Content Provenance Is Growing Up: What Anthropic's Watermark Really Signals

written by Stefan Christoph

- 11 minutes read
TL;DR: Text from Claude’s newer models carries an imperceptible statistical watermark, and its generated files carry a cryptographically signed C2PA provenance manifest where the platform supports it. It isn’t a gimmick, and the text watermark is not a hidden character you can delete. It’s a probabilistic signal, not a proof: it suggests a passage was likely produced by a marked Claude generation, not that a machine wrote every idea. For my media and broadcast customers, who keep asking “can I actually, legally use this content?”, it’s the clearest sign yet that AI-generated content is growing up.

A demo I filed under “someday”

Two years ago I was at the ORF in Vienna for AI Day, Tech & Data. Great room, sharp discussions about where generative AI was heading for broadcasters. Among the talks, Adobe showed something called Content Credentials: a way to attach tamper-evident provenance to a piece of media, so anyone downstream could see where it came from and how it had been edited [5].

I remember thinking: genuinely useful, but adoption feels years away, and it only covers files. Meanwhile the question my media customers actually kept asking was messier and more urgent. How do I reliably, and legally, use AI-generated content in my own publications and videos? Nobody had a clean answer. There was real confusion about what was allowed, what was safe, and how you’d ever prove any of it.

Two years later, that “someday” showed up on a Tuesday.

The trigger

Claude models launched on or after August 2, 2026 now mark the content they generate in two ways [1]. Generated files (images, SVGs) get a cryptographically signed C2PA manifest bound to the asset, the very standard Adobe was demoing back at the ORF. And generated text carries an imperceptible watermark, applied at the model level, present no matter which product or cloud the text comes through [1].

Not because it’s fashionable. Because the EU AI Act’s Article 50 transparency obligations became applicable on that date, and Anthropic signed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content [1]. Google has shipped text watermarking in production for a while (SynthID) [3], and OpenAI marks its generated images with both C2PA metadata and SynthID watermarks [8]. These are not one shared standard: C2PA is an interoperable, cross-vendor manifest, while each lab’s text watermark is its own proprietary scheme. But the direction is unmistakable, and marking generated content is becoming table stakes.

Here’s the part almost everyone gets wrong, so let me unpack it.

The text watermark is not a hidden character

When people hear “invisible watermark in text,” they picture a hidden Unicode character, a zero-width space or a look-alike letter smuggled into the string. That technique exists, but it’s the weak one: strip the odd characters and it’s gone, and it doesn’t survive re-typing or a screenshot.

The serious approach is different and, honestly, rather elegant. Take one well-known published design [2]. At each step a language model doesn’t pick one word; it produces a probability distribution over thousands of possible next tokens and samples from the likely ones. Where the text has room, several are plausible. The watermark biases a pseudo-randomly chosen subset of those candidate tokens, keyed to the preceding tokens, so generation leans toward its “preferred” set whenever the choice is loose. Anthropic hasn’t published the exact algorithm it uses, but this is the family of technique in play [1] [2].

You don’t see it, and it’s designed to preserve meaning and quality (any change to how a model samples can in principle affect the output, but the impact is meant to be negligible). A detector that knows the key scores how often those preferred tokens appear. Above a calibrated threshold, and on a long enough passage, that’s strong evidence the text came from that watermarking scheme, subject to the detector’s measured error rates. The signal lives in the choices, not in the characters, which is why it survives copy-paste and even some light editing [2].

It isn’t a lie detector, and it’s worth being precise about what it is and isn’t. A detected mark is a signal, not a verdict: it says a passage was probably produced by a marked model, not who authored the underlying ideas. People use these models to proofread, translate, and summarize, so a human’s own writing can carry the mark too [1]. For the everyday case, though, it’s a real, quantifiable provenance signal where we never had one before.

The fingerprint rubs off

There is a catch, and it is the honest core of this topic. The watermark is a statistical fingerprint spread across the model’s word choices, so anything that changes those words weakens it. Paraphrasing, translation, or sufficiently extensive editing can weaken or remove detectability, and studies of paraphrase attacks bear this out [9]. A short passage barely carries a signal to begin with, and a rewrite (even by a weaker, unwatermarked model) can strip it [9]. How well it holds up in practice depends on the length, the watermark’s strength, the detector, and the kind of edit, and reported results vary by scheme and experiment: a light touch-up to a long article often leaves enough original phrasing to stay detectable, while a thorough rewrite usually does not.

There is also a structural tension worth naming. The EU wants marking to be interoperable, which is about shared detector interfaces and comparable outputs, not about exposing the secret keys that make a watermark hard to forge. And regardless of keys, paraphrasing remains a separate, largely unsolved robustness problem. So treat a detected mark as evidence, not proof, and treat its absence with care: absence does not reliably rule out a marked-model origin. The content could have been edited, translated, kept short, or produced by a model from before marking existed. That is exactly why this is a provenance signal, not an “AI or not” verdict.

And removal is only half the story; the reverse has been demonstrated too. By querying a watermarked model enough, researchers have shown you can approximately reverse-engineer its keying, and that buys an attacker two things [10]. One, cleaner scrubbing: knowing roughly which tokens are “preferred” makes the mark easier to strip. Two, and more troubling, spoofing: you can stamp the fingerprint onto text the model never produced, so arbitrary text, or another model’s output, gets falsely attributed to it. A watermark you can forge is not evidence you can lean on, which is a large part of why detection is usually kept private or behind an API rather than fully published.

