Claude’s invisible watermark: what it can and cannot indicate

Anthropic says supported Claude models place embedded watermarks in generated text and digitally signed provenance metadata in generated files where the relevant product supports file processing.^[1]

Illustration of a document under a magnifying glass revealing binary provenance marks, beside a warning symbol and a signed-file badge — A useful clue, provided nobody promotes the magnifying glass to judge and jury.

These mechanisms carry different kinds of evidence. Anthropic describes a detected Claude mark as an indication that content may have been processed by Claude, while C2PA defines a signed structure for recording assertions about an asset and its history.^[1]^[4]^[5]

Anthropic’s published statements

Anthropic states that Claude models launched on or after 2 August 2026 support marking at launch. It also states that marking is being added to earlier models, without attributing that sequence to a particular technical or legal cause.^[1]

The company says marking covers supported models across Claude, Claude Platform, Claude Code, Claude Cowork and Claude Tag worldwide. It also says embedded text watermarks apply through AWS, Google Cloud and Microsoft Foundry, while signed provenance metadata may not be available on every platform.^[1]

According to Anthropic, a positive detection indicates that content may have been processed by Claude. The same page says this does not prove that Claude wrote the original material, because later operations such as translation, proofreading or reformatting can also result in marked output.^[1]

Anthropic lists several reasons why a mark may be absent, including unsupported or older models, short text, substantial editing or translation, and products or file types that do not support the relevant marking method. The absence of a supported mark therefore does not establish that Claude was not involved.^[1]

In the public Anthropic documentation reviewed on 13 August 2026, detection mechanisms were described as forthcoming. That documentation did not provide the technical design, decision thresholds or measured false-positive and false-negative rates.^[1]

EU legal requirements

Article 50 of the EU AI Act applies from 2 August 2026. The European Commission states that providers of generative AI systems must make synthetic text, audio, images and video detectable through machine-readable marking techniques, subject to the provision and its implementation guidance.^[2]

The Commission describes a limited grace period for systems placed on the market before 2 August 2026. For those systems, the Article 50(2) marking and detection obligation applies from 2 December 2026.^[2]

The Commission also describes a narrow exemption for qualifying business-to-business or industrial contexts and states that content generated before 2 August 2026 does not require retrospective labelling.^[2]

The voluntary Code of Practice on Transparency of AI-generated Content provides measures through which signatories can demonstrate compliance. Providers and deployers may use other means, but the Commission states that the adequacy of those measures will be assessed individually by market-surveillance authorities.^[3]

C2PA provenance in version 2.4

The current citation used here is the C2PA Technical Specification 2.4. A C2PA manifest can contain provenance assertions, bind them to an asset through cryptographic hashes and protect the claim with a digital signature.^[4]^[5]

C2PA distinguishes embedded manifests from soft bindings such as invisible watermarks or fingerprints, which can help recover an externally stored manifest after embedded metadata has been removed. The C2PA explainer also confirms that provenance metadata itself can be removed.^[4]^[5]

A valid signature and asset binding provide evidence about the integrity of the signed claim. They do not by themselves establish that every assertion is complete or that the depicted event is true.^[5]^[6]

Independent technical analysis

NIST reports that the detectability of text watermarks depends on factors including text length, entropy, the watermarking method and subsequent transformations. Its review notes that paraphrasing can reduce detection accuracy, particularly for shorter text, while longer samples may retain more signal.^[7]

An independent UMBC security analysis reports that C2PA can make assertions tamper-evident but argues that this is insufficient to verify the provenance or veracity of a digital asset. The paper identifies implementation and specification concerns involving optional or missing information, validator behaviour, timestamps and certificate management.^[6]

What a result supports

For Claude text marking, Anthropic limits a positive result to the proposition that a supported Claude system may have processed the material. A negative result does not exclude Claude involvement under the limitations listed by Anthropic.^[1]

For C2PA, validation can establish whether the manifest, signature and asset binding pass the specified checks. Interpretation still requires examination of the signer, the assertions, the trust chain and any missing provenance information.^[4]^[5]^[6]