Everyone is about to hunt for invisible characters in Claude's output ;) They will not find any. The mark is in the word choices, and that changes what it can do, who it is really for, and who gets access. The actually dangerous invisible characters are still sitting exactly where they have always been - in the jailbreaking and "hidden" communication space.
Anthropic said this week that Claude watermarks its text. Within a day my feed had a tool for removing a thing that is not there: a regex that strips zero-width characters, plus advice to replace every em dash with a comma. Somebody called it a watermark remover. Anything for a click, I guess...
What Anthropic Implemented
From August 2, 2026, every new Claude model marks what it produces. This is Anthropic keeping a commitment under the EU AI Act's Article 50 code of practice on transparency, and they applied it worldwide rather than geofencing it to Europe. It covers claude.ai, the API, Claude Code, Cowork, and the versions running on AWS, Google Cloud and Microsoft Foundry.
There are two different mechanisms, and the headlines mashed them into one.
Files get signed provenance metadata. C2PA, the open standard, attached to .svg, .png and .jpg. That part is normal, well understood, and easy to strip. It is a chain of custody, not a lock.
Text gets a watermark woven, in their words, "directly into the text itself" while the model is generating. On durability they say it "will travel with the text when it's copied and pasted elsewhere, and may persist through some editing". SOME ;)
The marking happens at generation time, and it is made of the text itself. Nothing gets inserted, so there is no odd character for a human to notice and nothing for a character scanner to flag. It is not zero-width spaces, not lookalike characters, and not the em dash.
How Anthropic's Watermarking Works
Anthropic has published neither the method nor the detector. What follows is inference from the public literature, so treat it as my educated guess rather than the provable blueprint.
The published schemes do not all work alike. Google's SynthID scores candidate tokens with a keyed function and runs a small tournament between them. Aaronson's approach picks tokens from a keyed pseudorandom stream. The red and green list, from Kirchenbauer and colleagues, is the oldest and by far the easiest to explain. What they share is the only part that actually matters: the pattern hides in which token came out, never in the bytes around it. In plain terms, it compares the word choices you would expect by default against a slightly skewed distribution that only the key holder can measure. Human writing can be profiled the same way, with pretty decent accuracy. Everyone has their habits and a handful of low frequency words they reach for more often than average. Stack enough of those little patterns and you become detectable too.
So here is the red and green version, since it is the simplest to follow:
When a model writes, it is choosing the next word from a list of options that are all "defensible". "The report shows" or "the report indicates" or "the report suggests". Nothing hangs on which one comes out.
You use a secret key to split the vocabulary into two halves at each step. Call them green and red. Then you nudge the sampler, very slightly, toward the green half. Not enough to make the prose worse, and nowhere near enough for a reader to notice, because every one of those words was already a reasonable choice.
In one sentence this is invisible. In four hundred words it becomes mathematically undeniable. An unmarked text lands near fifty percent green by chance. A marked one drifts, and keeps drifting the same way, and anyone holding the key can recompute the split and measure how many standard deviations out the text sits. That number is the watermark.
A tournament scheme works differently. What does not change is where the mark is placed: in which words got picked. This is why detecting or stripping unusual characters does absolutely nothing. Delete every zero-width character in a Claude answer. Convert every em dash to a comma. Normalize the whitespace, run it through a linter, retype it by hand into Notepad... The words are still the words, and the words are the watermark.
The em dash panic is funny. It is a punctuation mark that professional writers used for a century before anyone had an opinion about it, and it became a tell for one reason: models overuse it, and the average person does not know how to type one without copying it from somewhere first. That is a style fingerprint, the same class of evidence as Opus saying "here's the kicker" or another model finding a moat in everything. Those patterns are real and people spot them easily, but that is not the watermark - it is more like a habit. We all have those.
Where I Agree With The Skeptics
The mechanism is more serious than people think, and it accomplishes less than the headlines suggest. Anthropic is refreshingly direct about most of that.
A mark means "processed by Claude", not "written by AI". Feed Claude a human essay and ask it to fix the commas, and the output comes back marked. Translate a human article, summarize a human report, tidy a human email: marked, marked, marked. The regulation is written as though machine-authored and machine-touched are the same thing.
Absence of a mark proves nothing. Also their own words. Heavy editing, paraphrasing, format conversion, an unsupported platform, or a model from anyone else. All produce "clean" text.
Short text carries no signal. Statistics need volume. A headline, a tweet, a subject line, a product description: too few tokens for the count to mean anything. Most of the text that people actually worry about is short.
One paraphrase pass removes it. Not because the characters got cleaned, but because a different model rewriting the passage makes its own word choices, under its own key or none. The rewrite is the removal tool, and it costs about as much as the original generation did.