Two mechanisms, different evidence

It helps to keep the two apart:

  • C2PA / Content Credentials for files. It binds cryptographically signed provenance assertions to an asset: signer-attributed claims about its origin and the edits captured by participating tools, not a guaranteed ground-truth history. You can strip the manifest, and unauthorized changes make its binding fail to validate, while C2PA-aware edits can append new signed claims that preserve the earlier provenance. The trust you place in any of it depends on validating the signer and its certificate chain. This is the mature, industry-standard side, and it’s exactly what Adobe was showing in Vienna [5].
  • Statistical text watermarking for plain text, where there is no file to sign. It’s a different kind of evidence: not a signed history, but a probabilistic signal that a passage likely came from a particular marked model [2].

They’re complementary rather than interchangeable. C2PA gives you a signed provenance record on files; the text watermark gives you a source-detection signal on prose. Files were always the easier case. Text was the hard problem. Having both is what starts to cover the range of content my customers actually produce.

The question my media customers are really asking

Under the technical curiosity, the question was rarely “is the watermark clever?” It was “can I use this in production without getting into trouble?” It’s worth being clear that the EU AI Act answers only one slice of that: transparency. It doesn’t settle copyright, licensing, confidentiality, defamation, or data-protection, which travel with generated content independently.

On transparency, Article 50 splits the duty in two. Article 50(2) puts the marking obligation on the provider of the generating system: outputs must be machine-readable and detectable as AI-generated, using solutions that are “effective, interoperable, robust and reliable as far as this is technically feasible.” Notably, it doesn’t prescribe C2PA or any specific watermarking algorithm. That’s the obligation Anthropic and its peers are responding to.

Article 50(4) puts a separate disclosure obligation on the deployer. For AI-generated or manipulated text “published with the purpose of informing the public on matters of public interest,” you must disclose that it’s AI-generated, with one carve-out that matters for newsrooms and brands: the duty doesn’t apply where the content “has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication” [4].

Read that carve-out carefully, because it’s the whole game for editorial teams. The test isn’t who owns the content; it’s whether a genuine human review or editorial-control process happened, and whether an identifiable person or organization holds editorial responsibility for it. The law isn’t saying “don’t use AI.” For public-interest publishing, it’s saying unreviewed AI text has to be labelled, while accountable, edited work does not. That rewards the workflow good editorial teams already run.

If You’re Running This on AWS

This is where it gets concrete for the media and broadcast crowd. Content provenance on AWS isn’t theoretical.

The German public broadcaster ARD built a C2PA-based content-provenance pipeline on AWS, using S3, Lambda, and KMS to sign Content Credentials at creation, with a customized web player that verifies each video fragment near-real-time on playback and flags anything it can’t confirm [6]. That’s a public broadcaster, solving exactly the trust problem the ORF room was worried about, on production-grade serverless building blocks.

And the marking travels with the content wherever you build. Anthropic states the text watermark applies when Claude is accessed through AWS, Google Cloud, or Microsoft Foundry, because it’s applied at the model level rather than bolted onto a single surface (signed file provenance, it notes, may not be supported on every platform) [1]. AWS has been on the file side of this for a while too: Amazon Titan Image Generator embeds C2PA Content Credentials by default, and Amazon sits on the C2PA Steering Committee [7]. The pattern Adobe sketched years ago now has cloud-native plumbing and a regulatory tailwind behind it.

Why this is a good-news story

It would be easy to frame watermarking as a leash on AI. I’d argue the opposite.

For two years the honest answer to “can I trust and reuse this generated content?” was “sort of, be careful.” Provenance signals, on files and now on text, plus a transparency rule that rewards human editorial ownership rather than punishing AI use, turn that into something you can actually operationalize. You can show where a file came from. You can build an audit-and-signing workflow that records human review and editorial sign-off. You can put together a publishing process that stands up to scrutiny.

None of these signals is bulletproof on its own, and I wouldn’t build an automated “AI or not” gate on any single one. But that’s the wrong bar. The point isn’t a perfect detector. It’s that the demo I filed under “someday” is now a Tuesday feature across three frontier labs and a public-broadcaster reference architecture. Generated content didn’t get more suspicious. It’s growing up: the file-provenance side is mature, the text watermark is a capable teenager you shouldn’t trust unsupervised, and the law is the adult in the room that rewards a human owning the final call.

This post was written with AI assistance and reviewed and edited by me; the analysis, argument, and any errors are my own.

Sources

Stefan Christoph

About the Author

Stefan Christoph is a Principal Solutions Architect at AWS, focused on agentic AI, media & entertainment, and helping builders move from demo to production. He writes about AI architecture, developer productivity, and the future of software.

This is a personal blog. Opinions expressed here are my own and do not represent the views or positions of my employer.

Learn more →

Cross-posted to LinkedIn

🎬 Also available as a blog walkthrough video on YouTube

❤️ Created with the support of AI (Kiro)

📝 Last updated: August 17, 2026 — Editorial polish for readability and voice