What It Actually Detects — and What It Can Never Prove

Since August 2026, text generated by Claude carries an invisible watermark. It survives copy-and-paste, format conversion, even retyping. If your company uses AI anywhere in its content pipeline — and most now do — you need to understand exactly what this mark reveals, where it fades, and what no detector can legitimately claim about your work.

Consider a simple sentence: “The weather was cold and…” What comes next? Perhaps “overcast”. Perhaps “grey”. Both are perfectly natural, and no reader on earth could tell you which a human would have chosen. It is precisely in that gap — the choice between two equally good words — that Claude’s watermark now lives.

The strangest property of this watermark is that nothing is added to the text. No hidden characters, no zero-width spaces, no metadata. You can paste the text into Notepad, run it through three converters, retype it by hand — the mark remains. Because the mark is not something written into the text. The mark is the pattern of which words were chosen.

This matters to any business that uses AI in sales collateral, documentation, marketing, code or client communication. A growing number of platforms and buyers are developing a reflex: detect AI involvement, discount the content. We think that reflex is wrong — work should be judged by its outcome, not its toolchain — but it exists, and it is about to be armed with far better instruments. Understanding how those instruments actually work is the difference between managing the risk and being blindsided by it.

Why this happened now

This is not a company initiative. On 2 August 2026, the EU AI Act’s transparency obligations took effect: providers placing generative AI on the European market must mark generated content in a machine-readable way. Roughly 190 organisations — Anthropic among them, alongside every other name you would expect — signed the accompanying Code of Practice on AI content transparency.

The detail worth noticing: Anthropic states it has enabled the watermark globally, not just for European users, because it has no reliable way to segment the feature by region. A European regulation has, in practice, become a worldwide default. Wherever your business operates, the text you receive from the model is marked.

What the watermark is not

Three very different things circulate under the name “AI watermark”, and they are constantly confused.

It is not hidden characters. The old story about models embedding zero-width symbols between letters describes a fragile trick that dies with a single “paste without formatting”. Anthropic is explicit: nothing is inserted into the text.

It is not metadata. Metadata is a label attached to a file — that mechanism exists, and it is used for images, which we cover below. Text carries no label.

And it is not style analysis. The “AI detectors” that have wrecked students’ and writers’ reputations by guessing from stylistic habits are a fundamentally different — and far less reliable — technology. A watermark does not read handwriting; it checks against a key.

How it actually works

A language model does not write a paragraph the way a person does. It generates one token at a time, and at each step it produces a ranked list of candidates. “Overcast” — highly likely. “Grey” — also highly likely. Something absurd — statistical noise, already filtered out.

When two or three candidates are roughly equally good, what breaks the tie? Randomness. Literally a random number generator — which is why the same question asked twice yields two slightly different answers.

The watermark replaces that dice roll. Instead of a genuinely random number, the model uses a number computed from a secret key and the few preceding words. To any reader, the choices still look random. But they are no longer random — they are reproducible. Whoever holds the key can take a finished text and ask: does this chain of word choices match what the keyed model would have produced? From that, a probability that Claude was involved.

Anthropic’s own analogy is a good one. Imagine a game of Monopoly where, instead of rolling a die, you open a book containing a million digits of pi at a random page and read off consecutive digits each turn. The players notice nothing — pi’s digits are indistinguishable from chance at the table. But anyone who later compares the game log against pi can prove which book the game was played from.

Two important corrections to common myths. The watermark does not make the model favour particular words: in one sentence it will pick “overcast”, in the next “grey”, because the computation depends on context. And it never pushes the model towards odd or exotic vocabulary — the selection happens only among candidates the model was already considering. The technology, called SynthID and developed by Google DeepMind, operates after the model’s quality filters, as a tie-breaker among finalists that would all have been acceptable answers.

Does quality suffer? Anthropic reports no measurable effect on content, creativity or readability in internal testing. DeepMind’s evidence is stronger still: they silently switched a portion of live Gemini traffic to watermarked generation and compared user feedback at scale. No statistically significant difference — and none in controlled side-by-side human evaluation either.

How detection works — and why its honesty matters

The detector does not deliver verdicts; it reads probabilities. Crucially, it has three outputs, not two: watermark present, watermark absent, and inconclusive — with configurable thresholds between them.

That third state is the healthiest thing in the entire design. The damage done by style-based AI detectors over recent years came precisely from confident percentages issued where no confidence was possible. A system entitled to say “insufficient data” is a categorically better instrument than one that always answers.

Anthropic has said it will offer detection through an API rather than releasing the detector publicly — a sensible middle path, since a public detector is effectively a training rig for erasing the mark: edit, test, repeat until it no longer triggers.