It covers two labs out of a dozen. Google has watermarked Gemini's text with SynthID since 2024, published the method in Nature, and open sourced the scheme that October. Anthropic is second and two years behind. Anyone determined to publish unmarked machine text still has a long list of options.
So the people who end up marked are the people who were never the problem: the ones using a safety-conscious lab's product, in the open, for ordinary work.
There is one more asymmetry, and it is the part that actually bothers me. C2PA on files is a public standard with public tooling, so anyone can check a file and anyone can see it has been stripped. The text mark is the reverse: durable, and legible only to whoever holds the key. Anthropic says detection for users and third parties is coming, in technical documentation that does not exist yet. So today your writing can carry a mark you cannot read, cannot contest, and cannot prove was forged, while the research below says forging one runs about fifty dollars. A mark that is cheap to fake and impossible for the accused to audit is not evidence. It is an allegation with nothing attached for the defense.
How To Remove Anthropic's Watermark
Paraphrasing the whole thing through another model is the obvious one, so here are the ones that are not obvious.
Shuffle the synonyms. Swap a small share of the content words at random. You do not need to know which half is green, because every swap is a coin flip messing up the final number. Break enough of them and the score falls below the reliable detection threshold. This is a vibe coded script and a thesaurus.
Mix five drafts. Give the same brief to five different models and mix the sentences. Every model's choices dilute every other model's, so there is no clean run left for the statistics to work on.
Ask for low-entropy output. The watermark relies on the freedom to choose between equally good words. Demand a table, a schema, a list of fields, code, or a tight format where nearly every token is forced, and there is almost nothing left for watermarking to touch.
Diff the eras. The mark arrived on a date, and Anthropic says older models are still waiting to be retrofitted. That gives you a control group: the same family of models, new output marked, old output not. Run identical prompts or reprocess existing old content at volume, then compare which word won each time. I would bet somebody publishes one within days, and what comes out can work both ways - remove the mark, or let someone add it. We do not need the exact key. We only need a good enough pattern to make the number unreliable, and unreliable effectively kills anything based on a confidence score.
Steal the key, roughly. That last idea is not mine and it is not hypothetical. Jovanović, Staab and Vechev did the general version at ICML 2024: query a watermarked model enough times and you can approximate the green list without ever seeing the secret. Under fifty dollars, better than eighty percent success on schemes considered safe at the time. Their attack scrubs the mark, and it can also spoof it, which means human written text can be modified to the point where a detector will confidently flag it as AI written.
Will Anthropic's Watermarking Break Your Writing Style?
Watermarking strength depends on how many equally good words the model had available at each step. Long, less specific text = lots of room = strong signal. Short or highly specific = no room = not enough signal for reliable detection.
So what does everyone outside the developer world do with AI all day? Writing on-brand documents with a heavily optimized tone of voice. A style skill. A banned-word list. Few-shot examples of approved copy. A retrieval corpus of everything the company has ever published. The "write it like this, not like that" kind of thing. That list is the last two years of marketing "prompt engineering", compiled.
All of those little tweaks take potential watermarking words off the table. That is what those files and custom prompts were created for. Your voice system and the watermark are competing for the same slots, and only one of them can have each word.
Either your constraints win while the watermark gets blurred out, or the mark wins and your text does not fully follow your instructions. I cannot tell you how big the impact on existing systems will be, if any. What I can tell you is that the drift has a direction. It moves away from the word the model would have reached for, toward the acceptable alternative. Isn't that what people have spent the last two years learning to call slop? The second-best verb. The adjective that is not wrong but is not what a human would have picked. It is almost like we can feel it but have a hard time explaining it, and that is your brain's pattern recognition working. Just like you can recognize your favorite author's writing without their name under it.
The watermark is made out of the same material as the complaint. That little "something's off" moment. This is what everyone using AI for content spends countless hours optimizing against, and now the model adds it on purpose. Google did it a while ago and nobody cared. Why? Simple... who uses Gemini to write public facing content? My first thought was: "I wonder if Gemini's sloppy writing style is a side effect of being slopmarked."
OK, let's timestamp it. I just coined it, and I, Dawid Jóźwiak, claim this as my invention: "slopmarking".
The knowledge base problem is worse, because it adds up fast. Anything you built out of model output carries the watermark with it: your voice library, your snippet bank, your few-shot examples, your RAG corpus. Try explaining that to a client whose compliance team just ran a checker over the brand book ¯\_(ツ)_/¯
AI detector tools will have a lot of fun in the coming weeks...
Detection Is Probably Not Aimed At You
Let me argue the other side for a minute, because the best case for this thing is not the one triggering all the online drama around this release.
Article 50(2) asks for a watermark that is machine readable. Not human readable. Machine. So stop picturing a teacher checking an essay, and picture the highest-value consumer of a machine-readable synthetic-text signal: whoever is filtering the next training data set.
