMBF box — its marker survives a plain strings dump
strings image.png | grep -ci 'c2pa\|jumb'
# provenance markup in SVG
grep -il 'c2pa\|<metadata\|provenance' *.svg
# zero-width and invisible characters in text
python3 -c "import sys;t=open(sys.argv[1]).read();print(sum(ord(c) in (0x200b,0x200c,0x200d,0xfeff,0x2060) for c in t))" file.txtA statistical watermark will not show up in any of these — that is the entire point of it, and detecting one requires the key and Anthropic's promised tooling. What these checks can tell you is whether a file carries provenance metadata, and whether someone reached for the naive approach.
Will this make the models worse?
The natural worry: if the sampler is being nudged, does output quality drop — and does code get worse?
Probably not much, and here is why. Watermarking needs entropy to hide in. It works by choosing between candidates that were all plausible, and code has far fewer such moments than prose: after def foo( there is not a green-list alternative to self. Every practical scheme therefore only marks positions where the distribution is broad enough, and skips the rest. Low-entropy text — code, structured output, JSON — is largely watermark-free as a side effect, which also means it is the hardest content to mark at all.
So the quality worry is smaller than it looks. The real cost is the asymmetry: the mark is removable in one paraphrase by anyone who cares, and permanent for everyone who does not. It burdens the compliant and barely inconveniences the determined — which is a familiar shape for compliance-driven engineering, and worth saying plainly rather than pretending the technology is stronger than it is.
What it is good for is provenance at scale: spotting that a flood of submissions came from a model, that a dataset is contaminated with synthetic text, or that a document has model output in it. Signal, not proof. Anthropic says exactly that, and the detection tooling — when it ships — should be judged on whether it makes the uncertainty legible rather than hiding it behind a confidence score.
What to do about it
- If you publish in the EU with AI assistance, this is now a fact about your pipeline rather than a choice. Marks will be present in Claude output by default, worldwide.
- If you generate images or SVGs, expect C2PA metadata. Check whether your build step strips it — most optimisers do — and decide whether you want that.
- If you rely on detection, do not. Absence of a mark is not evidence of human authorship, and the vendor says so first.
- If you were declaring human authorship anyway, the machine-readable version is arriving to sit alongside it — which is the same argument we made for saying so explicitly.