Explaining Anthropic’s New Watermarking Of Claude AI-Generated Outputs And What It Signifies For Society

Detecting AI-Generated Outputs

You might already know that there is a lot of handwringing that AI is generating tons of content and this is getting mixed in with human-written content. Trying to discern the AI stuff from human-written stuff is very hard to do. I’ve repeatedly noted that the so-called AI content detection apps are not reliable, and they should not be used since the false positives and false negatives outweigh their benefits; see my in-depth assessment at the link here.

The gist is that there is no suitable means to simply electronically scan text and definitively declare whether it was handwritten versus AI-generated. Be exceedingly cautious and skeptical when using or seeing the results of any AI-content detection tools. Worse still, some people think they can merely look at text and eyeball whether it is AI or not. They look to see if certain words are used or if a particular form of punctuation is used. This is not a likely method when it comes to modern LLMs. In the early days, the initial AIs were somewhat predictable and rudimentary about their vocabulary and punctuation. Nowadays, the AIs are computationally cleverer and can adroitly change wording and punctuation so that a signature of sorts is no longer readily discernible.

Furthermore, even if an AI is lazy and happens to use detectable patterns in the generated text, this can be easily overcome by anyone who cares to mask it. You can grab the generated text, do some quick editing, and get rid of those eyeball-obvious textual clues. Or you can simply tell the AI in your prompt that it is to generate its output in a manner that doesn’t showcase any discernible pattern. Have the AI do the grunt work for you.

Caring About AI Versus Human Content

You might be wondering why people care whether content is written by hand versus AI-generated. There are lots of good reasons to care.

First, if the expectation is that someone is supposed to handwrite some desired piece of text and is told explicitly to not use AI to do so, it would be quite helpful to have a means of determining whether the text they give you is on the up-and-up. A student in school might have been given a homework assignment and told to only compose the answers by their own hand and not dip into AI. The student goes home, and the next day comes to class and turns in the essay. Did the student write the essay, or did AI do the work for them? It is darn tough to figure this out, and false accusations can harm the innocent.

Second, a lot of the AI-generated content is being posted to the Internet. Sometimes it is labeled as being AI-generated. Most of the time it is not. When you come across a snippet of content on the Internet, you have no viable means of knowing whether it was hand-devised or AI-generated. Someone might falsely claim they wrote the content, trying to claim credit for something that AI did. For my analysis of how people are increasingly convincing themselves that they wrote AI-generated content because they merely entered a nifty prompt, see the link here.

Third, there are weighty concerns that the online world is heading toward a morass of AI slop. Some believe that AI-generated content tends to be of a poorer quality than human-written material. The scale of generating AI output can gradually exceed the pace at which humans produce written content. Overall, the Internet is striving toward being overly dominated by AI-generated posted content, which is a phenomenon known as the dead Internet theory. AI slop will beget more AI slop. Eventually, the Internet will be the lowest common denominator, and humans will mentally degrade accordingly (see my detailed explanation at the link here).

Fourth, AI laws are being enacted that require AI makers to ensure that their AI-generated outputs can be detected as produced by their respective AI. I’ve previously discussed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content; see my coverage at the link here, and noted that this AI law goes into force on August 2, 2026, causing AI makers to push forward on compliance with that law. Thus, AI makers are reaching a point where, rather than simply optionally marking their AI outputs, they are going to be legally required to do so.

Distinguishing AI Outputs

The head-scratching question arises as to how to discern that a written composition has been crafted by a human or via AI. That is the zillion-dollar question. It is much harder to do than might seem at first glance.

One approach would be to require AI makers to include a line in all AI-generated outputs that says the text was prepared by AI. A person who then opts to copy and send that output to someone else or post it online would be providing notice that the content is AI-produced. Easy-peasy, problem solved.

Of course, the world is never that straightforward. The embedded line that says the content was AI-generated can simply be lopped out. You can just clip out that line. No fuss, no real effort involved. The content then becomes ambiguously sourced.

A more capable approach entails having the AI write the output in a manner that will signify it is AI-produced, but do so in a non-obvious way. As per my point earlier, it used to be that AI commonly wrote by default in a fashion that gave clues to being AI-written. We can turn that idea in a different direction, forcing the AI to intentionally make use of patterns so that the content can be discerned as AI-composed. That’s the role of watermarking.

