AI now signs everything it writes in invisible ink. And it takes three minutes to strip.

In early August 2026, Anthropic announced that Claude models released on or after 2 August embed an invisible watermark in the text they generate, in line with the transparency obligations of the European AI Act. One question immediately follows: does it hold?

This article answers at three levels. What the vendor has confirmed. What belongs to the public technical debate and is therefore only a hypothesis. And what all of this means for the subject we actually care about here, photo watermarking.

What is confirmed

How this kind of watermark can work, technically

Hypothesis 1: the watermark is injected at sampling time. A language model does not produce words, it produces at each step a probability distribution over its vocabulary, typically 100,000 to 200,000 tokens. The next word is drawn from that distribution. Every published scheme intervenes at that drawing step, not afterwards on the finished text. If that is the case here, it would directly explain the confirmed fact that the watermark survives copy and paste: it would not be around the text, it would be the text.

Hypothesis 2: the green list mechanism. The reference scheme, published by Kirchenbauer and coauthors in 2023, works like this: for each word or word fragment to generate, the system uses the preceding tokens and a secret key to split the possible choices into two groups, a "green list" representing a fraction γ of the vocabulary, often 25% or 50%, and a red list. The model remains free to choose from both, but green tokens get a slight advantage in its probabilities.

The important subtlety is that the green list changes at every position. A word can be green in one sentence and red in another: there is no fixed list of "AI words". By repeatedly giving that small advantage to green choices, the finished text statistically contains more of them than a normal text. The detector, which holds the key, can reconstruct after the fact the expected lists at each position and count how often the text falls on the green side. Over a few words, that proves nothing. Over several hundred tokens, the gap can become statistically significant.

Put differently, the watermark is not a hidden character inside the text: it is a slight statistical anomaly in the sequence of words the model chose.

Hypothesis 3: or a distribution-preserving variant. Another family, popularised by Scott Aaronson, does not bias probabilities but replaces the random draw with a deterministic draw driven by a pseudo-random sequence derived from the key (the Gumbel trick, or exponential sampling argmax r_i^(1/p_i)). Statistically, the text follows exactly the same distribution as unwatermarked text, so the marking is undetectable without the key while remaining correlated with the secret sequence for whoever holds it. This family does not degrade text quality, which makes it more credible for a commercial product. Between the two, I lean towards this second option, but that is an intuition, not information.

What is certain in every case: detection is a statistical test, not a read. The detector replays the hash on the suspect text, reconstructs the expected lists and counts the matches. On unwatermarked text, you expect around γ·T matches over T tokens. A score is computed:

z = (observed matches − γT) / sqrt( T · γ · (1 − γ) )

A z of 4 corresponds to a false positive probability of roughly 1 in 30,000. Two non-negotiable consequences, whatever the scheme. Confidence grows with the square root of length: you typically need several hundred tokens, meaning 150 to 300 words, for a usable score, so a headline or a text message will never prove anything. And detection stays probabilistic by construction: it never says "this text comes from Claude", it says "the probability that unwatermarked text shows this distribution is 1 in X".

The hard limit is entropy. You can only bias a choice when several plausible options exist. When the model is nearly certain of the next token, there is no room, and forcing a token would produce an error. Serious schemes skip those positions. A reasonable hypothesis follows: constrained text carries little or no watermark. An exact quotation, an address, a formula, a short factual answer, code with imposed syntax, a faithful translation. The marking would therefore work best on long, free-form text, which is to say precisely on essays and articles, consistent with the stated target.

A trade-off that cannot be engineered away. Since the hash depends on preceding tokens, any insertion or substitution locally breaks synchronisation. You can make the scheme more edit-resistant by shrinking the hash context window, but you then make it easier to reverse-engineer for anyone able to query the model at scale. Robustness and resistance to reverse engineering pull in opposite directions. There is no setting that wins on both.

Stripping the watermark

Anthropic has acknowledged that heavy editing, paraphrasing and translation can render the watermark unreadable. From that statement, the following hypotheses can be drawn.

• Have another model rewrite the text, typically an open model running locally and therefore unwatermarked. This would be the most effective and cheapest attack, since it removes the very condition the marking depends on: the choice of words.
• Rewrite by hand, substituting synonyms and restructuring, provided a significant share of the text is touched.
• Translate then translate back, since going through another language redistributes the vocabulary entirely.

What should change nothing, on the other hand, and this is where many people get it wrong. Pasting the text into a plain editor to remove formatting would be pointless: in the mechanism described above, the watermark is not in the font, nor in the spaces, nor in the metadata. It is in the token choices themselves. If the words stay the same, the signal stays the same.

The same goes for retyping the text by hand. The detector does not know whether the words were pasted or typed. Technically, reproducing the exact same text reproduces the same tokens and therefore the same statistical signal.

Finally, asking for ten arguments and keeping only five does not necessarily remove the bias. It mainly reduces the amount of data available to the detector. The proportion of green tokens should, on average, stay abnormally high, but the score becomes less reliable because the text is shorter. That distinction matters. Weakening detection by shrinking the sample is not the same thing as removing the watermark.

