Anthropic: a Claude watermark means "the model touched this," not "AI wrote this

AI watermarking is having a moment. Anthropic turned it on for Claude, Google runs it in Gemini, and a big EU law is pushing the rest of the industry the same way. If you own product or design decisions, someone on your team or in your next review is going to float watermarking as a trust feature. Let me catch you up before you promise something you can't back up.

The deep cut

• Watermarks track the model, not the author. Anthropic's own FAQ says a hit means Claude "might have produced or processed" text, nothing more.
• A statistical mark ships because nobody can feel it. DeepMind's 20 million Gemini responses showed a 0.01 percent gap in thumbs-up rates.
• Paraphrase beats provenance every time. A tool like ShieldFont or a rewrite model scrambles the token choices the whole scheme depends on.

What the mark actually says

The watermark does not identify who wrote something. It does not scan the web on its own. It tells the key holder that a specific model likely touched the text. That's the whole claim. Anthropic states it plainly in its help center: "A watermark only helps test whether Claude might have produced or processed the content."

That gap matters for your roadmap. If a user pastes their own paragraph into Claude for a grammar fix, the output carries the mark even though every idea is theirs. So a watermark hit does not mean "AI wrote this." It means "this passed through a model." Those are different claims, and your feature copy needs to say the smaller one.

Why it ships without a fight

The reason this works at all is clever, and worth understanding before you repeat vendor talking points. The mark is not hidden characters or metadata. It lives in which word the model picks at each step. Sebastian Raschka's walkthrough shows how a model scores every possible next token, then samples one. The watermark tilts that choice using a secret key, then averages out to zero bias overall.

That is why it shipped. DeepMind routed live Gemini traffic through watermarked and clean models across close to 20 million responses. The thumbs-up rate differed by 0.01 percent. No quality tradeoff nobody could feel means no reason not to turn it on. Add Article 50 of the EU AI Act with fines up to 15 million euros, and the on switch flips itself.

The parts that break it

Copy and paste does nothing, because there is nothing separate to strip. But the mark degrades the moment the token sequence changes. Run the text through another model to paraphrase it, and you replace the choices the watermark rides on. The watermarks-remover project is honest that heavy rewriting is exactly the attack.

Detection from the other side is just as shaky. Raschka's detector build calls it a "cat-and-mouse game," where checkers learn a pattern, the next model drops it, and false positives flag human writing as machine. Third-party detectors do not hold Anthropic's key at all, so they fall back to guessing.

The other side of the same coin

While companies mark their output, publishers are fighting to poison the input. ShieldFont uses font ligatures to show readers clean text while feeding scrapers garbage. "The knight rode his horse into battle" becomes "the knight rode his engine into battle" in the raw HTML, swapping about 42.8 percent of content words.

It carries the same lesson from the other direction. Creators Isaque Seneda and Gabriel Abrucio admit OCR on a screenshot defeats it, and it breaks screen readers for people with disabilities. Both watermarking and anti-scraping are pressure, not proof. They make bad behavior more costly, not impossible. Sell them as friction, not a guarantee, and your users won't feel lied to later.

Three questions for your team

• If we surface a watermark result to users, does our copy say "this model touched the text" and not "AI wrote this"? Get the claim exact before legal or a user catches the gap.
• Are we leaning on a third-party detector that does not hold the model's key? If so, we are shipping guesses with false positives, and we should know that before a customer disputes a flag.
• What do we actually owe the EU AI Act, and where does compliance end and marketing begin? Draw that line now so we don't promise provenance a paraphrase can erase.