Where the signal is strong — and where it barely exists

This is the part with direct operational consequences. The watermark lives in choices between equally plausible words. Remove the choice, and there is nowhere for the mark to sit.

Short texts. A tweet-length passage contains too few decisions to yield a signal. A three-page article yields plenty. Detection confidence grows with length.

Factual density. Anthropic’s own example: “Newton’s principal work was the Mathematical Principles of Natural…” — there is exactly one correct continuation. Truth constrains choice, and choice is where the mark lives. The irony is worth savouring: the more precise and factual a text, the more weakly it is marked.

Code. Code is the extreme case of constrained choice — in most positions only one formulation works. Generated code is marked substantially more weakly than prose; the signal survives mainly in comments, where phrasing is free.

Editing and proofreading. The watermark attaches only to words the model itself chose. Hand Claude your draft to fix punctuation and typos, and 99% of the returned words are yours — a handful of corrections is unlikely to register at all.

Full generation and translation. The opposite pole. A text written entirely by the model — and above all a translation, where every output word is the model’s choice — carries the densest possible marking.

Can a mark be removed by rewriting? Honestly: to a degree, yes. Light editing will likely survive detection; a rewrite that replaces every word will certainly defeat it. But as Anthropic elegantly notes, if you have replaced every word, it is a fair philosophical question whether the text is still “generated” — you have, after all, written it yourself.

Files are different: a passport, not an accent

For supported file types — PNG, SVG — Claude attaches a cryptographically signed provenance record using C2PA, the same open standard camera manufacturers use to certify photographs. Any C2PA-aware tool can read it.

The best way to hold the two mechanisms in mind: the text watermark is an accent — it is in the speech itself, inseparable, travelling everywhere the text goes. C2PA is a passport in a pocket — hard to forge, signed, tamper-evident, but trivially discarded. Screenshot the image: gone. Re-save in another format: gone. Upload to a social network that recompresses media: gone. Nothing was forged; the label simply fell off.

What a detection result proves — and what it cannot

Read this section twice, because it is where policy mistakes will be made.

If a mark is found, it proves one thing only: that Claude was, with some probability, involved. It cannot distinguish “Claude wrote this from scratch” from “Claude heavily edited a human draft” from “Claude translated someone else’s article”. It does not identify the author, the organisation or the conversation — the mark contains no information about the user whatsoever. And it in no way demonstrates that a human did not do the substantive work.

If no mark is found, that proves almost nothing either. The text may predate the rollout; may come from a model with a different key or no watermark; may have been written or rewritten by a person; may simply be too short; may be a proofread human draft. Absence of a mark is not a certificate of human authorship.

Anthropic states this plainly: the watermark can show only that a model probably touched the text somewhere. It is not an instrument of accusation — not in a university, not in an employment dispute, not in court, in either direction. Any platform, procurement policy or manager treating a detection score as proof of “AI-generated, therefore low-quality” is misusing the tool in a way its own makers explicitly disclaim.

What this means for your business

A practical reading of all of the above.

First, the everyday workflows most companies actually run — a specialist researches, structures and drafts, AI polishes; an engineer designs, AI accelerates implementation — produce weakly marked or effectively unmarked output, because the substantive choices remain human. The workflows that produce densely marked output are the ones where the model does everything: bulk generation with minimal input, and translation. If your concern is platform treatment of your content, the variable that matters is the density of human decision-making in the pipeline — which happens to be the same variable that determines quality.

Second, expect the ecosystem to generalise. Every major signatory will ship its own watermark with its own key within the year. We are entering a world where most machine-generated text carries an invisible maker’s mark, readable only by the key holder. The interesting commercial question — who gets detection access, and on what terms — is still open.

Third, notice the deeper shift: the industry is quietly moving from detection (“catch AI text”) to provenance (“sign content at the source”) — the same logic by which cameras certify photographs. And here lies the paradox that will define the next few years: we are building infrastructure that can prove, with caveats, that AI was involved — while no technology exists, or is on the horizon, that can prove a human was. As AI-assisted work becomes the norm, it is the second proof that will grow in value.

Our position has not changed: work should be judged by its outcome. If two days of unaided human effort produce a weaker result than fifteen minutes of a skilled specialist directing an AI, penalising the second is not quality control — it is superstition. The honest response to watermarking is not to hide AI involvement but to make the human contribution in your pipeline real, substantial and visible in the result. That is how we use these tools in our own engineering practice, and it is what we would recommend designing for in yours.

Software Planet Group builds complex SaaS platforms and web-based business products, and helps clients integrate AI into engineering and content workflows where it demonstrably improves the outcome. If you are working out what content-marking obligations and AI detection mean for your product or pipeline, talk to us.