Training a model on the output of models degrades it, which means every lab needs to know which parts of the web its own generation wrote. At crawl scale, per-document accuracy stops mattering, because the decision is aggregate. Drop the marked pile, keep the rest.
Look at this from the training-data perspective and most objections lose their weight.
Short text carries no signal, and it does not need to, because the filter runs on long documents. One paraphrase pass removes it, and nobody is paraphrasing ten trillion tokens. It marks processing rather than authorship, which is exactly what a crawl filter wants gone. Will this be weaponized in the future? I will answer with another question: what in human history wasn't?
Watermarking works well enough for the job nobody is discussing, and poorly for every job the outrage crowd is screaming about.
I am not going to tell you that is why it exists, because I do not know. What I can say is that the strongest version of this mechanism serves the people who built it, and that the code of practice was written with those people in the room. Make of that what you like.
Who Gets Access To The Detection Mechanism
This is The Question everyone should be asking: who will be able to detect the mark, and on what terms?
Today, only Anthropic can. They say detection for users and third parties is coming.
That promise is harder to keep than it sounds. A detector anyone can query is an oracle. Give me unlimited yes-or-no answers on "is this marked" and I will edit against it until it says no, automatically, without ever understanding the scheme. Public detection and a durable mark cannot both be true. So the detector has to be rationed, and the rationing is the actual policy. (Or... the mark carries multiple keys, which makes it exponentially harder to optimize against. Shhhhh!)
There is already a precedent. Google built a portal for checking SynthID, opened it in May 2025 to early testers, and put journalists, media professionals and researchers on a waitlist. Not everyone. A list.
Which means the useful question is not "should AI text be marked". It is: when your work gets flagged, who ran the check, what threshold did they use, do you get to see the score, and can you appeal it? Right now the answers are somebody with access, unpublished, no, and no.
The people cheering and the people furious are both arguing about whether the marking is good. The thing that will decide what it does to anyone is who ends up holding the detector, and what they are allowed to do with it. Notice who ends up on each side of it. The mark reassures people who mostly do not use these tools, and it is carried by people who use them all day.
Invisible Characters VS Anthropic's Watermarking
The technique everyone imagined does exist, it works, it is documented, and it is being used in many different ways - from watermarking eBooks to prompt injections.
Unicode has a block called Tags, U+E0000 to U+E007F. The most commonly used part (what you would normally type by hand) runs from U+E0020 to U+E007E, which shadows printable ASCII exactly: add 0xE0000 to the code point of a printable character and you get its invisible twin. Control characters have no twin, because those slots were never assigned, and unassigned code points are the one thing in this block that a font might draw as a box. So the "standard" group is roughly ninety five characters, which is plenty for English text. Those twins render as nothing in almost everything while remaining fully present in the text. Copy it, paste it, and it is still there, just not rendered as a visible character. As of today it still goes through LinkedIn, X and Reddit, because it is valid Unicode and most platforms have no reason to block it.
A human sees "Great post, thanks for sharing". An AI reading the same string sees that plus whatever was smuggled along with it. Johann Rehberger named this ASCII smuggling and built the tool that decodes it, then demonstrated it against Microsoft 365 Copilot, which Microsoft patched in 2024. It is the cleanest indirect prompt injection vector there is, because there is no sanitizer for it: these are not special characters in HTML, or SQL, or markdown. They are letters. They just happen to be letters that a standard web page does not render.
Anything that reads text on your behalf will read those too. The browsing assistant, the RAG pipeline, the code review bot, the agent holding your tools, the thing summarizing your inbox, the moderation filter checking user input.
I have an obvious interest here, since I built the tool that finds this stuff, which is also why I noticed nobody was looking at the right characters. I wrote up the full character reference a while back: the Tags block, the zero-width characters, the lookalike homoglyphs, the space variants, with code points and detection code. Then I built Stegano, a Chrome extension that scans any page and highlights every hidden character it finds. It runs entirely locally and the source is on GitHub under MIT, so take it apart if you would rather not trust the store listing. It can also encrypt before hiding, AES-256-GCM behind a password, which means you can leave a message in public that requires a password to read. Fun stuff ;)
Try It: UNICODE Zero-space Converter
Below is a small tool. It does the Tags block encoding in your browser, and nothing leaves the page (it all happens inside your browser).
Type a message, one line of printable ASCII, hide it, copy the result, paste it into a social post. Then paste that post back into the reveal box and watch it come out again.
Then do the second experiment. Take a few paragraphs of Claude output, anything at all, and paste it into the reveal box. Nothing?
That empty result is the entire point. The watermark is in there somewhere, in the shape of the sentences, and no character-level tool will ever show it to you.
