It's the first time in the history of the world.
From 2 August, every text created by Claude will carry a hidden watermark.
Watermarks are embedded in the statistical distribution of text, and copy and paste are removed, and some edits cannot be erased.
Anthropic announced the plan in a help document on Monday.
It was triggered by the transparency of Article 50 of the EU's AI law, which requires lithium-generated AI providers to label output content.
Anthropic has signed the relevant guidelines of practice, but the scope of the label is far beyond the scope of the regulations:Exports of all Claude products worldwide are valid, but not limited to EU users.
Two layers of marking: text hidden and signedAnthropic has designed two layers of markup for AI-generated content.
The first layer is the text watermark.
When creating text, Claude introduces an invisible statistical bias in the process of Token selection.
The official document says: "You can't see it, it won't change the meaning, quality or readability of Claude's response".
This watermark is embedded in the text itself and does not rely on external metadata.
The help document notes that the watermark "will spread along with the copy and paste of the text, which may still exist after some editing".
Watermark is valid at the model level, covering all text output of Claude's products.
In terms of technical principles, a common idea for large model watermarks is that when the model generates text, it deviates slightly from certain tokens according to the detection algorithm, so that the statistical distribution of the output deviates from the natural probability.
This bias is not visible to the naked eye, and detection tools can identify it.
Anthropic has not disclosed the technical details of its plans.
Anthropic claims that the watermark "does not change meaning", which logically excludes traceable pathways with word selection and location as traceable identifiers, and that Apple has reportedly used similar word substitution techniques to track internal leakers.
Signs are likely to act on statistical characteristics that are lower than the vocabulary layer, but the specific scheme has not been verified by the outside world.
The second layer is file tracing metadata.
When Claude generates files in.svg,.png,.jpg, etc., the digital signature trace information is attached, following the open standards of the content source and the C2PA authenticity alliance.
C2PA signatures can mark documents that have been processed by Claude and detect if they have been tampered with.
The two layers of marking have different coverage.
Text waterproofing is implemented at the model level, with all text output;
C2PA metadata is only attached to file types supported by Claude, and some cloud platforms may not support signature metadata.
Anthropic said it would provide waterproofing tools to users and third parties, but the technical documentation has not yet been released.
Covering five product lines, effective globallyThe EU's AI legislation is restricted to AI systems that are online in the EU market, and Anthropic has chosen to push the label globally.
The official documentation states that the tag applies to all supported model outputs and is valid in all areas where Claude provides services, covering the five product lines of the Claude Platform (API), Claude, Claude Code, Claude Cowork, Claude Tag.
The same applies to cloud clients accessed through AWS, Google Cloud, and Microsoft Foundry.
C2PA signature metadata depends on the functionality of the platform.
The timeline is divided into two parts.
August 2 is the entry into force of the new model, and Claude, who will be available in the EU on and after that date, must support the marking at the time of release.
The EU's AI law, an old model released before 2 August, has a transition period, with a compliance deadline extended to 2 December.
Anthropic is adapting the marking functionality for the older model without giving a specific timeline.
The bill also provides for a fine of up to 15 million euros, or 3 percent of global annual revenue, whichever is higher.
Four limitations: Anthropic self-inflicted prevention needleAnthropic uses extensive documentation to describe the limitations of watermarks.
The wording of the announcement was cautious, blocking almost every possible misreading in advance.
There's a watermark that doesn't match the original Claude.
Users often use Claude to edit, translate, summarize, or format, and output with a watermark, but the content comes from the user himself.
The Anthropic original makes it clear: "Claude may not have been the original author".
The detection of the watermark only indicated that the content "may have been processed by Claude".
In turn, no watermark can prove that the content was written by humans.
The official document lists several instances of missing watermarks:
The content generated by the old model does not have a watermark;
After text is heavily edited, rewritten, translated, or mixed with other text, the watermark may decrease to undetectable extent;
If a paragraph is too short, there is not enough text to detect the algorithm;
After a file is formatted, rescued, or scanned, the C2PA elements may be stripped off.
On the other hand, quality degradation is a more deadly dispute.
Academic research records a balance between the strength of the watermark and the quality of the textThe stronger the watermark, the more resistant to editing, the easier it is to affect the output quality.
Some studies have found that the negative impact of watermarks on the quality of text is more pronounced when models are not confident about the output.
IBM researchers also pointed out that specific waterproofing schemes reduce the quality of the generated text, requiring additional processing to maintain its naturalness.
Anthropic claims that the watermark "does not affect quality and readability", but without an open technical framework, users cannot independently verify this claim.
The durability of the C2PA elements is also questioned as to whether the C2PA standard already has open source removal tools available.
The metadata can be extracted when the format is converted or retrieved, and the metadata attached to the external file is easier to remove than the watermarks embedded in the text statistical distribution.
The first large-scale deployment of text watermarksMajor AI companiesAnthropic was the first mainstream AI company to deploy waterprints on a large scale in text output.
SynthID, developed by Google DeepMind, covers watermarks for text, images and audio.
OpenAI has discussed waterproofing and slower deployment.
One of the highlights of Anthropic's practice is the explicit commitment to open third parties to verify whether a piece of text has been processed by Claude.
This commitment has sparked controversy at the user level.
Pay users can't turn off the watermark.
For users who use Claude to write emails, draft internal documents, or generate any trace-neutral content, the text is then marked with an identifiable source.
Claude users have in the past expressed dissatisfaction with pricing adjustments, reliability and excessive safety restrictions, and the watermark may further exacerbate this friction.
This change may increase the appeal of the open source model.
Waterproofing is a natural feature of the open source model, and for users who don't want output traceable, this constitutes a real motivation for switching.
To API developers, Anthropic reminds in its documentation that developers deploying Claude in their own products need to self-assess Article 50 compliance requirements for their own products and services.
Watermark comes from the model layer of Anthropic, and the legal obligations of downstream developers require alternative judgments.
Detection tools are a key part of the entire program.
The value of the seal depends on the reliability of the detection and the ease with which it can be embedded and the difficulty with identification.
The technical documentation and detection API that Anthropic promises when to land, how accurately to detect, and whether it can be resistant to counterattacks will determine whether this marking mechanism is a truly available transparency infrastructure or is limited to a compliance document submitted to the EU.