On August 11, 2026, Anthropic updated a support document, stating that Claude will add machine-readable marks to generated content. Two mechanisms are involved: embedding an invisible watermark into text, and attaching C2PA signed provenance metadata to files such as SVG, PNG, and JPG. The document is candid, listing a series of limitations: for instance, detecting a mark only suggests that the content was “likely processed by Claude” rather than definitive proof; short paragraphs lack sufficient text to support a reliable signal; and signals may become undetectable after heavy editing, rewriting, or translation. The direct catalyst for this change is EU AI Act Article 50, which requires machine-readable marking of AI-generated content and officially took effect on August 2, 2026. Anthropic subsequently enabled it as a global default behavior.
When I saw this update, my first reaction was curiosity about what technical novelty it actually brings. Looking closely into the details reveals that over 90% of the logic behind text watermarking simply ports an already well-known primitive into a new scenario. That primitive is one that many encounter when performing generation control: intervening in the probability distribution during token sampling at each step.
The primitive of text watermarking is distribution intervention during sampling, which sounds like a purely technical action. But to understand why moving this action to a watermarking scenario becomes complex, one must step back and ask a more fundamental question: if we want to embed a detectable signal into AI-generated text, what must this signal withstand? Considering the demands of adversarial scenarios, the constraints that a watermark must satisfy can be summarized in three points.
First, selective perceptibility. These are two sides of the same constraint. To human readers, the embedded signal must be imperceptible, without compromising text quality, meaning, or fluency; yet to detection algorithms, it must exhibit statistical significance, enabling clear determination that the sequence of tokens did not stem from natural sampling. These two sides create a direct inherent tension: tune the bias to be as small as possible, and text quality is preserved, but algorithm detection confidence drops, yielding false positives; tune the bias to be as large as possible, and the algorithm easily identifies the signal, but human reading feels awkward. Both requirements must be satisfied simultaneously within a single perturbation magnitude.
Second, unforgeability. The embedder and the detector must share a secret key. To a third party without the key, watermarked generation output exhibits no feature differences from ordinary random sampling. Lacking this layer of cryptographic constraints, an attacker could selectively detect and remove watermarks, or forge watermarks to pollute detectors or frame others. This is an independently layered cryptographic constraint, orthogonal to the inherent tension of selective perceptibility.
Third, propagation survival. The signal must survive various processes of propagation, including copy-pasting, light editing, heavy rewriting, translation, truncation, concatenation, and mixing. If someone takes Claude’s output and feeds it to another model to rewrite, is the watermark still intact? This constraint is the hardest because rewriting by definition reconstructs the token sequence, causing statistical signals anchored at the token level to fail. Resisting rewriting requires placing signals at a semantic layer deeper than tokens, but that in turn introduces new dilemmas around cross-model representation differences.
Each of these three constraints carries its own inherent tension, collectively constituting the full problem space facing watermarking. Propagation survival is the most difficult corner among them—one that currently lacks an algorithmic solution.
Stepping back after listing these three constraints, the sampling intervention primitive used to satisfy them is not itself new. Most people building LLM applications have used structured output tools like JSON mode or guidance: under normal circumstances, at each step the model randomly picks one token from a set of candidates according to probability; JSON mode, prior to sampling, directly suppresses probabilities of tokens violating JSON syntax to zero, while guidance is more flexible, adding regex or syntax tree constraints to nudge the probability distribution toward “outputting a valid structure.” This is sampling intervention: artificially adjusting the model’s probability distribution when selecting the next token.
How large the bias is tuned determines how invisible it is to humans and how detectable it is to machines; this sampling intervention knob can balance the inherent tension of selective perceptibility to some extent, making it a good reference starting point. Watermarking and guidance use the exact same knob, but connect to entirely different constraints.
Comparing guidance with watermarking makes the differences crisp. guidance also intervenes in sampling, yet does not need to face any of the constraints mentioned above.
Regarding selective perceptibility, guidance allows arbitrarily distorting the distribution. When users explicitly require a specific format, it does not matter how wide the KL divergence gets, nor does it need to be imperceptible to humans. Regarding forgery risk, guidance operates on public rules, requiring no key and having no unforgeability requirements. Regarding propagation survival, guidance outputs are consumed downstream immediately upon generation, without undergoing rewriting. Regarding validation methods, guidance provides deterministic hard guarantees, without relying on long text to piece together soft statistical guarantees.