One nuance that matters. Every workaround has a cost, and that is probably the real point of the measure. If a human reads and rewrites everything, we are no longer facing unsupervised automated output but assisted work, with someone taking responsibility for it. If a second model does the job, quality degrades with every pass. For the industrial production of empty content and fake reviews, the friction is real. For an individual case, an assignment, a false declaration, a dispute to build, the workaround takes minutes and requires no skill. My hypothesis: the watermark will reduce the volume of automated content, not targeted fraud.

Photo watermarking

Anthropic's announcement is about text, but marking started with images, and that is where the fraud stakes sit. A fake sentence costs no one money. A fake photo of a damaged parcel does.

What is established. Google has watermarked its generated images since 2023 with its SynthID technology, and has since extended it to audio, video and text. In parallel, the C2PA standard, backed by Adobe, Microsoft and Google, attaches a signed provenance history to a file, indicating which tool created the image and what modifications followed. The two approaches are complementary: one lives in the pixels, the other in the metadata. We cover the second one in our article on C2PA.

How it works, in principle. An image watermark is not hidden in a corner of the picture, it is spread across all pixels as a very low amplitude pattern, imperceptible but statistically correlated with a key. For a generator, you can go further and bias the initial noise of the diffusion process, so the image carries the marking from creation rather than afterwards. Detection is, again, a correlation test that returns a score, not a binary verdict.

Why image watermarking is structurally more solid than text watermarking. This is analysis, not vendor data, but it rests on a simple reality: a 12-megapixel photo offers tens of millions of values that can be altered with no visible consequence, whereas a 500-word text offers only a few hundred choices, part of which are constrained by meaning. The hiding capacity is not remotely comparable. An image watermark therefore has considerable redundancy margin, which lets it survive transformations that would completely destroy a text marking.

What Google claims, and what remains unverified. Google states that SynthID resists common modifications such as cropping, resizing, compression or added filters. That is a vendor claim. To my knowledge there is no large-scale independent public evaluation establishing how far that resistance actually goes, or at what level of degradation the score becomes unusable. Treat it as a credible claim, not as a measured fact.

Plausible workarounds on the image side

• Re-photograph the image, or screenshot it. You go back through a physical sensor or a rendering pipeline, which can break the fine correlation and strips all C2PA metadata along the way.
• Recompress aggressively, resample, add grain. You degrade the signal until the score falls below the detection threshold. The cost is visible: the image loses quality.
• Run the image through a second model in image-to-image mode, or through an upscaler. Every pixel is rebuilt, so the original pattern does not necessarily survive.
• Never use a watermarking tool in the first place. This is the most mundane and the most radical workaround. An open image generation model installed on a personal computer marks nothing at all. No technical obligation applies to software running offline on someone's machine.

That last point is decisive and applies to text as well. Marking depends entirely on the cooperation of whoever generates the content. The players who comply are the legitimate ones. Someone building a false insurance claim or a fake parcel dispute will specifically avoid the tool that leaves a trace. Watermarking makes honest content traceable, it does not make dishonest content detectable.

And the most important point for a seller or an insurer: an image watermark never tells you anything about a real photo. It answers the question "did this image come out of that generator?". It never answers "does this photo really show this object, on this date, in this condition?". An authentic photo has no watermark, and neither does a photo generated by an unwatermarked tool. From a detector's point of view the two look identical. Visual clues still have value, and we listed them in our detection guide, but they are chasing generators that improve faster than they do.

The right question is not "is this AI?" but "where does this file come from?"

The whole watermarking paradigm, for text as for images, rests on negative proof: demonstrating that content is artificial. It depends on the generator's cooperation and collapses the moment that cooperation disappears. The opposite approach is positive proof, produced at the source by the person who has an interest in being protected. A photo taken with CertiPix is signed at the moment of capture, timestamped, then anchored independently. There is nothing left to estimate afterwards: either the proof exists and matches the file, or it does not. A file modified after signing no longer matches, and nobody needs to compute a probability to see it. You move from a statistical test, with its false positives and false negatives, to a deterministic check.

One honest caveat: the absence of a certificate does not prove a photo is fake, just as the absence of a watermark does not prove a text is human. Proof at the source is not there to accuse others, it is there to defend yourself. On a marketplace, in an insurance claim or at a handover of keys, whoever can produce a certified photo does not have to convince anyone, they show. The discussion ends there.

What it changes in practice

For an individual seller, nothing changes day to day, except the confirmation that waiting for a future universal detection tool is a bad strategy. The right answer to a disputed photo is still the timestamped photo taken at the right moment, before shipping and on delivery. For a marketplace or an insurer, a watermark score is one signal among others, never sufficient evidence to refuse a refund or close an account. For a school or a publisher, same message: a score opens a conversation, it does not close a case. And for everyone, Anthropic's announcement has one merit, that of bringing into the open a debate that had stayed technical. Marking generated content is a good thing. It will never replace being able to prove the origin of what you produce yourself.

A watermark tries to prove that content is artificial, and therefore depends on whoever generated it. Proof at the source demonstrates that a file is authentic, and depends only on you.