Watermarking Is Challenging

We are all aware of watermarking when it comes to paper-based materials and likewise for any tangible artifact that exists in a definitive physical form. A dollar bill can contain a watermark, allowing an eyeball to see whether it is real or counterfeit. Watermarks can also be hidden from visual inspection, requiring some other means to detect the watermark.

Watermarking for digital photographs and graphical images is more readily accomplished than with text since you can embed all sorts of digital ones and zeros that won’t impact the picture, but that can be detected by inspecting the binary representation. It is possible to use sophisticated mathematical algorithms to populate the bits in a manner that almost no one other than someone armed with the algorithm can later detect as being part of a special pattern.

Trying to watermark digital text is a beast of a different kind. Anything that is done to the text will potentially alter the words we see and impact the meaning of the text. If you had an algorithm that simply said to replace the word “of” with the word “and”, the resulting text, which is now presumably discernible as AI-written, is going to be nonsensical for human use.

Anthropic Announcement On Watermarking

In a posting on the Anthropic Claude support page on August 11, 2026, these points were made about their newly announced watermarking efforts (excerpts):

• “To support transparency and comply with our legal obligations, Anthropic is working to include machine-readable marks in content that Claude generates.”
• “Claude models launched on or after August 2, 2026, support marking at launch. We’re also working to add marking support to Claude models released before that date, and we’ll update this article as that becomes available.”
• “When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.”
• “Because the watermark is part of the text, it will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing.”
• “A detected mark provides a signal that content was processed by Claude, but is not fully conclusive.”

Let’s go ahead and unpack those indications.

Knowing If A Watermark Is Present

One notable aspect about the announcement is that we aren’t told what method is being used to perform the watermarking. On the one hand, you could emphasize that they should keep their method a secret. If they divulge how it works, people will instantly find ways to defeat it. Ergo, they remain mum about their secret method.

The other side of that coin is that the public has no ready means to figure out whether the watermark exists in a piece of content or not. If we don’t know the method, how are we to discern whether the watermark is there? The answer in the posting is that Anthropic says they are working on that aspect (“We’re also working to enable users and other third parties to detect Claude’s embedded watermarks and provenance metadata”).

Presumably, you will ultimately be able to take a piece of content and run it through a detection tool that will be provided by Anthropic or an authorized third party. They will be keeping the method close to their chest. I’m sure hackers will try mightily to reverse engineer the detectors and otherwise work steadily to crack the code of how the watermarking is being undertaken. That is one of those few surefire bets in life.

The Balancing Act Of Watermarking

There is a delicate balancing act associated with digital watermarking of text. The idea is to do something to the text so that it contains a watermark. Meanwhile, don’t do something so obvious that people will find and just strip out the watermark. The watermark must be hidden in plain sight and yet not cognitively trivial to discern. And, all the while, ensure that the text makes sense and retains whatever meaning it is supposed to possess.

This is a tall order.

A watermarking method that has been gaining popularity among AI makers performs a statistical uplift to instill a kind of patterning or veritable watermark during the generation of the words that are going to be output. In that sense, the watermarking is not done after the generated output is produced. Instead, it is done at the time of generating the content. This has some helpful advantages.

Example Of How It Works

Let’s look at a quick example to see how this can work. Imagine that AI is generating a response to a prompt and is doing so one word at a time. Each word is carefully chosen. The choice of which word to use is made from several possible words at each step.

Suppose the prompt was asking the AI how to make a ham sandwich. The AI might start assembling the response word-by-word and could have arrived at these choices: “Place a slice of ham onto a bagel and add mustard.” Each word was selected on a one-at-a-time basis, going from the start of the sentence to the end of the sentence.

When the AI got to the word about the bread, in this instance the word selected was “bagel”; there were several other options available, such as saying flatbread (statistical second choice), wheat bread (statistical third choice), white bread (statistical fourth choice), and other possibilities. Assume that “bagel” was the statistically top-ranked choice overall, and therefore chosen accordingly.

Aha, in the realm of watermarking, the AI might opt to intentionally choose the second choice rather than the top-ranked choice; thus, the sentence comes out as “Place a slice of ham onto a flatbread and add mustard.” If the AI consistently keeps picking the second choice for many of the words that are being chosen, this becomes a handy pattern for the AI. A human looking at the sentence doesn’t realize that the second choice is being chosen. They see a sentence that looks completely normal.

Detecting The Watermark

I think you can see that this statistical uplift is going to be quite hard to detect. Humans are unlikely to see the watermark by looking for any patterns in the wording. All the sentences are still going to make sense and abide by whatever the topic at hand is. The subtlety of picking the second statistically viable word on numerous occasions is a nearly hidden way of producing the watermark.

