On August 11, Anthropic announced it would embed invisible watermarks in text generated by Claude (I covered it in that day’s briefing). The next day, TechCrunch ran a follow-up whose headline says it all: Some Claude users are mad that Anthropic’s new watermarks will catch them cheating at their jobs and classes.

One Reddit user quoted in the piece put the fear this way: “Who will get caught? You. The student who used Claude to reorganize a paragraph. The journalist who asked the AI to summarize a two-hundred-page transcript. The writer who had creative block and asked for synonyms. Those guys come out of the process with a digital tattoo on their forehead.” Another called it “a very sinister direction to take” and aimed the irony at the industry’s own record: watermarking users’ output is “terrifyingly ironic given how many of the frontier models came by their training data.” The supporters were just as loud. The bluntest of them: “There is literally no good argument for why this isn’t a good idea. The only reason you wouldn’t want this is to lie to people.”

The two camps are not arguing about the same thing. To see the dispute clearly, you need answers to two separate questions: what can this watermark technically detect, and who actually owns the “getting caught” problem?

The facts first: this is a compliance move

The immediate trigger is Article 50 of the EU AI Act: providers of generative AI must mark synthetic content in a machine-readable format, an obligation that took effect on August 2, 2026 (EUR-Lex full text). Violations carry fines of up to €15 million or 3% of global annual turnover, whichever is higher (Euronews). Alongside the hard obligation sits a voluntary Code of Practice on marking and labelling of AI-generated content, drafted by independent experts with the European Commission facilitating: first draft in December 2025, final version in June 2026. Anthropic confirms on its official help page that it is a signatory.

That help page is the most detailed first-hand description of what Anthropic is doing that I’ve been able to find. For text: an imperceptible watermark that doesn’t change the meaning, quality, or readability of the output, survives copy-paste, and may persist through some editing. For generated files in supported formats (.png, .jpg, .svg): digitally signed provenance metadata following the C2PA standard, an open content-provenance spec that works like a tamper-evident certificate of origin attached to the file (specification). The rollout is worldwide, not EU-only, and covers every entry point: the API, claude.ai, Claude Code, and Claude served through AWS, Google Cloud, and Microsoft Foundry. Models launched after August 2 carry the marks from day one; older models are listed as “in progress,” with no completion date from Anthropic. The regulation does set one clock: a transitional provision adopted this July gives systems already on the market before August 2 until December 2, 2026 to comply (Regulation (EU) 2026/1744; Commission FAQ). Which means that, depending on which model you’re on, the one you are using at this moment may not be watermarked yet.

The sentence in that help page most worth holding onto: a detected mark indicates the content “may have been processed by Claude,” and Anthropic states plainly that this is “not fully conclusive.” That sentence is the key to the entire controversy. I’ll come back to it.

Mechanism: how a watermark hides in ordinary words

Anthropic hasn’t published its algorithm, and says technical documentation for detection is coming later. But text watermarking has mature, public methods in the research literature and at competitors (the European Commission commissioned three technical studies of marking and detection techniques as the evidence base for the Code of Practice), which give us something to check against.

The best-known family in that public literature is the statistical sampling watermark. A language model produces text one token at a time: before writing each word, it holds a list of candidate words, each with a probability. The watermarking algorithm uses a secret key, held only by the vendor, to designate a subset of those candidates as “favored” at every step, and quietly boosts their probability. Any individual sentence looks completely normal, because the boosted words were plausible choices anyway. But across enough text, re-scoring with the same key shows the favored words appearing at a rate natural writing wouldn’t produce, and a statistical test can call it. This method was published back in 2023 (Kirchenbauer et al.); there is no fixed length threshold for “enough,” because the paper’s detection statistic scales with token count and with how strongly the sampling was biased, so what’s detectable depends on the algorithm’s parameters and the text itself. Google DeepMind’s SynthID takes the same route of adjusting candidate-token probabilities during generation (official technical post), with a different algorithm, already live in Gemini.

This principle happens to explain every property on Anthropic’s help page. Copy-paste doesn’t remove the mark, because the words are still the words. Heavy rewriting, translation, and blending in your own prose can defeat it, because the words get swapped out and the statistical signal is diluted. Short passages often can’t be reliably flagged, because a statistical test needs sample size. The other family of techniques stuffs special characters into the text at the character layer, such as the zero-width space, invisible to the eye; but those characters can be found and stripped programmatically, with Unicode normalization or a simple character filter, so their transparency value is low. Judging from the published properties, Claude’s watermark looks like the statistical sampling family. That is my inference, not a confirmed fact: Anthropic hasn’t said, and the public information doesn’t rule out a character-level or hybrid scheme. Everything below that leans on this assumption inherits that uncertainty.

What it can detect, and when it fails

Connect the boundaries above. Per the properties Anthropic lists, what leaves a record is Claude output that is long enough and used essentially verbatim. Paste a full response into an assignment, a report, an email, and the watermark travels with it.

