How Claude marks AI-generated content
A reference on the two mechanisms Anthropic deployed on 2 August 2026, what each one covers, and where each one stops working.
Last reviewed
Everything here is drawn from Anthropic’s published material and contemporaneous reporting. Where the company has not disclosed something — and the detection method itself is the big one — this page says so rather than filling the gap.
Mechanism one: the text watermark
Claude embeds an imperceptible watermark into the text it generates. It does not change the meaning or readability of the output, and it is not a character, a marker or a token you could search for. The mark works by subtly biasing the model’s word choices, so the signal emerges from the distribution of vocabulary across a passage.
Two properties follow from that design:
- It survives copy and paste. There is nothing to leave behind, because the watermark is the words themselves.
- It degrades with rewriting. Editing dilutes it; enough paraphrase removes it. Anthropic does not claim otherwise — one of its engineers described the approach as imperfect, editable around, and a first step.
The detection method has not been published. In practice that means Anthropic is currently the only party able to check for it. No third-party service can verify the presence of the mark from text alone, whatever its landing page claims.
Mechanism two: C2PA file signing
For supported file types — .png, .jpg and .svg — Claude attaches signed provenance metadata following the Coalition for Content Provenance and Authenticity standard. Unlike the text watermark this is fully open: the format is specified, the manifest is readable, and tampering is detectable because the manifest is cryptographically signed.
Structurally, the manifest is a tree of JUMBF boxes carrying CBOR-encoded claims and assertions, with a COSE signature over the claim. In a JPEG it rides in APP11 segments; in a PNG it sits in a caBX chunk; in a WebP it is a C2PA RIFF chunk. The inspector on this site parses all three.
The assertion that carries the actual provenance claim is c2pa.actions, and the field that matters inside it is digitalSourceType. A value of trainedAlgorithmicMedia is the file declaring it was made by a generative model; digitalCapture is the declaration of a camera.
What is covered
- Models launched on or after 2 August 2026 carry marking from launch
- Support for earlier models was described as in progress
- All surfaces: the API, Claude, Claude Code, Claude Cowork and Claude Tag
- Cloud distribution too — AWS, Google Cloud and Microsoft Foundry
- Applied worldwide, not only in the EU
The worldwide part is a deliberate choice. The obligation originates in the EU AI Act’s transparency requirements for generative systems, and Anthropic elected to ship one behaviour everywhere rather than maintain a separate European build.
Documented limits
Anthropic states these directly, and they are load-bearing:
- A detected mark means content may have been processed by Claude — not that Claude wrote it. Proofreading, translation and summarising all produce marked output from human writing.
- There is no detectable signal on output from models predating the rollout.
- Very short passages do not carry enough signal.
- Heavily paraphrased text loses the mark.
- File metadata is destroyed by screenshots and by format conversion, so C2PA provenance is routinely lost in ordinary use.
The asymmetry is the thing to hold onto: presence of a mark is weak positive evidence about processing, and absence is no evidence at all. Neither supports an authorship conclusion on its own. The consequences of getting that wrong are covered in what a mark actually means.
On removal tools
A market appeared within days of the announcement selling Claude watermark removal. The overwhelming majority of these strip zero-width Unicode characters and homoglyphs.
That operation is unrelated to the text watermark, which contains no such characters. The text comes back visually identical, the buyer believes it has been cleaned, and the statistical signature is exactly where it was. Since the detection method is unpublished, neither the seller nor the buyer can check the result — which is a convenient property for a product to have.
Stripping invisible characters is a legitimate operation for legitimate reasons, and the scanner here does it. Those reasons are broken CSV imports, failed deduplication, corrupted database keys and unreadable diffs. Defeating provenance is not among them, because it does not work.