Since August 2, Anthropic has been embedding watermarks into output from new Claude models — statistical markers in generated text, and cryptographically signed provenance metadata in generated image files. The move responds to Article 50 of the EU AI Act, which requires AI systems to label synthetic content, but Anthropic is applying it globally, not just in Europe. Here’s how each system works and what it can realistically tell you.
Text: the green-token bias
The text watermark follows an approach from the academic literature — specifically the work of Kirchenbauer et al. (2023) at the University of Maryland, now widely used in the industry. The mechanism works at sampling time, not as a post-processing step.
During token generation, the model’s vocabulary (roughly 100K tokens for Claude-class models) is partitioned into a “green list” and a “red list” using a keyed hash of the preceding context — a sliding window of the most recent tokens combined with a secret key that only Anthropic holds. Before each sampling step, tokens on the green list get a small logit boost (the original paper used δ = 2.0; the exact value Anthropic uses is undisclosed). The model still samples from the full distribution — it just systematically favors green tokens by a small, context-dependent margin.
For anyone without the key, the text looks completely normal. There is no visible pattern, no punctuation quirk, no invisible Unicode character. For Anthropic’s detector running with the key: for each token position in a passage, regenerate the green/red partition and record whether the actual token was green. Under no watermark, roughly half the tokens should be green by chance. Under the watermark, significantly more should be. A z-test on the green-token count produces a p-value, and above a threshold you conclude the text is Claude-generated.
The practical consequence: the watermark travels with the text through copy-paste, survives some editing (adding or removing sentences), but degrades under heavy paraphrasing, translation, or rewriting, since those change the actual tokens. Short passages (under roughly 200 tokens) don’t accumulate enough signal to produce reliable p-values.
There is no public detection tool yet. Anthropic says documentation and a checker are in preparation. When it arrives, the expected interface is: paste text, receive a score or p-value, not a binary yes/no. Absence of a mark does not mean a human wrote the text — content from earlier models, or text that was heavily rewritten, will also fail detection.
Images: C2PA provenance metadata
Image files generated by Claude (.png, .jpg, .svg) receive a C2PA signed manifest — a cryptographically authenticated record of the file’s AI origin embedded in the file’s metadata. C2PA (Coalition for Content Provenance and Authenticity) is an open standard backed by Adobe, Microsoft, Google, the BBC, and others. The manifest specifies: which model produced the file, when, and optionally what prompt or parameters were used. A SHA-256 hash of the image content is signed with Anthropic’s private key, so any pixel-level modification to the image will invalidate the signature.
You can verify C2PA metadata right now with existing tools — no waiting for Anthropic’s forthcoming documentation. Adobe’s Content Authenticity portal accepts image uploads and displays any embedded C2PA manifest. The Hugging Face python-c2pa library lets you inspect manifests programmatically. On desktop, recent versions of Photoshop and Lightroom show content credentials in the file info panel.
The limitation is significant: C2PA metadata lives in file container headers. Re-saving the image in any editor, taking a screenshot, uploading to most social media platforms, or converting between formats strips the manifest entirely. It’s a chain-of-custody record, not a forgery-resistant fingerprint. If the metadata is present, it’s reliable (the signature is cryptographically strong). If it’s absent, you know nothing about the file’s origin.
What this actually resolves
Both systems are probabilistic and partial, and Anthropic says so explicitly: marks are “not conclusive evidence” of Claude’s involvement, and absence of marks cannot guarantee human authorship. That’s the honest framing. The text watermark catches unmodified or lightly modified Claude output. The C2PA manifest proves provenance if the file has been handled carefully. Neither system catches a determined actor who knows to paraphrase text or strip metadata.
The practical use case is institutional: a news organization receiving a contributor submission, a university checking a submitted essay, a content platform doing spot checks at scale. You run a batch through the detector and flag high-scoring passages for review. You check image manifests before publishing. That’s narrower than “AI detection” implies, but it’s a real capability that didn’t exist before.
The more interesting question is what happens when Anthropic publishes the detector. The academic literature on green-token watermarks includes a body of work on attacking them: spoofing (generating unmarked text that the detector scores as watermarked), scrubbing (paraphrasing systematically to break the signal), and transplanting marks from one document to another. None of these are trivial, but they’re not theoretical either. A public detector makes the attack surface concrete. How robust the scheme is at Anthropic’s specific δ and key-partitioning design won’t be fully testable until the documentation lands.