What will likely go undetected: heavily rewritten text, text translated into another language, short sentences and fragments. Anthropic lists these as conditions where the mark may fail, and Google says the same about SynthID: the signal is badly weakened and misses become far more likely, though neither company calls it absolute. And the most important limit: the watermark cannot distinguish “written by Claude” from “touched by Claude.” Write an entire piece yourself, hand it to Claude to fix typos, and the text that comes back may carry the mark. The watermark’s semantics are “processed,” not “ghost-written.”

Now the bypass routes, taken one at a time, still on the unconfirmed assumption that Claude uses statistical sampling. Retyping everything from the screen sounds like the most thorough laundering and is useless against this family: the mark lives in which words were chosen, not in the file or the characters (Kirchenbauer et al. detect it by re-scoring the token choices themselves), so typing the same words back out carries the mark along intact. Retyping only defeats character-level tricks like zero-width spaces. Having another vendor’s model rewrite the text really can dilute Claude’s statistical signal; paraphrase and translation weaken these watermarks, as both Kirchenbauer’s group and Google acknowledge, though the same group’s follow-up study found that even after strong human paraphrasing, the signal was still detectable once roughly 800 tokens had been observed. And if that vendor also watermarks (SynthID is already live in Gemini), the rewritten text may pick up their mark instead, and whether anything gets flagged then depends on text length and each detector’s threshold. Not a sure win. Counting it all up: the two exits that need no technical skill are rewriting heavily by hand and starting with an unwatermarked model. The attack literature catalogues more elaborate options, none of them a guaranteed miss. What the simple exits demand is extra effort, or a different tool.

If that picture is right, it points the opposite way from the anger. My read, and this is a judgment about incentives rather than anything backed by deployment data, is that the watermark doesn’t filter for the people most determined to cheat; it filters for the people least on guard. Anyone deliberately concealing AI use has ready exits; what gets recorded is the usage that never thought to defend itself. That is the true part of the “digital tattoo” line.

One more detail will decide how this plays out: who holds the detector. Anthropic has not released a detection tool. Google’s SynthID detection portal is rolling out to early testers, with a waitlist open to journalists, media professionals, and researchers (announcement). If detection capability is granted only to platforms and institutions, ordinary people can’t even check whether their own text carries a mark. The information asymmetry between the detectors and the detected deserves more scrutiny than the watermark itself.

Who owns “getting caught”

The EU’s division of duties is written down: marking the content is the model provider’s legal obligation (Article 50(2)); the everyday boundary of “does using AI break the rules” sits mostly with schools and employers, with law and sector regulators drawing only the outer perimeter. The first duty has had fines behind it since August 2. As for the second, I haven’t seen statistics on how many organizations have put their AI policy in writing; all I can say is that in the settings I’ve personally encountered, nobody had. The student “who used Claude to reorganize a paragraph” panics precisely because nobody ever told them whether that counts as a violation.

The watermark converts that blank from deferrable to overdue. Here is my worry, and it is a prediction rather than something I can document: organizations without written rules will be tempted to use detection results as the rule. When a probabilistic signal gets plugged into an enforcement pipeline, the confidence details tend to get dropped along the way; “may have been processed” becomes “violation” at the front line, and the burden of proof lands on whoever got flagged. The help page says detection is not conclusive. Disciplinary processes don’t read help pages.

Go back to “the only reason you wouldn’t want this is to lie to people.” That line holds only if there is a consensus on what counts as lying. Right now there isn’t: the same act, using Claude to reorganize a paragraph, can be an encouraged productivity habit at one company and academic misconduct in one course. The watermark can measure “a machine touched this.” It cannot measure those boundaries. Only rules can set them.

Where I land

For individuals, there is one main line: don’t fight this at the technical layer, go get the rules stated. Researching how to scrub the watermark is a waste of time. The conditions where it fails are effectively published already, and the mark’s evidentiary vagueness cuts both ways: it can’t convict you of cheating, and it can’t clear you either. What actually protects you is one written sentence saying “AI is allowed for this kind of task.” Until such a rule exists, setting your working assumption to “any text a new model produces may be identifiable” is more reliable than betting the detector will miss.

For the industry: Article 50’s marking obligation covers generative AI providers in the EU market, with carve-outs for systems that only provide standard editing assistance or don’t substantially alter the input (Article 50(2)). Google already has the technology in production, and the compliance direction is fixed. On this trajectory, I expect text watermarking to become a factory default for mainstream models; that is a prediction, not a done deal. Even then, “did you use AI” will not become a one-test certainty: what a watermark gives you is a probabilistic signal tied to one vendor’s key, which is how the schemes public today work, and short or heavily rewritten text will keep slipping through (Google’s own framing). But for output that is long enough and used verbatim, the question will be far more measurable than it is today. Whether there is a written rule about how you’re allowed to use AI, though, remains a question every organization has to answer for itself. That answer is what the watermark actually forces.

References