How does an authorized detection tool figure out if the watermark is present?

Aha, that’s the added trickery. The chances of any usual detection method ferreting out the watermark are low. A tool that is built knowing the method can examine the sentences and compare the word choices to the pattern of word choices that the AI would normally make. If the second word choice is consistently being encountered in the examined text, this is a strong indicator that the AI indeed generated that content.

We can make this method much more robust. Maybe instead of always choosing the second choice, the watermark process does something else. Suppose that 50% of the time the second choice is made, 30% of the time the third choice is made, and 20% of the time the fourth choice is made. This makes things even harder for anyone else to crack and find the watermark. An even stronger method includes having a secret cryptographic key that guides the watermarking process toward the preferred token patterns.

Breaking The Watermark

You might have observed that in the excerpted points of Anthropic, they said that the watermark will persist when the text is copied and placed somewhere else, and can tolerate some semblance of editing. First, the text, if kept entirely intact, is going to carry the watermark since it has that secret pattern of word choices. The question is how much editing can be done before the watermark breaks down and is no longer significant.

Pretend that I take the sentence that says to make a ham sandwich with flatbread, and I change the word to a bagel. Oops, I have marred the watermark. That might be okay as long as I don’t do a lot of editing to the text. The larger the body of text that was output and watermarked, the less harmful my few edits are. There will still be a lot of text that contains the watermark (a preponderance of statistical second choices).

The statistical signal of the watermarks might remain at some high percentage after my edits, perhaps 90% to 99%. That is enough to be somewhat sure that the watermark is there. If the watermarks remain at only 10% after my edits (not many of the statistical second choices), now things are getting dicey. The detection tool is going to be on thin ice to conclude that the watermark is truly there.

Not Foolproof

The crux is that the watermark is not a foolproof indicator. It could be that if I plop my ham sandwich sentence into a lengthy handwritten story about going to the beach, the one sentence isn’t going to be enough of a preponderance of the text to serve as a viable signal of a watermark. It gets lost in a sea of text. The statistical signal is getting diluted by the unwatermarked content.

This watermarking method, akin to nearly all watermarking methods for text, must be taken with a grain of salt. If a user collects AI-generated watermarked text and plunges it inside a large body of unwatermarked text, the watermark is then less viable. There are many more escape routes. If a user goes to one AI to generate text, then hands the text to another AI to do a rewrite, the odds are that the resulting text is going to end up no longer having a viable concentration of the watermark. The other AI is going to be making its choices of which words to select, no longer bound by the second-choice preference.

At least one nice thing is that if you hand the text to a different watermarking AI, which we’ll assume is using its own proprietary method, this other AI will be attempting to watermark the text as it is being rewritten. In that intriguing way, the former watermark might be lost, but the new watermark of this other AI might now be embedded. The disconcerting consideration is that because the former watermark is now gone, you won’t be able to determine where the text originated from.

The World We Are In

Now that you are aware of how watermarking can be undertaken, you might want to sit down for this next state-of-woe. Once people realize that AI is embedding watermarks, there are going to be some who go hog wild with this. They will not realize that this is all a statistical gambit. An AI detector that is well-devised should give an indication of the chances that the watermark exists, rather than simply saying the watermark is there or not there. We’ll have to wait and see how this goes.

Either way, we can expect that people will readily misinterpret the detection of the watermark. They will assume that even a tiny chance of the content having the watermark means that the person absolutely used AI to write the text, even though that’s not what the indication signifies. More twists will occur. Treacherous people will claim that the watermark exists, and thus point an accusing finger at authors, despite not even using a detection tool or disregarding whatever the detection tool says. They will simply lie, and others will indubitably assume that the text was checked via a detection tool.

You can keep going down this rabbit hole. Some people will use a detection tool that looks for a Claude watermark and feed it text that was produced by ChatGPT. The detection tool will say that it doesn’t originate from Claude. Voilà, the person proclaims that no AI produced the content. Wrong; it was produced by ChatGPT. On and on, these charades will arise.

A final thought for now. Niccolò Machiavelli made this famous utterance: “It is double pleasure to deceive the deceiver.” A societal shift toward embracing watermarking of AI content is not going to be the saving grace that many assume it will be. Numerous holes and pitfalls are on this road ahead. Be alert and especially watch out for the determinable deceivers.