The same knob, when placed under different engineering requirements, diverges in trade-off directions. The knob is shared, but facing different problems leads trade-off choices down distinct paths.
The three constraints left unaddressed by guidance have already been confronted in production by Google’s SynthID. Published in Nature in 2024, it is one of the schemes in this family with relatively fully disclosed details.
Its prototype is the green-list mechanism proposed by Kirchenbauer et al. in 2023: before generating each token, a pseudo-random hash is run using the preceding context as a seed, randomly splitting the entire vocabulary into green and red groups, and making the model slightly more inclined to pick tokens from the green group. Humans cannot read any difference, but the frequency of green tokens in a piece of text systematically exceeds random chance, enabling a detector with the key to extract it statistically.
SynthID-Text introduced an improvement on top of this: instead of simply pushing probabilities toward the green group, it draws m candidate tokens from the model’s original distribution, scores them using m keyed pseudo-random functions, and selects the one with the highest score. This achieves bias while respecting the model’s original distribution, trading lower distortion for higher detection efficiency.
This stands as one of the most core algorithmic micro-innovations across the entire field. It specifically serves to harmonize the conflict between imperceptibility and detectability, independent of the format constraints of guidance.
As for the propagation survival corner, SynthID’s trade-off was to preserve selective perceptibility while forfeiting propagation survival: choosing lower quality costs and upper-medium detectability, but leaving the signal unable to withstand rewriting. Audit tests conducted by ETH Zurich SRI Lab on SynthID-Text revealed that rewriting alone could push the watermark removal success rate to over 90%. OpenAI also acknowledged similar findings in 2024, noting that such text watermarks can easily be bypassed through rewriting by another model, translation, or inserting special characters and subsequently deleting them. Rewriting by definition reconstructs the token sequence, thereby destroying statistical signals anchored at the token level.
Looking deeper into the details, a distinction must be made regarding the level of openness of SynthID. The Nature paper clarified the mechanism of text watermarking, and in October 2024 a reference implementation was open-sourced on Hugging Face, making the text line auditable at both mechanism and code levels. Online production keys, parameter configurations, and concrete settings during Gemini’s actual runtime remain undisclosed; image, audio, and video routes have not even opened their mechanisms to the public, with detectors held exclusively by Google. Only the text route can undergo academic auditing, while other types resemble unilateral vendor claims. Anthropic has not yet disclosed the specific algorithm for its text watermarking, making its overall transparency even lower than SynthID’s text route.
Placing this sampling intervention mechanism back into adversarial scenarios makes its true positioning crystal clear: it functions more like a filter than a serious forensic tool. In compliance or honest-use scenarios, when a platform wishes to quickly screen large-scale content for candidate sets suspected of being generated by Claude, as long as most content has not been intentionally rewritten, watermarking provides acceptable recall rates and derivable false positive rates. Faced with intentional, targeted adversarial attacks, an attacker need only perform a single model rewrite or cross-lingual translation to erase statistical signals with high probability. Treating statistical significance detection as authoritative forensic evidence is technically untenable.
Facing the natural shortcoming of propagation survival, the industry’s current pragmatic choice is adopting a defense-in-depth architecture. C2PA offers strong cryptographic guarantees but easily fails when encountering screenshots or re-rendering; sampling watermarks, while easily washed away, seamlessly survive pure-text copy-pasting. Their failure modes complement each other. The EU Code of Practice emphasizes a three-layer defense comprising C2PA, sampling watermarking, and logging, primarily because no single mechanism can cover all attack vectors alone. This design embodies a defense stack mindset—building protection through the complementarity of distinct failure modes rather than attempting to solve every problem with a single sampling knob.
Returning to the initial question: is there innovation in this technology? Yes, but only a small fraction—such as leveraging tournament sampling for fine-tuning within the inherent tension of selective perceptibility. The remaining 90% of the work ports a sampling knob originally intended for generation control onto a steganographic channel embedded with cryptographic constraints. As for the propagation survival dilemma that currently defies algorithmic solution, engineering practice opts to backstop it with defense-in-depth mechanisms and candid probabilistic positioning. This compromise and pragmatism may well be the posture such technologies must adopt when transitioning into real-world deployment.